3 ms·
I would have assumed linux conntrack to do more rigorous "tcp window checking" as an assumption, however the article also notes they received a positive respons
by lathiat 2y ago
I would have assumed linux conntrack to do more rigorous "tcp window checking" as an assumption, however the article also notes they received a positive response from OpenWRT who implemented a mitigation, so I am curious to see the details of that mitigation.
- taneliv 2y agoAs user zootboy above comments, OpenWRT removed a patch from their kernels that introduced a "no window checking" option for TCP processing,[1] which I suppose was enabled by default. [1] https://github.com/openwrt/openwrt/commit/75e78bcaab847557ce1782eb2dea9dff9a029171 https://github.com/openwrt/openwrt/commit/75e78bcaab847557ce...
- xxpor 2y agoNote that this means that conntrack's window tracking has to be perfectly in sync with both endpoints (assuming TCP invalids are dropped). Given endpoints tend to be updated more often than middleboxes, this isn't a great assumption to make.