netdev - Re: ports beeing reused too fast

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20090514132944.561a1691@nehalam>
Date:	Thu, 14 May 2009 13:29:44 -0700
From:	Stephen Hemminger <shemminger@...tta.com>
To:	Octavian Purdila <opurdila@...acom.com>
Cc:	netdev@...r.kernel.org, Bill Fink <billfink@...dspring.com>,
	Eric Dumazet <dada1@...mosbay.com>,
	Cosmin Ratiu <cratiu@...acom.com>
Subject: Re: ports beeing reused too fast

On Tue, 12 May 2009 18:52:25 +0300
Octavian Purdila <opurdila@...acom.com> wrote:

> 
> > I raised the issue to the original author of the proposed RFC and added
> > the issue to the ongoing review of the draft.
> >
> > There is a suggested workaround using a bitmap but it seems like it would
> > be expensive to implement:
> >       
> > http://ietfreport.isoc.org/all-ids/draft-ananth-tsvwg-timewait-00.txt
> 
> OK, I now understand how TW could be an issue here - I didn't realize that we 
> could have sockets in TW on the server side.
> 
> Since the workaround seems expensive, would it be acceptable to add a new 
> sysctl option to disable port randomization?
> 
> Thanks,
> tavi
> 

Patches welcome.  Also, it matters whether application does bind() first
or port is assigned as part of the accept. In the later case the starting
point is a hash of the 5 tuple and changes only every 5 minutes.  Linux
also reuses ports in time wait, so it will reuse sockets more aggressively
than other hosts; this existed before port randomization.

-- 
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html