In ignore state, we let SYN goes in original, the server might respond
with RST/ACK, and that RST packet is erroneously dropped because of the
flag IP_CT_TCP_FLAG_MAXACK_SET being already set. So we reset the flag
in this case.
Unfortunately that might not be enough, an out of order ACK in origin
might reset it back, and we might end up again dropping a valid RST when
the server responds with RST SEQ=0.
The patch disables also the RST check when we are not in established
state and we receive an RST with SEQ=0 that is most likely a response to
a SYN we had let it go through.
Signed-off-by: Ali Abdallah <aabdallah@xxxxxxx>
---
net/netfilter/nf_conntrack_proto_tcp.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 318b8f723349..e958fde8cf9b 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -949,6 +949,10 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
ct->proto.tcp.last_flags =
ct->proto.tcp.last_wscale = 0;
+ /* Reset the max ack flag so in case the server replies
+ * with RST/ACK it will not be marked as an invalid rst.
+ */
+ ct->proto.tcp.seen[dir].flags &= ~IP_CT_TCP_FLAG_MAXACK_SET;
tcp_options(skb, dataoff, th, &seen);
if (seen.flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
ct->proto.tcp.last_flags |=
@@ -1030,6 +1034,13 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
if (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET) {
u32 seq = ntohl(th->seq);
+ /* If we are not in established state, and an RST is
+ * observed with SEQ=0, this is most likely an answer
+ * to a SYN we had let go through above.
+ */
+ if (seq == 0 && !nf_conntrack_tcp_established(ct))
+ break;
+
if (before(seq, ct->proto.tcp.seen[!dir].td_maxack)) {
/* Invalid RST */
spin_unlock_bh(&ct->lock);
--
2.26.2
