Vulnerability Development mailing list archives
Re: FreeBSD listen()
From: djb () CR YP TO (D. J. Bernstein)
Date: Fri, 5 Nov 1999 23:58:43 -0000
I recently put together an online FTP reference manual, including a thorough discussion of PORT and PASV security: http://cr.yp.to/ftp/security.html There's a paragraph that explains exactly why a listenonce() syscall, rejecting all SYNs past the first, would make the difference between insecure FTP and secure FTP, assuming secure TCP. (This observation appeared in comp.protocols.tcp-ip in January 1997.) David Schwartz writes:
If you only wish to accept one connection, only call 'accept' once.
You're missing the point. Several connections may already have been accepted by the operating system before you ever call accept(). The desired behavior is for the client's connection to be rejected if it's not going to be the one that you obtain from accept(). ---Dan
Current thread:
- Re: FreeBSD listen() CyberPsychotic (Oct 30)
- Re: FreeBSD listen() Vladimir Dubrovin (Nov 05)
- Re: FreeBSD listen() Sebastian (Nov 05)
- Re: FreeBSD listen() CyberPsychotic (Nov 03)
- Re: FreeBSD listen() David Schwartz (Nov 05)
- Re: FreeBSD listen() Blue Boar (Nov 05)
- Re: FreeBSD listen() Vladimir Dubrovin (Nov 05)
- <Possible follow-ups>
- Re: FreeBSD listen() D. J. Bernstein (Nov 05)
- Re: FreeBSD listen() D. J. Bernstein (Nov 08)