Consider following ruleset: ... ct state new accept ... ct state invalid drop Normally a tcp receiver will reply with an ack once it receives a delayed packet. Example: +0.0001 < P. 1:1461(1460) ack 1 win 257 +.0 > . 1:1(0) ack 1461 win 65535 +0.0001 < P. 1461:2921(1460) ack 1 win 257 [..] +0.0001 < P. 65701:67161(1460) ack 1 win 257 +.0 > . 1:1(0) ack 67161 win 65535 // all data received // delayed packet, already acked +0.0001 < P. 1:1461(1460) ack 1 win 257 // nf_ct_proto_6: SEQ is under the lower bound (already ACKed data retransmitted) IN=.. SEQ=1 ACK=4162510439 WINDOW=257 ACK PSHR +.0 > . 1:1(0) ack 67161 win 65535 If the delayed packet is not dropped, the receiver can immediately send another ack, but this doesn't happen if INVALID packets are dropped by the ruleset (which is a common thing to do). This changes conntrack to treat such packets as valid, with the caveat that they will not extend the tcp timeout or cause state changes. Ideally we could augment state matching so that this decision is pushe to the ruleset but so far I don't see how this could be done with the limited space we have in sk_buff (except for yet another skb extension, but that appears to be too much for such a narrow use case). Florian Westphal (3): netfilter: conntrack: prepare tcp_in_window for ternary return value netfilter: conntrack: ignore overly delayed tcp packets netfilter: conntrack: remove unneeded indent level net/netfilter/nf_conntrack_proto_tcp.c | 208 ++++++++++++++----------- 1 file changed, 116 insertions(+), 92 deletions(-) -- 2.35.1
