]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: SYNPROXY: fix sending window update to client
authorPhil Sutter <phil@nwl.cc>
Mon, 27 Jul 2015 22:53:26 +0000 (00:53 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 10 Aug 2015 11:55:07 +0000 (13:55 +0200)
commitbe6a8caef6ead9514e09020d9291a5b8b39ce5e6
treed487541d2b43e7d8ded82679feecde7d25c1601d
parent0462810e168f84c61f7bf02717a8a85b08a4e769
netfilter: SYNPROXY: fix sending window update to client

Upon receipt of SYNACK from the server, ipt_SYNPROXY first sends back an ACK to
finish the server handshake, then calls nf_ct_seqadj_init() to initiate
sequence number adjustment of forwarded packets to the client and finally sends
a window update to the client to unblock it's TX queue.

Since synproxy_send_client_ack() does not set synproxy_send_tcp()'s nfct
parameter, no sequence number adjustment happens and the client receives the
window update with incorrect sequence number. Depending on client TCP
implementation, this leads to a significant delay (until a window probe is
being sent).

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv4/netfilter/ipt_SYNPROXY.c
net/ipv6/netfilter/ip6t_SYNPROXY.c