lkml.org 
[lkml]   [2001]   [Nov]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subjectlittle TCP checksum bug?
    Date
    Hi,

    After playing with malicious TCP-packet I found out
    that in certain cases the kernel will reply with a wrong
    TCP-checksum set. This has only been tested against 2.2.19
    and 2.4.5!

    root@krondor:/home/gorny/btk# tcpdump -vXi lo >> dump
    root@krondor:/home/gorny/btk# cat dump
    18:56:29.316097 128.0.0.1.4000 > localhost.8012: S [tcp sum ok]
    1732610923:1732610928(5) win 65535 (ttl 40, id 29204, len 45)
    0x0000 4500 002d 7214 0000 2806 21b5 8000 0001 E..-r...(.!.....
    0x0010 7f00 0001 0fa0 1f4c 6745 8b6b 0000 0000 .......LgE.k....
    0x0020 5002 ffff 3466 0000 7768 6f6f 74 P...4f..whoot
    18:56:29.316169 localhost.8012 > localhost.4000: R [bad tcp cksum 1!] 0:0(0)
    ack 1732610924 win 0 (ttl 255, id 72, len 40)
    0x0000 4500 0028 0048 0000 ff06 bd85 7f00 0001 E..(.H..........
    0x0010 7f00 0001 1f4c 0fa0 0000 0000 6745 8b6c .....L......gE.l
    0x0020 5014 0000 8f30 0000 P....0..
    [...]

    I don't think this will become a big problem, while most
    people are running ipchains/iptables and/or some sort of
    IDS's so those packets won't come through.
    (Note that this has been tested on a standalone pc, while (of course)
    128.0.0.1 didn't exist and no firewall)

    If one want to test this behaviour you can download a little
    c-file (4 kB) from here: http://gorny.ath.cx/archive/strange/strange.c

    Gorny

    "When I was a little kid, I had this dream where a snake would rule and
    dominate the entire world (actually, I guess that a penguin was also part of
    the dream... but never mind)" -- Python Develper's Handbook, Andre Lessa
    http://gorny.ath.cx

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:13    [W:0.047 / U:59.412 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site