leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: Mark SYN/ACK packets as invalid from original direction

Browse Source 
Clients should not send such packets. By accepting them, we open
up a hole by wich ephemeral ports can be discovered in an off-path
attack.

See: "Reflection scan: an Off-Path Attack on TCP" by Jan Wrobel,
http://arxiv.org/abs/1201.2074

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Jozsef Kadlecsik 2012-08-31 09:55:53 +00:00 committed by Pablo Neira Ayuso
parent 0626af3139
commit 64f509ce71
1 changed files with 8 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
net/netfilter/nf_conntrack_proto_tcp.c
View File

@ -158,21 +158,18 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
* sCL -> sSS * sCL -> sSS
*/ */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */
/*synack*/ { sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR }, /*synack*/ { sIV, sIV, sSR, sIV, sIV, sIV, sIV, sIV, sIV, sSR },
/* /*
* sNO -> sIV Too late and no reason to do anything * sNO -> sIV Too late and no reason to do anything
* sSS -> sIV Client can't send SYN and then SYN/ACK * sSS -> sIV Client can't send SYN and then SYN/ACK
* sS2 -> sSR SYN/ACK sent to SYN2 in simultaneous open * sS2 -> sSR SYN/ACK sent to SYN2 in simultaneous open
* sSR -> sIG * sSR -> sSR Late retransmitted SYN/ACK in simultaneous open
* sES -> sIG Error: SYNs in window outside the SYN_SENT state * sES -> sIV Invalid SYN/ACK packets sent by the client
* are errors. Receiver will reply with RST * sFW -> sIV
* and close the connection. * sCW -> sIV
* Or we are not in sync and hold a dead connection. * sLA -> sIV
* sFW -> sIG * sTW -> sIV
* sCW -> sIG * sCL -> sIV
* sLA -> sIG
* sTW -> sIG
* sCL -> sIG
*/ */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */
/*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV }, /*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },