lkml.org 
[lkml]   [2005]   [Jan]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH] Fix broken RST handling in ip_conntrack
From
Date
Hi Linus, Andrew
(Sending this mail to you since Davem is on vacation)

Here's a patch that fixes a pretty serious bug introduced by a recent
"bugfix". The problem is that RST packets are ignored if they follow an
ACK packet, this means that the timeout of the connection isn't
decreased, so we get lots of old connections lingering around until the
timeout expires, the default timeout for state ESTABLISHED is 5 days.

This needs to go into -bk as soon as possible. The bug is present in
2.6.10 as well.

--- linux-2.6.10-rc3-bk14/net/ipv4/netfilter/ip_conntrack_proto_tcp.c.orig 2004-12-30 19:48:33.000000000 +0100
+++ linux-2.6.10-rc3-bk14/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2004-12-30 19:49:46.000000000 +0100
@@ -906,7 +906,8 @@ static int tcp_packet(struct ip_conntrac
if (index == TCP_RST_SET
&& ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
&& conntrack->proto.tcp.last_index <= TCP_SYNACK_SET)
- || conntrack->proto.tcp.last_index == TCP_ACK_SET)
+ || (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
+ && conntrack->proto.tcp.last_index == TCP_ACK_SET))
&& after(ntohl(th->ack_seq),
conntrack->proto.tcp.last_seq)) {
/* Ignore RST closing down invalid SYN or ACK
--
/Martin
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 14:09    [W:0.025 / U:0.336 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site