known TCP vulnerability ??

[Andre Oppermann]

"Li, Qing" wrote:
> 
>         http://www.kb.cert.org/vuls/id/464113
> 
>         http://www.linuxsecurity.com/content/view/104980/98/
> 
>         Ran the packet tests against FreeBSD 5.3 and 6-CURRENT and both
>         respond to the SYN+FIN packets with SYN+ACK.

This is expected behaviour because of FreeBSD used to implement T/TCP
according to RFC1644.  I haven't removed this part from TCP because
I have a better reincarnation of T/TCP without the previous shortcomings
almost ready which uses this again.

The CERT article describes how dumb firewalls with poor stateful
inspection may get fooled by this and other flag combinations.
All I can say is it's not our fault.  The SYN+FIN combination is
described in RFC1644 and if the firewall gets it wrong...  Well,
the real world sucks.

>         Should I file a PR if there isn't one already ??

No action required here.

What you could check is whether our firewalls packages in stateful
mode (ipfw, pf, ipfilter) can be fooled by this.  I doubt it but
if you can verify it, that would be great.

-- 
Andre