On Tue, May 25, 2010 at 8:17 PM, Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxxxxxx> wrote: > Hi, > > On Tue, 25 May 2010, Changli Gao wrote: > >> iptables target SYNPROXY. >> >> This patch implements an iptables target SYNPROXY, which works in the raw table >> of the PREROUTING chain, before conntracking system. Syncookies is used, so no >> new state is introduced into the conntracking system. In fact, until the first >> connection is established, conntracking system doesn't see any packets. So when >> there is a SYN-flood attack, conntracking system won't be busy on finding and >> deleting the un-assured ct. > > My main problem with your target is that by using it, important and useful > TCP options are lost: timestamp and SACK. That pushes back TCP by almost > twenty years. Yea. Only MSS option is supported. But it is better than being DoSed. And you can set a threshold for SYNPROXY with limit match, then there isn't any difference if there isn't any SYN-flood attack. > > Here you reason for the target that it protects conntrack itself, but in > the Kconfig text you write that it protects the servers behind the > firewall. Both can be true, but if the real goal is to defend the servers > then your target could simply send a faked ACK to complete the three way > handshake and that way TCP would not be crippled (conntrack timeout > should still be adjusted). > Yes, both can be true. You descried above is called SYNDefender by Checkpoint, and it doesn't work as well as SYNPROXY. http://www.usenix.org/events/sec01/invitedtalks/oliver.pdf -- Regards， Changli Gao(xiaosuo@xxxxxxxxx) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
