* TCP port randomization
@ 2007-10-17 21:15 Krzysztof Oledzki
2007-10-17 22:08 ` Stephen Hemminger
0 siblings, 1 reply; 5+ messages in thread
From: Krzysztof Oledzki @ 2007-10-17 21:15 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: netdev
[-- Attachment #1: Type: TEXT/PLAIN, Size: 1251 bytes --]
Hello,
Is it normal that TCP port randomization (tested with 2.6.22) works only
when explicitly binding to a IP address:
--- cut here ---
root@fw1:~# nc 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
root@fw1:~# nc 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
root@fw1:~# nc 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S
23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S
23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S
--- cut here ---
--- cut here ---
root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S
23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S
23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S
--- cut here ---
Best regards,
Krzysztof Olędzki
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: TCP port randomization
2007-10-17 21:15 TCP port randomization Krzysztof Oledzki
@ 2007-10-17 22:08 ` Stephen Hemminger
2007-10-17 22:31 ` Krzysztof Oledzki
0 siblings, 1 reply; 5+ messages in thread
From: Stephen Hemminger @ 2007-10-17 22:08 UTC (permalink / raw)
To: Krzysztof Oledzki; +Cc: netdev
On Wed, 17 Oct 2007 23:15:48 +0200 (CEST)
Krzysztof Oledzki <olel@ans.pl> wrote:
> Hello,
>
> Is it normal that TCP port randomization (tested with 2.6.22) works only
> when explicitly binding to a IP address:
>
>
> --- cut here ---
> root@fw1:~# nc 192.168.129.28 11
> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
> root@fw1:~# nc 192.168.129.28 11
> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
> root@fw1:~# nc 192.168.129.28 11
> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>
> 23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S
> 23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S
> 23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S
> --- cut here ---
>
>
> --- cut here ---
> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>
> 23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S
> 23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S
> 23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S
> --- cut here ---
>
> Best regards,
>
> Krzysztof Olędzki
It is a expected side effect. The starting point for the search
is based on hash(srcaddr, dstaddr, dstport, secret).
You are using same source, dest and port so yes it will stay
the same until rekeying occurs.
The secret only changes every 5min same as TCP initial sequence number.
--
Stephen Hemminger <shemminger@linux-foundation.org>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: TCP port randomization
2007-10-17 22:08 ` Stephen Hemminger
@ 2007-10-17 22:31 ` Krzysztof Oledzki
2007-10-17 22:34 ` Stephen Hemminger
0 siblings, 1 reply; 5+ messages in thread
From: Krzysztof Oledzki @ 2007-10-17 22:31 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: netdev
[-- Attachment #1: Type: TEXT/PLAIN, Size: 2073 bytes --]
On Wed, 17 Oct 2007, Stephen Hemminger wrote:
> On Wed, 17 Oct 2007 23:15:48 +0200 (CEST)
> Krzysztof Oledzki <olel@ans.pl> wrote:
>
>> Hello,
>>
>> Is it normal that TCP port randomization (tested with 2.6.22) works only
>> when explicitly binding to a IP address:
>>
>>
>> --- cut here ---
>> root@fw1:~# nc 192.168.129.28 11
>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>> root@fw1:~# nc 192.168.129.28 11
>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>> root@fw1:~# nc 192.168.129.28 11
>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>>
>> 23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S
>> 23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S
>> 23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S
>> --- cut here ---
>>
>>
>> --- cut here ---
>> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>>
>> 23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S
>> 23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S
>> 23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S
>> --- cut here ---
>>
>> Best regards,
>>
>> Krzysztof Olędzki
>
> It is a expected side effect.
So it is not possible to use randomization without binding to a specific
srcip?
> The starting point for the search
> is based on hash(srcaddr, dstaddr, dstport, secret).
> You are using same source, dest and port so yes it will stay
> the same until rekeying occurs.
> The secret only changes every 5min same as TCP initial sequence number.
If I get it right, even with explicitly selected constant srcaddr port
numbers should simply increase? This is not what I observed.
Thanks.
