From: Patrick McHardy <kaber@trash.net>
To: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>,
akepner@sgi.com, netdev@oss.sgi.com,
Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Subject: Re: [RFC/PATCH] "strict" ipv4 reassembly
Date: Wed, 18 May 2005 01:36:47 +0200 [thread overview]
Message-ID: <428A800F.6040809@trash.net> (raw)
In-Reply-To: <20050517232828.GA26894@gondor.apana.org.au>
Herbert Xu wrote:
> On Tue, May 17, 2005 at 04:16:41PM -0700, David S. Miller wrote:
>
>>Good point, in both cases what ends up happening is that
>>the queue is invalidated. In the existing case it's usually
>>because the final UDP or whatever checksum doesn't pass.
>>With your idea it'd be due to the artificially deflated timeout.
>
>
> It just occured to me that the optimisation in IPv4/IPv6 that performs
> fragmentation after tunnel-mode IPsec is fundamentally broken. It
> makes IPsec vulnerable to fragmentation attacks.
You mean vulnerable at reassembly time? Isn't that something reassembly
and policy checks should take care of?
Regards
Patrick
next prev parent reply other threads:[~2005-05-17 23:36 UTC|newest]
Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-05-17 16:18 [RFC/PATCH] "strict" ipv4 reassembly Arthur Kepner
2005-05-17 17:49 ` David S. Miller
2005-05-17 18:28 ` Arthur Kepner
2005-05-17 18:48 ` David S. Miller
2005-05-17 20:21 ` Arthur Kepner
2005-05-17 18:38 ` Andi Kleen
2005-05-17 18:45 ` Pekka Savola
2005-05-17 18:50 ` David S. Miller
2005-05-17 18:56 ` Rick Jones
2005-05-17 18:57 ` John Heffner
2005-05-17 19:09 ` David S. Miller
2005-05-17 19:21 ` Rick Jones
2005-05-17 19:26 ` Ben Greear
2005-05-17 20:48 ` Thomas Graf
2005-05-17 19:17 ` Andi Kleen
2005-05-17 19:56 ` David Stevens
2005-05-17 20:17 ` Andi Kleen
2005-05-17 20:22 ` David S. Miller
2005-05-17 20:27 ` Andi Kleen
2005-05-17 21:02 ` David S. Miller
2005-05-17 21:13 ` Andi Kleen
2005-05-17 21:24 ` David S. Miller
2005-05-17 21:25 ` Rick Jones
2005-05-17 22:06 ` Arthur Kepner
2005-05-17 22:18 ` Rick Jones
2005-05-17 22:40 ` David Stevens
2005-05-17 23:11 ` Herbert Xu
2005-05-17 23:20 ` Arthur Kepner
2005-05-17 23:25 ` Herbert Xu
2005-05-17 23:55 ` David Stevens
2005-05-18 0:00 ` Herbert Xu
2005-05-18 0:04 ` Andi Kleen
2005-05-18 0:09 ` Herbert Xu
2005-05-18 0:52 ` David S. Miller
2005-05-18 0:06 ` Nivedita Singhvi
2005-05-18 0:10 ` Herbert Xu
2005-05-18 0:51 ` David S. Miller
2005-05-18 1:05 ` Andi Kleen
2005-05-18 1:13 ` Herbert Xu
2005-05-18 1:09 ` John Heffner
2005-05-17 23:53 ` Rick Jones
2005-05-17 22:12 ` David S. Miller
2005-05-17 22:23 ` Rick Jones
2005-05-17 20:29 ` John Heffner
2005-05-17 19:01 ` Nivedita Singhvi
2005-05-17 19:13 ` Rick Jones
2005-05-17 19:25 ` Nivedita Singhvi
2005-05-17 19:31 ` John Heffner
2005-05-17 19:52 ` Nivedita Singhvi
2005-05-17 20:05 ` John Heffner
2005-05-17 20:12 ` Rick Jones
2005-05-17 19:33 ` Rick Jones
2005-05-17 19:53 ` Andi Kleen
2005-05-17 22:11 ` Herbert Xu
2005-05-17 22:13 ` David S. Miller
2005-05-17 23:08 ` Herbert Xu
2005-05-17 23:16 ` David S. Miller
2005-05-17 23:28 ` Herbert Xu
2005-05-17 23:36 ` Patrick McHardy [this message]
2005-05-17 23:41 ` Herbert Xu
2005-05-18 0:47 ` Thomas Graf
2005-05-18 1:06 ` Arthur Kepner
2005-05-18 1:16 ` Herbert Xu
2005-05-18 1:37 ` Thomas Graf
2005-05-18 1:52 ` Herbert Xu
2005-05-18 11:30 ` Thomas Graf
2005-05-18 11:40 ` Herbert Xu
2005-05-18 12:24 ` Thomas Graf
2005-05-18 16:21 ` Rick Jones
2005-05-18 17:40 ` Thomas Graf
2005-05-18 17:44 ` Thomas Graf
2005-05-18 21:46 ` Herbert Xu
2005-05-18 22:24 ` David Stevens
2005-05-18 22:39 ` Nivedita Singhvi
2005-05-18 23:31 ` Thomas Graf
2005-05-18 21:45 ` Herbert Xu
2005-05-19 12:23 ` Thomas Graf
2005-05-19 12:48 ` Herbert Xu
2005-05-19 15:19 ` Thomas Graf
2005-05-19 17:02 ` Rick Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=428A800F.6040809@trash.net \
--to=kaber@trash.net \
--cc=akepner@sgi.com \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=kuznet@ms2.inr.ac.ru \
--cc=netdev@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.