netdev - RE: [PATCH] tcp: RST: binding oif to iif for tcp v4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 3 Feb 2012 16:43:10 -0500
From:	Shawn Lu <shawn.lu@...csson.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
CC:	"davem@...emloft.net" <davem@...emloft.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"xiaoclu@...il.com" <xiaoclu@...il.com>
Subject: RE: [PATCH] tcp: RST: binding oif to iif for tcp v4

 
See inline.
-----Original Message-----
From: Eric Dumazet [mailto:eric.dumazet@...il.com] 
Sent: Friday, February 03, 2012 1:32 PM
To: Shawn Lu
Cc: davem@...emloft.net; netdev@...r.kernel.org; xiaoclu@...il.com
Subject: Re: [PATCH] tcp: RST: binding oif to iif for tcp v4

Le vendredi 03 février 2012 à 12:16 -0800, Shawn Lu a écrit :
> Binding RST packet outgoing interface to incomming interface for tcp 
> v4. This has few benefits:
> 1. tcp_v6_send_reset already did that.

I dont think so. ipv6 makes no special provision for RST.
[shawn LU] it's in  tcp_v6_send_response line 899 of tcp_ipv6.c
 fl6.flowi6_oif = inet6_iif(skb);

> 2. This helps tcp connect with SO_BINDTODEVICE set. When connection is 
> lost, we still able to sending out RST using same interface.

I dont understand this.

[shawn Lu] ok.  Tcp socket is bind to device using SO_BINDTODEVICE  to
Limit traffic to specifc interface.  Sometime, it may not have a valid
Source address to get through ip_route_output_key. 

> 3. limit RST traffic in ingress interface reduce the impact of RST 
> attack.
> 
[shawn Lu] sometime, we want to limit unimportant traffic to certain interface
To reduce impact on other interface 

I dont understand this.

Me confused.

Why RST are special and should bypass/force routing decisions ?

This is going to break some setups.


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html