lkml.org 
[lkml]   [2013]   [Feb]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] tcp: sysctl to disable TCP simultaneous connect
    On 02/07/2013 10:44 AM, Kees Cook wrote:
    >>
    >> This patch probably also breaks TCP STUNT that is used by some applications for NAT
    >> traversal.
    >
    > The patch would not break it -- it defaults the sysctl to staying enabled.
    >
    > If you mean the documentation should be updated, sure, that's easy to do.
    >
    > David: I know you aren't a fan of this patch, but I'd like to try to
    > convince you. :) This leaves the feature enabled and add a toggle for
    > systems (like Chrome OS) that don't want to risk this DoS at all.
    > There are so very many other toggle, I don't see why this one would be
    > a problem to add.
    >

    It is not just STUNT, but in NAT-less configurations behind stateful
    firewalls (which is expected to be the norm for IPv6), TCP rendezvous
    via crossed SYN is a very effective way to establish peer-to-peer
    connections.

    -hpa



    \
     
     \ /
      Last update: 2013-02-07 21:22    [W:3.606 / U:0.368 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site