Commit 3e134696 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 



Pablo Niera Ayuso says:

====================

The following patchset contains Netfilter fixes for net:

1) Fix syn-retransmits until initiator gives up when connection is re-used
   due to rst marked as invalid, from Florian Westphal.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 010a74f5 c410cb97

net/netfilter/nf_conntrack_proto_tcp.c

+15 −0
Original line number Diff line number Diff line
@@ -1068,6 +1068,13 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, 
				ct->proto.tcp.last_flags |=

					IP_CT_EXP_CHALLENGE_ACK;

		}



		/* possible challenge ack reply to syn */

		if (old_state == TCP_CONNTRACK_SYN_SENT &&

		    index == TCP_ACK_SET &&

		    dir == IP_CT_DIR_REPLY)

			ct->proto.tcp.last_ack = ntohl(th->ack_seq);



		spin_unlock_bh(&ct->lock);

		nf_ct_l4proto_log_invalid(skb, ct, state,

					  "packet (index %d) in dir %d ignored, state %s",
@@ -1193,6 +1200,14 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, 
			 * segments we ignored. */

			goto in_window;

		}



		/* Reset in response to a challenge-ack we let through earlier */

		if (old_state == TCP_CONNTRACK_SYN_SENT &&

		    ct->proto.tcp.last_index == TCP_ACK_SET &&

		    ct->proto.tcp.last_dir == IP_CT_DIR_REPLY &&

		    ntohl(th->seq) == ct->proto.tcp.last_ack)

			goto in_window;



		break;

	default:

		/* Keep compilers happy. */