| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <45ACC1DE.6090708@trash.net> Date: Tue, 16 Jan 2007 13:15:26 +0100 From: Patrick McHardy <kaber@...sh.net> To: Herbert Xu <herbert@...dor.apana.org.au> CC: Michael Tokarev <mjt@....msk.ru>, netdev@...r.kernel.org Subject: Re: rare bad TCP checksum with 2.6.19? Herbert Xu wrote: > On Tue, Jan 16, 2007 at 11:08:51AM +0300, Michael Tokarev wrote: > >>Ok. Here's another trace, from that remote network that triggers >>this thing more-or-less reliable (every 2nd transfer at least) -- >>http://www.corpit.ru/mjt/bh-bad-cksum-dmp.bin . It's a full session >>between 216.168.29.244 - the requesting/receiving side -- and >>81.13.94.6 -- our sending side (the file being transferred is some >>trojan horse I found on a friend's PC, so be careful ;) > > > I'll have a look at this tomorrow. > > Since you're certain that this is being seen on the wire, one > possibility is that we've got a bug somewhere that's zeroing > skb->ip_summed on a packet with a partial checksum. > > One potential spot where this could happen is netfilter. > Patrick, do you know of any recent changes (this is happening > with 2.6.19) that might cause this? The incremental HW checksum update stuff went in 2.6.19, so thats a prime suspect. Can't see where this could be happening though. Michael, how exactly is netfilter involved in your setup? - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists