Re: SYN attack, with FIN flag set

[Michael Tokarev <mjt@tls.msk.ru>]

On 03.12.2011 12:53, Eric Dumazet wrote:
[]
> TCP stack first tries to lookup a socket, given the tuple found in
> incoming packet.
> 
> This is where your machine is hit : we find the listener socket and lock
> it.
> 
> Then, once socket was found and locked, state machine handle various
> possible states.
> 
> In your case, you want to bypass the lookup, and eventually bypass the
> IP route lookup as well (to keep IP route cache small)
> 
> iptables -t raw -I PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

Maybe it makes some sence to add a basic "sanity" check rule
before the socket lookup?

The question here is why SYN+FIN results in worse behavour than
SYN alone - in the default setup, without iptables rules?  As
far as I understand, "regular" SYN attack is handled just fine,
but SYN+FIN attack makes the machine to "choke", and it is not
obvious how to fix it -- naive --syn iptables rule does not help.

The price for the sanity check appears to be small since there's
already a check for RST.

Just asking, not suggesting anything... ;)

Thanks,

/mjt