Hacker News Reader

I would have assumed linux conntrack to do more rigorous "tcp window checking" as an assumption, however the article also notes they received a positive response from OpenWRT who implemented a mitigation, so I am curious to see the details of that mitigation.

View on HN

As user zootboy above comments, OpenWRT removed a patch from their kernels that introduced a "no window checking" option for TCP processing,[1] which I suppose was enabled by default.

[1] https://github.com/openwrt/openwrt/commit/75e78bcaab847557ce...

Note that this means that conntrack's window tracking has to be perfectly in sync with both endpoints (assuming TCP invalids are dropped). Given endpoints tend to be updated more often than middleboxes, this isn't a great assumption to make.

Reply on news.ycombinator.com