netdev - Re: DSCP values in TCP handshake

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.00.1104190547300.14027@uplift.swm.pp.se>
Date:	Tue, 19 Apr 2011 05:50:34 +0200 (CEST)
From:	Mikael Abrahamsson <swmike@....pp.se>
To:	Stephen Hemminger <shemminger@...tta.com>
cc:	Joe Buehler <aspam@....net>, Eric Dumazet <eric.dumazet@...il.com>,
	netdev@...r.kernel.org
Subject: Re: DSCP values in TCP handshake

On Mon, 18 Apr 2011, Stephen Hemminger wrote:

> If the DSCP bits are reflected, then it could allow for even better SYN 
> flood attack. Attacker could maliciously set DSCP to elevate priority 
> processing of his bogus SYN packets and also cause SYN-ACK on reverse 
> path to also take priority.

Incoming, it's already too late. Outgoing, yes, that might be a problem, 
but if you have a QoS enabled network then you might as well solve that in 
the network, not in the host.

Does Linux internally look at DSCP when deciding what SYNs to handle 
first? If not, I think the above reasoning is misdirected.

-- 
Mikael Abrahamsson    email: swmike@....pp.se
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html