lkml.org 
[lkml]   [2022]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 180/338] netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
    Date
    From: Pablo Neira Ayuso <pablo@netfilter.org>

    [ Upstream commit f2dd495a8d589371289981d5ed33e6873df94ecc ]

    Do not reset IP_CT_TCP_FLAG_BE_LIBERAL flag in out-of-sync scenarios
    coming before the TCP window tracking, otherwise such connections will
    fail in the window check.

    Update tcp_options() to leave this flag in place and add a new helper
    function to reset the tcp window state.

    Based on patch from Sven Auhagen.

    Fixes: c4832c7bbc3f ("netfilter: nf_ct_tcp: improve out-of-sync situation in TCP tracking")
    Tested-by: Sven Auhagen <sven.auhagen@voleatech.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nf_conntrack_proto_tcp.c | 17 +++++++++++++----
    1 file changed, 13 insertions(+), 4 deletions(-)

    diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
    index 40f8a1252394..66cda5e2d6b9 100644
    --- a/net/netfilter/nf_conntrack_proto_tcp.c
    +++ b/net/netfilter/nf_conntrack_proto_tcp.c
    @@ -362,8 +362,8 @@ static void tcp_options(const struct sk_buff *skb,
    length, buff);
    BUG_ON(ptr == NULL);

    - state->td_scale =
    - state->flags = 0;
    + state->td_scale = 0;
    + state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;

    while (length > 0) {
    int opcode=*ptr++;
    @@ -784,6 +784,16 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct)
    test_bit(IPS_ASSURED_BIT, &ct->status);
    }

    +static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state)
    +{
    + state->td_end = 0;
    + state->td_maxend = 0;
    + state->td_maxwin = 0;
    + state->td_maxack = 0;
    + state->td_scale = 0;
    + state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;
    +}
    +
    /* Returns verdict for packet, or -1 for invalid. */
    static int tcp_packet(struct nf_conn *ct,
    const struct sk_buff *skb,
    @@ -882,8 +892,7 @@ static int tcp_packet(struct nf_conn *ct,
    ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
    ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
    ct->proto.tcp.last_flags;
    - memset(&ct->proto.tcp.seen[dir], 0,
    - sizeof(struct ip_ct_tcp_state));
    + nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]);
    break;
    }
    ct->proto.tcp.last_index = index;
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-04-14 16:06    [W:4.102 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site