tcp tuning tcp_syncookies

tcp_syncookies.
Send out syncookies when the syn backlog queue of a socket overflows. This is to prevent against the common “syn flood attack”. Disabled (0) by default.

:--:cat /proc/sys/net/ipv4/tcp_syncookies
0
:--:

added from linux kernel source.
/*
160  * Generate a syncookie.  mssp points to the mss, which is returned
161  * rounded down to the value encoded in the cookie.
162  */
163 __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
164 {
165         const struct iphdr *iph = ip_hdr(skb);
166         const struct tcphdr *th = tcp_hdr(skb);
167         int mssind;
168         const __u16 mss = *mssp;
169
170         tcp_synq_overflow(sk);
171
172         /* XXX sort msstab[] by probability?  Binary search? */
173         for (mssind = 0; mss > msstab[mssind + 1]; mssind++)
174                 ;
175         *mssp = msstab[mssind] + 1;
176
177         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);
178
179         return secure_tcp_syn_cookie(iph->saddr, iph->daddr,
180                                      th->source, th->dest, ntohl(th->seq),
181                                      jiffies / (HZ * 60), mssind);
182 }

What does rfc 1337 say ?

From RFC 1337.
TIME-WAIT
state removes the hazard of old duplicates for “fast” or “long” connections, in which clock-driven ISN selection is unable to prevent overlap of the old and new sequence spaces. The TIME-WAIT delay allows all old duplicate segments time enough to die in the Internet before the connection is reopened.

echo 1 > /proc/sys/net/ipv4/tcp_rfc1337

 /* FIN arrived, enter true time-wait state. */
                tw->tw_substate   = TCP_TIME_WAIT;
                tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
                if (tmp_opt.saw_tstamp) {
                        tcptw->tw_ts_recent_stamp = get_seconds();
                        tcptw->tw_ts_recent       = tmp_opt.rcv_tsval;
                }

tcp tuning tcp_rfc1337

From RFC 1337.
TIME-WAIT
state removes the hazard of old duplicates for “fast” or “long” connections, in which clock-driven ISN selection is unable to prevent overlap of the old and new sequence spaces. The TIME-WAIT delay allows all old duplicate segments time enough to die in the Internet before the connection is reopened.

echo 1 > /proc/sys/net/ipv4/tcp_rfc1337

 /* FIN arrived, enter true time-wait state. */
                tw->tw_substate   = TCP_TIME_WAIT;
                tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
                if (tmp_opt.saw_tstamp) {
                        tcptw->tw_ts_recent_stamp = get_seconds();
                        tcptw->tw_ts_recent       = tmp_opt.rcv_tsval;
                }

generating random passwords.

makepass.py

from random import choice
import string
def GenPasswd(length=8, chars=string.letters+string.digits):
    return ''.join([ choice(chars) for i in range(length) ])

ahiliation:~$python
Python 2.5.5 (r255:77872, Mar 20 2010, 05:19:32)
[GCC 4.4.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import makepass
>>> for i in range(6):
...    print makepass.GenPasswd(12)
...
BSxqLK9mpq4R
FRlppP7K2Che
YBkz0QZMJojC
JjTQlcHzDsC3
WMD5BfRcyTEk
quO9nlBirm2U
>>>

Credit : Devin Leung.

getservbyname programming

The getservbyname() function returns a servent structure for the entry from the database that  matches  the  service name  using protocol proto.  If proto is NULL, any protocol will be matched.  A connection is opened to the database if necessary.

getservbyname(“ftp”, “tcp”) = 0x7fcc5248b8c0

The servent structure is defined in as follows:

struct servent {
char *s_name; /* official service name */
char **s_aliases; /* alias list */
int s_port; /* port number */
char *s_proto; /* protocol to use */
}

Stallman, Richard: The Realization
[audio:http://www.freeinfosociety.com/media/sounds/72.mp3]