On Wed, 2015-11-18 at 18:35 +0100, Hannes Frederic Sowa wrote: > On Wed, Nov 18, 2015, at 18:28, Eric Dumazet wrote: > > On Wed, 2015-11-18 at 16:54 +0100, Hannes Frederic Sowa wrote: > > > > > Still, the RST packet can be dropped along the way. So the teardown of > > > the socket on the other side might not happen. > > > > This is why it is better to send RST for every incoming in-excess packet > > I agree it would be better to send a RST than ACK incoming data. Just > thinking out loud, would it make sense to add a sub-state to timewait so > we RST all other packets for TIMEWAIT_LEN duration?
Intuitively this timewait creation looks dangerous to me, maybe from an attack surface perspective. An out of sequence packet sends an advisory RST packet, which is already a hint for building some kinds of attacks. Now if we also create a timewait socket, and its associated timer, we also add quite a risk of memory and cpu consumption. So I am fine you create a timewait, only if you can prove there is no change in security. Thanks ! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
