4 ms·
From TFA: - A single SYN request is sent on an opened || closed port - It carries an OTP for authentication so you can be the only one to open a po
by cryptonector 4y ago
From TFA:
- A single SYN request is sent on an opened || closed port
- It carries an OTP for authentication so you can be the only one to open a port
- Once authentified, a random (HMAC based) port is opened for a TCP connection
- Then, the port is closed as soon as a connection has been established
Very clever. The fake SYN carries data, an OTP. Very nice!
- nousermane 4y agoClever, yes. But this will break in presence of middle-boxen that rewrite IP-ID [1] and/or TCP-SEQ/ACK [2] numbers (SSL inspection firewalls, WAN optimizers, older satellite modems, even some particularly bad carrier-grade NAT devices). [1] https://en.wikipedia.org/wiki/IPv4#Identification https://en.wikipedia.org/wiki/IPv4#Identification [2] https://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure https://en.wikipedia.org/wiki/Transmission_Control_Protocol#...
- cryptonector 4y agoYes, putting the HMAC in the IP ID field is brittle. Maybe a TCP option could be used.
- jmprspret 4y agoCan't all that be done without eBPF in a normal userspace program?
- cryptonector 4y agoYes, using SOCK_RAW.