lkml.org 
[lkml]   [2007]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 16/23] NETFILTER: nf_conntrack_tcp: fix connection reopening

    -stable review patch. If anyone has any objections, please let us know.

    ------------------


    From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>

    Upstream commits: 17311393 + bc34b841 merged together. Merge done by
    Patrick McHardy <kaber@trash.net>

    [NETFILTER]: nf_conntrack_tcp: fix connection reopening

    With your description I could reproduce the bug and actually you were
    completely right: the code above is incorrect. Somehow I was able to
    misread RFC1122 and mixed the roles :-(:

    When a connection is >>closed actively<<, it MUST linger in
    TIME-WAIT state for a time 2xMSL (Maximum Segment Lifetime).
    However, it MAY >>accept<< a new SYN from the remote TCP to
    reopen the connection directly from TIME-WAIT state, if it:
    [...]

    The fix is as follows: if the receiver initiated an active close, then the
    sender may reopen the connection - otherwise try to figure out if we hold
    a dead connection.

    Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    Tested-by: Krzysztof Piotr Oledzki <ole@ans.pl>
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


    ---
    net/netfilter/nf_conntrack_proto_tcp.c | 38 ++++++++++++++-------------------
    1 file changed, 17 insertions(+), 21 deletions(-)

    --- a/net/netfilter/nf_conntrack_proto_tcp.c
    +++ b/net/netfilter/nf_conntrack_proto_tcp.c
    @@ -831,6 +831,22 @@ static int tcp_packet(struct nf_conn *co
    tuple = &conntrack->tuplehash[dir].tuple;

    switch (new_state) {
    + case TCP_CONNTRACK_SYN_SENT:
    + if (old_state < TCP_CONNTRACK_TIME_WAIT)
    + break;
    + if ((conntrack->proto.tcp.seen[!dir].flags &
    + IP_CT_TCP_FLAG_CLOSE_INIT)
    + || (conntrack->proto.tcp.last_dir == dir
    + && conntrack->proto.tcp.last_index == TCP_RST_SET)) {
    + /* Attempt to reopen a closed/aborted connection.
    + * Delete this connection and look up again. */
    + write_unlock_bh(&tcp_lock);
    + if (del_timer(&conntrack->timeout))
    + conntrack->timeout.function((unsigned long)
    + conntrack);
    + return -NF_REPEAT;
    + }
    + /* Fall through */
    case TCP_CONNTRACK_IGNORE:
    /* Ignored packets:
    *
    @@ -879,27 +895,6 @@ static int tcp_packet(struct nf_conn *co
    nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
    "nf_ct_tcp: invalid state ");
    return -NF_ACCEPT;
    - case TCP_CONNTRACK_SYN_SENT:
    - if (old_state < TCP_CONNTRACK_TIME_WAIT)
    - break;
    - if ((conntrack->proto.tcp.seen[dir].flags &
    - IP_CT_TCP_FLAG_CLOSE_INIT)
    - || after(ntohl(th->seq),
    - conntrack->proto.tcp.seen[dir].td_end)) {
    - /* Attempt to reopen a closed connection.
    - * Delete this connection and look up again. */
    - write_unlock_bh(&tcp_lock);
    - if (del_timer(&conntrack->timeout))
    - conntrack->timeout.function((unsigned long)
    - conntrack);
    - return -NF_REPEAT;
    - } else {
    - write_unlock_bh(&tcp_lock);
    - if (LOG_INVALID(IPPROTO_TCP))
    - nf_log_packet(pf, 0, skb, NULL, NULL,
    - NULL, "nf_ct_tcp: invalid SYN");
    - return -NF_ACCEPT;
    - }
    case TCP_CONNTRACK_CLOSE:
    if (index == TCP_RST_SET
    && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
    @@ -932,6 +927,7 @@ static int tcp_packet(struct nf_conn *co
    in_window:
    /* From now on we have got in-window packets */
    conntrack->proto.tcp.last_index = index;
    + conntrack->proto.tcp.last_dir = dir;

    pr_debug("tcp_conntracks: ");
    NF_CT_DUMP_TUPLE(tuple);
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-11-15 07:35    [W:7.392 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site