lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 27 Aug 2013 11:05:24 +0200 From: Patrick McHardy <kaber@...sh.net> To: Jesper Dangaard Brouer <hawk@...u.dk> Cc: pablo@...filter.org, netfilter-devel@...r.kernel.org, netdev@...r.kernel.org, mph@....com, jesper.brouer@...il.com, as@....com Subject: Re: [PATCH 0/5] netfilter: SYNPROXY target v3 On Tue, Aug 27, 2013 at 10:35:56AM +0200, Jesper Dangaard Brouer wrote: > On Tue, 27 Aug 2013, Patrick McHardy wrote: > > >Since the SYN proxy can't know the options the server supports, they have > >to be specified as parameters to the SYNPROXY target. The assumption is that > >these options are constant as long as you don't change settings on the > >server. > > Future extention idea: Perhaps we could auto detect the options the > server supports, after the first connection have been created? > I know this is problematic/difficult for the iptables framework, > because it would require the module to keep an internal dynamic > state, which iptables module does not handle well (due to how the > entires ruleset is reloaded on rule changes). The main reason why I didn't add this is since it assumes you have a single rule per destination. That assumption can't be made, so you'd have to maintain a table of options per destination. I'll add the synconf tool to generate rules based on what the server actually supports to the iptables repository once this has been merged. > Guess, the easiest thing to implement, would be to give a warning, > if the options (the server supports) does not match the modules config. Yes, that could be done. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists