Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 72d4d3e3 authored Apr 21, 2018 by Jozsef Kadlecsik Committed by Pablo Neira Ayuso Apr 27, 2018

netfilter: Fix handling simultaneous open in TCP conntrack

Dominique Martinet reported a TCP hang problem when simultaneous open was used.
The problem is that the tcp_conntracks state table is not smart enough
to handle the case. The state table could be fixed by introducing a new state,
but that would require more lines of code compared to this patch, due to the
required backward compatibility with ctnetlink.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Reported-by: Dominique Martinet <asmadeus@codewreck.org>
Tested-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 25eb0ea7

include/uapi/linux/netfilter/nf_conntrack_tcp.h

+3 −0

Original line number	Diff line number	Diff line
		@@ -46,6 +46,9 @@ enum tcp_conntrack {
		/* Marks possibility for expected RFC5961 challenge ACK */
		#define IP_CT_EXP_CHALLENGE_ACK 0x40

		/* Simultaneous open initialized */
		#define IP_CT_TCP_SIMULTANEOUS_OPEN 0x80

		struct nf_ct_tcp_flags {
		__u8 flags;
		__u8 mask;

net/netfilter/nf_conntrack_proto_tcp.c

+11 −0

Original line number	Diff line number	Diff line
		@@ -981,6 +981,17 @@ static int tcp_packet(struct nf_conn *ct,
		return NF_ACCEPT; /* Don't change state */
		}
		break;
		case TCP_CONNTRACK_SYN_SENT2:
		/* tcp_conntracks table is not smart enough to handle
		* simultaneous open.
		*/
		ct->proto.tcp.last_flags \|= IP_CT_TCP_SIMULTANEOUS_OPEN;
		break;
		case TCP_CONNTRACK_SYN_RECV:
		if (dir == IP_CT_DIR_REPLY && index == TCP_ACK_SET &&
		ct->proto.tcp.last_flags & IP_CT_TCP_SIMULTANEOUS_OPEN)
		new_state = TCP_CONNTRACK_ESTABLISHED;
		break;
		case TCP_CONNTRACK_CLOSE:
		if (index == TCP_RST_SET
		&& (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)