lkml.org 
[lkml]   [1999]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject[Problem] predictable IP ID
Hi,

As people have mentioned predictable IP packet IDs is a fairly serious
security breach in the kernel.
(See http://www.securityfocus.com/templates/archive.pike?list=1&date=1999-08-1&msg=BUGTRAQ%251999080211573830@LISTS.SECURITYFOCUS.COM)

I consider two clear ways to solve the problem.
1. Make IP ID sequence not so predictable for example like OpenBSD folks have
done.
See http://www.openbsd.org/cgi-bin/cvsweb/src/sys/netinet/ip_id.c?rev=1.1

2. Another approach is to use different IP ID sequences for different target
hosts. As I've preliminary discussed with Alexey Kuznetsov we can create
an additional storage for (dst IP, IP ID) pairs referred from dst cache
entries.
Pro:
- Time interval between packets with the same IP ID increases instead of
decrease in OpenBSD solution.
Currently IP IDs start to repeat after a global 2^16 counter wrap.
Using the proposed approach IDs start to repeat after a _host_ counter
wrap. The difference may be significant if the system communicates
with a lot of hosts.
- If a dst cache entry exists IP ID generation will cost about a zero
instead of a dozen or two of multiplications and divisions in the OpenBSD
code.
- Later we may decide to keep some other information on per-destination
basis using this infrastructure.
Contra:
- Extra memory to keep the data and extra kernel code.

What do people prefer?

Best regards
Andrey V.
Savochkin

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:0.106 / U:0.936 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site