iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: conntrack: connection timeout after re-register

Browse Source 
If the first packet conntrack sees after a re-register is an outgoing
keepalive packet with no data (SEG.SEQ = SND.NXT-1), td_end is set to
SND.NXT-1.
When the peer correctly acknowledges SND.NXT, tcp_in_window fails
check III (Upper bound for valid (s)ack: sack <= receiver.td_end) and
returns false, which cascades into nf_conntrack_in setting
skb->_nfct = 0 and in later conntrack iptables rules not matching.
In cases where iptables are dropping packets that do not match
conntrack rules this can result in idle tcp connections to time out.

v2: adjust td_end when getting the reply rather than when sending out
    the keepalive packet.

Fixes: f94e63801ab2 ("netfilter: conntrack: reset tcp maxwin on re-register")
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Francesco Ruggeri 2020-10-07 12:32:52 -07:00 committed by Pablo Neira Ayuso
parent 79dce09ab0
commit 4f25434bcc
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
net/netfilter/nf_conntrack_proto_tcp.c
View File

@ -541,13 +541,20 @@ static bool tcp_in_window(const struct nf_conn *ct,
swin = win << sender->td_scale; swin = win << sender->td_scale;
sender->td_maxwin = (swin == 0 ? 1 : swin); sender->td_maxwin = (swin == 0 ? 1 : swin);
sender->td_maxend = end + sender->td_maxwin; sender->td_maxend = end + sender->td_maxwin;
/* if (receiver->td_maxwin == 0) {
* We haven't seen traffic in the other direction yet /* We haven't seen traffic in the other
* but we have to tweak window tracking to pass III * direction yet but we have to tweak window
* and IV until that happens. * tracking to pass III and IV until that
*/ * happens.
if (receiver->td_maxwin == 0) */
receiver->td_end = receiver->td_maxend = sack; receiver->td_end = receiver->td_maxend = sack;
} else if (sack == receiver->td_end + 1) {
/* Likely a reply to a keepalive.
* Needed for III.
*/
receiver->td_end++;
}
} }
} else if (((state->state == TCP_CONNTRACK_SYN_SENT } else if (((state->state == TCP_CONNTRACK_SYN_SENT
&& dir == IP_CT_DIR_ORIGINAL) && dir == IP_CT_DIR_ORIGINAL)