From owner-freebsd-security Mon Jun 2 16:30:21 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.5/8.8.5) id QAA19938 for security-outgoing; Mon, 2 Jun 1997 16:30:21 -0700 (PDT) Received: from khavrinen.lcs.mit.edu (khavrinen.lcs.mit.edu [18.24.4.193]) by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id QAA19933 for ; Mon, 2 Jun 1997 16:30:15 -0700 (PDT) Received: (from wollman@localhost) by khavrinen.lcs.mit.edu (8.8.5/8.8.5) id TAA25329; Mon, 2 Jun 1997 19:24:55 -0400 (EDT) Date: Mon, 2 Jun 1997 19:24:55 -0400 (EDT) From: Garrett Wollman Message-Id: <199706022324.TAA25329@khavrinen.lcs.mit.edu> To: Darren Reed Cc: security@FreeBSD.ORG Subject: Re: TCP RST Handling in 2.2 (fwd) In-Reply-To: <199706022238.IAA29632@plum.cyber.com.au> References: <199706022238.IAA29632@plum.cyber.com.au> Sender: owner-security@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk < said: > Currently, not even the SEQ number is verified (for an RST packet) - i.e. > that the ACK does acknowledge the SYN. > I think there is room for improvement in the code. Comments ? Certainly. It might also be worth implementing the three-way RST handshake which has been proposed by some to fill some theoretical gaps in TCP's handling of resets which could (very rarely) result in innocent connections getting reset. I don't propose to do either myself, however, although I'm happy to look at anyone else's attempt to do so. -GAWollman -- Garrett A. Wollman | O Siem / We are all family / O Siem / We're all the same wollman@lcs.mit.edu | O Siem / The fires of freedom Opinions not those of| Dance in the burning flame MIT, LCS, CRS, or NSA| - Susan Aglukark and Chad Irschick