Re: ICMP attacks against TCP

["David S. Miller" <davem@xxxxxxxxxxxxx>]

On Sun, 12 Sep 2004 22:40:04 -0300
Fernando Gont <fernando@xxxxxxxxxxx> wrote:

> There are some other work-arounds (for example, ignoring ICMP Source Quench 
> messages) are not implemented in Linux, though.

I have no problem changing Linux to ignore these ICMP Source Quench
messages, I completely agree with the draft.  I've made the
change in both my 2.4.x and 2.6.x trees as follows:

# This is a BitKeeper generated diff -Nru style patch.
#
# ChangeSet
#   2004/09/13 15:43:14-07:00 davem@xxxxxxxxxxxxxxxxxx 
#   [TCP]: Just silently ignore ICMP Source Quench messages.
#   
#   Recommended by draft-gont-tcpm-icmp-attacks-01.txt
#   
#   Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
# 
# net/ipv4/tcp_ipv4.c
#   2004/09/13 15:42:33-07:00 davem@xxxxxxxxxxxxxxxxxx +1 -5
#   [TCP]: Just silently ignore ICMP Source Quench messages.
# 
diff -Nru a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
--- a/net/ipv4/tcp_ipv4.c       2004-09-13 15:44:01 -07:00
+++ b/net/ipv4/tcp_ipv4.c       2004-09-13 15:44:01 -07:00
@@ -1033,11 +1033,7 @@
 
        switch (type) {
        case ICMP_SOURCE_QUENCH:
-               /* This is deprecated, but if someone generated it,
-                * we have no reasons to ignore it.
-                */
-               if (!sock_owned_by_user(sk))
-                       tcp_enter_cwr(tp);
+               /* Just silently ignore these. */
                goto out;
        case ICMP_PARAMETERPROB:
                err = EPROTO;