Full Disclosure mailing list archives
Re: DNS and NAT (was: DNS and CheckPoint)
From: "Riad S. Wahby" <rsw () jfet org>
Date: Fri, 11 Jul 2008 13:04:29 -0400
Valdis.Kletnieks () vt edu wrote:
With 64K source ports, you'll have collisions over 1% of the time at only 1024 in use. With 8K in use, you're hitting collisions 12% of the time.
Good point. When collisions occur, as Thomas and I have pointed out, the behavior of the NAT implementation is going to be crucial. In the case of linux netfilter NATs, a quick look at the code reveals that when netfilter selects a source port it does so with the net_random() function call, which is #define'd (in include/linux/net.h) as random32(). random32() comes from the kernel's lib/random32.c, and according to the file header: /* This is a maximally equidistributed combined Tausworthe generator based on code from GNU Scientific Library 1.5 (30 Jun 2004) x_n = (s1_n ^ s2_n ^ s3_n) s1_{n+1} = (((s1_n & 4294967294) <<12) ^ (((s1_n <<13) ^ s1_n) >>19)) s2_{n+1} = (((s2_n & 4294967288) << 4) ^ (((s2_n << 2) ^ s2_n) >>25)) s3_{n+1} = (((s3_n & 4294967280) <<17) ^ (((s3_n << 3) ^ s3_n) >>11)) (etc) */ Even if this random number generator is prone to sequence prediction attacks, Mallory does not know when the NAT is rewriting Alice's port selection. Beyond that, our scenario requires that there are collisions happening, meaning that NAT's RNG state is being advanced by an unknown number of other machines. This mixing of Alice's random source ports with Trent's random source ports and Carol's colliding source ports would seem to make exploitation impractical even in the case that Trent's RNG is weak against sequence prediction. -=rsw _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- DNS and NAT (was: DNS and CheckPoint) Thomas Cross (Jul 10)
- Re: DNS and NAT (was: DNS and CheckPoint) Riad S. Wahby (Jul 10)
- Re: DNS and NAT (was: DNS and CheckPoint) Thomas Cross (Jul 11)
- Re: DNS and NAT (was: DNS and CheckPoint) Valdis . Kletnieks (Jul 11)
- Re: DNS and NAT (was: DNS and CheckPoint) Riad S. Wahby (Jul 11)
- Re: DNS and NAT (was: DNS and CheckPoint) Marco Slaviero (Jul 16)
- Re: DNS and NAT (was: DNS and CheckPoint) Thomas Cross (Jul 11)
- Re: DNS and NAT (was: DNS and CheckPoint) Riad S. Wahby (Jul 10)
- Re: DNS and NAT (was: DNS and CheckPoint) Ryan McBride (Jul 16)
- <Possible follow-ups>
- Re: DNS and NAT (was: DNS and CheckPoint) Elazar Broad (Jul 11)
- Re: DNS and NAT (was: DNS and CheckPoint) Thomas Cross (Jul 14)