Re: [Patch] IPv4 TCP security impovement

Brandon S. Allbery KF8NH (allbery@kf8nh.apk.net)
Sun, 10 Jan 1999 10:54:12 -0500


In message <19990109104405.A701@rhea>, Joachim Baran writes:
+-----
| Port 24 (nothing - no daemon - no nothing)
| -> This port is unconnected. There is no
| service behind it. Here I would drop
| the received packet without sending
| an ACK+RST.
|
| So: There couldn't have been any connection to
| port 24, because nobody is listening there...
+--->8

Let's try this again.

(1) You are on a dynamic IP (dynamic IP dialup or DHCP lease)
(2) The dynamic IP addresses are recycled quickly
(3) You are on an IP address previously used by a system which had a daemon
using port 24 and did not shut down the daemon correctly before
relinquishing the IP.

So now there is a remote system which has an open connection to port 24 on
"your" IP address, because it doesn't know that the system it was talking to
isn't there any more.

(4) The remote sends a packet to your port 24
(5) Your patch causes the packet to be ignored
(6) The remote retries, because your system didn't respond to it properly
(that is, by sending RST)
(7) The above continues until the remote decides that the connection has
been lost or until something on your system uses port 24 (at which point the
remote will finally be sent RST)

You seem to be certain that you'll never get a recycled IP address. I
suggest you learn how the real world works; granted that recycling IPs
quickly "isn't nice", nevertheless it happens. And it happens often enough
that you have to deal with it.

-- 
brandon s. allbery	[os/2][linux][solaris][japh]	 allbery@kf8nh.apk.net
system administrator	     [WAY too many hats]	   allbery@ece.cmu.edu
carnegie mellon / electrical and computer engineering			 KF8NH
     We are Linux. Resistance is an indication that you missed the point.

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/