Subject: Re: [PATCH] netfilter: conntrack: tcp: do not lower timeout to CLOSE for in-window RSTs

From: Florian Westphal <[email-masked]>
Date: Sat, 6 Jul 2024 19:04:32 +0200

Jozsef Kadlecsik <[email-masked]> wrote:
> I fully agree with Florian: conntrack plays the role of a middle box and 
> cannot absolutely know the right seq/ack numbers of the client/server 
> sides. Add NAT on top of that and there are a couple of ways to attack a 
> given traffic. I don't see a way by which the checkings/parameters could 
> be tightened without blocking real traffic.

I forgot about TCP timestamps, which we do not track at the moment.

But then there is a slight caveat: if one side exits, RST won't
carry timestamp option, so even keeping track of timestamps will help
:-(