On Thu, 18 Oct 2007 00:31:13 +0200 (CEST) Krzysztof Oledzki <[EMAIL PROTECTED]> wrote:
> > > On Wed, 17 Oct 2007, Stephen Hemminger wrote: > > > On Wed, 17 Oct 2007 23:15:48 +0200 (CEST) > > Krzysztof Oledzki <[EMAIL PROTECTED]> wrote: > > > >> Hello, > >> > >> Is it normal that TCP port randomization (tested with 2.6.22) works only > >> when explicitly binding to a IP address: > >> > >> > >> --- cut here --- > >> [EMAIL PROTECTED]:~# nc 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> [EMAIL PROTECTED]:~# nc 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> [EMAIL PROTECTED]:~# nc 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> > >> 23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S > >> 23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S > >> 23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S > >> --- cut here --- > >> > >> > >> --- cut here --- > >> [EMAIL PROTECTED]:~# nc -s 192.168.129.2 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> [EMAIL PROTECTED]:~# nc -s 192.168.129.2 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> [EMAIL PROTECTED]:~# nc -s 192.168.129.2 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> > >> 23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S > >> 23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S > >> 23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S > >> --- cut here --- > >> > >> Best regards, > >> > >> Krzysztof Olędzki > > > > It is a expected side effect. > > So it is not possible to use randomization without binding to a specific > srcip? > > > The starting point for the search > > is based on hash(srcaddr, dstaddr, dstport, secret). > > You are using same source, dest and port so yes it will stay > > the same until rekeying occurs. > > The secret only changes every 5min same as TCP initial sequence number. > > If I get it right, even with explicitly selected constant srcaddr port > numbers should simply increase? This is not what I observed. > > When you set srcaddr, it calls bind, and bind does randomization always independent of address. This existing behavior may seem odd, but it shouldn't present a security problem. -- Stephen Hemminger <[EMAIL PROTECTED]> - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
