Fixing "Slipping in the window" before 4.11-release

[Mike Silbersack]

On Mon, 3 Jan 2005, Don Lewis wrote:

> That's pretty much what previous versions of the draft suggested. The
> earlier versions made some suggestions about how to deal with the corner
> case by adjusting the sequence number in ACK, but these schemes added a
> bunch of complexity and had some fatal flaws.
>
> I believe that sending the ACK challenge is the Cisco IPR claim.

The goofy special cases in the previous draft could have potentially been 
unique.  In the current draft, however, their description of the ACK 
challenge to an incoming SYN follows RFC 793 Figure 10 (page 34) exactly. 
I think we're safe here.

>> Sounds like that's the way to go, with the addition of rate limiting those
>> ACKs.
>
> I'm not sure that it makes sense to rate limit the ACKs in this special
> case.  If an attacker has enough information to trigger an ACK response
> flood from the hardened stack, he could still produce a flood by turning
> off the SYN bit.  A general way of rate limiting ACKs triggered by the
> reception of out of window data could be a good idea, but this would
> have to be done very carefully to avoid breaking the algorithms that
> look at ACKs to sense network congestion.

I probably agree here... but I want to just fix this one problem for 4.11, 
and I don't want to touch the rest of the TCP stack whatsoever.  If 
integrating this case with others in rate limiting makes sense, we could 
do that in 6.x and 5.x, but I don't want to risk breaking 4.x by rewriting 
dropafterack at this point in time.

> I was going to suggest just doing a
> 	goto dropafterack;
> but there's a lot of code in tcp_output() that might unnecessarily
> perturb things.  I think you can get away without creating a template
> for this.  Take a look at the code under the dropwithreset label.

Hm, tcp_respond does look like a good candidate...

BTW, that tcp template code should probably have been removed years ago, 
it's only used by keepalives now.  I just haven't gotten around to 
replacing it.

Mike "Silby" Silbersack