Re: conntrack and RSTs received during CLOSE_WAIT

[Robert L Mathews <lists@tigertech.com>]

I haven't received any more followups on this, so I'll try to hack some 
solution around the problem.

But I will mention that I'm surprised that this didn't generate more 
discussion. Unless I'm confused (which is possible), sending 
out-of-sequence RST packets appears to be a trivial way to bypass connlimit.

It seems that all an attacker needs to do is send invalid RST packets 
with a sequence number one less than the last ACK received from the 
server. Then conntrack will forget about the connection, allowing the 
attacker to open as many connections as desired, regardless of connlimit 
limits.

I wrote a little perl script that I can leave running in the background 
on the client to send the necessary RST packets. In my testing, it does 
allow me to bypass connlimit restrictions on a server:

  http://www.tigertech.net/patches/rawip.pl

This seems to make connlimit less useful than I'd previously believed. 
Am I just misunderstanding something?

-- 
Robert L Mathews, Tiger Technologies     http://www.tigertech.net/