Files
msm-5.15/include/linux
Pablo Neira Ayuso c4832c7bbc netfilter: nf_ct_tcp: improve out-of-sync situation in TCP tracking
Without this patch, if we receive a SYN packet from the client while
the firewall is out-of-sync, we let it go through. Then, if we see
the SYN/ACK reply coming from the server, we destroy the conntrack
entry and drop the packet to trigger a new retransmission. Then,
the retransmision from the client is used to start a new clean
session.

This patch improves the current handling. Basically, if we see an
unexpected SYN packet, we annotate the TCP options. Then, if we
see the reply SYN/ACK, this means that the firewall was indeed
out-of-sync. Therefore, we set a clean new session from the existing
entry based on the annotated values.

This patch adds two new 8-bits fields that fit in a 16-bits gap of
the ip_ct_tcp structure.

This patch is particularly useful for conntrackd since the
asynchronous nature of the state-synchronization allows to have
backup nodes that are not perfect copies of the master. This helps
to improve the recovery under some worst-case scenarios.

I have tested this by creating lots of conntrack entries in wrong
state:

for ((i=1024;i<65535;i++)); do conntrack -I -p tcp -s 192.168.2.101 -d 192.168.2.2 --sport $i --dport 80 -t 800 --state ESTABLISHED -u ASSURED,SEEN_REPLY; done

Then, I make some TCP connections:

$ echo GET / | nc 192.168.2.2 80

The events show the result:

 [UPDATE] tcp      6 60 SYN_RECV src=192.168.2.101 dst=192.168.2.2 sport=33220 dport=80 src=192.168.2.2 dst=192.168.2.101 sport=80 dport=33220 [ASSURED]
 [UPDATE] tcp      6 432000 ESTABLISHED src=192.168.2.101 dst=192.168.2.2 sport=33220 dport=80 src=192.168.2.2 dst=192.168.2.101 sport=80 dport=33220 [ASSURED]
 [UPDATE] tcp      6 120 FIN_WAIT src=192.168.2.101 dst=192.168.2.2 sport=33220 dport=80 src=192.168.2.2 dst=192.168.2.101 sport=80 dport=33220 [ASSURED]
 [UPDATE] tcp      6 30 LAST_ACK src=192.168.2.101 dst=192.168.2.2 sport=33220 dport=80 src=192.168.2.2 dst=192.168.2.101 sport=80 dport=33220 [ASSURED]
 [UPDATE] tcp      6 120 TIME_WAIT src=192.168.2.101 dst=192.168.2.2 sport=33220 dport=80 src=192.168.2.2 dst=192.168.2.101 sport=80 dport=33220 [ASSURED]

and tcpdump shows no retransmissions:

20:47:57.271951 IP 192.168.2.101.33221 > 192.168.2.2.www: S 435402517:435402517(0) win 5840 <mss 1460,sackOK,timestamp 4294961827 0,nop,wscale 6>
20:47:57.273538 IP 192.168.2.2.www > 192.168.2.101.33221: S 3509927945:3509927945(0) ack 435402518 win 5792 <mss 1460,sackOK,timestamp 235681024 4294961827,nop,wscale 4>
20:47:57.273608 IP 192.168.2.101.33221 > 192.168.2.2.www: . ack 3509927946 win 92 <nop,nop,timestamp 4294961827 235681024>
20:47:57.273693 IP 192.168.2.101.33221 > 192.168.2.2.www: P 435402518:435402524(6) ack 3509927946 win 92 <nop,nop,timestamp 4294961827 235681024>
20:47:57.275492 IP 192.168.2.2.www > 192.168.2.101.33221: . ack 435402524 win 362 <nop,nop,timestamp 235681024 4294961827>
20:47:57.276492 IP 192.168.2.2.www > 192.168.2.101.33221: P 3509927946:3509928082(136) ack 435402524 win 362 <nop,nop,timestamp 235681025 4294961827>
20:47:57.276515 IP 192.168.2.101.33221 > 192.168.2.2.www: . ack 3509928082 win 108 <nop,nop,timestamp 4294961828 235681025>
20:47:57.276521 IP 192.168.2.2.www > 192.168.2.101.33221: F 3509928082:3509928082(0) ack 435402524 win 362 <nop,nop,timestamp 235681025 4294961827>
20:47:57.277369 IP 192.168.2.101.33221 > 192.168.2.2.www: F 435402524:435402524(0) ack 3509928083 win 108 <nop,nop,timestamp 4294961828 235681025>
20:47:57.279491 IP 192.168.2.2.www > 192.168.2.101.33221: . ack 435402525 win 362 <nop,nop,timestamp 235681025 4294961828>

I also added a rule to log invalid packets, with no occurrences  :-) .

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2009-11-23 10:37:34 +01:00
..
2009-09-23 07:39:29 -07:00
2009-06-18 08:46:47 +10:00
2009-10-27 16:47:55 -04:00
2009-09-19 02:14:45 -04:00
2009-06-17 00:36:36 -04:00
2009-01-30 23:38:03 +05:30
2009-09-20 16:09:20 +05:30
2009-09-08 17:42:50 -07:00
2009-01-30 23:38:37 +05:30
2009-04-01 08:59:23 -07:00
2009-01-30 23:39:42 +05:30
2009-06-01 06:21:13 +00:00
2009-01-30 23:40:06 +05:30
2009-04-23 10:06:35 +01:00
2009-10-03 20:52:01 +02:00
2009-06-11 21:36:09 -04:00
2009-01-30 23:44:08 +05:30
2009-07-12 12:22:34 -07:00
2009-09-23 11:01:25 -07:00
2009-07-14 20:29:57 +08:00
2009-06-11 21:36:06 -04:00
2009-09-18 09:48:52 -07:00
2009-06-22 10:12:30 +01:00
2009-05-18 14:46:26 +01:00
2009-01-30 23:46:03 +05:30
2009-04-03 14:53:32 -07:00
2009-09-14 17:41:42 -07:00
2009-01-30 23:46:40 +05:30
2009-06-17 09:33:49 -07:00
2009-01-30 23:48:33 +05:30
2009-07-08 09:18:05 -07:00
2009-10-07 01:10:44 -07:00
2009-03-16 08:32:27 -06:00
2009-06-24 08:17:04 -04:00
2009-10-20 01:06:22 -07:00
2009-09-12 14:48:40 +02:00
2009-06-15 21:30:25 -07:00
2009-06-18 13:04:05 -07:00
2009-09-01 01:13:31 -07:00
2009-01-30 23:51:17 +05:30
2009-09-18 22:45:43 +02:00
2009-09-01 17:52:57 -07:00
2009-04-02 19:04:53 -07:00
2009-09-11 12:54:58 -07:00
2009-08-19 23:08:24 +04:00
2009-07-26 19:25:44 -07:00
2009-01-30 23:53:12 +05:30
2009-01-30 23:53:40 +05:30
2009-01-30 23:54:53 +05:30
2009-01-30 23:55:45 +05:30
2009-01-30 23:56:13 +05:30
2009-01-30 23:56:48 +05:30
2009-10-07 13:57:10 -07:00
2009-06-29 08:59:10 +10:00
2009-02-02 21:40:58 +05:30
2009-06-02 00:45:24 -07:00
2009-08-21 15:30:12 -07:00
2009-07-31 08:55:48 +02:00
2009-09-23 07:39:41 -07:00
2009-06-18 13:03:56 -07:00
2009-09-26 10:17:19 -07:00
2009-04-21 13:41:48 -07:00
2009-04-21 13:41:48 -07:00
2009-10-18 18:52:53 -07:00
2009-01-30 23:59:44 +05:30
2009-01-31 00:00:06 +05:30
2009-08-29 15:53:00 +02:00
2009-09-30 00:32:06 -04:00
2009-09-23 07:39:58 -07:00
2009-09-10 10:46:47 +03:00
2009-09-19 13:13:17 -07:00
2009-09-26 10:17:19 -07:00
2009-09-22 07:17:33 -07:00
2009-09-18 21:22:08 +02:00
2009-04-06 16:06:26 +01:00
2009-06-23 20:21:39 +01:00
2009-07-30 16:03:45 +09:30
2009-04-28 07:37:28 +02:00
2009-06-16 19:47:48 -07:00
2009-09-23 07:39:41 -07:00
2009-09-22 07:17:35 -07:00
2009-06-16 08:40:20 +02:00
2009-04-29 17:32:35 -07:00
2009-01-31 00:00:35 +05:30
2009-07-08 09:31:56 -07:00
2009-06-11 21:36:02 -04:00
2009-01-31 00:01:11 +05:30
2009-03-20 10:48:14 -07:00
2009-09-21 15:14:51 +02:00
2009-10-12 23:40:10 -07:00
2009-06-17 18:02:11 -07:00
2009-06-17 18:02:11 -07:00
2009-09-26 10:17:19 -07:00
2009-06-17 12:24:34 -07:00
2009-06-17 18:02:11 -07:00
2009-03-10 20:33:18 -04:00
2009-10-07 16:39:42 -04:00
2009-06-15 21:44:43 -07:00
2009-04-01 08:59:13 -07:00
2009-04-01 08:59:13 -07:00
2009-01-31 00:03:40 +05:30
2009-04-24 08:54:21 +02:00
2009-09-22 07:17:47 -07:00
2009-10-04 15:05:10 -07:00
2009-03-13 16:09:12 -07:00
2009-06-18 13:04:04 -07:00
2009-07-29 19:10:36 -07:00
2009-09-23 07:39:41 -07:00
2009-03-30 15:22:01 +02:00
2009-06-11 21:36:12 -04:00
2009-03-26 02:18:35 +01:00
2009-01-31 00:05:59 +05:30
2009-09-19 08:53:22 +02:00
2009-09-19 08:53:22 +02:00
2009-08-23 19:13:02 -07:00
2009-06-24 08:17:06 -04:00
2009-09-01 12:48:21 -04:00
2009-05-09 10:49:41 -04:00
2009-04-01 08:59:24 -07:00
2009-04-08 14:33:38 -07:00
2009-08-28 19:57:30 -04:00
2009-04-13 15:04:29 -07:00
2009-01-31 00:06:33 +05:30
2009-06-15 15:50:49 +02:00
2009-04-21 19:40:00 -07:00
2009-04-27 02:45:02 -07:00
2009-03-27 12:18:56 -04:00
2009-01-31 00:07:00 +05:30
2009-08-31 18:08:51 +02:00
2009-05-12 11:11:48 +02:00
2009-04-02 19:05:01 -07:00
2009-07-06 13:57:03 -07:00
2009-09-02 01:03:43 -07:00
2009-08-30 22:26:34 +02:00
2009-02-18 15:37:53 -08:00
2009-02-03 11:23:12 +11:00
2009-09-23 06:46:23 -07:00
2009-09-23 18:13:10 -07:00
2009-08-26 12:39:29 +01:00
2009-09-23 22:26:32 +09:30
2009-09-23 22:26:32 +09:30
2009-09-23 22:26:32 +09:30
2009-09-23 22:26:32 +09:30
2009-09-23 22:26:32 +09:30
2009-09-23 22:26:32 +09:30
2009-09-22 07:17:30 -07:00
2009-09-19 13:13:25 -07:00
2009-09-19 13:13:26 -07:00
2009-09-15 16:51:30 +02:00
2009-09-21 15:14:53 +02:00