Re: [Patch] IPv4 TCP security impovement

Andi Kleen (ak@muc.de)
Sat, 9 Jan 1999 01:53:53 +0100


On Fri, Jan 08, 1999 at 08:07:45PM +0100, Joachim Baran wrote:
> On Fri, Jan 08, 1999 at 06:03:58PM +0100, Andi Kleen wrote:
> > that on a dynamic IP dialup machine, someone else uses the same IP first,
> > opens a connection to a server, hangs up without closing the connection
> > properly, you get the same IP, the server sends TCP packets to the
> > local port of the old connection. For that the TCP standard requires to
> Hm, my client also gets the same port? I think that's
> not very reasonable.

But it is reality. That is why TCP uses sequence numbers, time stamps
and strict rules like the TIME_WAIT 2*MSL delay (although a lot of dialup
servers violate it)

> > send RSTs, because otherwise the other end will not notice that something
> > went wrong and trying again for a long time (using up your bandwidth etc.).
> I'm talking about UNCONNECTED ports. Understand the
> patch - luke... (Sorry - but that's how it is).

The ports are unconnected because they have been opened by a different machine
that had the same IP. Your machine does not know that they exists, until
the packets arrive.

> > Also you have no rate limiting in your printk, everybody can fill up your
> > log partition completely or even make the machine unusable.
> What should I send else? Bad checksums, invalid
> ICMP packets? Look at what the kernel is reporting
> till now - I think information is good. Without
> reporting you'll never now if you're the own user
> who has root access on your machine.

The kernel uses a crude hack called net_ratelimit() for it. Not rate limiting
is inacceptable.

>
> If the config option is to much overload (I've
> take this choice so that the patch is fast) the
> patch could get into the kernel as is - without
> a choice...

The patch is not suitable for kernel inclusion IMHO.

> If there is something with the RFCs tell me - I
> haven't read them all...

...

-Andi

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/