From patchwork Wed Oct 22 19:37:53 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jozsef Kadlecsik X-Patchwork-Id: 402280 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id A907114007F for ; Thu, 23 Oct 2014 06:37:22 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932427AbaJVThT (ORCPT ); Wed, 22 Oct 2014 15:37:19 -0400 Received: from smtp-in.kfki.hu ([148.6.0.26]:35234 "EHLO smtp1.kfki.hu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754259AbaJVThS (ORCPT ); Wed, 22 Oct 2014 15:37:18 -0400 Received: from localhost (localhost [127.0.0.1]) by smtp1.kfki.hu (Postfix) with ESMTP id 1C79C3C800DB; Wed, 22 Oct 2014 21:37:14 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at smtp1.kfki.hu Received: from smtp1.kfki.hu ([127.0.0.1]) by localhost (smtp1.kfki.hu [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id kf-YyCmyXYVv; Wed, 22 Oct 2014 21:37:12 +0200 (CEST) Received: from blackhole.kfki.hu (blackhole.kfki.hu [IPv6:2001:738:5001::114]) by smtp1.kfki.hu (Postfix) with ESMTP id 0329E3C800C4; Wed, 22 Oct 2014 21:37:10 +0200 (CEST) Received: by blackhole.kfki.hu (Postfix, from userid 1000) id 2957020E3C; Wed, 22 Oct 2014 21:37:53 +0200 (CEST) Date: Wed, 22 Oct 2014 21:37:53 +0200 (CEST) From: Jozsef Kadlecsik To: vDev cc: netfilter-devel@vger.kernel.org, netfilter@vger.kernel.org Subject: Re: TCP LAST ACK incorrectly treated as invalid In-Reply-To: Message-ID: References: User-Agent: Alpine 2.10 (DEB 1266 2009-07-14) MIME-Version: 1.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org On Tue, 21 Oct 2014, vDev wrote: > I am unable to post a pcap file at this point but here is an ASCII > output. The last ACK (ID: 6200) was considered invalid due to III > evaluating to 0 and res=0 in the earlier trace. That cannot be the last ACK, because it's a FIN, ACK packet: > Linux_Router.1026 > REMOTE_SERVER.63001: Flags [F.], cksum 0xf632 > (correct), seq 31, ack 20, win 1500, length 0 > 16:39:35.328857 IP (tos 0x0, ttl 52, id 6200, offset 0, flags [DF], > proto TCP (6), length 40) However, this is still not enough. The debug lines corresponding to the captured packets are required too. Moreover, previously there were packets skipping the window checking in the debug log, without enough debug data to identify them: > <7>[ 2238.870000] tcp_conntracks: > <7>[ 2238.870000] syn=0 ack=1 fin=0 rst=0 old=3 new=3 > <7>[ 2238.870000] tcp_conntracks: > <7>[ 2238.870000] syn=0 ack=1 fin=1 rst=0 old=3 new=4 So please apply this small patch, which adds the missing debug info: and send me the kernel debug messages and the tcpdump recording of the packet flow. If you must send the tcpdump in ascii, then print absolute and not relative TCP sequence numbers. At the moment the only thing I see about the packet flow is that the first reply packet answering the first FIN does not ack the FIN flag itself. However the TCP conntrack state table advances the state to CLOSE_WAIT, instead of keeping the FIN_WAIT state. But that's still not a problem in handling the next packets. Best regards, Jozsef - E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary --- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c index 44d1ea3..655170f 100644 --- a/net/netfilter/nf_conntrack_proto_tcp.c +++ b/net/netfilter/nf_conntrack_proto_tcp.c @@ -830,12 +830,16 @@ static int tcp_packet(struct nf_conn *ct, th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph); BUG_ON(th == NULL); + pr_debug("tcp_packet: "); spin_lock_bh(&ct->lock); old_state = ct->proto.tcp.state; dir = CTINFO2DIR(ctinfo); index = get_conntrack_index(th); new_state = tcp_conntracks[dir][index][old_state]; tuple = &ct->tuplehash[dir].tuple; + pr_debug("dir=%u, seq=%u ack=%u win=%u end=%u\n", + dir, ntohl(th->seq), ntohl(th->ack_seq), ntohs(th->window), + segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th)); switch (new_state) { case TCP_CONNTRACK_SYN_SENT: