Re: [PATCH] Fix accepting invalid RST segments

[Patrick McHardy <kaber@trash.net>]

Jozsef Kadlecsik wrote:
> Hi Patrick,
> 
> Robert L Mathews discovered that some clients send evil TCP RST segments, 
> which are accepted by netfilter conntrack but discarded by the 
> destination. Thus the conntrack entry is destroyed but the destination 
> retransmits data until timeout.
> 
> The same technique, i.e. sending properly crafted RST segments, can easily 
> be used to bypass connlimit/connbytes based restrictions (the sample 
> script written by Robert can be found in the netfilter mailing list 
> archives).
> 
> The patch below adds a new flag and new field to struct ip_ct_tcp_state so 
> that checking RST segments can be made more strict and thus TCP conntrack 
> can catch the invalid ones: the RST segment is accepted only if its 
> sequence number higher than or equal to the highest ack we seen from the 
> other direction. (The last_ack field cannot be reused because it is used 
> to catch resent packets.)


Applied, thanks.