lkml.org 
[lkml]   [2000]   [Sep]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: linux kernel TCP, network connections and iptables
On Fri, Sep 08, 2000 at 02:18:22AM +0300, George Athanassopoulos wrote:
> On Fri, 8 Sep 2000, Andi Kleen wrote:
>
> :I forgot to add: Alexey is of course right in that it doesn't help you
> :at all. You cannot defend against packet floods, and with an active TCP
> :you can be always tricked into bouncing packets without load limit
> :(e.g. just by sending out of order packets for an established connection
> :or in a zillion other ways)
> :
> :
> :-Andi
> :
>
> "At all" is not what I would say. Of course noone is trying to defend
> just at the kernel level. But I believe every step to make the linux
> kernel less trickable to such exploitation of TCP implementation
> "weaknesses", and also trying to make linux kernel behave less like
> a TCP flood amplifier, is welcomed (without serious or harmful
> "violation" of the protocol).

If Linux stopped sending ACKs for out of order packets your machine would
be pretty much unusable over lossy links (because fast retransmit would
not work properly anymore) But that of course can be used
to cause your machine to send at least an outgoing packet for each incoming
packet.

There are lots of other similar cases which are not fixable IMHO

> Untill some other way comes up, I will try out Alan's patch. I believe
> it will help a lot, in conjuction with ipfw and some kind of dynamic
> manipulation of it.

You don't need the patch as I pointed out, it can be all done from user space
using tc
But it'll only stop a single attack, but there are lots of other attacks
possible.

It would probably be more useful to find out why an attack kills other
systems on your net. I guess you have a fast internet connection (near
your ethernet speed) and you're probably using half duplex ethernet,
correct?

-Andi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 12:38    [W:0.059 / U:2.788 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site