netdev - Re: "Listenless" TCP over NAT?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080905121511.GA14016@2ka.mipt.ru>
Date:	Fri, 5 Sep 2008 16:15:12 +0400
From:	Evgeniy Polyakov <johnpol@....mipt.ru>
To:	xerces8 <xerces8@...n.net>
Cc:	Linux Netdev <netdev@...r.kernel.org>,
	Linux Networking <linux-net@...r.kernel.org>
Subject: Re: "Listenless" TCP over NAT?

On Fri, Sep 05, 2008 at 01:45:13PM +0200, xerces8 (xerces8@...n.net) wrote:
> Recently someone mentioned on this (or maybe other...) list a seldom used
> technique of establishing a TCP connection without one host listening on a port,
> but but acting as "clients" and connecting to the peers port.

This is supported by userspace network stack, which was presented here,
but I'm not sure that exactly unetstack was recommended to you.

http://tservice.net.ru/~s0mbre/old/?section=projects&item=unetstack

> My question: Can this be used to establish a TCP connection between two hosts that
> are both behind a (P)NAT router ?
> 
> (the idea being: NAT router lets outgoing connections thru, and in this case both
> NAT router would  see an "outgoing" connection)

Depending on how NAT is implemented. Usually NAT software will only
allow syn/ack packets before connection is established, and thus if one
peer sends syn packet, and second one sends ack packet (without seeng
ack first) it will work, but if second peer's NAT will send a reset
packet before ack from the peer, first NAT can drop connection (as long
as peer itself).

> If yes, this would simplify the life of many users :-)

It is not directly supported by unetstack, but you can simply extend its
state machine to switch to different state without explicit packet
receiving.

-- 
	Evgeniy Polyakov
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html