mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 21:57:43 +00:00
netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
[ Upstream commitf2dd495a8d
] Do not reset IP_CT_TCP_FLAG_BE_LIBERAL flag in out-of-sync scenarios coming before the TCP window tracking, otherwise such connections will fail in the window check. Update tcp_options() to leave this flag in place and add a new helper function to reset the tcp window state. Based on patch from Sven Auhagen. Fixes:c4832c7bbc
("netfilter: nf_ct_tcp: improve out-of-sync situation in TCP tracking") Tested-by: Sven Auhagen <sven.auhagen@voleatech.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
cec71a718c
commit
806ef544cf
1 changed files with 13 additions and 4 deletions
|
@ -354,8 +354,8 @@ static void tcp_options(const struct sk_buff *skb,
|
||||||
length, buff);
|
length, buff);
|
||||||
BUG_ON(ptr == NULL);
|
BUG_ON(ptr == NULL);
|
||||||
|
|
||||||
state->td_scale =
|
state->td_scale = 0;
|
||||||
state->flags = 0;
|
state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;
|
||||||
|
|
||||||
while (length > 0) {
|
while (length > 0) {
|
||||||
int opcode=*ptr++;
|
int opcode=*ptr++;
|
||||||
|
@ -840,6 +840,16 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct)
|
||||||
test_bit(IPS_ASSURED_BIT, &ct->status);
|
test_bit(IPS_ASSURED_BIT, &ct->status);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state)
|
||||||
|
{
|
||||||
|
state->td_end = 0;
|
||||||
|
state->td_maxend = 0;
|
||||||
|
state->td_maxwin = 0;
|
||||||
|
state->td_maxack = 0;
|
||||||
|
state->td_scale = 0;
|
||||||
|
state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;
|
||||||
|
}
|
||||||
|
|
||||||
/* Returns verdict for packet, or -1 for invalid. */
|
/* Returns verdict for packet, or -1 for invalid. */
|
||||||
int nf_conntrack_tcp_packet(struct nf_conn *ct,
|
int nf_conntrack_tcp_packet(struct nf_conn *ct,
|
||||||
struct sk_buff *skb,
|
struct sk_buff *skb,
|
||||||
|
@ -946,8 +956,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
|
||||||
ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
|
ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
|
||||||
ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
|
ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
|
||||||
ct->proto.tcp.last_flags;
|
ct->proto.tcp.last_flags;
|
||||||
memset(&ct->proto.tcp.seen[dir], 0,
|
nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]);
|
||||||
sizeof(struct ip_ct_tcp_state));
|
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
ct->proto.tcp.last_index = index;
|
ct->proto.tcp.last_index = index;
|
||||||
|
|
Loading…
Reference in a new issue