Messages in this thread | | | Date | Thu, 9 Sep 1999 20:42:12 +0400 | From | Savochkin Andrey Vladimirovich <> | Subject | [Problem] predictable IP ID |
| |
Hi,
As people have mentioned predictable IP packet IDs is a fairly serious security breach in the kernel. (See http://www.securityfocus.com/templates/archive.pike?list=1&date=1999-08-1&msg=BUGTRAQ%251999080211573830@LISTS.SECURITYFOCUS.COM)
I consider two clear ways to solve the problem. 1. Make IP ID sequence not so predictable for example like OpenBSD folks have done. See http://www.openbsd.org/cgi-bin/cvsweb/src/sys/netinet/ip_id.c?rev=1.1
2. Another approach is to use different IP ID sequences for different target hosts. As I've preliminary discussed with Alexey Kuznetsov we can create an additional storage for (dst IP, IP ID) pairs referred from dst cache entries. Pro: - Time interval between packets with the same IP ID increases instead of decrease in OpenBSD solution. Currently IP IDs start to repeat after a global 2^16 counter wrap. Using the proposed approach IDs start to repeat after a _host_ counter wrap. The difference may be significant if the system communicates with a lot of hosts. - If a dst cache entry exists IP ID generation will cost about a zero instead of a dozen or two of multiplications and divisions in the OpenBSD code. - Later we may decide to keep some other information on per-destination basis using this infrastructure. Contra: - Extra memory to keep the data and extra kernel code.
What do people prefer?
Best regards Andrey V. Savochkin
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |