Date: Wed, 30 Apr 2003 15:30:06 +0300 From: Ruslan Ermilov <ru@freebsd.org> To: Garrett Wollman <wollman@lcs.mit.edu> Cc: net@freebsd.org Subject: Re: Reducing ip_id information leakage Message-ID: <20030430123006.GC68817@sunbay.com> In-Reply-To: <200304292247.h3TMlpPU044307@khavrinen.lcs.mit.edu> References: <200304292247.h3TMlpPU044307@khavrinen.lcs.mit.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
--oj4kGyHlBMXGt3Le Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Apr 29, 2003 at 06:47:51PM -0400, Garrett Wollman wrote: > Here's a patch inspired by a recent Steve Bellovin paper. It also > saves a bswap operation in the common case for non-TCP (non-PMTUD) > traffic. Untested as yet, but I have great faith.... >=20 Looks like a winner! > Index: ip_output.c > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > RCS file: /home/cvs/src/sys/netinet/ip_output.c,v > retrieving revision 1.187 > diff -u -r1.187 ip_output.c > --- ip_output.c 12 Apr 2003 06:11:46 -0000 1.187 > +++ ip_output.c 29 Apr 2003 22:42:55 -0000 > @@ -223,17 +223,29 @@ > pkt_dst =3D args.next_hop ? args.next_hop->sin_addr : ip->ip_dst; > =20 > /* > - * Fill in IP header. > + * Fill in IP header. If we are not allowing fragmentation, > + * then the ip_id field is meaningless, so send it as zero > + * to reduce information leakage. Otherwise, if we are not > + * randomizing ip_id, then don't bother to convert it to network > + * byte order -- it's just a nonce. Note that a 16-bit counter > + * will wrap around in less than 10 seconds at 100 Mbit/s on a > + * medium with MTU 1500. See Steven M. Bellovin, "A Technique > + * for Counting NATted Hosts", Proc. IMW'02, available at > + * <http://www.research.att.com/~smb/papers/fnat.pdf>. > */ > if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) =3D=3D 0) { > ip->ip_v =3D IPVERSION; > ip->ip_hl =3D hlen >> 2; > ip->ip_off &=3D IP_DF; > + if (ip->ip_off) > + ip->ip_id =3D 0; > + else { > #ifdef RANDOM_IP_ID > - ip->ip_id =3D ip_randomid(); > + ip->ip_id =3D ip_randomid(); > #else > - ip->ip_id =3D htons(ip_id++); > + ip->ip_id =3D ip_id++; > #endif > + } > ipstat.ips_localout++; > } else { > hlen =3D ip->ip_hl << 2; > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" --=20 Ruslan Ermilov Sysadmin and DBA, ru@sunbay.com Sunbay Software AG, ru@FreeBSD.org FreeBSD committer, +380.652.512.251 Simferopol, Ukraine http://www.FreeBSD.org The Power To Serve http://www.oracle.com Enabling The Information Age --oj4kGyHlBMXGt3Le Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (FreeBSD) iD8DBQE+r8HOUkv4P6juNwoRAtVRAJ0a/JotVPV5LvdWLfOyNePEUCjYdgCfc0eK l+2iexVR2wrSuUu7hvXbH9U= =L2F6 -----END PGP SIGNATURE----- --oj4kGyHlBMXGt3Le--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030430123006.GC68817>