v2:
- rebase on top of nf-next
- add patch 4, this was not part of v1.
Consider following ruleset:
... ct state new accept
... ct state invalid drop
Normally a tcp receiver will reply with an ack once it receives
a delayed packet. Example:
+0.0001 < P. 1:1461(1460) ack 1 win 257
+.0 > . 1:1(0) ack 1461 win 65535
+0.0001 < P. 1461:2921(1460) ack 1 win 257
[..]
+0.0001 < P. 65701:67161(1460) ack 1 win 257
+.0 > . 1:1(0) ack 67161 win 65535 // all data received
// delayed packet, already acked
+0.0001 < P. 1:1461(1460) ack 1 win 257
// nf_ct_proto_6: SEQ is under the lower bound (already ACKed data retransmitted) IN=.. SEQ=1 ACK=4162510439 WINDOW=257 ACK PSHR
+.0 > . 1:1(0) ack 67161 win 65535
If the delayed packet is not dropped, the receiver can
immediately send another ack, but this doesn't happen if
INVALID packets are dropped by the ruleset (which is a common thing to do).
This changes conntrack to treat such packets as valid, with the caveat
that they will not extend the tcp timeout or cause state changes.
Ideally we could augment state matching so that this decision
is pushed to the ruleset but so far I don't see how this could be done
with the limited space we have in sk_buff (except for yet another skb
extension, but that appears to be too much for such a narrow use case).
Florian Westphal (4):
netfilter: conntrack: prepare tcp_in_window for ternary return value
netfilter: conntrack: ignore overly delayed tcp packets
netfilter: conntrack: remove unneeded indent level
netfilter: conntrack: reduce timeout when receiving out-of-window fin
or rst
net/netfilter/nf_conntrack_proto_tcp.c | 318 ++++++++++++++++---------
1 file changed, 199 insertions(+), 119 deletions(-)
--
2.35.1
