Messages in this thread | | | Date | Sat, 9 Jan 1999 01:53:53 +0100 | From | Andi Kleen <> | Subject | Re: [Patch] IPv4 TCP security impovement |
| |
On Fri, Jan 08, 1999 at 08:07:45PM +0100, Joachim Baran wrote: > On Fri, Jan 08, 1999 at 06:03:58PM +0100, Andi Kleen wrote: > > that on a dynamic IP dialup machine, someone else uses the same IP first, > > opens a connection to a server, hangs up without closing the connection > > properly, you get the same IP, the server sends TCP packets to the > > local port of the old connection. For that the TCP standard requires to > Hm, my client also gets the same port? I think that's > not very reasonable.
But it is reality. That is why TCP uses sequence numbers, time stamps and strict rules like the TIME_WAIT 2*MSL delay (although a lot of dialup servers violate it)
> > send RSTs, because otherwise the other end will not notice that something > > went wrong and trying again for a long time (using up your bandwidth etc.). > I'm talking about UNCONNECTED ports. Understand the > patch - luke... (Sorry - but that's how it is).
The ports are unconnected because they have been opened by a different machine that had the same IP. Your machine does not know that they exists, until the packets arrive.
> > Also you have no rate limiting in your printk, everybody can fill up your > > log partition completely or even make the machine unusable. > What should I send else? Bad checksums, invalid > ICMP packets? Look at what the kernel is reporting > till now - I think information is good. Without > reporting you'll never now if you're the own user > who has root access on your machine.
The kernel uses a crude hack called net_ratelimit() for it. Not rate limiting is inacceptable.
> > If the config option is to much overload (I've > take this choice so that the patch is fast) the > patch could get into the kernel as is - without > a choice...
The patch is not suitable for kernel inclusion IMHO.
> If there is something with the RFCs tell me - I > haven't read them all...
...
-Andi
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |