lkml.org 
[lkml]   [1996]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: ICMPs & syn flood fix to prevent spoofing (previously "nuke?")
On Wed, 23 Oct 1996, Alan Cox wrote:

> > information lying around somewhere. I think BSD has already done
> > something like this. Another portion of the icmp code i have been playing
>
> I've not seen such changes, but I'd be happy to add contributed code that
> smart checks the body of ICMP errors to see if they look real. It will stop
> the most clueless. At the end of the day only the beating of sense into big
> providers to filter fake source addresses coming FROM their networks will
> solve these problems for good. Unfortunately it doesn't make them thousands
> of dollars so they don't seem to give a shit.

which is even more frustrating when one considers what a trivial rule it
is to add. it would be great if bigger network providers would demand
such filtering, but that would be really hard to police.

> > around with is the icmp redirect section. I have been attempting to add
> > routes to my own machine by sending out spoofed icmps, but the test to add
> > the route always seems to fail when it comes to the
> > ((gw^dev->pa_addr)&dev->pa_mask) test in the ip_rt_redir function of
> > net/ipv4/route.c... Does anyone know what the purpose of this test is and
> > whether or not it is working correctly? Or even who I should contact (is
> > there a maintainer for the icmp section of the linux networking code?)
>
> The check works out if the route being added is sensible. A redirect of
> another nondirectly reachable address is nonsense. That line is an optimised
> version of
>
> if((dev->pa_addr&dev->pa_mask)==(gw&dev->pa_addr))
>

from what i remember the route code makes sure that the redirect's source
ip is that of the gateway of the route its replacing, makes sure that the
new gateway is on the network of the old gateway, and must have come in
through the device that the network is reached through. Isn't the above
check the network part?

of course this means that if people can fake redirects they can still do
some pretty annoying stuff, but it lessens the possiblity of annoyance
quite a bit.

-- zach


\
 
 \ /
  Last update: 2005-03-22 13:38    [W:0.397 / U:0.068 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site