Re: [PATCH] add a sysctl to disable TCP simultaneous connection opening

[Willy Tarreau <w@1wt.eu>]

On Fri, Oct 10, 2008 at 10:59:25AM +0300, Rémi Denis-Courmont wrote:
> On Friday 10 October 2008 00:42:24 ext Willy Tarreau, you wrote:
> > On Thu, Oct 09, 2008 at 07:21:03PM +0300, Rémi Denis-Courmont wrote:
> > > Le mercredi 8 octobre 2008 14:54:02 Stephen Hemminger, vous avez écrit :
> > > > Does this break NAT traversal via STUNT used by applications like
> > > > Skype?
> > >
> > > This will break the main ICE-TCP mechanism (IETF
> > > draft-ietf-mmusic-ice-tcp). I am not aware of any application using this
> > > _as_of_now_. Probably too many NAT and firewall implementations will
> > > reject it already. And then, some TCP stacks reportedly do not support it
> > > (e.g. Windows before Vista).
> >
> > And opening this through firewalls would be too much dangerous as it would
> > allow servers to reconnect outside, pretty much defeating the initial
> > purpose of the firewall.
> 
> Duh? If you require a SYN from the outside to the server, before you allow the 
> server to send either SYN or SYN/ACK, I fail to see the problem.

Requiring the firewall to expect a first SYN to come from the internet is like
doing no check at all. When your server has been rooted, you can pretty much
expect that your guest has no problem sending you a SYN.

Willy