* TCP port randomization @ 2007-10-17 21:15 Krzysztof Oledzki 2007-10-17 22:08 ` Stephen Hemminger 0 siblings, 1 reply; 5+ messages in thread From: Krzysztof Oledzki @ 2007-10-17 21:15 UTC (permalink / raw) To: Stephen Hemminger; +Cc: netdev [-- Attachment #1: Type: TEXT/PLAIN, Size: 1251 bytes --] Hello, Is it normal that TCP port randomization (tested with 2.6.22) works only when explicitly binding to a IP address: --- cut here --- root@fw1:~# nc 192.168.129.28 11 (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused root@fw1:~# nc 192.168.129.28 11 (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused root@fw1:~# nc 192.168.129.28 11 (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused 23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S 23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S 23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S --- cut here --- --- cut here --- root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused 23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S 23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S 23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S --- cut here --- Best regards, Krzysztof Olędzki ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: TCP port randomization 2007-10-17 21:15 TCP port randomization Krzysztof Oledzki @ 2007-10-17 22:08 ` Stephen Hemminger 2007-10-17 22:31 ` Krzysztof Oledzki 0 siblings, 1 reply; 5+ messages in thread From: Stephen Hemminger @ 2007-10-17 22:08 UTC (permalink / raw) To: Krzysztof Oledzki; +Cc: netdev On Wed, 17 Oct 2007 23:15:48 +0200 (CEST) Krzysztof Oledzki <olel@ans.pl> wrote: > Hello, > > Is it normal that TCP port randomization (tested with 2.6.22) works only > when explicitly binding to a IP address: > > > --- cut here --- > root@fw1:~# nc 192.168.129.28 11 > (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > root@fw1:~# nc 192.168.129.28 11 > (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > root@fw1:~# nc 192.168.129.28 11 > (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > > 23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S > 23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S > 23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S > --- cut here --- > > > --- cut here --- > root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 > (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 > (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 > (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > > 23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S > 23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S > 23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S > --- cut here --- > > Best regards, > > Krzysztof Olędzki It is a expected side effect. The starting point for the search is based on hash(srcaddr, dstaddr, dstport, secret). You are using same source, dest and port so yes it will stay the same until rekeying occurs. The secret only changes every 5min same as TCP initial sequence number. -- Stephen Hemminger <shemminger@linux-foundation.org> ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: TCP port randomization 2007-10-17 22:08 ` Stephen Hemminger @ 2007-10-17 22:31 ` Krzysztof Oledzki 2007-10-17 22:34 ` Stephen Hemminger 0 siblings, 1 reply; 5+ messages in thread From: Krzysztof Oledzki @ 2007-10-17 22:31 UTC (permalink / raw) To: Stephen Hemminger; +Cc: netdev [-- Attachment #1: Type: TEXT/PLAIN, Size: 2073 bytes --] On Wed, 17 Oct 2007, Stephen Hemminger wrote: > On Wed, 17 Oct 2007 23:15:48 +0200 (CEST) > Krzysztof Oledzki <olel@ans.pl> wrote: > >> Hello, >> >> Is it normal that TCP port randomization (tested with 2.6.22) works only >> when explicitly binding to a IP address: >> >> >> --- cut here --- >> root@fw1:~# nc 192.168.129.28 11 >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >> root@fw1:~# nc 192.168.129.28 11 >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >> root@fw1:~# nc 192.168.129.28 11 >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >> >> 23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S >> 23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S >> 23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S >> --- cut here --- >> >> >> --- cut here --- >> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >> >> 23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S >> 23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S >> 23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S >> --- cut here --- >> >> Best regards, >> >> Krzysztof Olędzki > > It is a expected side effect. So it is not possible to use randomization without binding to a specific srcip? > The starting point for the search > is based on hash(srcaddr, dstaddr, dstport, secret). > You are using same source, dest and port so yes it will stay > the same until rekeying occurs. > The secret only changes every 5min same as TCP initial sequence number. If I get it right, even with explicitly selected constant srcaddr port numbers should simply increase? This is not what I observed. Thanks. Best regards, Krzysztof Olędzki ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: TCP port randomization 2007-10-17 22:31 ` Krzysztof Oledzki @ 2007-10-17 22:34 ` Stephen Hemminger 2007-10-18 10:29 ` Krzysztof Oledzki 