Date: Thu, 07 Jun 2012 08:31:51 +0100 From: John Haxby <john.haxby@...cle.com> To: Kurt Seifried <kseifried@...hat.com> CC: oss-security@...ts.openwall.com Subject: Re: CVE Request -- kernel: tcp: drop SYN+FIN messages -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 01/06/12 20:12, Kurt Seifried wrote: > In my limited testing with iptables on RHEL 6.2 it appears that > --state NEW works properly, and won't allow SYN+FIN to create > connections (I used hping3 and the SYN+FIN Packets were blocked). > > So the default ruleset: > > -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j DROP > -A INPUT -j REJECT --reject-with icmp-host-prohibited > > should work, so you could do you clever --syn bits first and then have > that set to protect stuff from SYN+FIN. What happens if you have "-j ACCEPT" instead of "-j DROP"? I would expect that sshd wouldn't see the connection but you would get all the unpleasant side effects that made T/TCP deprecated. jch -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iF4EAREIAAYFAk/QWOYACgkQRQu7fpQvo8i5MwEAiJseTDYDaW2AsQaAz444Y7gv Qjbh/Y9rPosBsO0QFlYA/jTuPFgSN38RNVI3l78kh7Cwh9zrBVIXKDG3JPTxakuc =rjvP -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.