Re: TCP Connection tracking and SYN/ACK/PSH

[Phil Oester <kernel@linuxace.com>]

On Mon, Apr 18, 2005 at 03:34:41AM +0200, Henrik Nordstrom wrote:
> Just a small note to support this: SYN+ACK+PSH is a perfectly valid flags 
> combination, even more so if there actually is data enclosed in the 
> SYN+ACK (which is valid, only a little odd).
> 
> There is not really any good reason why conntrack should care in detail 
> about the PSH flag. Most if not all valid flag combinations are good both 
> with and without PSH (even SYN).

Given that nmap's Xmas tree scan uses an invalid PSH flag combination to scan
for open ports, I'd suggest conntrack should care about the flag.

While the particular combination being seen here is likely always harmless,
perhaps netfilter should only allow RFC-defined handshakes as a general
rule.

Phil