lkml.org 
[lkml]   [2008]   [Aug]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC][PATCH 1/1] cxgb3i: cxgb3 iSCSI initiator
David Miller wrote:
> From: Jeff Garzik <jgarzik@pobox.com>
> Date: Fri, 08 Aug 2008 18:15:41 -0400
>
>
>> * security updates for TCP problems mean that a single IP address can be
>> PARTIALLY SECURE, because security updates for kernel TCP stack and
>> h/w's firmware are inevitably updated separately (even if distributed
>> and compiled together). Yay, we are introducing a wonderful new
>> security problem here.
>>
>> * from a security, network scanner and packet classifier point of view,
>> a single IP address no longer behaves like Linux. It behaves like
>> Linux... sometime. Depending on whether it is a magic TCP port or not.
>>
>
> I agree with everything Jeff has stated.
>
> Also, I find it ironic that the port abduction is being asked for in
> order to be "compatible with existing tools" yet in fact this stuff
> breaks everything. You can't netfilter this traffic, you can't apply
> qdiscs to it, you can't execut TC actions on them, you can't do
> segmentation offload on them, you can't look for the usual TCP MIB
> statistics on the connection, etc. etc. etc.
>
> It is broken from every possible angle.
>

I think a lot of these _could_ be implemented and integrated with the
standard tools.







\
 
 \ /
  Last update: 2008-08-09 16:07    [from the cache]
©2003-2011 Jasper Spaans