From owner-freebsd-security  Mon Aug 31 13:27:34 1998
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id NAA24893
          for freebsd-security-outgoing; Mon, 31 Aug 1998 13:27:34 -0700 (PDT)
          (envelope-from owner-freebsd-security@FreeBSD.ORG)
Received: from stennis.ca.sandia.gov (stennis.ca.sandia.gov [146.246.243.44])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA24885
          for <security@FreeBSD.ORG>; Mon, 31 Aug 1998 13:27:32 -0700 (PDT)
          (envelope-from bmah@stennis.ca.sandia.gov)
Received: (from bmah@localhost)
	by stennis.ca.sandia.gov (8.9.1/8.9.1) id NAA24999;
	Mon, 31 Aug 1998 13:26:28 -0700 (PDT)
Message-Id: <199808312026.NAA24999@stennis.ca.sandia.gov>
X-Mailer: exmh version 2.0.2 2/24/98
To: Don Lewis <Don.Lewis@tsc.tdk.com>
cc: bmah@california.sandia.gov, Tristan Horn <tristan+-eyixqg@ETHEREAL.NET>,
        BUGTRAQ@netspace.org, security@FreeBSD.ORG
Subject: Re: FreeBSD's RST validation 
In-reply-to: Your message of "Mon, 31 Aug 1998 11:55:07 PDT."
             <199808311855.LAA28095@salsa.gv.tsc.tdk.com> 
From: bmah@CA.Sandia.GOV (Bruce A. Mah)
Reply-to: bmah@CA.Sandia.GOV
X-Face: g~c`.{#4q0"(V*b#g[i~rXgm*w;:nMfz%_RZLma)UgGN&=j`5vXoU^@n5<Pi&akO)o^8;[r
 %l(8ZHlbF`dD>v4:OO)c["!w)nD/!!~e4Sj7LiT'6*wZ83454H""lb{CC%T37O!!'S$S&D}sem7I[A
 2V%N&+
X-Url: http://www.ca.sandia.gov/~bmah/
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Mon, 31 Aug 1998 13:26:28 -0700
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

If memory serves me right, Don Lewis wrote:

> On Aug 31, 11:24am, Bruce A. Mah wrote:

[snip]

> }   		if (tiflags & TH_RST) {
> } ! 			if ((tiflags & TH_ACK) &&
> } ! 			/* XXX outside window? XXX */
> } ! 			    (SEQ_GT(ti->ti_ack, tp->iss) && 
> } ! 			     SEQ_LEQ(ti->ti_ack, tp->snd_max)))
> }   				tp = tcp_drop(tp, ECONNREFUSED);
> }   			goto drop;
> }   		}
> 
> As more data is sent across the connection, the wider the window for
> a spoofed RST opens.  Once you send 2 GB, legitimate RSTs no longer
> work.  You should probably be comparing against tp->snd_una instead
> of tp->iss.

Hmmm.  I was thinking specifically of the problem that with a RST arriving for 
a connection in SYN_SENT, the ACK in the RST-bearing segment has to 
acknowledge the initial SYN (thus, a test against tp->iss).  I hadn't thought 
that the ever-increasing difference between tp->snd_una and tp->iss would be a 
problem, since at this point in the code, we know that the receiving end of 
the connection is in SYN_SENT, as opposed to, say, ESTABLISHED.  Shouldn't 
(tp->snd_una == tp->iss) in this state, in which case, either would do?  (Not 
trying to split hairs, but just trying to learn a little more.)

Thanks,

Bruce.



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message