Bugtraq mailing list archives
Re: FreeBSD's RST validation
From: bmah () CA Sandia GOV (Bruce A. Mah)
Date: Mon, 31 Aug 1998 13:26:28 -0700
If memory serves me right, Don Lewis wrote:
On Aug 31, 11:24am, Bruce A. Mah wrote:
[snip]
} if (tiflags & TH_RST) { } ! if ((tiflags & TH_ACK) && } ! /* XXX outside window? XXX */ } ! (SEQ_GT(ti->ti_ack, tp->iss) && } ! SEQ_LEQ(ti->ti_ack, tp->snd_max))) } tp = tcp_drop(tp, ECONNREFUSED); } goto drop; } } As more data is sent across the connection, the wider the window for a spoofed RST opens. Once you send 2 GB, legitimate RSTs no longer work. You should probably be comparing against tp->snd_una instead of tp->iss.
Hmmm. I was thinking specifically of the problem that with a RST arriving for a connection in SYN_SENT, the ACK in the RST-bearing segment has to acknowledge the initial SYN (thus, a test against tp->iss). I hadn't thought that the ever-increasing difference between tp->snd_una and tp->iss would be a problem, since at this point in the code, we know that the receiving end of the connection is in SYN_SENT, as opposed to, say, ESTABLISHED. Shouldn't (tp->snd_una == tp->iss) in this state, in which case, either would do? (Not trying to split hairs, but just trying to learn a little more.) Thanks, Bruce.
Current thread:
- Re: FreeBSD's RST validation Don Lewis (Aug 31)
- Re: FreeBSD's RST validation Bruce A. Mah (Aug 31)
- <Possible follow-ups>
- Re: FreeBSD's RST validation Don Lewis (Aug 31)
- Re: FreeBSD's RST validation Bruce A. Mah (Aug 31)