Messages in this thread |  | | Date | Wed, 23 Oct 1996 22:10:46 -0700 (PDT) | From | Zach Brown <> | Subject | Re: ICMPs & syn flood fix to prevent spoofing (previously "nuke?") |
| |
On Wed, 23 Oct 1996, Alan Cox wrote:
> > information lying around somewhere. I think BSD has already done > > something like this. Another portion of the icmp code i have been playing > > I've not seen such changes, but I'd be happy to add contributed code that > smart checks the body of ICMP errors to see if they look real. It will stop > the most clueless. At the end of the day only the beating of sense into big > providers to filter fake source addresses coming FROM their networks will > solve these problems for good. Unfortunately it doesn't make them thousands > of dollars so they don't seem to give a shit.
which is even more frustrating when one considers what a trivial rule it is to add. it would be great if bigger network providers would demand such filtering, but that would be really hard to police.
> > around with is the icmp redirect section. I have been attempting to add > > routes to my own machine by sending out spoofed icmps, but the test to add > > the route always seems to fail when it comes to the > > ((gw^dev->pa_addr)&dev->pa_mask) test in the ip_rt_redir function of > > net/ipv4/route.c... Does anyone know what the purpose of this test is and > > whether or not it is working correctly? Or even who I should contact (is > > there a maintainer for the icmp section of the linux networking code?) > > The check works out if the route being added is sensible. A redirect of > another nondirectly reachable address is nonsense. That line is an optimised > version of > > if((dev->pa_addr&dev->pa_mask)==(gw&dev->pa_addr)) >
from what i remember the route code makes sure that the redirect's source ip is that of the gateway of the route its replacing, makes sure that the new gateway is on the network of the old gateway, and must have come in through the device that the network is reached through. Isn't the above check the network part?
of course this means that if people can fake redirects they can still do some pretty annoying stuff, but it lessens the possiblity of annoyance quite a bit.
-- zach
|  |