From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
Pablo Neira Ayuso <pablo@netfilter.org>
Subject: [ 24/38] netfilter: Mark SYN/ACK packets as invalid from original direction
Date: Wed, 21 Nov 2012 16:40:07 -0800 [thread overview]
Message-ID: <20121122003906.895898987@linuxfoundation.org> (raw)
In-Reply-To: <20121122003904.262382971@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
commit 64f509ce71b08d037998e93dd51180c19b2f464c upstream.
Clients should not send such packets. By accepting them, we open
up a hole by wich ephemeral ports can be discovered in an off-path
attack.
See: "Reflection scan: an Off-Path Attack on TCP" by Jan Wrobel,
http://arxiv.org/abs/1201.2074
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_proto_tcp.c | 19 ++++++++-----------
1 file changed, 8 insertions(+), 11 deletions(-)
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -159,21 +159,18 @@ static const u8 tcp_conntracks[2][6][TCP
* sCL -> sSS
*/
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */
-/*synack*/ { sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
+/*synack*/ { sIV, sIV, sSR, sIV, sIV, sIV, sIV, sIV, sIV, sSR },
/*
* sNO -> sIV Too late and no reason to do anything
* sSS -> sIV Client can't send SYN and then SYN/ACK
* sS2 -> sSR SYN/ACK sent to SYN2 in simultaneous open
- * sSR -> sIG
- * sES -> sIG Error: SYNs in window outside the SYN_SENT state
- * are errors. Receiver will reply with RST
- * and close the connection.
- * Or we are not in sync and hold a dead connection.
- * sFW -> sIG
- * sCW -> sIG
- * sLA -> sIG
- * sTW -> sIG
- * sCL -> sIG
+ * sSR -> sSR Late retransmitted SYN/ACK in simultaneous open
+ * sES -> sIV Invalid SYN/ACK packets sent by the client
+ * sFW -> sIV
+ * sCW -> sIV
+ * sLA -> sIV
+ * sTW -> sIV
+ * sCL -> sIV
*/
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */
/*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
next prev parent reply other threads:[~2012-11-22 21:21 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20121122003904.262382971@linuxfoundation.org>
2012-11-22 0:39 ` [ 01/38] mm: bugfix: set current->reclaim_state to NULL while returning from kswapd() Greg Kroah-Hartman
2012-11-22 0:39 ` [ 02/38] PCI/PM: Fix deadlock when unbinding device if parent in D3cold Greg Kroah-Hartman
2012-11-23 2:35 ` Ben Hutchings
2012-11-23 3:09 ` Huang Ying
2012-11-23 7:47 ` Huang Ying
2012-11-30 2:01 ` Greg Kroah-Hartman
2012-11-30 2:54 ` Huang Ying
2012-12-11 8:12 ` Huang Ying
2012-12-11 18:08 ` Greg Kroah-Hartman
2012-12-14 7:08 ` Huang Ying
2012-12-14 21:56 ` Greg Kroah-Hartman
2012-11-26 18:55 ` Greg Kroah-Hartman
2012-11-26 19:08 ` Greg Kroah-Hartman
2012-11-26 19:30 ` Greg Kroah-Hartman
2012-11-27 0:28 ` Huang Ying
2012-11-22 0:39 ` [ 03/38] fanotify: fix missing break Greg Kroah-Hartman
2012-11-22 0:39 ` [ 04/38] crypto: cryptd - disable softirqs in cryptd_queue_worker to prevent data corruption Greg Kroah-Hartman
2012-11-22 0:39 ` [ 05/38] ptp: update adjfreq callback description Greg Kroah-Hartman
2012-11-24 0:26 ` Herton Ronaldo Krzesinski
2012-11-26 18:46 ` Greg Kroah-Hartman
2012-11-26 21:19 ` Keller, Jacob E
2012-11-22 0:39 ` [ 06/38] ALSA: hda: Cirrus: Fix coefficient index for beep configuration Greg Kroah-Hartman
2012-11-22 0:39 ` [ 07/38] ALSA: hda - Force to reset IEC958 status bits for AD codecs Greg Kroah-Hartman
