lkml.org 
[lkml]   [2005]   [Jun]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
    On Sun, Jun 12, 2005 at 10:06:27PM +1000, Herbert Xu wrote:
    > On Sun, Jun 12, 2005 at 01:40:39PM +0200, Willy Tarreau wrote:
    > >
    > > Sorry Herbert, but both RFC793 page 32 figure 9 and my Linux box disagree
    > > with this statement. Look: at line 5, A rejects the SYN-ACK because the
    > > ACK is wrong during the session setup.
    >
    > Look at the first check inside th->ack in tcp_rcv_synsent_state_process.

    Herbert, I perfectly agree with this check and it's consistent with what I
    observe. But as you know, there's a difference between resetting a session
    and sending an RST to say that we refuse a segment. This check does not kill
    the session, it sends an RST whose SEQ is equal to the SYN-ACK's ACK. It's
    possible you though the "reset_and_undo" label was used to kill the session,
    but it's not the case (although the naming is not clear). So if the remote
    end was the one which sent the SYN-ACK, it will clear its session. If it has
    been spoofed, it will ignore the RST because in turn, the SEQ will not be
    within its window.

    Try it by yourself if you don't believe me. I've done lots of tests with
    hping2 and I've never managed to kill a session with both a SEQ and ACK
    outside the windows.

    Regards,
    Willy

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-06-12 14:36    [W:3.244 / U:0.212 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site