Re: [fw-wiz] Firewalls that generate new packets..

One issue that happened many years ago was that certain Windows TCP/
IP implementations would allocate the packet in memory and then write
the outgoing data into the allocated space.

The remainder of the packet (MTU - data_length) would contain
whatever garbage was lying around the sending computer's memory
space. Over time, this would leak large portions of memory out the
network port.

A firewall that copied data into a fresh, initialized packet would
avoid this information leak.

I can't see any disadvantages to using this approach. Packets with
improper length and header information would be truncated or dropped
by the firewall, and that's probably a good thing.

-j


On Nov 13, 2007, at 7:58 PM, Kelly Robinson wrote:

Some firewalls, after receiving a packet, generate a new packet and
populate it with data from the original, rather than forwarding the
same packet that was received. What are the advantages and
disadvantages of this approach? And does anyone have any examples
of any firewalls that do this on the market?

Thanks

- k
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • [NT]Microsoft Windows WRITE_ANDX SMB Command Handling Kernel DoS
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Windows Vista SP1 with latest security updates ... Invalid system memory was referenced. ... Srv.sys is the driver that will process the received SMB packet, ...
    (Securiteam)
  • Re: [PATCH 1/1] network memory allocator.
    ... Swap storage then sends an ack for that data, since network allocations ... data and main system can work with that free memory. ... No need to detect OOM or something other - it just works. ... each new packet goes slow path since VJ header ...
    (Linux-Kernel)
  • Re: [RFC][PATCH 0/9] Network receive deadlock prevention for NBD
    ... True, that is done, but we then discard this packet at the very first ... piece of memory will not get stuck waiting on some unimportant blocked ... So even though we allocate the packet we do not loose the ...
    (Linux-Kernel)
  • Re: [PATCH 1/1] network memory allocator.
    ... Kevent network AIO uses usual alloc_skb, naio is called when packet is ... data and main system can work with that free memory. ... You do not see the point of network tree allocator. ...
    (Linux-Kernel)
  • Re: Communications kernel -> userland
    ... > for packet streams and if we made it complicated enough it would require ... of new data from the user process to the kernel well, ... to the user process memory. ...
    (freebsd-hackers)