[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <47DEB5B9.4030905@alcatel-lucent.com>
Date: Mon, 17 Mar 2008 13:17:29 -0500
From: Nebojsa Miljanovic <neb@...atel-lucent.com>
To: Alan Cox <alan@...rguk.ukuu.org.uk>
CC: linux-kernel@...r.kernel.org,
"Kittlitz, Edward (Ned)" <nkittlitz@...atel-lucent.com>,
asweeney@...atel-lucent.com,
"Polhemus, William (Bart)" <bpolhemus@...atel-lucent.com>
Subject: Re: SO_REUSEADDR not allowing server and client to use same port
OK. I see. So, it would have to be some malicious application running together
with the server (i.e. on the same CPU). I do see now why you said it would be
very very hard to make this happen.
Still, it would be nice to introduce SO_REUSEPORT socket options so secure
servers (who happen to be clients as well) can re-use ports when necessary.
Another option would be to check if port re-use is happening inside same
application and allow it. That may make half of the folks happy, so I am not
sure if I like it as much as I like SO_REUSEPORT option.
Thanks,
Neb
On 3/17/2008 12:30 PM, Alan Cox wrote:
> On Mon, 17 Mar 2008 11:43:28 -0500
> Nebojsa Miljanovic <neb@...atel-lucent.com> wrote:
>
>
>>Alan,
>>thanks. With that additional INFO, I was able to find detailed description of
>>this denial of service attack (attached below).
>>Just to clarify. Having this port re-use check prevents folks from launching
>>this attack as opposed to being victim of it?
>
>
> Different issue. I can hijack a connection.
>
> Imagine I have a server bound to *.5000, and someone is about to connect.
> If on the server box I am able to bind and issue a connect outwards
> matching the inbound connection I will get the connection not the server.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists