d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add a sysctl (net.inet.tcp.insecure_rst) which allows one to specify

Browse Source 
that the RFC 793 specification for accepting RST packets should be
following.  When followed, this makes one vulnerable to the attacks
described in "slipping in the window", but it may be necessary in
some odd circumstances.
This commit is contained in:
silby 2005-01-03 07:08:37 +00:00
parent 44153c6433
commit 632a7b8c5a
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/netinet/tcp_input.c
View File

@ -131,6 +131,11 @@ SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3390, CTLFLAG_RW,
&tcp_do_rfc3390, 0,
"Enable RFC 3390 (Increasing TCP's Initial Congestion Window)");
static int tcp_insecure_rst = 0;
SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_rst, CTLFLAG_RW,
&tcp_insecure_rst, 0,
"Follow the old (insecure) criteria for accepting RST packets.");
SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW, 0,
"TCP Segment Reassembly Queue");
@ -1528,7 +1533,8 @@ trimthenstep6:
goto close;
case TCPS_ESTABLISHED:
if (tp->last_ack_sent != th->th_seq) {
if (tp->last_ack_sent != th->th_seq &&
tcp_insecure_rst == 0) {
tcpstat.tcps_badrst++;
goto drop;
}

8
sys/netinet/tcp_reass.c
View File

@ -131,6 +131,11 @@ SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3390, CTLFLAG_RW,
&tcp_do_rfc3390, 0,
"Enable RFC 3390 (Increasing TCP's Initial Congestion Window)");
static int tcp_insecure_rst = 0;
SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_rst, CTLFLAG_RW,
&tcp_insecure_rst, 0,
"Follow the old (insecure) criteria for accepting RST packets.");
SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW, 0,
"TCP Segment Reassembly Queue");
@ -1528,7 +1533,8 @@ trimthenstep6:
goto close;
case TCPS_ESTABLISHED:
if (tp->last_ack_sent != th->th_seq) {
if (tp->last_ack_sent != th->th_seq &&
tcp_insecure_rst == 0) {
tcpstat.tcps_badrst++;
goto drop;
}