Re: [PATCH] OpenBSD Networking-related randomization port - Lorenzo Hernández García-Hierro

From: "Lorenzo Hernández García-Hierro" <lorenzo@gnu.org>
To: linux@horizon.com
Cc: mingo@elte.hu, Arjan van de Ven <arjan@infradead.org>,
	bunk@stusta.de, Chris Wright <chrisw@osdl.org>,
	davem@redhat.com, Hank Leininger <hlein@progressive-comp.com>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	netdev@oss.sgi.com, shemminger@osdl.org, Valdis.Kletnieks@vt.edu,
	spender@grsecurity.net
Subject: Re: [PATCH] OpenBSD Networking-related randomization port
Date: Wed, 02 Feb 2005 18:38:37 +0100	[thread overview]
Message-ID: <1107365917.3754.155.camel@localhost.localdomain> (raw)
In-Reply-To: <20050202171702.24523.qmail@science.horizon.com>

[-- Attachment #1: Type: text/plain, Size: 1206 bytes --]

El mié, 02-02-2005 a las 17:17 +0000, linux@horizon.com escribió:
> There *are* things in OpenBSD, like randomized port assignment (as opposed
> to the linear scan in tcp_v4_get_port()) that would be worth emulating.
> Maybe worry about that first?
> 

Completely agreed with you, I was just trying to help with split up
patches, but, as your analysis shows, it's more a weak implementation
than a real security improvement.

All I can say, just ignore the patch.I will work on other (worthy)
issues that are in a bigger need.

Maybe I would work something out on randomized source ports, as soon as
I get time for it.

Note also that Brad fixed obsd_rand.c code this week, I've added him to
the CC list because there are things that may concern grSecurity he
should be able to comment further on it and discuss whatever concerns
*his* work (which is, BTW, a good thing (tm) to have in mind even if he
didn't send split up patches for each feature, which I really don't
know).

I've just ported it out of grsecurity.

Thanks for your meaningful comments,
Cheers.
-- 
Lorenzo Hernández García-Hierro <lorenzo@gnu.org> 
[1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]

[-- Attachment #2: Esta parte del mensaje está firmada digitalmente --]
[-- Type: application/pgp-signature, Size: 189 bytes --]