| Message ID | 20240131225943.7536-2-pablo@netfilter.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | fb366fc7541a1de521ab3df58471746aa793b833 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/6] netfilter: conntrack: correct window scaling with retransmitted SYN | expand |
Hello: This series was applied to netdev/net.git (main) by Pablo Neira Ayuso <pablo@netfilter.org>: On Wed, 31 Jan 2024 23:59:38 +0100 you wrote: > From: Ryan Schaefer <ryanschf@amazon.com> > > commit c7aab4f17021 ("netfilter: nf_conntrack_tcp: re-init for syn packets > only") introduces a bug where SYNs in ORIGINAL direction on reused 5-tuple > result in incorrect window scale negotiation. This commit merged the SYN > re-initialization and simultaneous open or SYN retransmits cases. Merging > this block added the logic in tcp_init_sender() that performed window scale > negotiation to the retransmitted syn case. Previously. this would only > result in updating the sender's scale and flags. After the merge the > additional logic results in improperly clearing the scale in ORIGINAL > direction before any packets in the REPLY direction are received. This > results in packets incorrectly being marked invalid for being > out-of-window. > > [...] Here is the summary with links: - [net,1/6] netfilter: conntrack: correct window scaling with retransmitted SYN https://git.kernel.org/netdev/net/c/fb366fc7541a - [net,2/6] netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV https://git.kernel.org/netdev/net/c/776d45164844 - [net,3/6] netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new https://git.kernel.org/netdev/net/c/6e348067ee4b - [net,4/6] netfilter: ipset: fix performance regression in swap operation https://git.kernel.org/netdev/net/c/97f7cf1cd80e - [net,5/6] netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger https://git.kernel.org/netdev/net/c/259eb32971e9 - [net,6/6] netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations https://git.kernel.org/netdev/net/c/8059918a1377 You are awesome, thank you!
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c index e573be5afde7..ae493599a3ef 100644 --- a/net/netfilter/nf_conntrack_proto_tcp.c +++ b/net/netfilter/nf_conntrack_proto_tcp.c @@ -457,7 +457,8 @@ static void tcp_init_sender(struct ip_ct_tcp_state *sender, const struct sk_buff *skb, unsigned int dataoff, const struct tcphdr *tcph, - u32 end, u32 win) + u32 end, u32 win, + enum ip_conntrack_dir dir) { /* SYN-ACK in reply to a SYN * or SYN from reply direction in simultaneous open. @@ -471,7 +472,8 @@ static void tcp_init_sender(struct ip_ct_tcp_state *sender, * Both sides must send the Window Scale option * to enable window scaling in either direction. */ - if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE && + if (dir == IP_CT_DIR_REPLY && + !(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE)) { sender->td_scale = 0; receiver->td_scale = 0; @@ -542,7 +544,7 @@ tcp_in_window(struct nf_conn *ct, enum ip_conntrack_dir dir, if (tcph->syn) { tcp_init_sender(sender, receiver, skb, dataoff, tcph, - end, win); + end, win, dir); if (!tcph->ack) /* Simultaneous open */ return NFCT_TCP_ACCEPT; @@ -585,7 +587,7 @@ tcp_in_window(struct nf_conn *ct, enum ip_conntrack_dir dir, */ tcp_init_sender(sender, receiver, skb, dataoff, tcph, - end, win); + end, win, dir); if (dir == IP_CT_DIR_REPLY && !tcph->ack) return NFCT_TCP_ACCEPT;