| Message ID | 1438037606-5462-1-git-send-email-phil@nwl.cc |
|---|---|
| State | Awaiting Upstream, archived |
| Delegated to: | David Miller |
| Headers | show |
On Tue, Jul 28, 2015 at 12:53:26AM +0200, Phil Sutter wrote: > Upon receipt of SYNACK from the server, ipt_SYNPROXY first sends back an ACK to > finish the server handshake, then calls nf_ct_seqadj_init() to initiate > sequence number adjustment of forwarded packets to the client and finally sends > a window update to the client to unblock it's TX queue. > > Since synproxy_send_client_ack() does not set synproxy_send_tcp()'s nfct > parameter, no sequence number adjustment happens and the client receives the > window update with incorrect sequence number. Depending on client TCP > implementation, this leads to a significant delay (until a window probe is > being sent). Could you also fix the IPv6 side to get both codes in sync? Thanks. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c index fe8cc18..95ea633e 100644 --- a/net/ipv4/netfilter/ipt_SYNPROXY.c +++ b/net/ipv4/netfilter/ipt_SYNPROXY.c @@ -226,7 +226,8 @@ synproxy_send_client_ack(const struct synproxy_net *snet, synproxy_build_options(nth, opts); - synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size); + synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY, + niph, nth, tcp_hdr_size); } static bool
Upon receipt of SYNACK from the server, ipt_SYNPROXY first sends back an ACK to finish the server handshake, then calls nf_ct_seqadj_init() to initiate sequence number adjustment of forwarded packets to the client and finally sends a window update to the client to unblock it's TX queue. Since synproxy_send_client_ack() does not set synproxy_send_tcp()'s nfct parameter, no sequence number adjustment happens and the client receives the window update with incorrect sequence number. Depending on client TCP implementation, this leads to a significant delay (until a window probe is being sent). Signed-off-by: Phil Sutter <phil@nwl.cc> --- net/ipv4/netfilter/ipt_SYNPROXY.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)