* Willy Tarreau <[email protected]> 2005-06-12 15:36 > > The RST packet is sent by client A using its sequence numbers. Therefore > > it will pass the sequence number check on server B. > > > > 4) server B resets the connection. > > No, precisely the RST sent by A will take its SEQ from C's ACK number. > This is why B will *not* reset the connection (again, tested) if C's ACK > was not within B's window. Absolutely but it relies on the other stack being correctly implemented. The attack would work perfectly fine if there wasn't the rule that a RST must not be sent in response to another RST. The attack has been successful and still is because some firewalls are configured to send RSTs without respecting this rule. I like your patch and the idea behind it, it can successfully defeat the most simple method of preventing connections being established. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
- Follow-Ups:
- References:
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Herbert Xu <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Willy Tarreau <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Herbert Xu <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Willy Tarreau <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Herbert Xu <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Willy Tarreau <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Herbert Xu <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Willy Tarreau <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Herbert Xu <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Willy Tarreau <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- Prev by Date: Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- Next by Date: Re: [PATCH] ipt_recent fixes
- Previous by thread: Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- Next by thread: Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- Index(es):