| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <87abdetol1.fsf@basil.nowhere.org> Date: Thu, 09 Oct 2008 05:49:30 +0200 From: Andi Kleen <andi@...stfloor.org> To: Willy Tarreau <w@....eu> Cc: David Miller <davem@...emloft.net>, netdev@...r.kernel.org Subject: Re: [PATCH] add a sysctl to disable TCP simultaneous connection opening Willy Tarreau <w@....eu> writes: > As a reminder (especially for those who are not aware of this feature), > it is possible with TCP to connect two clients together if both send > crossed SYNs, then SYN-ACKs, then ACKs. This implies that each side > accepts the sequence number of the other one without any ability to > check that it matches its SYN. So it's trivial for an attacker to > prevent one client from establishing a connection from a known port > to a known address/port by sending it a SYN to that port. The client > will then send a SYN-ACK and will not accept the expected server's > SYN-ACK because the SYN SEQ will be different. The server might also > send an RST on the client's SYN-ACK if it's not firewalled. The > connection will eventually timeout in a SYN-RECV state or simply be > aborted. One reasonable tweak for this would be to use a very aggressive timeout for simultaneously opened connections that didn't get an ACK yet. But to be honest it doesn't seem like a very pressing problem to me either. -Andi -- ak@...ux.intel.com -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists