Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 01 Feb 2008 14:50:55 +0900
From:      gnn@freebsd.org
To:        Ingo Flaschberger <if@xip.at>
Cc:        "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>, Andre Oppermann <andre@freebsd.org>, "Bruce M. Simpson" <bms@freebsd.org>, freebsd-net@freebsd.org
Subject:   Re: tcp-md5 check for incomming connection
Message-ID:  <m23asd5io0.wl%gnn@neville-neil.com>
In-Reply-To: <alpine.LFD.1.00.0801311311010.4705@filebunker.xip.at>
References:  <alpine.LFD.1.00.0801291905020.17757@filebunker.xip.at> <479FF09B.4050705@FreeBSD.org> <20080130083105.S36482@maildrop.int.zabbadoz.net> <alpine.LFD.1.00.0801310106400.723@filebunker.xip.at> <47A19CC2.4070609@freebsd.org> <alpine.LFD.1.00.0801311311010.4705@filebunker.xip.at>

next in thread | previous in thread | raw e-mail | index | archive | help
At Thu, 31 Jan 2008 13:15:12 +0100 (CET),
Ingo Flaschberger wrote:
> 
> Dear Andre,
> 
> >> 2) linux method:
> >>     Look for CONFIG_TCP_MD5SIG in linux-2.6.24/net/ipv4/tcp_ipv4.c
> >>     (sorry no weblink..)
> >>     They check and block md5-packets early in tcp_v4_do_rcv.
> >>     afinet.c -> tcp_v4_rcv -> tcp_v4_do_rcv
> >>     -> for Freebsd: place some logic early in tcp_input function
> >>         and call a new function to check md5.
> >
> > IMHO calling a special function that does the check (like in tcp_output)
> > is the way to go.  This function should be run as late as possible after
> > the other segment validity checks to prevent easy cpu exhaustion attacks
> > with packets that only get the port numbers right.
> >
> > In tcp_new there is a natural place to perform the check.  tcp_input will
> > show up this weekend.  This doesn't prevent your work on the current code
> > at all as tcp_new won't show up in -current for a long time and when it
> > does it will not get MFC'd.
> 
> Ok.
> I will do the first patch for freebsd 6.2 (as my system uses it) and do 
> the a port to current (and I thing 6.3 too).
> 
> Regardding Bruce:
> I would prefer to implement md5 via the old setkey api as I also have todo 
> my daily business.
> 
> >> 3) Bruce extended method:
> >>     http://lists.freebsd.org/pipermail/freebsd-net/2004-April/003761.html
> >>     Use his code and add at severall places in tcp_input function
> >>     similar checks.
> >> 
> >> Options:
> >>     *) enable disable it via sysctl
> >>     *) count total, good and bad packets via sysctl
> >
> > This belongs into struct tcpstat, not a new sysctl.
> 
> Ok.
> With which tool can this counters be read?
> Should I add the on/off feature? Via which tool?
> 

Enable/disable via sysctl.

Read via netstat.

Best,
George



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?m23asd5io0.wl%gnn>