From: "David S. Miller" <davem@redhat.com>
To: alan@lxorguk.ukuu.org.uk
Cc: davids@webmaster.com, linux-kernel@vger.kernel.org
Subject: Re: RFC2385 (MD5 signature in TCP packets) support
Date: Fri, 15 Mar 2002 15:37:05 -0800 (PST) [thread overview]
Message-ID: <20020315.153705.111545634.davem@redhat.com> (raw)
In-Reply-To: <E16m1J7-00051f-00@the-village.bc.nu>
In-Reply-To: <20020315.151628.122227750.davem@redhat.com> <E16m1J7-00051f-00@the-village.bc.nu>
From: Alan Cox <alan@lxorguk.ukuu.org.uk>
Date: Fri, 15 Mar 2002 23:40:21 +0000 (GMT)
> Ignoring valid RST frames breaks TCP.
If they don't have the right MD5 frame they are not valid.
If there is an error in the network stack there is no way for
a remote TCP to fix things. Making RST frames more complex
guarentees that more error conditions will not be broken out of.
A RST must, in order to function properly, be as simple and non-error
prone as possible. MD5 signatures are totally against that.
This is why PAWS timestamp, etc. checks are DISABLED for RST frames.
Only the sequence number is verified, but that is it.
IPSEC has a lot more going for it, but most cisco's still only
support the MD5 stuff.
I frankly don't care what Cisco's do or do not do.
I don't care if Cisco made a rotten decision. I'm not going to let
Cisco's mistakes crap up Linux's networking.
Either use IPSEC or fix its' deficiencies.
next prev parent reply other threads:[~2002-03-15 23:40 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-03-15 22:36 David Schwartz
2002-03-15 22:53 ` David S. Miller
2002-03-15 23:11 ` David Schwartz
2002-03-15 23:14 ` David S. Miller
2002-03-15 23:15 ` Alan Cox
2002-03-15 23:13 ` David Schwartz
2002-03-15 23:16 ` David S. Miller
2002-03-15 23:37 ` David S. Miller [this message]
2002-03-15 23:45 ` David S. Miller
2002-03-15 23:57 ` David S. Miller
2002-03-16 0:06 ` David Schwartz
2002-03-16 1:43 ` Alan Cox
2002-03-18 4:09 ` David S. Miller
2002-03-18 5:06 ` Mike Fedyk
2002-03-18 6:19 ` David S. Miller
2002-03-16 4:19 ` debugging eth driver Petko Manolov
2002-03-16 17:27 ` Alan Cox
2002-03-16 18:52 ` Petko Manolov
2002-03-16 20:56 ` Alan Cox
2002-03-17 1:36 ` Keith Owens
2002-03-17 3:37 ` Tomasz Kłoczko
2002-03-22 7:40 ` Cameron Simpson
2002-03-16 0:01 ` RFC2385 (MD5 signature in TCP packets) support David Schwartz
2002-03-16 0:12 ` Alan Cox
2002-03-15 23:59 ` Alan Cox
2002-03-15 23:53 ` David Schwartz
2002-03-15 23:54 ` David S. Miller
2002-03-16 0:14 ` Alan Cox
2002-03-15 23:40 ` Alan Cox
2002-03-17 10:00 ` bert hubert
2002-03-22 5:55 ` 2.5.7, IDE, 'handler not null', 'kernel timer added twice' David Schwartz
2002-03-22 6:10 ` Davide Libenzi
2002-03-22 10:59 ` Martin Dalecki
2002-03-22 20:13 ` Davide Libenzi
2002-03-23 13:12 ` Martin Dalecki
2002-03-22 6:31 ` Andre Hedrick
2002-03-15 23:19 ` RFC2385 (MD5 signature in TCP packets) support Alan Cox
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20020315.153705.111545634.davem@redhat.com \
--to=davem@redhat.com \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=davids@webmaster.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®