lkml.org 
[lkml]   [1997]   [Jun]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: firewall hooks and fragmentation in 2.0.3x
Alan Cox wrote:
>
> > Each IP datagram goes through the output INET firewall code
> > exactly once. Fragmentation happens *after* the output code has
> > said 'YES'. Further, the whole output datagram will be provided
>
> Doesnt work like that and it wont work like that. We don't gain anything
> by such a rule but we lose performance. The kernel doesnt build a complete
> packet for many code paths, its building bits and sending some before its even
> thought about the rest of the packet.

You are entirely right -- it doesn't work like that. I claim that for
any
security 'feature' it is important to be able to specify how it works.
In this
case, I suspect that there is no specification for when and how often
which
bits of IP datagrams are filtered. Further, I suspect that it changes
from
OS revision to OS revision.

Is it possible to fix on how it *ought* to work, and then document it?
Then
any code alignment can be done.

Philip

--
Philip Gladstone +1 617 487 7700
Raptor Systems, Waltham, MA http://www.raptor.com/

\
 
 \ /
  Last update: 2005-03-22 13:39    [W:0.040 / U:1.160 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site