netdev - Re: [PATCH nf] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20150515190633.GA11015@salvia>
Date:	Fri, 15 May 2015 21:06:33 +0200
From:	Pablo Neira Ayuso <pablo@...filter.org>
To:	Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>
Cc:	Jesper Dangaard Brouer <brouer@...hat.com>, netdev@...r.kernel.org,
	netfilter-devel@...r.kernel.org
Subject: Re: [PATCH nf] conntrack: RFC5961 challenge ACK confuse conntrack
 LAST-ACK transition

On Mon, May 11, 2015 at 12:02:17PM +0200, Jozsef Kadlecsik wrote:
> Hi,
> 
> On Thu, 7 May 2015, Jesper Dangaard Brouer wrote:
> 
> > In compliance with RFC5961, the network stack send challenge ACK in
> > response to spurious SYN packets, since commit 0c228e833c88 ("tcp:
> > Restore RFC5961-compliant behavior for SYN packets").
> > 
> > This pose a problem for netfilter conntrack in state LAST_ACK, because
> > this challenge ACK is (falsely) seen as ACKing last FIN, causing a
> > false state transition (into TIME_WAIT).
> > 
> > The challenge ACK is hard to distinguish from real last ACK.  Thus,
> > solution introduce a flag that tracks the potential for seeing a
> > challenge ACK, in case a SYN packet is let through and current state
> > is LAST_ACK.
> > 
> > When conntrack transition LAST_ACK to TIME_WAIT happens, this flag is
> > used for determining if we are expecting a challenge ACK.
> > 
> > Scapy based reproducer script avail here:
> >  https://github.com/netoptimizer/network-testing/blob/master/scapy/tcp_hacks_3WHS_LAST_ACK.py
> > 
> > Fixes: 0c228e833c88 ("tcp: Restore RFC5961-compliant behavior for SYN packets")
> > Signed-off-by: Jesper Dangaard Brouer <brouer@...hat.com>
> 
> The patch looks OK to me, thanks Jesper.
> 
> Acked-by: Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>

Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html