netdev - Re: [PATCH RFC 0/5] netfilter: implement netfilter SYN proxy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 8 Aug 2013 02:13:45 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	David Miller <davem@...emloft.net>, eric.dumazet@...il.com,
	pablo@...filter.org, netfilter-devel@...r.kernel.org,
	netdev@...r.kernel.org, mph@....com, jesper.brouer@...il.com,
	as@....com
Subject: Re: [PATCH RFC 0/5] netfilter: implement netfilter SYN proxy

On Thu, Aug 08, 2013 at 02:04:12AM +0200, Hannes Frederic Sowa wrote:
> On Wed, Aug 07, 2013 at 04:40:56PM -0700, David Miller wrote:
> > From: Hannes Frederic Sowa <hannes@...essinduktion.org>
> > Date: Wed, 7 Aug 2013 23:05:40 +0200
> > 
> > > It seems, Windows stopped using tcp timestamps at least in windows 8 by
> > > default.
> > 
> > Thankfully, Android device outnumber Windows 8 installs
> > by... something like 1,000 to 1, right?
> 
> Heh, at minimum. :)
> 
> > I throw a huge "doesn't matter" to whatever Windows's TCP stack
> > decides to do.  It absolutely should not dictate whether we decide to
> > make use of this or that feature of TCP.  It's a bit player at best.
> > 
> > So if Windows 8 is the reason you're saying we shouldn't use
> > timestamps for anything, you're wrong.
> 
> Actually, I don't care at all, because I don't do anything with windows
> and don't get paid by anyone who wants me to care. ;)
> 
> But if we switch to a similar scheme as freebsd we can even care
> less because even if some other operating systems or a major provider
> decides to disable timestamps on their devices, we would still have
> window scaling, sack (and ecn?) under syn dos. So, I do think it is an
> improvement and don't see any disadvantages.
> 
> So, I don't care as long as the change (and siphash or maybe another
> hashing scheme) is secure enough...

So maybe lets agree to this - we all don't care about Windows 8, but
more importantly, I'd prefer to do one thing at a time and cryptographic
hashing isn't exactly my area of expertise. So lets get these patches
in order and after that I'll look into making SYN cookies perform better
for the poor souls using Windows 8, if that's possible without using
timestamps ;)
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html