Re: packets with syn/fin vs pf_norm.c

Darren Reed wrote:
> No, you're wrong on this.
> 
> Packets for TCP with SYN + FIN set are valid under T/TCP.
> T/TCP is documented under RFC 1644.  To claim that these, earlier,
> documents render it ... "dead" is to argue that SACK and all other
> TCP enhancements since also fall into that bucket.
> 
> Very few people use T/TCP, although I believe FreeBSD is the only
> one of the BSDs that has done anything serious with it.  pf is wrong
> to unconditionally clear the FIN flag.  So there are a number of
> options here:
> - fix pf to not remove the FIN flag in FreeBSD
> - don't use T/TCP
> - don't use scrub in pf
> - don't use pf
> 
> I think this is a bug in the scrub implementation and should be
> fixed.
> 
> Darren

1. I thought that T/TCP was being removed from FreeBSD (already happened?).
2. It's trivial to predict Theo's response to this.
3. Since T/TCP is rare, there is little motivation to alter scrub to 
function differently than OpenBSD with respect to these packets.  If 
someone really needs this, there are plenty of alternatives.

But more importantly, the original question has been lost.  The original 
question was what should the various firewalls do when the kernel has 
been compiled with TCP_DROP_SYNFIN.  Regardless of whether those packets 
are valid or not, a person may have reason to compile this feature into 
the kernel.  So, should the firewalls acts differently if this kernel 
option is used?

Richard Coleman
rcoleman@criticalmagic.com
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"