Re: LAND check: 2.4.20

[Martijn Lievaart <m@rtij.nl>]

Vishwas Manral wrote:

>Hi Cedric/ Martin,
>
>Thanks for the reply. There are a few things you may be missing:-
>
>1. They cannot be in the rule set, unless we can put a rule which says for any Source-IP/ Port if destination will be the same value then drop. You cannot put the value of every possible IP/port in your rule set. Besides as you yourself mentioned the solution you state it may not work for all scenarios.
>  
>

Yes they can. You don't need a rule that syas srcip==dstip. If eth0 is 
connected to 1.2.3.0/24, put in a rule that drops traffic from any other 
interface with source address 1.2.3.0/24. In practice this works in any 
scenario where it matters imo.

>2. The source and destination address may be routed, though the same. So from a machine X I could send a packet with source and Destination IP of Y.
>  
>

Yes, that is possible. However, do you want to catch LAND attacks on a 
machine that has such weird routing functionality? If this really 
bothers you, write a custom match, it should be trivial.

>3. I am not sure which routing code checks for Source IP Address? Can you point me to some code (destroy it as a packet with local IP as source must be received on loopback)?
>  
>

See Patricks reply.

>The solution as done by most firewalls is to add a simple check in the check_tcp and check_udp. I think we need to add this to the iptables code.
>  
>

If you really need this functionality, it is trivial to write a custom 
match for it. If case 2 above is a reality for you, you need the 
flexibility of a custom match anyhow, as you cannot solve the problem 
generically in that case.

M4