little TCP checksum bug?

[Gorny]

Hi,

After playing with malicious TCP-packet I found out
that in certain cases the kernel will reply with a wrong
TCP-checksum set. This has only been tested against 2.2.19
and 2.4.5!

root@krondor:/home/gorny/btk# tcpdump -vXi lo >> dump
root@krondor:/home/gorny/btk# cat dump
18:56:29.316097 128.0.0.1.4000 > localhost.8012: S [tcp sum ok]
1732610923:1732610928(5) win 65535 (ttl 40, id 29204, len 45)
0x0000   4500 002d 7214 0000 2806 21b5 8000 0001        E..-r...(.!.....
0x0010   7f00 0001 0fa0 1f4c 6745 8b6b 0000 0000        .......LgE.k....
0x0020   5002 ffff 3466 0000 7768 6f6f 74               P...4f..whoot
18:56:29.316169 localhost.8012 > localhost.4000: R [bad tcp cksum 1!] 0:0(0)
ack 1732610924 win 0 (ttl 255, id 72, len 40)
0x0000   4500 0028 0048 0000 ff06 bd85 7f00 0001        E..(.H..........
0x0010   7f00 0001 1f4c 0fa0 0000 0000 6745 8b6c        .....L......gE.l
0x0020   5014 0000 8f30 0000                            P....0..
[...]

I don't think this will become a big problem, while most
people are running ipchains/iptables and/or some sort of
IDS's so those packets won't come through.
(Note that this has been tested on a standalone pc, while (of course)
128.0.0.1 didn't exist and no firewall)

If one want to test this behaviour you can download a little
c-file (4 kB) from here: http://gorny.ath.cx/archive/strange/strange.c

Gorny

"When I was a little kid, I had this dream where a snake would rule and
dominate the entire world (actually, I guess that a penguin was also part of
the dream... but never mind)" -- Python Develper's Handbook, Andre Lessa
http://gorny.ath.cx