Enabling TCP RFC 1948

[Rui Paulo]

I would like to hear the opinions about enabling TCP RFC 1948
extensions (the code is already in tree for some years now).

Any comments?
--
Rui Paulo



--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Thor Lancelot Simon]

Post by Rui Paulo
I would like to hear the opinions about enabling TCP RFC 1948
extensions (the code is already in tree for some years now).
Any comments?

This isn't turned on by default because it is very expensive. It has
been discussed several times in the past.

[Rui Paulo]

Post by Thor Lancelot Simon

Post by Rui Paulo
I would like to hear the opinions about enabling TCP RFC 1948
extensions (the code is already in tree for some years now).
Any comments?

This isn't turned on by default because it is very expensive. It has
been discussed several times in the past.

There is no option to enable it yet. And Jason hasn't been
responsive ;-)

revision 1.108
date: 2001/03/20 20:07:51; author: thorpej; state: Exp; lines:
+126 -31
Two changes, designed to make us even more resilient against TCP
ISS attacks (which we already fend off quite well).

1. First-cut implementation of RFC1948, Steve Bellovin's cryptographic
hash method of generating TCP ISS values. Note, this code is
experimental
and disabled by default (experimental enough that I don't export the
variable via sysctl yet, either). There are a couple of issues I'd
like to discuss with Steve, so this code should only be used by
people
who really know what they're doing.


I spoke with Steve Bellovin last week about this, but I'll let him
explain what happened by his own words.

--
Rui Paulo



--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Steven M. Bellovin]

Post by Rui Paulo
revision 1.108
+126 -31
Two changes, designed to make us even more resilient against TCP
ISS attacks (which we already fend off quite well).
1. First-cut implementation of RFC1948, Steve Bellovin's cryptographic
hash method of generating TCP ISS values. Note, this code is
experimental
and disabled by default (experimental enough that I don't export the
variable via sysctl yet, either). There are a couple of issues I'd
like to discuss with Steve, so this code should only be used by
people
who really know what they're doing.
I spoke with Steve Bellovin last week about this, but I'll let him
explain what happened by his own words.

I'm not sure what the issue is. I suspect it's
http://www.cert.org/advisories/CA-2001-09.html and the paper it's based on,
http://www.thenewsh.com/~newsham/random-increments.pdf -- that identifies
some possible remaining issues with 1948 code. The problem is that
"better" fixes have the potential of breaking TCP correctness.

Anyway -- the proposal on the table isn't to make 1948 mode the default;
it's to make a sysctl available to let people who want it turn it on.
Even if you agree with the issues in that paper, the paper itself notes
that 1948 mode is much better than doing nothing.


--Steven M. Bellovin, http://www.cs.columbia.edu/~smb

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Elad Efrat]

Post by Steven M. Bellovin
I'm not sure what the issue is. I suspect it's
http://www.cert.org/advisories/CA-2001-09.html and the paper it's based on,
http://www.thenewsh.com/~newsham/random-increments.pdf -- that identifies
some possible remaining issues with 1948 code. The problem is that
"better" fixes have the potential of breaking TCP correctness.
Anyway -- the proposal on the table isn't to make 1948 mode the default;
it's to make a sysctl available to let people who want it turn it on.
Even if you agree with the issues in that paper, the paper itself notes
that 1948 mode is much better than doing nothing.

Makes sense; Rui can you please add the sysctl knob?

-e.

[Jason Thorpe]

Post by Rui Paulo
1. First-cut implementation of RFC1948, Steve Bellovin's cryptographic
hash method of generating TCP ISS values. Note, this code is
experimental
and disabled by default (experimental enough that I don't export the
variable via sysctl yet, either). There are a couple of issues I'd
like to discuss with Steve, so this code should only be used by
people
who really know what they're doing.

...and it was so long ago that I honestly cannot remember what it was
that I wanted to discuss with Steve...

-- thorpej


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Rui Paulo]

Post by Jason Thorpe

Post by Rui Paulo
1. First-cut implementation of RFC1948, Steve Bellovin's
cryptographic
hash method of generating TCP ISS values. Note, this code is
experimental
and disabled by default (experimental enough that I don't
export the
variable via sysctl yet, either). There are a couple of issues I'd
like to discuss with Steve, so this code should only be used by
people
who really know what they're doing.

...and it was so long ago that I honestly cannot remember what it
was that I wanted to discuss with Steve...

Are you okay with adding a sysctl MIB?

--
Rui Paulo



--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Jason Thorpe]

Post by Rui Paulo
Are you okay with adding a sysctl MIB?

Yes, of course.

-- thorpej


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de