netdev - Re: [RFC] sctp/tcp: Question -- ICMPv4 length check (not) redundant?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 28 Jul 2008 18:08:46 +0100
From:	Gerrit Renker <gerrit@....abdn.ac.uk>
To:	Vlad Yasevich <vladislav.yasevich@...com>
Cc:	Herbert Xu <herbert@...dor.apana.org.au>,
	David Miller <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [RFC] sctp/tcp: Question -- ICMPv4 length check (not) redundant?

| >  * only TCP/SCTP seem to have a proper per-protocol "payload too short" test;
| 
| Hm..  In the standard case, these do seem to be redundant since 8 bytes are required
| by ICMP spec.
| 
| >  * for DCCP, the work is actually doubled since 
| >    - first the ICMP handler tests for minimally 8 bytes, 
| >    - then the DCCP error handler tests for required minimum of 12 bytes.
| 
| DCCP and any other protocol that requires more error data should check for it in
| its own handler.  8 bytes should be guaranteed to such handler.
| 
| What am I missing?
| 
As per last message, please disregard the patch suggestion made at the
beginning of the thread.

In TCP, the 8 bytes happen to be enough for doing sequence number checks. Other
protocols have different header lengths and semantics. Thus doing the checks
at the transport layer makes more sense than in the ICMP handler.

RFC 1122 is almost 20 years old, from a time before IPcomp, SCTP, or DCCP.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html