lkml.org 
[lkml]   [2008]   [Aug]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC][PATCH 1/1] cxgb3i: cxgb3 iSCSI initiator
    David Miller wrote:
    > From: Jeff Garzik <jgarzik@pobox.com>
    > Date: Fri, 08 Aug 2008 18:15:41 -0400
    >
    >
    >> * security updates for TCP problems mean that a single IP address can be
    >> PARTIALLY SECURE, because security updates for kernel TCP stack and
    >> h/w's firmware are inevitably updated separately (even if distributed
    >> and compiled together). Yay, we are introducing a wonderful new
    >> security problem here.
    >>
    >> * from a security, network scanner and packet classifier point of view,
    >> a single IP address no longer behaves like Linux. It behaves like
    >> Linux... sometime. Depending on whether it is a magic TCP port or not.
    >>
    >
    > I agree with everything Jeff has stated.
    >
    > Also, I find it ironic that the port abduction is being asked for in
    > order to be "compatible with existing tools" yet in fact this stuff
    > breaks everything. You can't netfilter this traffic, you can't apply
    > qdiscs to it, you can't execut TC actions on them, you can't do
    > segmentation offload on them, you can't look for the usual TCP MIB
    > statistics on the connection, etc. etc. etc.
    >
    > It is broken from every possible angle.
    >

    I think a lot of these _could_ be implemented and integrated with the
    standard tools.







    \
     
     \ /
      Last update: 2008-08-09 16:07    [W:3.240 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site