tcp window tracking initial port to 2.6
Subsystems (3)
PATCH 1/1 tcp window tracking initial port to 2.6
Hi Jozsef and list,
I spent my sunday evening in porting the tcp window tracking system to the 2.6.x tree. Attached to this email the incremental fix to the CVS and the merge to the 2.6.x tree.
It works fine for me, anyway please, this must be considered an initial port. I tried to keep everything as similar as possible to the 2.4.x patch, so I made minor modifications. After the port is finished, hope that i could give you some feedback.
Some comments:
- I drop the old helpers modifications. I think that they are not needed anymore.
- I change the macro SEGMENT_SEQ_PLUS_LEN for an inline function called segment_seq_plus_len because I had important some problems porting this and I needed a bit of flexibility. Anyway maybe
- I commented all the nf_log_ip stuff because the API has changed for 2.6.x tree and I was sure of the correct use of the new one (nf_log_packet?).
Hope that the port is correct.
BTW I think that I experimented some problems with the nf-log patch for 2.6.x tree, I'll have a look at them.
regards,
Pablo
tcp_window-tracking.patch renamed from home/pablo/CVS/patch-o-matic-ng/tcp-window-tracking/linux.patch +195 -262
@@ -1,9 +1,8 @@ -diff -urN --exclude-from=/usr/src/diff.exclude linux-2.4.23-pending/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.4.23-tcp-win/include/linux/netfilter_ipv4/ip_conntrack.h ---- linux-2.4.23-pending/include/linux/netfilter_ipv4/ip_conntrack.h 2003-12-04 17:02:36.000000000 +0100 -+++ linux-2.4.23-tcp-win/include/linux/netfilter_ipv4/ip_conntrack.h 2003-12-09 09:45:55.000000000 +0100 -@@ -262,6 +262,11 @@ - /* Fake conntrack entry for untracked connections */ - extern struct ip_conntrack ip_conntrack_untracked; +--- linux-2.6.3-old/include/linux/netfilter_ipv4/ip_conntrack.h 2004-02-18 04:59:30.000000000 +0100 ++++ linux-2.6.3-patched/include/linux/netfilter_ipv4/ip_conntrack.h 2004-03-07 18:47:15.000000000 +0100 +@@ -251,6 +251,11 @@ + /* Call me when a conntrack is destroyed. */ + extern void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack); +/* Update TCP window tracking data when NAT mangles the packet */ +extern void ip_conntrack_tcp_update(struct sk_buff *skb,
@@ -13,9 +12,8 @@ /* Returns new sk_buff, or NULL */ struct sk_buff * ip_ct_gather_frags(struct sk_buff *skb); -diff -urN --exclude-from=/usr/src/diff.exclude linux-2.4.23-pending/include/linux/netfilter_ipv4/ip_conntrack_tcp.h linux-2.4.23-tcp-win/include/linux/netfilter_ipv4/ip_conntrack_tcp.h ---- linux-2.4.23-pending/include/linux/netfilter_ipv4/ip_conntrack_tcp.h 2002-11-29 00:53:15.000000000 +0100 -+++ linux-2.4.23-tcp-win/include/linux/netfilter_ipv4/ip_conntrack_tcp.h 2003-12-09 09:30:21.000000000 +0100 +--- linux-2.6.3-old/include/linux/netfilter_ipv4/ip_conntrack_tcp.h 2004-02-18 04:57:29.000000000 +0100 ++++ linux-2.6.3-patched/include/linux/netfilter_ipv4/ip_conntrack_tcp.h 2004-03-07 18:48:48.000000000 +0100 @@ -4,25 +4,41 @@ enum tcp_conntrack {
@@ -67,13 +65,12 @@ }; #endif /* _IP_CONNTRACK_TCP_H */ -diff -urN --exclude-from=/usr/src/diff.exclude linux-2.4.23-pending/include/linux/sysctl.h linux-2.4.23-tcp-win/include/linux/sysctl.h ---- linux-2.4.23-pending/include/linux/sysctl.h 2003-12-04 16:45:18.000000000 +0100 -+++ linux-2.4.23-tcp-win/include/linux/sysctl.h 2003-12-09 09:42:57.000000000 +0100 -@@ -377,6 +377,11 @@ +--- linux-2.6.3-old/include/linux/sysctl.h 2004-02-18 04:58:10.000000000 +0100 ++++ linux-2.6.3-patched/include/linux/sysctl.h 2004-03-07 18:50:32.000000000 +0100 +@@ -380,6 +380,11 @@ + NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT_STREAM=11, NET_IPV4_NF_CONNTRACK_ICMP_TIMEOUT=12, NET_IPV4_NF_CONNTRACK_GENERIC_TIMEOUT=13, - NET_IPV4_NF_CONNTRACK_BUCKETS=14, + NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_MAX_RETRANS=15, + NET_IPV4_NF_CONNTRACK_TCP_LOG_INVALID=16, + NET_IPV4_NF_CONNTRACK_TCP_LOOSE=17,
@@ -82,127 +79,31 @@ }; /* /proc/sys/net/ipv6 */ -diff -urN --exclude-from=/usr/src/diff.exclude linux-2.4.23-pending/net/ipv4/netfilter/ip_conntrack_core.c linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_conntrack_core.c ---- linux-2.4.23-pending/net/ipv4/netfilter/ip_conntrack_core.c 2003-12-04 16:56:14.000000000 +0100 -+++ linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_conntrack_core.c 2003-12-09 09:30:21.000000000 +0100 -@@ -864,11 +864,12 @@ +--- linux-2.6.3-old/net/ipv4/netfilter/ip_conntrack_core.c 2004-02-18 04:57:11.000000000 +0100 ++++ linux-2.6.3-patched/net/ipv4/netfilter/ip_conntrack_core.c 2004-03-07 18:52:45.000000000 +0100 +@@ -842,11 +842,12 @@ IP_NF_ASSERT((*pskb)->nfct); - ret = proto->packet(ct, (*pskb)->nh.iph, (*pskb)->len, ctinfo); + ret = proto->packet(ct, *pskb, ctinfo); - if (ret == -1) { - /* Invalid */ +- nf_conntrack_put((*pskb)->nfct); +- (*pskb)->nfct = NULL; +- return NF_ACCEPT; + if (ret < 0 ) { + /* Invalid: inverse of the return code tells + * to the netfilter core what to do. */ - nf_conntrack_put((*pskb)->nfct); - (*pskb)->nfct = NULL; -- return NF_ACCEPT; ++ nf_conntrack_put((*pskb)->nfct); ++ (*pskb)->nfct = NULL; + return -ret; } if (ret != NF_DROP && ct->helper) { -diff -urN --exclude-from=/usr/src/diff.exclude linux-2.4.23-pending/net/ipv4/netfilter/ip_conntrack_ftp.c linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_conntrack_ftp.c ---- linux-2.4.23-pending/net/ipv4/netfilter/ip_conntrack_ftp.c 2003-08-25 13:44:44.000000000 +0200 -+++ linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_conntrack_ftp.c 2003-12-09 09:30:21.000000000 +0100 -@@ -4,7 +4,6 @@ - #include <linux/netfilter.h> - #include <linux/ip.h> - #include <linux/ctype.h> --#include <net/checksum.h> - #include <net/tcp.h> - - #include <linux/netfilter_ipv4/lockhelp.h> -@@ -233,11 +232,10 @@ - struct ip_conntrack *ct, - enum ip_conntrack_info ctinfo) - { -- /* tcplen not negative guaranteed by ip_conntrack_tcp.c */ -+ /* datalen not negative guaranteed by ip_conntrack_proto_tcp.c */ - struct tcphdr *tcph = (void *)iph + iph->ihl * 4; - const char *data = (const char *)tcph + tcph->doff * 4; -- unsigned int tcplen = len - iph->ihl * 4; -- unsigned int datalen = tcplen - tcph->doff * 4; -+ unsigned int datalen = len - iph->ihl * 4 - tcph->doff * 4; - u_int32_t old_seq_aft_nl; - int old_seq_aft_nl_set; - u_int32_t array[6] = { 0 }; -@@ -257,22 +255,6 @@ - return NF_ACCEPT; - } - -- /* Not whole TCP header? */ -- if (tcplen < sizeof(struct tcphdr) || tcplen < tcph->doff*4) { -- DEBUGP("ftp: tcplen = %u\n", (unsigned)tcplen); -- return NF_ACCEPT; -- } -- -- /* Checksum invalid? Ignore. */ -- /* FIXME: Source route IP option packets --RR */ -- if (tcp_v4_check(tcph, tcplen, iph->saddr, iph->daddr, -- csum_partial((char *)tcph, tcplen, 0))) { -- DEBUGP("ftp_help: bad csum: %p %u %u.%u.%u.%u %u.%u.%u.%u\n", -- tcph, tcplen, NIPQUAD(iph->saddr), -- NIPQUAD(iph->daddr)); -- return NF_ACCEPT; -- } -- - LOCK_BH(&ip_ftp_lock); - old_seq_aft_nl_set = ct_ftp_info->seq_aft_nl_set[dir]; - old_seq_aft_nl = ct_ftp_info->seq_aft_nl[dir]; -diff -urN --exclude-from=/usr/src/diff.exclude linux-2.4.23-pending/net/ipv4/netfilter/ip_conntrack_irc.c linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_conntrack_irc.c ---- linux-2.4.23-pending/net/ipv4/netfilter/ip_conntrack_irc.c 2003-11-28 19:26:21.000000000 +0100 -+++ linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_conntrack_irc.c 2003-12-09 09:30:21.000000000 +0100 -@@ -26,7 +26,6 @@ - #include <linux/module.h> - #include <linux/netfilter.h> - #include <linux/ip.h> --#include <net/checksum.h> - #include <net/tcp.h> - - #include <linux/netfilter_ipv4/lockhelp.h> -@@ -109,13 +108,12 @@ - static int help(const struct iphdr *iph, size_t len, - struct ip_conntrack *ct, enum ip_conntrack_info ctinfo) - { -- /* tcplen not negative guarenteed by ip_conntrack_tcp.c */ -+ /* datalen not negative guarenteed by ip_conntrack_proto_tcp.c */ - struct tcphdr *tcph = (void *) iph + iph->ihl * 4; - const char *data = (const char *) tcph + tcph->doff * 4; - const char *_data = data; - char *data_limit; -- u_int32_t tcplen = len - iph->ihl * 4; -- u_int32_t datalen = tcplen - tcph->doff * 4; -+ u_int32_t datalen = len - iph->ihl * 4 - tcph->doff * 4; - int dir = CTINFO2DIR(ctinfo); - struct ip_conntrack_expect expect, *exp = &expect; - struct ip_ct_irc_expect *exp_irc_info = &exp->help.exp_irc_info; -@@ -138,22 +136,6 @@ - return NF_ACCEPT; - } - -- /* Not whole TCP header? */ -- if (tcplen < sizeof(struct tcphdr) || tcplen < tcph->doff * 4) { -- DEBUGP("tcplen = %u\n", (unsigned) tcplen); -- return NF_ACCEPT; -- } -- -- /* Checksum invalid? Ignore. */ -- /* FIXME: Source route IP option packets --RR */ -- if (tcp_v4_check(tcph, tcplen, iph->saddr, iph->daddr, -- csum_partial((char *) tcph, tcplen, 0))) { -- DEBUGP("bad csum: %p %u %u.%u.%u.%u %u.%u.%u.%u\n", -- tcph, tcplen, NIPQUAD(iph->saddr), -- NIPQUAD(iph->daddr)); -- return NF_ACCEPT; -- } -- - data_limit = (char *) data + datalen; - - /* strlen("\1DCC SEND t AAAAAAAA P\1\n")=24 -diff -urN --exclude-from=/usr/src/diff.exclude linux-2.4.23-pending/net/ipv4/netfilter/ip_conntrack_proto_tcp.c linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_conntrack_proto_tcp.c ---- linux-2.4.23-pending/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2003-11-28 19:26:21.000000000 +0100 -+++ linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2003-12-10 12:45:55.000000000 +0100 -@@ -1,3 +1,20 @@ +--- linux-2.6.3-old/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2004-02-18 04:59:50.000000000 +0100 ++++ linux-2.6.3-patched/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2004-03-07 20:49:57.000000000 +0100 +@@ -1,11 +1,20 @@ +-/* (C) 1999-2001 Paul `Rusty' Russell +- * (C) 2002-2004 Netfilter Core Team <[email protected]> +/* + * TCP connection tracking + */
@@ -214,16 +115,19 @@ + * - Real stateful connection tracking + * - Modified state transitions table + * - Window scaling support added -+ * + * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License version 2 as +- * published by the Free Software Foundation. + * version 2.1 -+ */ -+ + */ + +#define __NO_VERSION__ +#include <linux/config.h> #include <linux/types.h> #include <linux/sched.h> #include <linux/timer.h> -@@ -6,101 +23,268 @@ +@@ -14,101 +23,268 @@ #include <linux/in.h> #include <linux/ip.h> #include <linux/tcp.h>
@@ -277,19 +181,23 @@ - the conntrack of the connection) is required. RSN. --RR */ - static const char *tcp_conntrack_names[] = { - "NONE", -- "ESTABLISHED", - "SYN_SENT", - "SYN_RECV", -+ "ESTABLISHED", - "FIN_WAIT", -- "TIME_WAIT", -- "CLOSE", - "CLOSE_WAIT", - "LAST_ACK", -+ "TIME_WAIT", -+ "CLOSE", - "LISTEN" +- "NONE", ++ "NONE", ++ "SYN_SENT", ++ "SYN_RECV", + "ESTABLISHED", +- "SYN_SENT", +- "SYN_RECV", +- "FIN_WAIT", ++ "FIN_WAIT", ++ "CLOSE_WAIT", ++ "LAST_ACK", + "TIME_WAIT", + "CLOSE", +- "CLOSE_WAIT", +- "LAST_ACK", +- "LISTEN" ++ "LISTEN" }; -#define SECS *HZ
@@ -476,7 +384,7 @@ +/*rst*/ { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV }, +/*none*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV } }, - { +- { -/* REPLY */ -/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI */ -/*syn*/ {sSR, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR },
@@ -484,6 +392,7 @@ -/*ack*/ {sCL, sES, sSS, sSR, sFW, sTW, sCL, sCW, sCL, sLI }, -/*rst*/ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sLA, sLI }, -/*none*/{sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV } ++ { +/* REPLY */ +/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */ +/*syn*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
@@ -540,18 +449,13 @@ } }; -@@ -145,13 +329,370 @@ +@@ -158,13 +334,373 @@ return sprintf(buffer, "%s ", tcp_conntrack_names[state]); } -static unsigned int get_conntrack_index(const struct tcphdr *tcph) +static inline unsigned int get_conntrack_index(const struct tcphdr *tcph) - { -- if (tcph->rst) return 3; -- else if (tcph->syn) return 0; -- else if (tcph->fin) return 1; -- else if (tcph->ack) return 2; -- else return 4; ++{ + if (tcph->rst) return TCP_RST_SET; + else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET); + else if (tcph->fin) return TCP_FIN_SET;
@@ -580,9 +484,12 @@ + we doesn't have to deal with fragments. +*/ + -+#define SEGMENT_SEQ_PLUS_LEN(seq, len, iph, tcph) \ -+ (seq + len - (iph->ihl + tcph->doff)*4 \ -+ + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0)) ++static inline __u32 segment_seq_plus_len(__u32 seq, size_t len, struct iphdr *iph, ++ struct tcphdr *tcph) ++{ ++ return (seq + len - (iph->ihl + tcph->doff)*4 \ ++ + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0)); ++} + +/* Fixme: what about big packets? */ +#define MAXACKWINCONST 66000
@@ -641,7 +548,12 @@ + enum ip_conntrack_dir dir, + struct iphdr *iph, size_t len, + struct tcphdr *tcph) -+{ + { +- if (tcph->rst) return 3; +- else if (tcph->syn) return 0; +- else if (tcph->fin) return 1; +- else if (tcph->ack) return 2; +- else return 4; + struct ip_ct_tcp_state *sender = &state->seen[dir]; + struct ip_ct_tcp_state *receiver = &state->seen[!dir]; + __u32 seq, ack, end, win;
@@ -653,7 +565,7 @@ + seq = ntohl(tcph->seq); + ack = ntohl(tcph->ack_seq); + win = ntohs(tcph->window); -+ end = SEGMENT_SEQ_PLUS_LEN(seq, len, iph, tcph); ++ end = segment_seq_plus_len(seq, len, iph, tcph); + + DEBUGP("tcp_in_window: START\n"); + DEBUGP("tcp_in_window: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu seq=%u ack=%u win=%u end=%u\n",
@@ -799,7 +711,7 @@ + + res = 1; + } else { -+ if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) ++/* if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) + nf_log_ip((char *)iph, len, + "ip_conntrack_tcp: IGNORED: Out of window data; %s\n", + before(end, sender->td_maxend + 1) ?
@@ -809,7 +721,7 @@ + : "ACK is under the lower bound (possibly overly delayed ACK)" + : "ACK is over the upper bound (ACKed data has never seen yet)" + : "SEQ is under the lower bound (retransmitted already ACKed data)" -+ : "SEQ is over the upper bound (over the window of the receiver)"); ++ : "SEQ is over the upper bound (over the window of the receiver)");*/ + + res = ip_ct_tcp_be_liberal && !tcph->rst; + }
@@ -835,7 +747,7 @@ + struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[!dir]; +#endif + -+ end = SEGMENT_SEQ_PLUS_LEN(ntohl(tcph->seq), skb->len, iph, tcph); ++ end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, iph, tcph); + + WRITE_LOCK(&tcp_lock); + /*
@@ -888,18 +800,18 @@ + + /* Not whole TCP header? */ + if (tcplen < sizeof(struct tcphdr) || tcplen < tcph->doff*4) { -+ if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) ++ /* if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) + nf_log_ip((char *)iph, len, -+ "ip_conntrack_tcp: INVALID: truncated packet "); ++ "ip_conntrack_tcp: INVALID: truncated packet ");*/ + return 1; + } + + /* Check TCP flags. */ + tcpflags = (((u_int8_t *)tcph)[13] & ~(TH_ECE|TH_CWR)); + if (!tcp_valid_flags[tcpflags]) { -+ if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) ++ /*if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) + nf_log_ip((char *)iph, len, -+ "ip_conntrack_tcp: INVALID: invalid TCP flag combination "); ++ "ip_conntrack_tcp: INVALID: invalid TCP flag combination ");*/ + return 1; + } +
@@ -907,9 +819,9 @@ + /* FIXME: Source route IP option packets --RR */ + if (tcp_v4_check(tcph, tcplen, iph->saddr, iph->daddr, + csum_partial((char *)tcph, tcplen, 0))) { -+ if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) ++/* if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) + nf_log_ip((char *)iph, len, -+ "ip_conntrack_tcp: INVALID: bad TCP checksum "); ++ "ip_conntrack_tcp: INVALID: bad TCP checksum ");*/ + return 1; + } +
@@ -917,41 +829,40 @@ } /* Returns verdict for packet, or -1 for invalid. */ -@@ -159,60 +700,130 @@ - struct iphdr *iph, size_t len, +@@ -172,82 +708,223 @@ + const struct sk_buff *skb, enum ip_conntrack_info ctinfo) { - enum tcp_conntrack newconntrack, oldtcpstate; + enum tcp_conntrack new_state, old_state; + enum ip_conntrack_dir dir; - struct tcphdr *tcph = (struct tcphdr *)((u_int32_t *)iph + iph->ihl); -- -- /* We're guaranteed to have the base header, but maybe not the -- options. */ -- if (len < (iph->ihl + tcph->doff) * 4) { -- DEBUGP("ip_conntrack_tcp: Truncated packet.\n"); -- return -1; -- } -- + struct tcphdr tcph; + unsigned long timeout; + unsigned int index; + ++ /* FIXME: does unclean do the same? */ + if (skb_copy_bits(skb, skb->nh.iph->ihl * 4, &tcph, sizeof(tcph)) != 0) + return -1; + + /* Do not handle unclean packets, which could cause false alarms */ -+ if (unclean(iph, len)) ++ if (unclean(skb->nh.iph, skb->len)) + return -NF_ACCEPT; -+ + WRITE_LOCK(&tcp_lock); - oldtcpstate = conntrack->proto.tcp.state; - newconntrack - = tcp_conntracks - [CTINFO2DIR(ctinfo)] -- [get_conntrack_index(tcph)][oldtcpstate]; +- [get_conntrack_index(&tcph)][oldtcpstate]; - - /* Invalid */ - if (newconntrack == TCP_CONNTRACK_MAX) { +- DEBUGP("ip_conntrack_tcp: Invalid dir=%i index=%u conntrack=%u\n", +- CTINFO2DIR(ctinfo), get_conntrack_index(&tcph), +- conntrack->proto.tcp.state); + old_state = conntrack->proto.tcp.state; + dir = CTINFO2DIR(ctinfo); -+ index = get_conntrack_index(tcph); ++ index = get_conntrack_index(&tcph); + new_state = tcp_conntracks[dir][index][old_state]; + + switch (new_state) {
