[lkml]   [2008]   [Aug]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC][PATCH 1/1] cxgb3i: cxgb3 iSCSI initiator
David Miller wrote:
> From: Jeff Garzik <>
> Date: Fri, 08 Aug 2008 18:15:41 -0400
>> * security updates for TCP problems mean that a single IP address can be
>> PARTIALLY SECURE, because security updates for kernel TCP stack and
>> h/w's firmware are inevitably updated separately (even if distributed
>> and compiled together). Yay, we are introducing a wonderful new
>> security problem here.
>> * from a security, network scanner and packet classifier point of view,
>> a single IP address no longer behaves like Linux. It behaves like
>> Linux... sometime. Depending on whether it is a magic TCP port or not.
> I agree with everything Jeff has stated.
> Also, I find it ironic that the port abduction is being asked for in
> order to be "compatible with existing tools" yet in fact this stuff
> breaks everything. You can't netfilter this traffic, you can't apply
> qdiscs to it, you can't execut TC actions on them, you can't do
> segmentation offload on them, you can't look for the usual TCP MIB
> statistics on the connection, etc. etc. etc.
> It is broken from every possible angle.

I think a lot of these _could_ be implemented and integrated with the
standard tools.

 \ /
  Last update: 2008-08-09 16:07    [W:0.144 / U:0.192 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site