netdev - A misbehavior of handling TCP out of band data ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 3 Mar 2011 15:24:07 +0000
From:	Li Yu <raise.sail@...il.com>
To:	netdev <netdev@...r.kernel.org>
Subject: A misbehavior of handling TCP out of band data ?

Hi,

        In my words, if we did not turn on SO_OOBINLINE at receiver,
any OOB bytes do not have to be read from regular TCP byte stream.

        But in below extreme case: the sender process have a loop to
send 1 OOB byte 'O' and 1 byte normal data 'D', the receiver ignore
all OOB data, so if OOB feature works well, the receiver should
receive 'D' only, However, in fact, the receiver still can see OOB
bytes by recv() syscall without MSG_OOB flag.

        I found that we may send "ODODODODODOD...." in a tcp segment,
and tcp_sendmsg() has no special code to avoid this.

        Well, I know that it seem that above case is too extreme to
use in actual environment, but above is simplified from our actual
scenario.

        Anyway, I think that overwriting or skip previous OOB bytes is
acceptable, but leave them in regular TCP byte stream likely is a bug.
En, probably, the disabled SO_OOBINLINE just is a feature of receiver
side, sender do not need to have to guarantee it?

        Thanks.

Yu
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html