On Sat, 1 Mar 2008, Fernando Gont wrote:
I will also start working on the double-hash ephemeral port selection
algorithm described in the draft (this is, IMHO, the right approach to
ephemeral port randomization)
Kind regards,
--
Fernando Gont
Earlier in the week, I had commented (via private e-mail?) that I thought
that Amit Klein's algorithm which I recently implemented in ip_id.c might
be adapted to serve as an ephemeral port allocator. Now that I've thought
more about it, I'm not as certain that it would fit well. I'll try to
sketch out my ideas and see if I can figure out how it could fit.
The double-hash concept sounds pretty good, but there's a major problem
with it. If an application does a bind() to get a local port before doing
a connect(), you don't know the remote IP or the remote port.
There's a related "feature" in the BSD TCP stack that all local ports are
considered equal; even for applications that do a connect() call and
specify a remote IP/port, we do not let them use the same local port to
two different remote IPs at the same time. This puts a limit on the total
number of outgoing connections that one machine can have.
-Mike
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
