[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20120201.124426.592024530798207293.davem@davemloft.net>
Date: Wed, 01 Feb 2012 12:44:26 -0500 (EST)
From: David Miller <davem@...emloft.net>
To: eric.dumazet@...il.com
Cc: shawn.lu@...csson.com, netdev@...r.kernel.org, xiaoclu@...il.com
Subject: Re: [PATCH] tcp: md5: RST: getting md5 key from listener
From: Eric Dumazet <eric.dumazet@...il.com>
Date: Wed, 01 Feb 2012 10:54:55 +0100
> Le mercredi 01 février 2012 à 00:35 -0800, Shawn Lu a écrit :
>> TCP RST mechanism is broken in TCP md5(RFC2385). When
>> connection is gone, md5 key is lost, sending RST
>> without md5 hash is deem to ignored by peer. This can
>> be a problem since RST help protocal like bgp to fast
>> recove from peer crash.
>>
>> In most case, users of tcp md5, such as bgp and ldp,
>> have listener on both sides to accept connection from peer.
>> md5 keys for peers are saved in listening socket.
>>
>> There are two cases in finding md5 key when connection is
>> lost:
>> 1.Passive receive RST: The message is send to well known port,
>> tcp will associate it with listner. md5 key is gotten from
>> listener.
>>
>> 2.Active receive RST (no sock): The message is send to ative
>> side, there is no socket associated with the message. In this
>> case, finding listener from source port, then find md5 key from
>> listener.
>>
>> we are not loosing sercuriy here:
>> packet is checked with md5 hash. No RST is generated
>> if md5 hash doesn't match or no md5 key can be found.
>>
>> Signed-off-by: Shawn Lu <shawn.lu@...csson.com>
>> ---
>> v4: change title and change log.
>> regerated after "tcp: md5: protects md5sig_info with RCU"
>
>
> Signed-off-by: Eric Dumazet <eric.dumazet@...il.com>
Applied, thanks everyone.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists