diff options
author | fenner <fenner@FreeBSD.org> | 1998-01-21 02:05:59 +0000 |
---|---|---|
committer | fenner <fenner@FreeBSD.org> | 1998-01-21 02:05:59 +0000 |
commit | 606a03ebe5beda6ea740330bf2295c7adc7f4101 (patch) | |
tree | 9f85d573b646bcdb41ae4e051267b7dae6496ed1 /lib/libdisk | |
parent | 1ee427586a6b33df8a82d8e3adcce1fe5c75caa5 (diff) | |
download | FreeBSD-src-606a03ebe5beda6ea740330bf2295c7adc7f4101.zip FreeBSD-src-606a03ebe5beda6ea740330bf2295c7adc7f4101.tar.gz |
A more complete fix for the "land" attack, removing the "quick fix" from
rev 1.66. This fix contains both belt and suspenders.
Belt: ignore packets where src == dst and srcport == dstport in TCPS_LISTEN.
These packets can only legitimately occur when connecting a socket to itself,
which doesn't go through TCPS_LISTEN (it goes CLOSED->SYN_SENT->SYN_RCVD->
ESTABLISHED). This prevents the "standard" "land" attack, although doesn't
prevent the multi-homed variation.
Suspenders: send a RST in response to a SYN/ACK in SYN_RECEIVED state.
The only packets we should get in SYN_RECEIVED are
1. A retransmitted SYN, or
2. An ack of our SYN/ACK.
The "land" attack depends on us accepting our own SYN/ACK as an ACK;
in SYN_RECEIVED state; this should prevent all "land" attacks.
We also move up the sequence number check for the ACK in SYN_RECEIVED.
This neither helps nor hurts with respect to the "land" attack, but
puts more of the validation checking in one spot.
PR: kern/5103
Diffstat (limited to 'lib/libdisk')
0 files changed, 0 insertions, 0 deletions