Florian Westphal c410cb974f netfilter: conntrack: handle tcp challenge acks during connection reuse ... When a connection is re-used, following can happen: [ connection starts to close, fin sent in either direction ] > syn # initator quickly reuses connection < ack # peer sends a challenge ack > rst # rst, sequence number == ack_seq of previous challenge ack > syn # this syn is expected to pass Problem is that the rst will fail window validation, so it gets tagged as invalid. If ruleset drops such packets, we get repeated syn-retransmits until initator gives up or peer starts responding with syn/ack. Before the commit indicated in the "Fixes" tag below this used to work: The challenge-ack made conntrack re-init state based on the challenge ack itself, so the following rst would pass window validation. Add challenge-ack support: If we get ack for syn, record the ack_seq, and then check if the rst sequence number matches the last ack number seen in reverse direction. Fixes: c7aab4f170 ("netfilter: nf_conntrack_tcp: re-init for syn packets only") Reported-by: Michal Tesar <mtesar@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2023-01-17 23:00:06 +01:00
..
6lowpan
9p	xen: branch for v6.2-rc4	2023-01-12 17:02:20 -06:00
802	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
8021q	net: Remove the obsolte u64_stats_fetch_*_irq() users (net).	2022-10-28 20:13:54 -07:00
appletalk
atm	driver core: make struct class.dev_uevent() take a const *	2022-11-24 17:12:15 +01:00
ax25	ax25: af_ax25: Remove unnecessary (void*) conversions	2022-11-16 13:31:03 +00:00
batman-adv	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
bluetooth	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
bpf	New Feature:	2022-12-17 14:06:53 -06:00
bpfilter
bridge	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
caif	caif: fix memory leak in cfctrl_linkup_request()	2023-01-05 10:19:36 +01:00
can	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
ceph	Treewide: Stop corrupting socket's task_frag	2022-12-19 17:28:49 -08:00
core	gro: take care of DODGY packets	2023-01-09 07:37:07 +00:00
dcb	net: dcb: move getapptrust to separate function	2022-11-15 15:27:43 +01:00
dccp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-11-29 13:04:52 -08:00
dns_resolver	cred: Do not default to init_cred in prepare_kernel_cred()	2022-11-01 10:04:52 -07:00
dsa	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-12-13 09:49:29 +01:00
ethernet	net: ethernet: use sysfs_emit() to instead of scnprintf()	2022-12-07 20:02:44 -08:00
ethtool	ethtool: add netlink attr in rss get reply only if value is not null	2023-01-12 21:52:46 -08:00
hsr	hsr: Use a single struct for self_node.	2022-12-01 20:26:22 -08:00
ieee802154	Merge tag 'ieee802154-for-net-next-2022-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next	2022-12-07 17:33:26 -08:00
ife
ipv4	Including fixes from bpf, wifi, and netfilter.	2023-01-05 12:40:50 -08:00
ipv6	ipv6: raw: Deduct extension header length in rawv6_push_pending_frames	2023-01-11 12:49:13 +00:00
iucv
kcm	kcm: close race conditions on sk_receive_queue	2022-11-15 12:42:26 +01:00
key	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2022-11-29 20:50:51 -08:00
l2tp	l2tp: close all race conditions in l2tp_tunnel_register()	2023-01-16 13:40:55 +00:00
l3mdev
lapb
llc
mac80211	wifi: mac80211: fix MLO + AP_VLAN check	2023-01-10 13:24:30 +01:00
mac802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-12-08 18:19:59 -08:00
mctp	mctp: Remove device type check at unregister	2022-12-19 17:20:22 -08:00
mpls	net: Remove the obsolte u64_stats_fetch_*_irq() users (net).	2022-10-28 20:13:54 -07:00
mptcp	mptcp: netlink: respect v4/v6-only sockets	2023-01-13 21:55:45 -08:00
ncsi	net/ncsi: Silence runtime memcpy() false positive warning	2022-12-06 17:29:14 -08:00
netfilter	netfilter: conntrack: handle tcp challenge acks during connection reuse	2023-01-17 23:00:06 +01:00
netlabel
netlink	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
netrom
nfc	net: nfc: Fix use-after-free in local_cleanup()	2023-01-13 20:53:44 -08:00
nsh
openvswitch	net: openvswitch: release vport resources on failure	2022-12-21 17:48:12 -08:00
packet	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
phonet
psample
qrtr
rds	rds: remove redundant variable total_payload_len	2022-11-04 10:09:50 +00:00
rfkill	driver core: make struct class.dev_uevent() take a const *	2022-11-24 17:12:15 +01:00
rose	rose: Fix NULL pointer dereference in rose_send_frame()	2022-11-02 11:57:30 +00:00
rxrpc	rxrpc: Fix wrong error return in rxrpc_connect_call()	2023-01-12 21:51:55 -08:00
sched	net/sched: sch_taprio: fix possible use-after-free	2023-01-16 13:25:34 +00:00
sctp	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
smc	use less confusing names for iov_iter direction initializers	2022-11-25 13:01:55 -05:00
strparser
sunrpc	nfsd-6.2 fixes:	2023-01-10 15:03:06 -06:00
switchdev
tipc	tipc: fix unexpected link reset due to discovery messages	2023-01-06 12:53:10 +00:00
tls	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
unix	unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg()	2022-12-15 11:35:18 +01:00
vmw_vsock	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
wireless	Driver Core changes for 6.2-rc1	2022-12-16 03:54:54 -08:00
x25	net/x25: Fix skb leak in x25_lapb_receive_frame()	2022-11-15 20:22:19 -08:00
xdp	bpf: Expand map key argument of bpf_redirect_map to u64	2022-11-15 09:00:27 -08:00
xfrm	Treewide: Stop corrupting socket's task_frag	2022-12-19 17:28:49 -08:00
compat.c	use less confusing names for iov_iter direction initializers	2022-11-25 13:01:55 -05:00
devres.c
Kconfig
Kconfig.debug	net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET	2022-09-20 14:23:56 -07:00
Makefile
socket.c	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
sysctl_net.c