View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0002309 | unreal | ircd | public | 2005-01-31 05:22 | 2005-02-24 23:01 |
| Reporter | fez | Assigned To | |||
| Priority | normal | Severity | feature | Reproducibility | always |
| Status | closed | Resolution | open | ||
| Product Version | 3.2.2 | ||||
| Summary | 0002309: request: make nospoof a conf option... | ||||
| Description | Well I think it would be handy to make NOSPOOF a config option that can be changed on the fly... not sure how much work it would entail to make it optional, but somehow I think it could be done without too much trouble... (the biggest problem i could foresee is, what if a user is connecting and the server is still waiting for their PONG right when a /rehash is done which disables nospoof, but even dealing with that wouldnt be too bad) thoughts? -- Eric / fez | ||||
| 3rd party modules | |||||
|
|
I'm not really in favor of this. My thoughts: either you have an OS that has insecure TCP ISN or not, so you should not be enabling/disabling this via the conf. I can already see all those windows users disabling it 'because it's an annoying msg', not knowing that I then can spoof connections from any IP withing seconds (nt/w9x) or minutes (w2k/xp/..)! EDIT: ok, we could make it doable via-the-conf only for *NIX users of course.. then you get rid of my main concerns. |
|
|
why is the existence of the no-spoof-routine a problem at all? (even if the OS itself is TCP-secure) |
|
|
I think this would be nice, unfortunatly, it would be one more thing to slow down connects. |
|
|
I think it's a bad idea. First off, 90% of UNIX systems, i.e., probably 75% of our userbase, does not need nospoof. The way the system is now, in the aClient structure we have: #ifdef NOSPOOF int nospoof; #endif Therefore, if nospoof is disabled, we don't allocate memory. With this change, however, those 75% of the systems will now be using 4 additional bytes of memory per user. That's wasteful. And, I don't see any reason why you would want this dynamic. Today your OS is secure, and suddenly, tomorrow it isn't? Either you need nospoof or you don't, that's not something that is going to change. So why bother with the extra complexity and memory/CPU usage (however minor) for something that no one ever has a reason to change? |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2005-01-31 05:22 | fez | New Issue | |
| 2005-01-31 09:07 | syzop | Note Added: 0008963 | |
| 2005-01-31 09:08 | syzop | Note Edited: 0008963 | |
| 2005-01-31 09:09 | syzop | Note Edited: 0008963 | |
| 2005-01-31 10:57 | medice | Note Added: 0008964 | |
| 2005-01-31 18:09 | Stealth | Note Added: 0008966 | |
| 2005-01-31 23:34 |
|
Note Added: 0008967 | |
| 2005-02-24 23:01 | syzop | Status | new => closed |
