From owner-cvs-all  Sat Feb  3 21:49:21 2001
Delivered-To: cvs-all@freebsd.org
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP
	id 306BF37B401; Sat,  3 Feb 2001 21:49:00 -0800 (PST)
Received: (from rwatson@localhost)
	by freefall.freebsd.org (8.11.1/8.11.1) id f145n0v65837;
	Sat, 3 Feb 2001 21:49:00 -0800 (PST)
	(envelope-from rwatson)
Message-Id: <200102040549.f145n0v65837@freefall.freebsd.org>
From: Robert Watson <rwatson@FreeBSD.org>
Date: Sat, 3 Feb 2001 21:49:00 -0800 (PST)
To: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org
Subject: cvs commit: src/sys/netinet ip_fw.c
X-FreeBSD-CVS-Branch: RELENG_4
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

rwatson     2001/02/03 21:49:00 PST

  Modified files:        (Branch: RELENG_4)
    sys/netinet          ip_fw.c 
  Log:
  A recent commit (1.131.2.13) removed the security fix associated with
  FreeBSD-SA-01:08, breaking the "established" TCP matching flag even
  more than it was prior to the security advisory.  Reinstate the fix by
  restoring the conditional assocated with entering tcpflg_match().
  
  Reported by a number of people via send-pr, security-officer,
  et al., including:
  
    Steven Farmer <steve@megahack.com>
    Bernd Luevelsmeyer <bdluevel@heitec.net>
    Andrew Gordon <arg@arg1.demon.co.uk>
  
  Thanks to those people for bringing this to our attention in such a
  timely manner.  An updated advisory and/or announcement to the
  freebsd-stable mailing list will be forthcoming, once all parties have
  confirmed that this resolves the problems they were experiencing.
  
  PR:		24833
  Approved by:	security-officer
  Slap on the wrist to:	luigi
  
  Revision    Changes    Path
  1.131.2.14  +4 -2      src/sys/netinet/ip_fw.c



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message