Eric, thanks. I'm sorry for forgetting to mention this before, but the attack I referred to was against NAT _using_ port randomization, i.e. --random option (Netfilter from 2.4). We did _not_ refer to the known attack against NAT using port-preserving option (i.e., without port randomization). This attack is trivial when the DNS is not using port randomization, and we also show how to do this when the DNS is using port randomization. But the more challenging attack is when the NAT is using port randomization (--random). Of course, we also explain how to prevent these attacks. Cheers, Amir and Haya On Thu, Sep 2, 2010 at 4:04 PM, Eric Dumazet <eric.dumazet@xxxxxxxxx> wrote: > Le jeudi 02 septembre 2010 à 15:50 +0200, Amir Herzberg a écrit : >> We investigate some issues related to DNS poisoning, and specifically, >> an attack that poisons DNS cache, similar to Kaminski's attack, but >> that works even if the resolver selects random ports, as long as >> resolver is connected to the Internet via NAT. In particular, we >> tested the attack for the NetFilter NAT. >> >> For obvious reasons, I prefer at this point to share details only with >> developers of NAT devices. If you are such developer, please contact >> me and I can send you the details (paper). >> Feel also welcome to forward the messages to individuals/forums which >> may be relevant (i.e., developers). >> >> I apologize for not being able to promise to respond to requests from >> people who are just curious (i.e., not NAT developers). Thanks for >> your understanding. >> -- > > Strange, this should be supported since 2007 (port randomization for > nat) > > commit 41f4689a7c8cd76b77864461b3c58fde8f322b2c > Author: Eric Leblond <eric@xxxxxx> > Date: Wed Feb 7 15:10:09 2007 -0800 > > [NETFILTER]: NAT: optional source port randomization support > > This patch adds support to NAT to randomize source ports. > > Signed-off-by: Eric Leblond <eric@xxxxxx> > Signed-off-by: Patrick McHardy <kaber@xxxxxxxxx> > Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> > > If using MASQUERADE, its a very easy setup : > > iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE --random > > > > -- Amir Herzberg Associate Professor, Dept. of Computer Science Bar Ilan University http://AmirHerzberg.com -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
