Messages in this thread | | | Date | Sun, 12 Jun 2005 14:32:53 +0200 | From | Willy Tarreau <> | Subject | Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.) |
| |
On Sun, Jun 12, 2005 at 10:06:27PM +1000, Herbert Xu wrote: > On Sun, Jun 12, 2005 at 01:40:39PM +0200, Willy Tarreau wrote: > > > > Sorry Herbert, but both RFC793 page 32 figure 9 and my Linux box disagree > > with this statement. Look: at line 5, A rejects the SYN-ACK because the > > ACK is wrong during the session setup. > > Look at the first check inside th->ack in tcp_rcv_synsent_state_process.
Herbert, I perfectly agree with this check and it's consistent with what I observe. But as you know, there's a difference between resetting a session and sending an RST to say that we refuse a segment. This check does not kill the session, it sends an RST whose SEQ is equal to the SYN-ACK's ACK. It's possible you though the "reset_and_undo" label was used to kill the session, but it's not the case (although the naming is not clear). So if the remote end was the one which sent the SYN-ACK, it will clear its session. If it has been spoofed, it will ignore the RST because in turn, the SEQ will not be within its window.
Try it by yourself if you don't believe me. I've done lots of tests with hping2 and I've never managed to kill a session with both a SEQ and ACK outside the windows.
Regards, Willy
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |