Re: "LAND" Attack Update

From: Matthew Dillon (dillonat_private)
Date: Sun Nov 23 1997 - 01:46:35 PST

  • Next message: Aleph One: "Solaris 2.5.1 x86 statd exploit"

    :mycroftat_private (Charles M. Hannum) writes:
    :
    :>
    :> 2) A socket in LISTEN state is not initiating a connection attempt, so
    :>    if it receives a SYN-only packet from itself, it *must* be a
    :...
    :>    will be dropped by the first change.)
    :
    :BTW, on a related note...
    :
    :The FreeBSD hack to `fix' (or not allow) self-connects DOES NOT WORK
    :FOR MULTIHOMED HOSTS.  It's still possible to crash a multihomed
    :FreeBSD system by locally running a program that connects a TCP socket
    :to itself.
    
        Did you actually test this?  My understanding is that the freeze-up
        is due to the TCP stack looping within the same PCB.  In a multi-homed
        system you wind up with two different PCB's for each 'side' of the
        connection if you use two different IP addresses on the same host.  I
        would expect this to result in an RST so it should be sufficient to
        simply test for the (srcaddr,srcport) == (dstaddr,dstport).
    
        I haven't tested this either way but I specifically didn't do anything
        more complex in my quick freebsd hack because I assumed the other cases
        would be covered by an RST.
    
                                                    -Matt
    
        Matthew Dillon   Engineering, BEST Internet Communications, Inc.
                         <dillonat_private>
        [always include a portion of the original email in any response!]
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:33:10 PDT