[tor-relays] TCP SACK PANIC type kernel vulnerabilities: logging some packets

[tor@xxxxxxx]

As of last week there wasn't a new kernel out for our relay's distro, 
so I implemented an IPTables-based mitigation in our relay as such:

-A INPUT -p tcp --tcp-flags SYN SYN -m tcpmss --mss 1:500 -j LOG 
--log-prefix "TCP_SACK_PANIC: "
-A INPUT -p tcp --tcp-flags SYN SYN -m tcpmss --mss 1:500 -j DROP

Over the weekend we logged hits to this rule. I checked a few of the 
source hosts, and they were not relays at least as they are listed in 
https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1 .

I'll pull the rule out once the kernel is patched, but yeah. Things 
that make you go hmm.



_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays