Re: [PATCH] [1/1] Deprecate tcp_tw_{reuse,recycle}

[Ben Greear <greearb@candelatech.com>]

Andi Kleen wrote:
> We've recently had a long discussion about the CVE-2005-0356 time stamp denial-of-service
> attack. It turned out that Linux is only vunerable to this problem when tcp_tw_recycle
> is enabled (which it is not by default).
> 
> In general these two options are not really usable in today's internet because they
> make the (often false) assumption that a single IP address has a single TCP time stamp /
> PAWS clock. This assumption breaks both NAT/masquerading and also opens Linux to denial
> of service attacks (see the CVE description) 
> 
> Due to these numerous problems I propose to remove this code for 2.6.26

We use these features to enable creating very high numbers of short-lived
TCP connections, primarily used as a test tool for other network
devices.

Perhaps just document the adverse affects and/or have it print out a warning
on the console whenever the feature is enabled?


Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com