From: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
To: Luca Pesce <pesce.luca@gmail.com>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: xt_TCPMSS target dropping SYN packets with data: suggested mod
Date: Fri, 17 Jul 2009 11:46:06 +0200 [thread overview]
Message-ID: <4A60485E.6010503@plouf.fr.eu.org> (raw)
In-Reply-To: <873dce860907170044v45353d01sd5f0c5305e9ffdb8@mail.gmail.com>
Luca Pesce a écrit :
>
> Ok, so if the receiver is using syn cookies, the data in the SYN would
> be discarded, and that is fine.
Actually I don't know whether the data are discared or the whole SYN
packet is. My feeling is that the receiver should not ACK a discarded
segment, so the whole SYN packet should be discarded, maybe rejected
with a RST.
> But the current implementation of TCPMSS target is dropping the
> whole syn packet (if it is carrying any payload), so the receiver is
> not receiving the syn
I think this behaviour is wrong. As a general rule, I think that
matches, targets or conntrack should not drop packets implicitly. If a
target cannot handle the packet, just leave it unmodified (and possibly
log a warning).
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
prev parent reply other threads:[~2009-07-17 9:46 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-07-09 13:41 xt_TCPMSS target dropping SYN packets with data: suggested mod Luca Pesce
2009-07-15 15:38 ` Patrick McHardy
2009-07-16 7:15 ` Luca Pesce
2009-07-16 11:17 ` Pascal Hambourg
2009-07-17 7:44 ` Luca Pesce
2009-07-17 9:46 ` Pascal Hambourg [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4A60485E.6010503@plouf.fr.eu.org \
--to=pascal.mail@plouf.fr.eu.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pesce.luca@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).