Best regards,
Krzysztof Olędzki
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: TCP port randomization
2007-10-17 22:31 ` Krzysztof Oledzki
@ 2007-10-17 22:34 ` Stephen Hemminger
2007-10-18 10:29 ` Krzysztof Oledzki
0 siblings, 1 reply; 5+ messages in thread
From: Stephen Hemminger @ 2007-10-17 22:34 UTC (permalink / raw)
To: Krzysztof Oledzki; +Cc: netdev
On Thu, 18 Oct 2007 00:31:13 +0200 (CEST)
Krzysztof Oledzki <olel@ans.pl> wrote:
>
>
> On Wed, 17 Oct 2007, Stephen Hemminger wrote:
>
> > On Wed, 17 Oct 2007 23:15:48 +0200 (CEST)
> > Krzysztof Oledzki <olel@ans.pl> wrote:
> >
> >> Hello,
> >>
> >> Is it normal that TCP port randomization (tested with 2.6.22) works only
> >> when explicitly binding to a IP address:
> >>
> >>
> >> --- cut here ---
> >> root@fw1:~# nc 192.168.129.28 11
> >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
> >> root@fw1:~# nc 192.168.129.28 11
> >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
> >> root@fw1:~# nc 192.168.129.28 11
> >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
> >>
> >> 23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S
> >> 23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S
> >> 23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S
> >> --- cut here ---
> >>
> >>
> >> --- cut here ---
> >> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
> >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
> >> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
> >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
> >> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
> >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
> >>
> >> 23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S
> >> 23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S
> >> 23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S
> >> --- cut here ---
> >>
> >> Best regards,
> >>
> >> Krzysztof Olędzki
> >
> > It is a expected side effect.
>
> So it is not possible to use randomization without binding to a specific
> srcip?
>
> > The starting point for the search
> > is based on hash(srcaddr, dstaddr, dstport, secret).
> > You are using same source, dest and port so yes it will stay
> > the same until rekeying occurs.
> > The secret only changes every 5min same as TCP initial sequence number.
>
> If I get it right, even with explicitly selected constant srcaddr port
> numbers should simply increase? This is not what I observed.
>
>
When you set srcaddr, it calls bind, and bind does randomization always
independent of address.
This existing behavior may seem odd, but it shouldn't present a security
problem.
--
Stephen Hemminger <shemminger@linux-foundation.org>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: TCP port randomization
2007-10-17 22:34 ` Stephen Hemminger
@ 2007-10-18 10:29 ` Krzysztof Oledzki
0 siblings, 0 replies; 5+ messages in thread
From: Krzysztof Oledzki @ 2007-10-18 10:29 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: netdev
[-- Attachment #1: Type: TEXT/PLAIN, Size: 2572 bytes --]
On Wed, 17 Oct 2007, Stephen Hemminger wrote:
> On Thu, 18 Oct 2007 00:31:13 +0200 (CEST)
> Krzysztof Oledzki <olel@ans.pl> wrote:
>
>>
>>
>> On Wed, 17 Oct 2007, Stephen Hemminger wrote:
>>
>>> On Wed, 17 Oct 2007 23:15:48 +0200 (CEST)
>>> Krzysztof Oledzki <olel@ans.pl> wrote:
>>>
>>>> Hello,
>>>>
>>>> Is it normal that TCP port randomization (tested with 2.6.22) works only
>>>> when explicitly binding to a IP address:
>>>>
>>>>
>>>> --- cut here ---
>>>> root@fw1:~# nc 192.168.129.28 11
>>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>>>> root@fw1:~# nc 192.168.129.28 11
>>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>>>> root@fw1:~# nc 192.168.129.28 11
>>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>>>>
>>>> 23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S
>>>> 23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S
>>>> 23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S
>>>> --- cut here ---
>>>>
>>>>
>>>> --- cut here ---
>>>> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
>>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>>>> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
>>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>>>> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11
>>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
>>>>
>>>> 23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S
>>>> 23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S
>>>> 23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S
>>>> --- cut here ---
>>>>
>>>> Best regards,
>>>>
>>>> Krzysztof Olędzki
>>>
>>> It is a expected side effect.
>>
>> So it is not possible to use randomization without binding to a specific
>> srcip?
>>
>>> The starting point for the search
>>> is based on hash(srcaddr, dstaddr, dstport, secret).
>>> You are using same source, dest and port so yes it will stay
>>> the same until rekeying occurs.
>>> The secret only changes every 5min same as TCP initial sequence number.
>>
>> If I get it right, even with explicitly selected constant srcaddr port
>> numbers should simply increase? This is not what I observed.
>>
>>
> When you set srcaddr, it calls bind, and bind does randomization always
> independent of address.
>
> This existing behavior may seem odd, but it shouldn't present a security
> problem.
Right. Thank you very much for the explanation.
Best regards,
Krzysztof Olędzki
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2007-10-18 10:29 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-10-17 21:15 TCP port randomization Krzysztof Oledzki
2007-10-17 22:08 ` Stephen Hemminger
2007-10-17 22:31 ` Krzysztof Oledzki
2007-10-17 22:34 ` Stephen Hemminger
2007-10-18 10:29 ` Krzysztof Oledzki
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox