Skip to contentSkip to conversation

netfilter: SYNPROXY let unrelated packets continue

PATCH Applied Jesper Dangaard Brouer 3 participants 3 messages Aug 29, 2013 – Sep 4, 2013

Subsystems (3)
Networking Network drivers netfilter
lore
Share & tools
lore

Jesper Dangaard Brouer

author
#0 lore raw

PATCH 1/1 netfilter: SYNPROXY let unrelated packets continue

Packets reaching SYNPROXY were default dropped, as they were most likely invalid (given the recommended state matching). This patch, changes SYNPROXY target to let packets, not consumed, continue being processed by the stack.

This will be more in line other target modules. As it will allow more flexible configurations of handling, logging or matching on packets in INVALID states.

Signed-off-by Jesper Dangaard Brouer <[email protected]>

---
comments:
- This patch depend applying the TCP flags fix patch send earlier
- This replaces my patch: "netfilter: Extend SYNPROXY with a --continue option"

 net/ipv4/netfilter/ipt_SYNPROXY.c  |    8 ++++++--
 net/ipv6/netfilter/ip6t_SYNPROXY.c |    8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)
net/ipv4/netfilter/ipt_SYNPROXY.c +6 -2
index 90e489e..67e17dc 100644
@@ -285,11 +285,15 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 					  XT_SYNPROXY_OPT_ECN);
 
 		synproxy_send_client_synack(skb, th, &opts);
-	} else if (th->ack && !(th->fin || th->rst || th->syn))
+		return NF_DROP;
+
+	} else if (th->ack && !(th->fin || th->rst || th->syn)) {
 		/* ACK from client */
 		synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq));
+		return NF_DROP;
+	}
 
-	return NF_DROP;
+	return XT_CONTINUE;
 }
 
 static unsigned int ipv4_synproxy_hook(unsigned int hooknum,
net/ipv6/netfilter/ip6t_SYNPROXY.c +6 -2
index a5af0bf..19cfea8 100644
@@ -300,11 +300,15 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 					  XT_SYNPROXY_OPT_ECN);
 
 		synproxy_send_client_synack(skb, th, &opts);
-	} else if (th->ack && !(th->fin || th->rst || th->syn))
+		return NF_DROP;
+
+	} else if (th->ack && !(th->fin || th->rst || th->syn)) {
 		/* ACK from client */
 		synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq));
+		return NF_DROP;
+	}
 
-	return NF_DROP;
+	return XT_CONTINUE;
 }
 
 static unsigned int ipv6_synproxy_hook(unsigned int hooknum,
Acked-by on v1 1/1
#1 lore raw
Quoted 10 lines · Jesper Dangaard Brouer

Packets reaching SYNPROXY were default dropped, as they were most likely invalid (given the recommended state matching). This patch, changes SYNPROXY target to let packets, not consumed, continue being processed by the stack.

This will be more in line other target modules. As it will allow more flexible configurations of handling, logging or matching on packets in INVALID states.

Signed-off-by Jesper Dangaard Brouer <[email protected]>
Acked-by Patrick McHardy <[email protected]>
Quoted 4 lines

---
comments:
- This patch depend applying the TCP flags fix patch send earlier
- This replaces my patch: "netfilter: Extend SYNPROXY with a --continue option"

maintainer Applied
#2 lore raw
In reply to Jesper Dangaard Brouer
Quoted 8 lines · Jesper Dangaard Brouer

Packets reaching SYNPROXY were default dropped, as they were most likely invalid (given the recommended state matching). This patch, changes SYNPROXY target to let packets, not consumed, continue being processed by the stack.

This will be more in line other target modules. As it will allow more flexible configurations of handling, logging or matching on packets in INVALID states.

Applied, thanks.