netdev - Re: ports beeing reused too fast

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 09 May 2009 18:16:28 +0200
From:	Eric Dumazet <dada1@...mosbay.com>
To:	Octavian Purdila <opurdila@...acom.com>
CC:	netdev@...r.kernel.org
Subject: Re: ports beeing reused too fast

Eric Dumazet a écrit :
> Octavian Purdila a écrit :
>> On Saturday 09 May 2009 09:58:25 Eric Dumazet wrote:
>>
>>>> I've looked over the  code and it looks right, so maybe net_random() is
>>>> not random enough? Or maybe there are side effects because of the %
>>>> port_range?
>>> Random is random :)
>>> Probability a port can be reused pretty fast is not nul.
>>>
>> Thinking again about it... you are right :)
>>
>>> So yes, behavior you discovered is expected, when we switched port
>>> selection from a sequential one (not very secure btw) to a random one.
>>>
>>> Any strong reason why a firewall would drop a SYN because ports were used
>>> in a previous session ?
>> We don't know why the firewall (Cisco FWSM) is dropping the packets, may be a 
>> bug, limitation or miss-configuration. We are trying to track this down with 
>> the firewall vendor.
> 
> Normally, the client machine should not reuse a port during the TIME_WAIT duration
> (TCP_TIMEWAIT_LEN being 60 seconds on linux). Port selection being random or sequential,
> it should avoid all ports recently used.
> 
> Maybe this firewall has a longer TIME_WAIT enforcement (something like 2 minutes)

Another thing to consider is your client/server use or not tcp timestamps (RFC 1323)

# should allow client to use fast reuse of ports (and trigger a firewall problem)
echo 1 >/proc/sys/net/ipv4/tcp_timestamps

If both machines allow tcp timestamps, then same ports can be reused pretty fast.

If firewall doesnt fully understand RFC 1323, it might explain some problem
with port randomization and shortened time between port reuse.


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html