0 siblings, 1 reply; 5+ messages in thread From: Stephen Hemminger @ 2007-10-17 22:34 UTC (permalink / raw) To: Krzysztof Oledzki; +Cc: netdev On Thu, 18 Oct 2007 00:31:13 +0200 (CEST) Krzysztof Oledzki <olel@ans.pl> wrote: > > > On Wed, 17 Oct 2007, Stephen Hemminger wrote: > > > On Wed, 17 Oct 2007 23:15:48 +0200 (CEST) > > Krzysztof Oledzki <olel@ans.pl> wrote: > > > >> Hello, > >> > >> Is it normal that TCP port randomization (tested with 2.6.22) works only > >> when explicitly binding to a IP address: > >> > >> > >> --- cut here --- > >> root@fw1:~# nc 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> root@fw1:~# nc 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> root@fw1:~# nc 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> > >> 23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S > >> 23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S > >> 23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S > >> --- cut here --- > >> > >> > >> --- cut here --- > >> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 > >> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused > >> > >> 23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S > >> 23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S > >> 23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S > >> --- cut here --- > >> > >> Best regards, > >> > >> Krzysztof Olędzki > > > > It is a expected side effect. > > So it is not possible to use randomization without binding to a specific > srcip? > > > The starting point for the search > > is based on hash(srcaddr, dstaddr, dstport, secret). > > You are using same source, dest and port so yes it will stay > > the same until rekeying occurs. > > The secret only changes every 5min same as TCP initial sequence number. > > If I get it right, even with explicitly selected constant srcaddr port > numbers should simply increase? This is not what I observed. > > When you set srcaddr, it calls bind, and bind does randomization always independent of address. This existing behavior may seem odd, but it shouldn't present a security problem. -- Stephen Hemminger <shemminger@linux-foundation.org> ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: TCP port randomization 2007-10-17 22:34 ` Stephen Hemminger @ 2007-10-18 10:29 ` Krzysztof Oledzki 0 siblings, 0 replies; 5+ messages in thread From: Krzysztof Oledzki @ 2007-10-18 10:29 UTC (permalink / raw) To: Stephen Hemminger; +Cc: netdev [-- Attachment #1: Type: TEXT/PLAIN, Size: 2572 bytes --] On Wed, 17 Oct 2007, Stephen Hemminger wrote: > On Thu, 18 Oct 2007 00:31:13 +0200 (CEST) > Krzysztof Oledzki <olel@ans.pl> wrote: > >> >> >> On Wed, 17 Oct 2007, Stephen Hemminger wrote: >> >>> On Wed, 17 Oct 2007 23:15:48 +0200 (CEST) >>> Krzysztof Oledzki <olel@ans.pl> wrote: >>> >>>> Hello, >>>> >>>> Is it normal that TCP port randomization (tested with 2.6.22) works only >>>> when explicitly binding to a IP address: >>>> >>>> >>>> --- cut here --- >>>> root@fw1:~# nc 192.168.129.28 11 >>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >>>> root@fw1:~# nc 192.168.129.28 11 >>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >>>> root@fw1:~# nc 192.168.129.28 11 >>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >>>> >>>> 23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S >>>> 23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S >>>> 23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S >>>> --- cut here --- >>>> >>>> >>>> --- cut here --- >>>> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 >>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >>>> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 >>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >>>> root@fw1:~# nc -s 192.168.129.2 192.168.129.28 11 >>>> (UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused >>>> >>>> 23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S >>>> 23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S >>>> 23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S >>>> --- cut here --- >>>> >>>> Best regards, >>>> >>>> Krzysztof Olędzki >>> >>> It is a expected side effect. >> >> So it is not possible to use randomization without binding to a specific >> srcip? >> >>> The starting point for the search >>> is based on hash(srcaddr, dstaddr, dstport, secret). >>> You are using same source, dest and port so yes it will stay >>> the same until rekeying occurs. >>> The secret only changes every 5min same as TCP initial sequence number. >> >> If I get it right, even with explicitly selected constant srcaddr port >> numbers should simply increase? This is not what I observed. >> >> > When you set srcaddr, it calls bind, and bind does randomization always > independent of address. > > This existing behavior may seem odd, but it shouldn't present a security > problem. Right. Thank you very much for the explanation. Best regards, Krzysztof Olędzki ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2007-10-18 10:29 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2007-10-17 21:15 TCP port randomization Krzysztof Oledzki 2007-10-17 22:08 ` Stephen Hemminger 2007-10-17 22:31 ` Krzysztof Oledzki 2007-10-17 22:34 ` Stephen Hemminger 2007-10-18 10:29 ` Krzysztof Oledzki
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox