Messages in this thread | | | Subject | Re: [Patch] IPv4 TCP security impovement | From | Andi Kleen <> | Date | 08 Jan 1999 18:03:58 +0100 |
| |
In article <19990107111203.A446@rhea>, jbaran@hildesheim.sgh-net.de (Joachim Baran) writes: > no_tcp_socket: > +#ifdef CONFIG_TCP_ACKRST > + printk(KERN_DEBUG "%d.%d.%d.%d tried closed TCP socket port %d\n", > + NIPQUAD(skb->nh.iph->saddr), > + ntohs(th->dest) > + ); > +#else > tcp_v4_send_reset(skb); > - > +#endif
Not sending the RSTs is very unfriendly to the network. Imagine you run that on a dynamic IP dialup machine, someone else uses the same IP first, opens a connection to a server, hangs up without closing the connection properly, you get the same IP, the server sends TCP packets to the local port of the old connection. For that the TCP standard requires to send RSTs, because otherwise the other end will not notice that something went wrong and trying again for a long time (using up your bandwidth etc.).
Also you have no rate limiting in your printk, everybody can fill up your log partition completely or even make the machine unusable.
In short: this patch is a bad idea.
-Andi
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |