Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d0fe50c authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

ipv6: tcp: fix tcp_v6_conn_request() 



Since linux 2.6.26 (commit c6aefafb : Add IPv6 support to TCP SYN
cookies), we can drop a SYN packet reusing a TIME_WAIT socket.

(As a matter of fact we fail to send the SYNACK answer)

As the client resends its SYN packet after a one second timeout, we
accept it, because first packet removed the TIME_WAIT socket before
being dropped.

This probably explains why nobody ever noticed or complained.

Reported-by: default avatarJesse Young <jlyo@jlyo.org>
Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 15ac2b08

net/ipv6/tcp_ipv6.c

+7 −6
Original line number Diff line number Diff line
@@ -1255,6 +1255,13 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb) 
	if (!want_cookie || tmp_opt.tstamp_ok)

		TCP_ECN_create_request(req, tcp_hdr(skb));



	treq->iif = sk->sk_bound_dev_if;



	/* So that link locals have meaning */

	if (!sk->sk_bound_dev_if &&

	    ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)

		treq->iif = inet6_iif(skb);



	if (!isn) {

		struct inet_peer *peer = NULL;
@@ -1264,12 +1271,6 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb) 
			atomic_inc(&skb->users);

			treq->pktopts = skb;

		}

		treq->iif = sk->sk_bound_dev_if;



		/* So that link locals have meaning */

		if (!sk->sk_bound_dev_if &&

		    ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)

			treq->iif = inet6_iif(skb);



		if (want_cookie) {

			isn = cookie_v6_init_sequence(sk, skb, &req->mss);