2012-11-22 0:39 ` [ 08/38] ASoC: wm8978: pll incorrectly configured when codec is master Greg Kroah-Hartman
2012-11-22 0:39 ` [ 09/38] ASoC: dapm: Use card_list during DAPM shutdown Greg Kroah-Hartman
2012-11-22 0:39 ` [ 10/38] UBIFS: fix mounting problems after power cuts Greg Kroah-Hartman
2012-11-22 0:39 ` [ 11/38] UBIFS: introduce categorized lprops counter Greg Kroah-Hartman
2012-11-22 0:39 ` [ 12/38] s390/gup: add missing TASK_SIZE check to get_user_pages_fast() Greg Kroah-Hartman
2012-11-22 0:39 ` [ 13/38] USB: option: add Novatel E362 and Dell Wireless 5800 USB IDs Greg Kroah-Hartman
2012-11-22 0:39 ` [ 14/38] USB: option: add Alcatel X220/X500D " Greg Kroah-Hartman
2012-11-22 0:39 ` [ 15/38] wireless: allow 40 MHz on world roaming channels 12/13 Greg Kroah-Hartman
2012-11-22 0:39 ` [ 16/38] m68k: fix sigset_t accessor functions Greg Kroah-Hartman
2012-11-22 0:40 ` [ 17/38] ipv4: avoid undefined behavior in do_ip_setsockopt() Greg Kroah-Hartman
2012-11-22 0:40 ` [ 18/38] ipv6: setsockopt(IPIPPROTO_IPV6, IPV6_MINHOPCOUNT) forgot to set return value Greg Kroah-Hartman
2012-11-22 0:40 ` [ 19/38] net: correct check in dev_addr_del() Greg Kroah-Hartman
2012-11-22 0:40 ` [ 20/38] net-rps: Fix brokeness causing OOO packets Greg Kroah-Hartman
2012-11-22 0:40 ` [ 21/38] r8169: use unlimited DMA burst for TX Greg Kroah-Hartman
2012-11-22 0:40 ` [ 22/38] kbuild: Fix gcc -x syntax Greg Kroah-Hartman
2012-11-22 0:40 ` [ 23/38] netfilter: Validate the sequence number of dataless ACK packets as well Greg Kroah-Hartman
2012-11-22 0:40 ` Greg Kroah-Hartman [this message]
2012-11-22 0:40 ` [ 25/38] netfilter: nf_nat: dont check for port change on ICMP tuples Greg Kroah-Hartman
2012-11-22 0:40 ` [ 26/38] usb: use usb_serial_put in usb_serial_probe errors Greg Kroah-Hartman
2012-11-22 0:40 ` [ 27/38] eCryptfs: Copy up POSIX ACL and read-only flags from lower mount Greg Kroah-Hartman
2012-11-22 0:40 ` [ 28/38] eCryptfs: check for eCryptfs cipher support at mount Greg Kroah-Hartman
2012-11-22 0:40 ` [ 29/38] sky2: Fix for interrupt handler Greg Kroah-Hartman
2012-11-22 0:40 ` [ 30/38] drm/i915: fix overlay on i830M Greg Kroah-Hartman
2012-11-22 0:40 ` [ 31/38] NFS: Wait for session recovery to finish before returning Greg Kroah-Hartman
2012-11-22 0:40 ` [ 32/38] reiserfs: Fix lock ordering during remount Greg Kroah-Hartman
2012-11-22 0:40 ` [ 33/38] reiserfs: Protect reiserfs_quota_on() with write lock Greg Kroah-Hartman
2012-11-22 0:40 ` [ 34/38] reiserfs: Move quota calls out of " Greg Kroah-Hartman
2012-11-22 0:40 ` [ 35/38] reiserfs: Protect reiserfs_quota_write() with " Greg Kroah-Hartman
2012-11-22 0:40 ` [ 36/38] selinux: fix sel_netnode_insert() suspicious rcu dereference Greg Kroah-Hartman
2012-11-22 0:40 ` [ 37/38] PCI : ability to relocate assigned pci-resources Greg Kroah-Hartman
2012-11-23 13:29 ` Herton Ronaldo Krzesinski
[not found] ` <20121124014141.GD2752@ram.oc3035372033.ibm.com>
2012-11-26 18:53 ` Greg Kroah-Hartman
2012-11-22 0:40 ` [ 38/38] PCI : Calculate right add_size Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121122003906.895898987@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=kadlec@blackhole.kfki.hu \
--cc=linux-kernel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).