Re: kern/30550 (denial-of-service attack using ICMP "need to fragment" messages and MTU set to 1500)

To: kern-bug-people%netbsd.org@localhost,netbsd-bugs%netbsd.org@localhost,gnats-admin%netbsd.org@localhost,maxv%NetBSD.org@localhost,eravin%panix.com@localhost
Subject: Re: kern/30550 (denial-of-service attack using ICMP "need to fragment" messages and MTU set to 1500)
From: maxv%NetBSD.org@localhost
Date: Fri, 9 Feb 2018 20:05:02 +0000 (UTC)

Synopsis: denial-of-service attack using ICMP "need to fragment" messages and MTU set to 1500

State-Changed-From-To: open->closed
State-Changed-By: maxv%NetBSD.org@localhost
State-Changed-When: Fri, 09 Feb 2018 20:05:02 +0000
State-Changed-Why:
This issue got described in

https://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html

And NetBSD implemented the counter-measures 12 years ago
(tcp_subr.c::r1.192).

So close this PR... belatedly...

Prev by Date: NetBSD Nightly Trouble Ticket Report
Next by Date: Re: kern/39018 (ipsec code doesn't handle specific icmp codes)
Previous by Thread: Re: kern/52900 (dm: Fix kernel panic when target's ->init() failed)
Next by Thread: Re: kern/50676 (icmp traceroute does not work on NetBSD 7 / IPFilter 5.1)
Indexes:

Home | Main Index | Thread Index | Old Index