freebsd security - Jul 2005 - packets with syn/fin vs pf_norm.c

Hi,

First of all, I know that not dropping SYN/FIN isn't really a big deal, it
just makes no sense. But since it doesn't make any sense, I don't see
the reason why not to discard them.

I'm running pf on FreeBSD 5.4-RELEASE-p3 and I scrub any traffic. I've
read some other posts on google and as far as I can tell, clearly invalid
packets (like packets with SYN/RST set) is discared while scrub simply
remove the FIN bit on packets with SYN/FIN.

Note, I have no knowledge about coding in C, so sorry if this is wrong.
I checked the source and this what I found:

/usr/src/sys/contrib/pf/net/pf_norm.c:1424:
---
        flags = th->th_flags;
        if (flags & TH_SYN) {
                /* Illegal packet */
                if (flags & TH_RST)
                        goto tcp_drop;

                if (flags & TH_FIN)
                        flags &= ~TH_FIN;
        } else {
                /* Illegal packet */
                if (!(flags & (TH_ACK|TH_RST)))
                        goto tcp_drop;
        }
---

Wouldn't this code also check if I got TCP_DROP_SYNFIN set in my kernel
and/or if I got the sysctl option for that enabled? Also, what happens if I
run this little patch I 'wrote' (remember, I don't know C ;-D)

---
1427c1427
<               if (flags & TH_RST)
---
 >               if ((flags & TH_RST) || (flags & TH_FIN))
1429,1431d1428
<
<               if (flags & TH_FIN)
<                       flags &= ~TH_FIN;
---

Sorry if I got all this wrong, I'm just curious how I can drop packets 
with the
SYN/FIN bit set and still use scrub in pf.. Also, if I apply the patch 
above,
do I need to compile the kernel, world or both?


Best regards,
Jesper Wallin

<<On Sun, 03 Jul 2005 00:06:37 +0200, Jesper Wallin
<jesper@www.hackunite.net> said:
> First of all, I know that not dropping SYN/FIN isn't really a big deal,
it
> just makes no sense. But since it doesn't make any sense, I don't
see
> the reason why not to discard them.
Perhaps because you are under the erroneous impression that such
packets are nonsensical.

-GAWollman

Jesper Wallin <jesper@hackunite.net> writes:
> First of all, I know that not dropping SYN/FIN isn't really a big deal,
it
> just makes no sense. But since it doesn't make any sense, I don't
see
> the reason why not to discard them.
It is not invalid for a TCP segment to have both SYN and FIN set.  See
for instance RFC 1644.
> I'm running pf on FreeBSD 5.4-RELEASE-p3 and I scrub any traffic.
I've
> read some other posts on google and as far as I can tell, clearly invalid
> packets (like packets with SYN/RST set) is discared while scrub simply
> remove the FIN bit on packets with SYN/FIN.
It shouldn't, at least not unconditionally.

DES
-- 
Dag-Erling Sm?rgrav - des@des.no

<<On Mon, 04 Jul 2005 02:53:33 +0200, des@des.no (Dag-Erling Sm?rgrav)
said:
> It is not invalid for a TCP segment to have both SYN and FIN set.  See
> for instance RFC 1644.
RFC 793 is perhaps the better reference, followed by RFC 1025.

-GAWollman