linux-kernel - Re: [PATCH] net: Remove a noisy printk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.00.0812162044460.5854@blackhole.kfki.hu>
Date:	Tue, 16 Dec 2008 20:59:05 +0100 (CET)
From:	Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>
To:	Dave Jones <davej@...hat.com>
cc:	Jan Engelhardt <jengelh@...ozas.de>,
	David Miller <davem@...emloft.net>, ajax@...hat.com,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
	netfilter-devel@...r.kernel.org, Patrick McHardy <kaber@...sh.net>
Subject: Re: [PATCH] net: Remove a noisy printk

On Sun, 14 Dec 2008, Dave Jones wrote:

> On Sun, Dec 14, 2008 at 06:09:17PM +0100, Jozsef Kadlecsik wrote:
> 
>  > > >> @@ -147,8 +147,6 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum,
>  > > >>  	/* root is playing with raw sockets. */
>  > > >>  	if (skb->len < sizeof(struct iphdr) ||
>  > > >>  	    ip_hdrlen(skb) < sizeof(struct iphdr)) {
>  > > >> -		if (net_ratelimit())
>  > > >> -			printk("ipt_hook: happy cracking.\n");
>  > > >>  		return NF_ACCEPT;
>  > > >>  	}
>  > > >>  	return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb);
>  > > 
>  > > I think this change is ok.
>  > 
>  > In a >normal< system one usually does not use raw sockets. So if a root 
>  > process do use raw socket, at least netfilter sends a notification and 
>  > there's a chance that someone take notice it by checking the kernel logs.
> 
> 'normal' systems are irrelevant here. This message is triggerable remotely.
> Even though it's ratelimited, anyone can flood another boxes logs by
> sending enough packets.

The packets in question are shorter than the IP header. How would those be 
delivered to the host? On the LAN it might be possible to forge such 
packets with proper HW address and be delivered. But wouldn't the network 
card or the stack itself throw away the packets??
 
> The message is also utterly useless. What kind of action would you take
> to a few gigabytes of "ipt_hook: happy cracking.\n" ?
> There's no IP address logged, or any other useful information.

As the packet is shorter than the IP header, what could be logged, besides 
the fact that something worth to investigate is happening?

Best regards,
Jozsef
-
E-mail  : kadlec@...ckhole.kfki.hu, kadlec@...l.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/