netdev - Re: Enable syn cookies by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 16 Oct 2009 21:56:04 +0200
From:	Florian Westphal <fw@...len.de>
To:	Jarek Poplawski <jarkao2@...il.com>
Cc:	Olaf van der Spek <olafvdspek@...il.com>, netdev@...r.kernel.org
Subject: Re: Enable syn cookies by default

Jarek Poplawski <jarkao2@...il.com> wrote:
> > On 15-10-2009 10:59, Olaf van der Spek wrote:
> >> On Sat, Oct 10, 2009 at 3:01 PM, Olaf van der Spek <olafvdspek@...il.com> wrote:
> >>> Hi,
> >>>
> >>> I'm forwarding Debian feature request #520668.
> >>>
> >>> Could syn cookies be enabled by default?
> > 
> > Hi,
> > 
> > Alas, I can only give you a hint: while waiting for a better response,
> > you could try to 'google' for some archives of this list; AFAICR a few
> > (?) months ago David Miller explained this first question at least.
> > (In short: they aren't up-to-date enough.)
> 
> It looks like my memory is exact only about dates ("?"! ;-). There was
> mainly David's opinion and some more in the thread (shared with lkml).
> Here is a link:
> http://lkml.indiana.edu/hypermail/linux/kernel/0807.3/0050.html

Hrm, strange.

The syncookie sysctl only has an effect on tcp options
once a listening sockets' syn queue is full. And even if you lose all
the tcp options -- without tcp_syncookies=1, the connection request
would have been discarded. So I do not really understand why they
shouldn't default to 1. I've sent patches for both points raised
(no warning about syn queue overflow if cookies are disabled,
 syncookies sysctl defaults to 0), lets see what happens :-)

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html