On 2013-08-19 15:07, Jozsef Kadlecsik wrote:
> It can be fixed by fixing the middlebox, or disabling SACK by the
> TCPOPTSTRIP target, or by relaxing conntrack. For the latter, the next
> untested patch may be sufficient:
>
> diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
> index 7dcc376..8b5d783 100644
> --- a/net/netfilter/nf_conntrack_proto_tcp.c
> +++ b/net/netfilter/nf_conntrack_proto_tcp.c
> @@ -649,6 +649,11 @@ static bool tcp_in_window(const struct nf_conn *ct,
> receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
> receiver->td_scale);
>
> + /* Fall back to ACK when SACK is bogus */
> + if (!(before(sack, receiver->td_end + 1) &&
> + after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)))
> + sack = ack;
> +
> pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
> before(seq, sender->td_maxend + 1),
> after(end, sender->td_end - receiver->td_maxwin - 1),
>
> However it is good to cover the issue thus?
This didn't quite apply to my kernel tree, but I let patch apply it with
fuzz=2 and got:
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 2f80107..94b326b 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -653,6 +653,11 @@ static bool tcp_in_window(const struct nf_conn *ct,
in_recv_win = !receiver->td_maxwin ||
after(end, sender->td_end - receiver->td_maxwin - 1);
+ /* Fall back to ACK when SACK is bogus */
+ if (!(before(sack, receiver->td_end + 1) &&
+ after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)))
+ sack = ack;
+
pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
before(seq, sender->td_maxend + 1),
(in_recv_win ? 1 : 0),
I can confirm, that does indeed work! Thank you. I will continue watching
this thread for other things to test, if need be.
-Corey
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
