lkml.org 
[lkml]   [1999]   [Mar]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: select()/socket has problems under 2.2.x.
On Sat, 6 Mar 1999, David Miller wrote:

>The DoS Andi might be alluding to is one which is amusing and all BSD
>stacks are vulnerable to, and is the reason why we do so many strange
>and esoteric things with socket buffer accounting for TCP.
>
>Study the BSD stack and think about what happens if you feed it:
>
>1) packet with one byte of data, with sequence number at
> 1 byte before right edge of window.

If I understand well 1 byte before right edge of window means
`TCP_SKB_CB(skb)->seq == tp->rcv_wup + tp->rcv_wnd - 1'.

Suppose to have my patch applyed and that truesize was > of rcvbuf in
first place.

If so with my patch the packet it's queued in the out of order queue.

>2) packet with two bytes of data, with sequence number at
> 2 bytes before right edge of window.

So this second packet should prune the out_of_order_queue and should also
be discarded because rmem is still > of rcvbuf after the prune.

>continue the progression... wheee I've found a way to eat memory
>on a remote BSD host at factorial rates :-)

Maybe I didn't understood exactly what you mean (or maybe you are not
telling that my patch is vulnerable to this attack in first place) but I
think my patch is safe.

>The problem in the BSD stack is twofold:
>
>1) Their socket buffer accounting assumes that header bytes are
> a trivial amount of space compared to the data, so they don't
> account for it at all.
>2) They hold on to overlapping out of order segments.
>
>This really isn't all that interesting a DoS, it's just inconvenient,
>because (unlike the more fun exploits) you have to give your IP
>address identity away to make it work.

You have to give it your IP if you aren't able to spoof what the other TCP
stack is doing. If for example the victim is on the same ethernet you can
spoof your MAC address and spoof your IP address and you should be still
able to see the sequence number that cames from the other end, and see
it's offered window (and you can do that even if the host with the spoofed
IP is `up' because the victim is talking with a spoofed MAC address).

Andrea Arcangeli


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:50    [W:0.089 / U:0.236 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site