linux/net/netfilter
Jozsef Kadlecsik 73f306024c [NETFILTER]: Ignore ACKs ACKs on half open connections in TCP conntrack
Mounting NFS file systems after a (warm) reboot could take a long time if
firewalling and connection tracking was enabled.

The reason is that the NFS clients tends to use the same ports (800 and
counting down). Now on reboot, the server would still have a TCB for an
existing TCP connection client:800 -> server:2049. The client sends a
SYN from port 800 to server:2049, which elicits an ACK from the server.
The firewall on the client drops the ACK because (from its point of
view) the connection is still in half-open state, and it expects to see
a SYNACK.

The client will eventually time out after several minutes.

The following patch corrects this, by accepting ACKs on half open
connections as well.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-01 14:28:58 -08:00
..
core.c [NETFILTER]: split net/core/netfilter.c into net/netfilter/*.c 2005-08-29 15:51:11 -07:00
Kconfig [NETFILTER]: Add nf_conntrack subsystem. 2005-11-09 16:38:16 -08:00
Makefile [NETFILTER]: Add nf_conntrack subsystem. 2005-11-09 16:38:16 -08:00
nf_conntrack_core.c [NETFILTER]: Fix nf_conntrack compilation with CONFIG_NETFILTER_DEBUG 2005-11-16 23:14:19 -08:00
nf_conntrack_ftp.c [NETFILTER]: Add nf_conntrack subsystem. 2005-11-09 16:38:16 -08:00
nf_conntrack_l3proto_generic.c [NETFILTER]: Add nf_conntrack subsystem. 2005-11-09 16:38:16 -08:00
nf_conntrack_proto_generic.c [NETFILTER]: Add nf_conntrack subsystem. 2005-11-09 16:38:16 -08:00
nf_conntrack_proto_sctp.c [NETFILTER]: Add nf_conntrack subsystem. 2005-11-09 16:38:16 -08:00
nf_conntrack_proto_tcp.c [NETFILTER]: Ignore ACKs ACKs on half open connections in TCP conntrack 2005-12-01 14:28:58 -08:00
nf_conntrack_proto_udp.c [NETFILTER]: Add nf_conntrack subsystem. 2005-11-09 16:38:16 -08:00
nf_conntrack_standalone.c [NETFILTER] Remove nf_conntrack stat proc file when cleaning up 2005-11-15 16:47:09 -08:00
nf_internals.h [NETFILTER]: split net/core/netfilter.c into net/netfilter/*.c 2005-08-29 15:51:11 -07:00
nf_log.c [NETFILTER]: Fix compilation when no PROC_FS enabled 2005-08-29 15:56:54 -07:00
nf_queue.c [NETFILTER] nf_queue: Fix Ooops when no queue handler registered 2005-11-05 16:43:29 -02:00
nf_sockopt.c [NETFILTER]: split net/core/netfilter.c into net/netfilter/*.c 2005-08-29 15:51:11 -07:00
nfnetlink_log.c [NETFILTER] nfnetlink: unconditionally require CAP_NET_ADMIN 2005-11-14 15:24:59 -08:00
nfnetlink_queue.c [NETFILTER] nfnetlink: unconditionally require CAP_NET_ADMIN 2005-11-14 15:24:59 -08:00
nfnetlink.c [NETFILTER] nfnetlink: unconditionally require CAP_NET_ADMIN 2005-11-14 15:24:59 -08:00