Date: Thu, 24 Mar 2005 04:46:15 -0600 (CST) From: Mike Silbersack <silby@silby.com> To: Maxim Konovalov <maxim@macomnet.ru> Cc: andre@freebsd.org Subject: Re: ip_reass() - possibly incorrect goto Message-ID: <20050324043742.C47410@odysseus.silby.com> In-Reply-To: <20050323155414.S99626@mp2.macomnet.net> References: <E40595640FD457418D8F9005C2BEC8496456D4@mvebe001.americas.nokia.com> <20050323155414.S99626@mp2.macomnet.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 23 Mar 2005, Maxim Konovalov wrote:
> On Tue, 22 Mar 2005, 12:08-0800, Vijay.Singh@nokia.com wrote:
>
>> Hi hackers, I am looking at the ip_reass() routine. In case of the
>> 1st fragment we create the reassembly queue. After the queue has
>> been inserted in the hash bucket, the if () code does a " goto
>> inserted". Should this be changed to "goto done" instead? Any code
>> that is executed for the 1st fragment, like frag per packet limiting
>> and complete reassembly are not valid. Am I mistaken?
>
> Yep, it seems you are right. The second micro optimization - drop the
> fragment early if maxfragsperpacket == 0.
>
> Andre, Mike, what do you think?
Looks good to me. Please tell us if you come up with any more
optimizations for the reassembly code, Vijay.
On a related note...
While looking through the code, I think I figured out a way to avoid IDSes
if you're trying to mess with a FreeBSD machine:
/*
* Handle ECN by comparing this segment with the first one;
* if CE is set, do not lose CE.
* drop if CE and not-ECT are mixed for the same packet.
*/
Couldn't you send a fragment with half the "exploit" payload (too short
for the IDS to match), then send a packet with a different ECN status to
overwrite that fragment (at least in the IDS's buffer, but not in
FreeBSD's, since it would be dropped), and then send the second part of
the payload?
Hmmm...
Mike "Silby" Silbersack
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050324043742.C47410>