UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: conntrack: correct window scaling with retransmitted SYN 

[ Upstream commit fb366fc7541a1de521ab3df58471746aa793b833 ]

commit c7aab4f170 ("netfilter: nf_conntrack_tcp: re-init for syn packets
only") introduces a bug where SYNs in ORIGINAL direction on reused 5-tuple
result in incorrect window scale negotiation. This commit merged the SYN
re-initialization and simultaneous open or SYN retransmits cases. Merging
this block added the logic in tcp_init_sender() that performed window scale
negotiation to the retransmitted syn case. Previously. this would only
result in updating the sender's scale and flags. After the merge the
additional logic results in improperly clearing the scale in ORIGINAL
direction before any packets in the REPLY direction are received. This
results in packets incorrectly being marked invalid for being
out-of-window.

This can be reproduced with the following trace:

Packet Sequence:
> Flags [S], seq 1687765604, win 62727, options [.. wscale 7], length 0
> Flags [S], seq 1944817196, win 62727, options [.. wscale 7], length 0

In order to fix the issue, only evaluate window negotiation for packets
in the REPLY direction. This was tested with simultaneous open, fast
open, and the above reproduction.

Fixes: c7aab4f170 ("netfilter: nf_conntrack_tcp: re-init for syn packets only")
Signed-off-by: Ryan Schaefer <ryanschf@amazon.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Ryan Schaefer 2024-01-21 21:51:44 +00:00 committed by Greg Kroah-Hartman
parent 2d60887071
commit 6edc89300b
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/netfilter/nf_conntrack_proto_tcp.c
View File

@ -457,7 +457,8 @@ static void tcp_init_sender(struct ip_ct_tcp_state *sender,
const struct sk_buff *skb, const struct sk_buff *skb,
unsigned int dataoff, unsigned int dataoff,
const struct tcphdr *tcph, const struct tcphdr *tcph,
u32 end, u32 win) u32 end, u32 win,
enum ip_conntrack_dir dir)
{ {
/* SYN-ACK in reply to a SYN /* SYN-ACK in reply to a SYN
* or SYN from reply direction in simultaneous open. * or SYN from reply direction in simultaneous open.
@ -471,7 +472,8 @@ static void tcp_init_sender(struct ip_ct_tcp_state *sender,
* Both sides must send the Window Scale option * Both sides must send the Window Scale option
* to enable window scaling in either direction. * to enable window scaling in either direction.
*/ */
if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE && if (dir == IP_CT_DIR_REPLY &&
!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE)) { receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE)) {
sender->td_scale = 0; sender->td_scale = 0;
receiver->td_scale = 0; receiver->td_scale = 0;
@ -542,7 +544,7 @@ tcp_in_window(struct nf_conn *ct, enum ip_conntrack_dir dir,
if (tcph->syn) { if (tcph->syn) {
tcp_init_sender(sender, receiver, tcp_init_sender(sender, receiver,
skb, dataoff, tcph, skb, dataoff, tcph,
end, win); end, win, dir);
if (!tcph->ack) if (!tcph->ack)
/* Simultaneous open */ /* Simultaneous open */
return NFCT_TCP_ACCEPT; return NFCT_TCP_ACCEPT;
@ -585,7 +587,7 @@ tcp_in_window(struct nf_conn *ct, enum ip_conntrack_dir dir,
*/ */
tcp_init_sender(sender, receiver, tcp_init_sender(sender, receiver,
skb, dataoff, tcph, skb, dataoff, tcph,
end, win); end, win, dir);
if (dir == IP_CT_DIR_REPLY && !tcph->ack) if (dir == IP_CT_DIR_REPLY && !tcph->ack)
return NFCT_TCP_ACCEPT; return NFCT_TCP_ACCEPT;