netdev - Re: [PATCH rfc 1/4] net-timestamp: pull headers for SOCK

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20141125.145434.1790615963499624322.davem@davemloft.net>
Date:	Tue, 25 Nov 2014 14:54:34 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	willemb@...gle.com
Cc:	netdev@...r.kernel.org, luto@...capital.net,
	richardcochran@...il.com
Subject: Re: [PATCH rfc 1/4] net-timestamp: pull headers for SOCK_STREAM

From: Willem de Bruijn <willemb@...gle.com>
Date: Tue, 25 Nov 2014 14:52:00 -0500

> On Tue, Nov 25, 2014 at 1:42 PM, David Miller <davem@...emloft.net> wrote:
>> From: Willem de Bruijn <willemb@...gle.com>
>> Date: Tue, 25 Nov 2014 12:58:03 -0500
>>
>> What's the harm in exposing the headers?  Either it's harmful, and
>> therefore doing so for UDP is bad too, or it's harmless and
> 
> Headers may expose information not available otherwise. I don't
> immediately see critical problems, but that does not mean that they
> might not lurk there.
> 
> We so far avoid exposing the sequence number, though keeping it hidden
> is more about third parties. More in general, unprivileged processes
> may start requesting timestamps only to learn tcp state that they
> should either get from tcpinfo or cannot currently get at all, likely
> for good reason. A far-fetched example is identifying admin iptables
> tos mangling rules by reading the tos bits at the driver layer. At least
> on my machine, iptables -L is privileged.
> 
>> we should probably leave it alone to not risk breaking anyone.
> 
> That's fair. I sent it for rfc first for that reason. I won't resubmit
> unless more serious concerns are raised.

I just worry about the potential breakage.

Your concerns are valid... I honestly don't know what we should do here.
Both choices have merit.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html