netdev - Re: updates to syncookies - timestamps not needed any more (freebsd)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1373639563.10804.10.camel@edumazet-glaptop>
Date:	Fri, 12 Jul 2013 07:32:43 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Florian Westphal <fw@...len.de>
Cc:	David Miller <davem@...emloft.net>, hannes@...essinduktion.org,
	netdev@...r.kernel.org
Subject: Re: updates to syncookies - timestamps not needed any more (freebsd)

On Fri, 2013-07-12 at 16:25 +0200, Florian Westphal wrote:
> Eric Dumazet <eric.dumazet@...il.com> wrote:
> > On Fri, 2013-07-12 at 10:41 +0200, Florian Westphal wrote:
> > 
> > > The main difference to what linux does is to avoid encoding the 'count'
> > > value (Linux doesn't reseed secret[], and relies on count to detect old
> > > cookies).
> > > 
> > > Not having the counter frees up space to encode tcp options in the cookie
> > > instead of the timestamp.
> > 
> > But still wscale and sack options are disabled.
> 
> Yes, in Linux sack and wscale will be encoded in the timestamp, as
> cookie is already restricted to 24 bits due to counter.
> 
> Without the counter, that could be changed to allow sack/wscale even
> with ts off.

Another quick hack would be to allow sack being generated by the client.

If we receive sackOK in SYN, then syncookie SYNACK could contain sackOK,
if timestamps are not used.

Client would be allowed to use SACK in his ACK. Server would not
generate SACK, but would process incoming SACK.

Not sure what could break ?





--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html