]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: SYNPROXY: fix sending window update to client
authorPhil Sutter <phil@nwl.cc>
Mon, 27 Jul 2015 22:53:26 +0000 (00:53 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 10 Aug 2015 11:55:07 +0000 (13:55 +0200)
commit4eba416c1d7e3b735f8fcfef162006009618a598
treed487541d2b43e7d8ded82679feecde7d25c1601d
parent8d97e52a05a573870196d45431809b03e130dd6c
netfilter: SYNPROXY: fix sending window update to client

Upon receipt of SYNACK from the server, ipt_SYNPROXY first sends back an ACK to
finish the server handshake, then calls nf_ct_seqadj_init() to initiate
sequence number adjustment of forwarded packets to the client and finally sends
a window update to the client to unblock it's TX queue.

Since synproxy_send_client_ack() does not set synproxy_send_tcp()'s nfct
parameter, no sequence number adjustment happens and the client receives the
window update with incorrect sequence number. Depending on client TCP
implementation, this leads to a significant delay (until a window probe is
being sent).

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv4/netfilter/ipt_SYNPROXY.c
net/ipv6/netfilter/ip6t_SYNPROXY.c