Re: [Patch] IPv4 TCP security impovement

Joachim Baran (jbaran@hildesheim.sgh-net.de)
Fri, 8 Jan 1999 20:07:45 +0100


On Fri, Jan 08, 1999 at 06:03:58PM +0100, Andi Kleen wrote:
> that on a dynamic IP dialup machine, someone else uses the same IP first,
> opens a connection to a server, hangs up without closing the connection
> properly, you get the same IP, the server sends TCP packets to the
> local port of the old connection. For that the TCP standard requires to
Hm, my client also gets the same port? I think that's
not very reasonable.

> send RSTs, because otherwise the other end will not notice that something
> went wrong and trying again for a long time (using up your bandwidth etc.).
I'm talking about UNCONNECTED ports. Understand the
patch - luke... (Sorry - but that's how it is).

> Also you have no rate limiting in your printk, everybody can fill up your
> log partition completely or even make the machine unusable.
What should I send else? Bad checksums, invalid
ICMP packets? Look at what the kernel is reporting
till now - I think information is good. Without
reporting you'll never now if you're the own user
who has root access on your machine.

If the config option is to much overload (I've
take this choice so that the patch is fast) the
patch could get into the kernel as is - without
a choice...

If there is something with the RFCs tell me - I
haven't read them all...

Bye.

-- 
Joachim Baran                   jbaran@hildesheim.sgh-net.de
Breslauerstr.18     http://prinz.hannover.sgh-net.de/~jbaran
31171 Mahlerten                       Network Administration
Lower Saxony/Germany                         and Programming

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/