Dear,
I would like to propose a small patch in order to fix an issue of some
RSTs being marked as invalid.
For an established connection, at some point the server sends a [RST,
ACK], the client reuse the same port and sends a SYN, the SYN packet is
ignored in CLOSE state
nf_ct_tcp: invalid packet ignored in state CLOSE ... SEQ=xxxxxx ACK=0 SYN
The server then answers that SYN packet with an [RST, ACK] SEQ=0,
ACK=xxxxxx+1
This new RST, because of the IP_CT_TCP_FLAG_MAXACK_SET being already set, is
erroneously marked as invalid with 'nf_ct_tcp: "invalid rst"'.
Kind regards,
--
Ali Abdallah | SUSE Linux L3 Engineer
GPG fingerprint: 51A0 F4A0 C8CF C98F 842E A9A8 B945 56F8 1C85 D0D5
---
Here is the PATCH
From e9d4d3a70a19d8a3868d16c93281119797fb54df Mon Sep 17 00:00:00 2001
From: Ali Abdallah <aabdallah@xxxxxxx>
Date: Thu, 8 Apr 2021 07:44:27 +0200
Subject: [PATCH] Reset the max ACK flag on SYN in ignore state
In ignore state, we let SYN goes in original, the server might respond
with RST/ACK, and that RST packet is erroneously dropped because of the
flag IP_CT_TCP_FLAG_MAXACK_SET being already set.
---
net/netfilter/nf_conntrack_proto_tcp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index ec23330687a5..891a66e35afd 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -963,6 +963,9 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
ct->proto.tcp.last_flags =
ct->proto.tcp.last_wscale = 0;
+ /* Reset the max ack flag so in case the server replies
+ * with RST/ACK it will be marked as an invalid rst */
+ ct->proto.tcp.seen[dir].flags &= ~IP_CT_TCP_FLAG_MAXACK_SET;
tcp_options(skb, dataoff, th, &seen);
if (seen.flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
ct->proto.tcp.last_flags |=
--
2.26.2
Attachment:
signature.asc
Description: PGP signature
