Re: [new filter] simple packet authentication

[Harald Welte <laforge@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 1354 bytes --]

On Fri, Jan 23, 2004 at 02:16:08AM +0100, Alexandre Becoulet wrote:
> On Friday 23 January 2004 01:25, Andrew Hall wrote:
> 
> > This is a neat idea although I'd probably be a bit wary to use the IP ID
> > field when considering it's use with fragments.
> 
> Sure, using the IP ID field could be an issue. The module will not mangle 
> fragmented packets (offset > 0 or MF flag set). That's why packets have to be 
> mangled before being routed. At least, it should work for locally-generated 
> packets, and for packets reaching the first gateway. It should not be usefull 
> to mangle the packet later.

well, there is one problem... once you have IP_DF set, the Fragment ID
is believed to be ueseless.  Linux in fact is setting it to zero, at
least in some cases, for performance reasons (contention on the id
counter).  So I could  imagine some weird implementations that would
then discard the IPid at some later point in the forwarding path of your
packet.

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]