Re: 3-way handshake sets conntrack timeout to max_retrans

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 2019-07-11, Florian Westphal wrote:

Can you try this fix?

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -472,6 +472,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
	struct ip_ct_tcp_state *receiver = &state->seen[!dir];
	const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
	__u32 seq, ack, sack, end, win, swin;
+	u16 win_raw;
	s32 receiver_offset;
	bool res, in_recv_win;

@@ -480,7 +481,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
	 */
	seq = ntohl(tcph->seq);
	ack = sack = ntohl(tcph->ack_seq);
-	win = ntohs(tcph->window);
+	win_raw = ntohs(tcph->window);
+	win = win_raw;
	end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);

	if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
@@ -655,14 +657,14 @@ static bool tcp_in_window(const struct nf_conn *ct,
			    && state->last_seq == seq
			    && state->last_ack == ack
			    && state->last_end == end
-			    && state->last_win == win)
+			    && state->last_win == win_raw)
				state->retrans++;
			else {
				state->last_dir = dir;
				state->last_seq = seq;
				state->last_ack = ack;
				state->last_end = end;
-				state->last_win = win;
+				state->last_win = win_raw;
				state->retrans = 0;
			}
		}

Thanks for the quick turnaround, Florian!

I can confirm this indeed fixes my test case, I now get the expected
[UPDATE] tcp 6 432000 ESTABLISHED src=10.88.15.142 dst=10.88.1.2 sport=51451 dport=3230 src=10.88.1.2 dst=10.88.15.142 sport=3230 dport=51451 [ASSURED]

If that's going to be the official fix, feel free to add
Tested-By: Jakub Jankowski <shasta@xxxxxxxxxxx>


Regards,
 Jakub.


--
Jakub Jankowski|shasta@xxxxxxxxxxx|https://toxcorp.com/



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux