TCP RST handling in 6.0

[Lars Eggert]

Hi,

I came across the following in the release notes of 6.0 recently:

"The RST handling of the FreeBSD TCP stack has been improved to make  
reset attacks as difficult as possible while maintaining  
compatibility with the widest range of TCP stacks. (...) Note that  
this behavior technically violates the RFC 793 specification; the  
conventional (but less secure) behavior can be restored by setting a  
new sysctl net.inet.tcp.insecure_rst to 1. [MERGED]"

This means that the default, unconfigured FreeBSD TCP implementation  
is no longer RFC-conformant, which has always been one of its  
advantages over competing systems. Although I agree that the  
modification can be useful in some specific setups, making it the  
default at this time appears hasty. The IETF's tcpm working group is  
evaluating mechanisms for RST processing, and one will likely move to  
standards track in the future.

Thus, I'd like to suggest that the default for  
net.inet.tcp.insecure_rst be zero for now. AFAIK, any other TCP mod  
came disabled be default in the past, too.

Lars
--
Lars Eggert                                     NEC Network Laboratories