lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200513043908.GA25216@f3>
Date:   Wed, 13 May 2020 13:39:08 +0900
From:   Benjamin Poirier <benjamin.poirier@...il.com>
To:     Jan Engelhardt <jengelh@...i.de>
Cc:     zenczykowski@...il.com, maze@...gle.com, pablo@...filter.org,
        fw@...len.de, netdev@...r.kernel.org,
        netfilter-devel@...r.kernel.org
Subject: Re: [PATCH v2] doc: document danger of applying REJECT to INVALID CTs

On 2020-05-12 23:00 +0200, Jan Engelhardt wrote:
> Signed-off-by: Jan Engelhardt <jengelh@...i.de>
> ---
> 
> Simplify the trigger case by dropping mentions of P_3.
> New -A commands as proposed.
> 
>  extensions/libip6t_REJECT.man | 20 ++++++++++++++++++++
>  extensions/libipt_REJECT.man  | 20 ++++++++++++++++++++
>  2 files changed, 40 insertions(+)
> 
> diff --git a/extensions/libip6t_REJECT.man b/extensions/libip6t_REJECT.man
> index 0030a51f..cc845e6f 100644
> --- a/extensions/libip6t_REJECT.man
> +++ b/extensions/libip6t_REJECT.man
> @@ -30,3 +30,23 @@ TCP RST packet to be sent back.  This is mainly useful for blocking
>  hosts (which won't accept your mail otherwise).
>  \fBtcp\-reset\fP
>  can only be used with kernel versions 2.6.14 or later.
> +.PP
> +\fIWarning:\fP You should not indiscrimnately apply the REJECT target to
                                          ^ typo
> +packets whose connection state is classified as INVALID; instead, you should
> +only DROP these.
> +.PP
> +Consider a source host transmitting a packet P, with P experiencing so much
> +delay along its path that the source host issues a retransmission, P_2, with
> +P_2 being succesful in reaching its destination and advancing the connection
                   ^ typo

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