We've recently had a long discussion about the CVE-2005-0356 time stamp
denial-of-service
attack. It turned out that Linux is only vunerable to this problem when
tcp_tw_recycle
is enabled (which it is not by default).
In general these two options are not really usable in today's internet because
they
make the (often false) assumption that a single IP address has a single TCP
time stamp /
PAWS clock. This assumption breaks both NAT/masquerading and also opens Linux
to denial
of service attacks (see the CVE description)
Due to these numerous problems I propose to remove this code for 2.6.26
Signed-off-by: Andi Kleen <[EMAIL PROTECTED]>
Index: linux/Documentation/feature-removal-schedule.txt
===================================================================
--- linux.orig/Documentation/feature-removal-schedule.txt
+++ linux/Documentation/feature-removal-schedule.txt
@@ -354,3 +354,15 @@ Why: The support code for the old firmwa
and slightly hurts runtime performance. Bugfixes for the old firmware
are not provided by Broadcom anymore.
Who: Michael Buesch <[EMAIL PROTECTED]>
+
+---------------------------
+
+What: Support for /proc/sys/net/ipv4/tcp_tw_{reuse,recycle} = 1
+When: 2.6.26
+Why: Enabling either of those makes Linux TCP incompatible with
masquerading and
+ also opens Linux to the CVE-2005-0356 denial of service attack. And
these
+ optimizations are explicitely disallowed by some benchmarks. They also
have
+ been disabled by default for more than ten years so they're unlikely
to be used
+ much. Due to these fatal flaws it doesn't make sense to keep the code.
+Who: Andi Kleen <[EMAIL PROTECTED]>
+
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
