diff options
author | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2009-05-25 17:23:15 +0200 |
---|---|---|
committer | Patrick McHardy <kaber@trash.net> | 2009-05-25 17:23:15 +0200 |
commit | bfcaa50270e18f35220a11d46e98fc6232c24606 (patch) | |
tree | dd06bf91db9aff84adf442b6c8aa6be58c923ec0 /include/linux | |
parent | fecc1133b66af6e0cd49115a248f34bbb01f180a (diff) | |
download | kernel_goldelico_gta04-bfcaa50270e18f35220a11d46e98fc6232c24606.zip kernel_goldelico_gta04-bfcaa50270e18f35220a11d46e98fc6232c24606.tar.gz kernel_goldelico_gta04-bfcaa50270e18f35220a11d46e98fc6232c24606.tar.bz2 |
netfilter: nf_ct_tcp: fix accepting invalid RST segments
Robert L Mathews discovered that some clients send evil TCP RST segments,
which are accepted by netfilter conntrack but discarded by the
destination. Thus the conntrack entry is destroyed but the destination
retransmits data until timeout.
The same technique, i.e. sending properly crafted RST segments, can easily
be used to bypass connlimit/connbytes based restrictions (the sample
script written by Robert can be found in the netfilter mailing list
archives).
The patch below adds a new flag and new field to struct ip_ct_tcp_state so
that checking RST segments can be made more strict and thus TCP conntrack
can catch the invalid ones: the RST segment is accepted only if its
sequence number higher than or equal to the highest ack we seen from the
other direction. (The last_ack field cannot be reused because it is used
to catch resent packets.)
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'include/linux')
-rw-r--r-- | include/linux/netfilter/nf_conntrack_tcp.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/include/linux/netfilter/nf_conntrack_tcp.h b/include/linux/netfilter/nf_conntrack_tcp.h index 3066789..b2f384d 100644 --- a/include/linux/netfilter/nf_conntrack_tcp.h +++ b/include/linux/netfilter/nf_conntrack_tcp.h @@ -35,6 +35,9 @@ enum tcp_conntrack { /* Has unacknowledged data */ #define IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED 0x10 +/* The field td_maxack has been set */ +#define IP_CT_TCP_FLAG_MAXACK_SET 0x20 + struct nf_ct_tcp_flags { __u8 flags; __u8 mask; @@ -46,6 +49,7 @@ struct ip_ct_tcp_state { u_int32_t td_end; /* max of seq + len */ u_int32_t td_maxend; /* max of ack + max(win, 1) */ u_int32_t td_maxwin; /* max(win) */ + u_int32_t td_maxack; /* max of ack */ u_int8_t td_scale; /* window scale factor */ u_int8_t flags; /* per direction options */ }; |