Files
linux/include/uapi/linux
Jesper Dangaard Brouer b3cad287d1 conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition
In compliance with RFC5961, the network stack send challenge ACK in
response to spurious SYN packets, since commit 0c228e833c ("tcp:
Restore RFC5961-compliant behavior for SYN packets").

This pose a problem for netfilter conntrack in state LAST_ACK, because
this challenge ACK is (falsely) seen as ACKing last FIN, causing a
false state transition (into TIME_WAIT).

The challenge ACK is hard to distinguish from real last ACK.  Thus,
solution introduce a flag that tracks the potential for seeing a
challenge ACK, in case a SYN packet is let through and current state
is LAST_ACK.

When conntrack transition LAST_ACK to TIME_WAIT happens, this flag is
used for determining if we are expecting a challenge ACK.

Scapy based reproducer script avail here:
 https://github.com/netoptimizer/network-testing/blob/master/scapy/tcp_hacks_3WHS_LAST_ACK.py

Fixes: 0c228e833c ("tcp: Restore RFC5961-compliant behavior for SYN packets")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2015-05-15 20:50:56 +02:00
..
2014-10-20 10:30:15 +08:00
2014-09-23 23:15:46 -07:00
2015-02-14 17:05:03 +00:00
2015-04-21 16:16:02 -04:00
2015-02-23 09:59:07 -06:00
2013-04-26 16:08:16 +10:00
2014-07-01 10:48:05 -06:00
2014-03-20 14:55:18 +01:00
2015-03-06 21:50:02 -05:00
2014-11-19 14:48:02 -06:00
2014-12-08 12:55:57 +08:00
2012-10-16 18:49:15 -07:00
2014-08-08 15:57:31 -07:00
2015-04-12 21:25:13 -04:00
2014-05-14 10:04:34 +01:00
2013-12-11 12:57:55 -08:00
2013-08-13 15:10:22 -07:00
2014-12-16 11:19:42 -05:00
2014-12-22 16:12:36 -05:00
2015-01-05 22:44:46 -05:00
2015-02-09 16:59:03 +09:00
2014-12-02 13:52:53 -07:00
2015-02-17 14:34:51 -08:00
2015-02-03 12:48:40 -05:00
2014-08-08 15:57:31 -07:00
2013-11-27 11:03:38 -08:00
2014-03-04 13:51:06 -05:00
2015-01-20 13:51:06 +01:00
2014-12-13 12:42:52 -08:00
2013-02-27 19:10:22 -08:00
2015-02-02 18:46:51 -08:00
2013-04-19 14:57:57 -04:00
2015-04-23 15:16:14 -04:00
2012-11-16 10:15:35 -08:00
2014-03-21 14:21:13 -04:00
2015-04-07 17:29:41 -04:00
2015-02-07 18:43:16 +08:00
2014-12-10 17:41:10 -08:00
2014-12-09 14:10:41 +08:00
2013-03-22 16:19:59 -07:00
2015-03-05 22:08:42 -05:00
2014-04-26 12:13:24 -04:00
2013-05-02 13:40:15 +03:00
2015-03-29 12:13:52 +10:30
2015-03-29 12:13:52 +10:30
2014-12-09 12:05:24 +02:00
2013-12-11 09:25:20 -02:00
2015-03-31 13:58:35 -04:00