d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
5dcabf2d07
freebsd-skq/sys/netinet
History
Bill Fenner 764d8cef56 A more complete fix for the "land" attack, removing the "quick fix" from 
rev 1.66.  This fix contains both belt and suspenders.

Belt: ignore packets where src == dst and srcport == dstport in TCPS_LISTEN.
 These packets can only legitimately occur when connecting a socket to itself,
 which doesn't go through TCPS_LISTEN (it goes CLOSED->SYN_SENT->SYN_RCVD->
 ESTABLISHED).  This prevents the "standard" "land" attack, although doesn't
 prevent the multi-homed variation.

Suspenders: send a RST in response to a SYN/ACK in SYN_RECEIVED state.
 The only packets we should get in SYN_RECEIVED are
 1. A retransmitted SYN, or
 2. An ack of our SYN/ACK.
 The "land" attack depends on us accepting our own SYN/ACK as an ACK;
 in SYN_RECEIVED state; this should prevent all "land" attacks.

We also move up the sequence number check for the ACK in SYN_RECEIVED.
 This neither helps nor hurts with respect to the "land" attack, but
 puts more of the validation checking in one spot.

PR:             kern/5103
1998-01-21 02:05:59 +00:00
..
libalias Fixed a missing #include in the synopsis. 1998-01-16 13:02:58 +00:00
fil.c Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
icmp_var.h Some staticized variables were still declared to be extern. 1997-09-07 05:27:26 +00:00
if_atm.c Make INET a proper option. 1998-01-08 23:42:31 +00:00
if_atm.h import Chuck Cranor's ATM driver 1997-05-09 07:48:14 +00:00
if_ether.c Make INET a proper option. 1998-01-08 23:42:31 +00:00
if_ether.h Make INET a proper option. 1998-01-08 23:42:31 +00:00
if_fddi.h Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not 1997-02-22 09:48:43 +00:00
igmp_var.h Some staticized variables were still declared to be extern. 1997-09-07 05:27:26 +00:00
igmp.c Last major round (Unless Bruce thinks of somthing :-) of malloc changes. 1997-10-12 20:26:33 +00:00
igmp.h Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not 1997-02-22 09:48:43 +00:00
in_cksum.c Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not 1997-02-22 09:48:43 +00:00
in_hostcache.c Remove a bunch of variables which were unused both in GENERIC and LINT. 1997-11-07 08:53:44 +00:00
in_hostcache.h Add for public examination the beginnings of the per-host cache support 1997-06-18 01:24:28 +00:00
in_pcb.c The spl fixes in in_setsockaddr and in_setpeeraddr that were meant to 1997-12-25 06:57:36 +00:00
in_pcb.h Fix all areas of the system (or at least all those in LINT) to avoid storing 1997-08-16 19:16:27 +00:00
in_proto.c Throw options IPX, IPXIP and IPTUNNEL into opt_ipx.h. 1997-12-15 20:31:25 +00:00
in_rmx.c Removed unused #includes. 1997-08-02 14:33:27 +00:00
in_systm.h Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not 1997-02-22 09:48:43 +00:00
in_var.h Some staticized variables were still declared to be extern. 1997-09-07 05:27:26 +00:00
in.c Last major round (Unless Bruce thinks of somthing :-) of malloc changes. 1997-10-12 20:26:33 +00:00
in.h Export ipstat via sysctl. Don't understand why this wasn't done before. 1997-09-25 00:34:35 +00:00
ip_auth.c Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_auth.h Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_compat.h Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_divert.c Make INET a proper option. 1998-01-08 23:42:31 +00:00
ip_fil.c Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_fil.h Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_frag.c Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_frag.h Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_ftp_pxy.c Import version 3.2alpha7 1997-05-25 15:50:46 +00:00
ip_fw.c Make INET a proper option. 1998-01-08 23:42:31 +00:00
ip_fw.h Bump up packet and byte counters to 64-bit unsigned ints. As a 1998-01-08 03:03:54 +00:00
ip_icmp.c ICMP Timestamp Request messages could have harbored the same sort of 1997-08-25 16:29:27 +00:00
ip_icmp.h Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not 1997-02-22 09:48:43 +00:00
ip_input.c Make the BOOTP family new-style options (in opt_bootp.h) 1998-01-09 03:21:07 +00:00
ip_log.c Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_mroute.c Removed unused #includes. 1997-10-28 15:59:26 +00:00
ip_mroute.h Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not 1997-02-22 09:48:43 +00:00
ip_nat.c Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_nat.h Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_output.c Rename some local variables to avoid shadowing other local variables. 1997-11-07 09:21:01 +00:00
ip_proxy.c Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_proxy.h Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_state.c Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_state.h Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
ip_var.h Some staticized variables were still declared to be extern. 1997-09-07 05:27:26 +00:00
ip.h Removed a stale comment. (We don't declare ip_len and ip_offset as 1997-12-19 23:33:08 +00:00
ipl.h Import version 3.2alpha7 1997-05-25 15:50:46 +00:00
mlf_ipl.c Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
mln_ipl.c Import version 3.2alpha7 1997-05-25 15:50:46 +00:00
raw_ip.c Call in_pcballoc() at splnet(). As near as I can tell, this won't fix 1997-12-18 09:13:39 +00:00
tcp_debug.c Make INET a proper option. 1998-01-08 23:42:31 +00:00
tcp_debug.h Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not 1997-02-22 09:48:43 +00:00
tcp_fsm.h Fix all areas of the system (or at least all those in LINT) to avoid storing 1997-08-16 19:16:27 +00:00
tcp_input.c A more complete fix for the "land" attack, removing the "quick fix" from 1998-01-21 02:05:59 +00:00
tcp_output.c Don't allow the window to be increased beyond what is possible to 1997-10-07 21:10:06 +00:00
tcp_reass.c A more complete fix for the "land" attack, removing the "quick fix" from 1998-01-21 02:05:59 +00:00
tcp_seq.h Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not 1997-02-22 09:48:43 +00:00
tcp_subr.c Fix an incredibly horrible bug in the ipfw code 1997-12-19 03:36:15 +00:00
tcp_timer.c Make TCPDEBUG a new-style option. 1997-09-16 18:36:06 +00:00
tcp_timer.h Some staticized variables were still declared to be extern. 1997-09-07 05:27:26 +00:00
tcp_timewait.c Fix an incredibly horrible bug in the ipfw code 1997-12-19 03:36:15 +00:00
tcp_usrreq.c Fixed a missing splx(s) bug in tcp_usr_send(). 1997-12-18 09:50:38 +00:00
tcp_var.h The long-awaited mega-massive-network-code- cleanup. Part I. 1997-04-27 20:01:29 +00:00
tcp.h Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not 1997-02-22 09:48:43 +00:00
tcpip.h Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not 1997-02-22 09:48:43 +00:00
udp_usrreq.c Don't use ANSI string concatenation to misformat a string. 1997-12-19 23:46:21 +00:00
udp_var.h Some staticized variables were still declared to be extern. 1997-09-07 05:27:26 +00:00
udp.h Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not 1997-02-22 09:48:43 +00:00