From owner-freebsd-net@FreeBSD.ORG Wed Apr 30 05:30:32 2003 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B9CEA37B401 for ; Wed, 30 Apr 2003 05:30:32 -0700 (PDT) Received: from whale.sunbay.crimea.ua (whale.sunbay.crimea.ua [212.110.138.65]) by mx1.FreeBSD.org (Postfix) with ESMTP id 06E4B43FEC for ; Wed, 30 Apr 2003 05:30:26 -0700 (PDT) (envelope-from ru@whale.sunbay.crimea.ua) Received: from whale.sunbay.crimea.ua (ru@localhost [127.0.0.1]) h3UCUC62071891 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 30 Apr 2003 15:30:12 +0300 (EEST) (envelope-from ru@whale.sunbay.crimea.ua) Received: (from ru@localhost) by whale.sunbay.crimea.ua (8.12.9/8.12.8/Submit) id h3UCU68I071876; Wed, 30 Apr 2003 15:30:06 +0300 (EEST) (envelope-from ru) Date: Wed, 30 Apr 2003 15:30:06 +0300 From: Ruslan Ermilov To: Garrett Wollman Message-ID: <20030430123006.GC68817@sunbay.com> References: <200304292247.h3TMlpPU044307@khavrinen.lcs.mit.edu> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="oj4kGyHlBMXGt3Le" Content-Disposition: inline In-Reply-To: <200304292247.h3TMlpPU044307@khavrinen.lcs.mit.edu> User-Agent: Mutt/1.5.4i cc: net@freebsd.org Subject: Re: Reducing ip_id information leakage X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Apr 2003 12:30:33 -0000 --oj4kGyHlBMXGt3Le Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Apr 29, 2003 at 06:47:51PM -0400, Garrett Wollman wrote: > Here's a patch inspired by a recent Steve Bellovin paper. It also > saves a bswap operation in the common case for non-TCP (non-PMTUD) > traffic. Untested as yet, but I have great faith.... >=20 Looks like a winner! > Index: ip_output.c > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > RCS file: /home/cvs/src/sys/netinet/ip_output.c,v > retrieving revision 1.187 > diff -u -r1.187 ip_output.c > --- ip_output.c 12 Apr 2003 06:11:46 -0000 1.187 > +++ ip_output.c 29 Apr 2003 22:42:55 -0000 > @@ -223,17 +223,29 @@ > pkt_dst =3D args.next_hop ? args.next_hop->sin_addr : ip->ip_dst; > =20 > /* > - * Fill in IP header. > + * Fill in IP header. If we are not allowing fragmentation, > + * then the ip_id field is meaningless, so send it as zero > + * to reduce information leakage. Otherwise, if we are not > + * randomizing ip_id, then don't bother to convert it to network > + * byte order -- it's just a nonce. Note that a 16-bit counter > + * will wrap around in less than 10 seconds at 100 Mbit/s on a > + * medium with MTU 1500. See Steven M. Bellovin, "A Technique > + * for Counting NATted Hosts", Proc. IMW'02, available at > + * . > */ > if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) =3D=3D 0) { > ip->ip_v =3D IPVERSION; > ip->ip_hl =3D hlen >> 2; > ip->ip_off &=3D IP_DF; > + if (ip->ip_off) > + ip->ip_id =3D 0; > + else { > #ifdef RANDOM_IP_ID > - ip->ip_id =3D ip_randomid(); > + ip->ip_id =3D ip_randomid(); > #else > - ip->ip_id =3D htons(ip_id++); > + ip->ip_id =3D ip_id++; > #endif > + } > ipstat.ips_localout++; > } else { > hlen =3D ip->ip_hl << 2; > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" --=20 Ruslan Ermilov Sysadmin and DBA, ru@sunbay.com Sunbay Software AG, ru@FreeBSD.org FreeBSD committer, +380.652.512.251 Simferopol, Ukraine http://www.FreeBSD.org The Power To Serve http://www.oracle.com Enabling The Information Age --oj4kGyHlBMXGt3Le Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (FreeBSD) iD8DBQE+r8HOUkv4P6juNwoRAtVRAJ0a/JotVPV5LvdWLfOyNePEUCjYdgCfc0eK l+2iexVR2wrSuUu7hvXbH9U= =L2F6 -----END PGP SIGNATURE----- --oj4kGyHlBMXGt3Le--