Re: packets with syn/fin vs pf_norm.c

From: Dag-Erling Smørgrav (des_at_des.no)
Date: 07/04/05

  • Next message: Michael Schuh: "Re: bind() on 127.0.0.1 in jail: bound to the outside address?" 
    To: Jesper Wallin <jesper@hackunite.net>
Date: Mon, 04 Jul 2005 02:53:33 +0200

    Jesper Wallin <jesper@hackunite.net> writes:
    > First of all, I know that not dropping SYN/FIN isn't really a big deal, it
    > just makes no sense. But since it doesn't make any sense, I don't see
    > the reason why not to discard them.

    It is not invalid for a TCP segment to have both SYN and FIN set. See
    for instance RFC 1644.

    > I'm running pf on FreeBSD 5.4-RELEASE-p3 and I scrub any traffic. I've
    > read some other posts on google and as far as I can tell, clearly invalid
    > packets (like packets with SYN/RST set) is discared while scrub simply
    > remove the FIN bit on packets with SYN/FIN.

    It shouldn't, at least not unconditionally.

    DES 

    -- 
Dag-Erling Smørgrav - des@des.no
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: Michael Schuh: "Re: bind() on 127.0.0.1 in jail: bound to the outside address?"