netdev - RE: [PATCH] tcp: md5: RST: getting md5 key from listener

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <62162DF05402B341B3DB59932A1FA992B5B5C22B35@EUSAACMS0702.eamcs.ericsson.se>
Date:	Wed, 1 Feb 2012 13:48:00 -0500
From:	Shawn Lu <shawn.lu@...csson.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
CC:	"davem@...emloft.net" <davem@...emloft.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"xiaoclu@...il.com" <xiaoclu@...il.com>
Subject: RE: [PATCH] tcp: md5: RST: getting md5 key from listener

Hi,Eric

With linux support for TCP AO not in picture right now. 
Are you interested in putting patch to enable md5 key change( RFC4808)?

Or do you anybody else is working on linux implementation of TCP AO?

I posted this question before and get no response yet.


Thanks!
Shawn  

-----Original Message-----
From: Eric Dumazet [mailto:eric.dumazet@...il.com] 
Sent: Wednesday, February 01, 2012 1:55 AM
To: Shawn Lu
Cc: davem@...emloft.net; netdev@...r.kernel.org; xiaoclu@...il.com
Subject: Re: [PATCH] tcp: md5: RST: getting md5 key from listener

Le mercredi 01 février 2012 à 00:35 -0800, Shawn Lu a écrit :
> TCP RST mechanism is broken in TCP md5(RFC2385). When connection is 
> gone, md5 key is lost, sending RST without md5 hash is deem to ignored 
> by peer. This can be a problem since RST help protocal like bgp to 
> fast recove from peer crash.
> 
> In most case, users of tcp md5, such as bgp and ldp, have listener on 
> both sides to accept connection from peer.
> md5 keys for peers are saved in listening socket.
> 
> There are two cases in finding md5 key when connection is
> lost:
> 1.Passive receive RST: The message is send to well known port, tcp 
> will associate it with listner. md5 key is gotten from listener.
> 
> 2.Active receive RST (no sock): The message is send to ative side, 
> there is no socket associated with the message. In this case, finding 
> listener from source port, then find md5 key from listener.
> 
> we are not loosing sercuriy here:
> packet is checked with md5 hash. No RST is generated if md5 hash 
> doesn't match or no md5 key can be found.
> 
> Signed-off-by: Shawn Lu <shawn.lu@...csson.com>
> ---
> v4: change title and change log. 
> regerated after  "tcp: md5: protects md5sig_info with RCU"


Signed-off-by: Eric Dumazet <eric.dumazet@...il.com>

Thanks !


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html