Darren Reed wrote:
No, you're wrong on this.
Packets for TCP with SYN + FIN set are valid under T/TCP.
T/TCP is documented under RFC 1644. To claim that these, earlier,
documents render it ... "dead" is to argue that SACK and all other
TCP enhancements since also fall into that bucket.
Very few people use T/TCP, although I believe FreeBSD is the only
one of the BSDs that has done anything serious with it. pf is wrong
to unconditionally clear the FIN flag. So there are a number of
options here:
- fix pf to not remove the FIN flag in FreeBSD
- don't use T/TCP
- don't use scrub in pf
- don't use pf
I think this is a bug in the scrub implementation and should be
fixed.
Darren
1. I thought that T/TCP was being removed from FreeBSD (already happened?).
2. It's trivial to predict Theo's response to this.
3. Since T/TCP is rare, there is little motivation to alter scrub to
function differently than OpenBSD with respect to these packets. If
someone really needs this, there are plenty of alternatives.
But more importantly, the original question has been lost. The original
question was what should the various firewalls do when the kernel has
been compiled with TCP_DROP_SYNFIN. Regardless of whether those packets
are valid or not, a person may have reason to compile this feature into
the kernel. So, should the firewalls acts differently if this kernel
option is used?
Richard Coleman
[EMAIL PROTECTED]
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
