Re: [tcpm] Sequence number checking for incoming RST segments

On Oct 24, 2005, at 9:42, Ted Faber wrote:
> I'd start here: http://www.ietf.org/internet-drafts/draft-ietf-tcpm- 
> tcpsecure-03.txt
>
> Then I'd check the tcpm archives for discussion on that topic.   
> there's
> been a bit.  Those are here: http://www1.ietf.org/mail-archive/web/ 
> tcpm/current/index.html

FYI, the latest stable FreeBSD-6.0 also seems to implement (some  
variant of) tcpsecure:

"The RST handling of the FreeBSD TCP stack has been improved to make  
reset attacks as difficult as possible while maintaining  
compatibility with the widest range of TCP stacks. The algorithm is  
as follows: For connections in the ESTABLISHED state, only resets  
with sequence numbers exactly matching last_ack_sent will cause a  
reset; all other segments will be silently dropped. For connections  
in all other states, a reset anywhere in the window will cause the  
connection to be reset. All other segments will be silently dropped.  
Note that this behavior technically violates the RFC 793  
specification; the conventional (but less secure) behavior can be  
restored by setting a new sysctl net.inet.tcp.insecure_rst to 1.  
[MERGED]"

http://www.freebsd.org/releases/6.0R/relnotes-i386.html

Lars
--
Lars Eggert                                     NEC Network Laboratories

Re: [tcpm] Sequence number checking for incoming RST segments

Attachment: smime.p7s