lkml.org 
[lkml]   [1999]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [Patch] IPv4 TCP security impovement
From
Date
In article <19990107111203.A446@rhea>,
jbaran@hildesheim.sgh-net.de (Joachim Baran) writes:
> no_tcp_socket:
> +#ifdef CONFIG_TCP_ACKRST
> + printk(KERN_DEBUG "%d.%d.%d.%d tried closed TCP socket port %d\n",
> + NIPQUAD(skb->nh.iph->saddr),
> + ntohs(th->dest)
> + );
> +#else
> tcp_v4_send_reset(skb);
> -
> +#endif

Not sending the RSTs is very unfriendly to the network. Imagine you run
that on a dynamic IP dialup machine, someone else uses the same IP first,
opens a connection to a server, hangs up without closing the connection
properly, you get the same IP, the server sends TCP packets to the
local port of the old connection. For that the TCP standard requires to
send RSTs, because otherwise the other end will not notice that something
went wrong and trying again for a long time (using up your bandwidth etc.).

Also you have no rate limiting in your printk, everybody can fill up your
log partition completely or even make the machine unusable.

In short: this patch is a bad idea.

-Andi





-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:49    [W:0.268 / U:0.060 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site