@@ -960,7 +871,7 @@ + if (index == TCP_SYNACK_SET + && conntrack->proto.tcp.stored_seq == TCP_SYN_SET + && conntrack->proto.tcp.last_dir != dir -+ && after(ntohl(tcph->ack_seq), conntrack->proto.tcp.last_seq)) { ++ && after(ntohl(tcph.ack_seq), conntrack->proto.tcp.last_seq)) { + /* This SYN/ACK acknowledges a SYN that we earlier ignored + * as invalid. This means that the client and the server + * are both in sync, while the firewall is not. We kill
@@ -969,39 +880,64 @@ + * clean new session. + */ + WRITE_UNLOCK(&tcp_lock); -+ if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) -+ nf_log_ip((char *)iph, len, -+ "ip_conntrack_tcp: INVALID: killing out of sync session "); ++ /* if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) ++ nf_log_ip((char *)skb->nh.iph, skb->len, ++ "ip_conntrack_tcp: INVALID: killing out of sync session ");*/ + if (del_timer(&conntrack->timeout)) + conntrack->timeout.function((unsigned long)conntrack); + return -NF_ACCEPT; + } + conntrack->proto.tcp.stored_seq = index; + conntrack->proto.tcp.last_dir = dir; -+ conntrack->proto.tcp.last_seq = ntohl(tcph->seq); ++ conntrack->proto.tcp.last_seq = ntohl(tcph.seq); + -+ WRITE_UNLOCK(&tcp_lock); -+ if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) -+ nf_log_ip((char *)iph, len, -+ "ip_conntrack_tcp: INVALID: invalid SYN (ignored) "); + WRITE_UNLOCK(&tcp_lock); +- return -1; +- } +- +- conntrack->proto.tcp.state = newconntrack; +- +- /* Poor man's window tracking: record SYN/ACK for handshake check */ +- if (oldtcpstate == TCP_CONNTRACK_SYN_SENT +- && CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY +- && tcph.syn && tcph.ack) +- conntrack->proto.tcp.handshake_ack +- = htonl(ntohl(tcph.seq) + 1); +- +- /* If only reply is a RST, we can consider ourselves not to +- have an established connection: this is a fairly common +- problem case, so we can delete the conntrack +- immediately. --RR */ +- if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status) && tcph.rst) { ++/* if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) ++ nf_log_ip((char *)skb->nh.iph, skb->len, ++ "ip_conntrack_tcp: INVALID: invalid SYN (ignored) ");*/ + return NF_ACCEPT; ++ break; + case TCP_CONNTRACK_MAX: + /* Invalid packet */ - DEBUGP("ip_conntrack_tcp: Invalid dir=%i index=%u conntrack=%u\n", -- CTINFO2DIR(ctinfo), get_conntrack_index(tcph), -- conntrack->proto.tcp.state); -+ dir, get_conntrack_index(tcph), ++ DEBUGP("ip_conntrack_tcp: Invalid dir=%i index=%u conntrack=%u\n", ++ dir, get_conntrack_index(&tcph), + old_state); WRITE_UNLOCK(&tcp_lock); -- return -1; -+ if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) -+ nf_log_ip((char *)iph, len, -+ "ip_conntrack_tcp: INVALID: invalid state "); +- if (del_timer(&conntrack->timeout)) +- conntrack->timeout.function((unsigned long)conntrack); +- } else { +- /* Set ASSURED if we see see valid ack in ESTABLISHED after SYN_RECV */ +- if (oldtcpstate == TCP_CONNTRACK_SYN_RECV +- && CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL +- && tcph.ack && !tcph.syn +- && tcph.ack_seq == conntrack->proto.tcp.handshake_ack) +- set_bit(IPS_ASSURED_BIT, &conntrack->status); + ++/* if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) ++ nf_log_ip((char *)skb->nh.iph, skb->len, ++ "ip_conntrack_tcp: INVALID: invalid state ");*/ + return -NF_ACCEPT; + case TCP_CONNTRACK_SYN_SENT: -+ if (old_state >= TCP_CONNTRACK_TIME_WAIT) { ++ if (old_state >= TCP_CONNTRACK_TIME_WAIT) { + /* Attempt to reopen a closed connection. -+ * Delete this connection and look up again. */ ++ * Delete this connection and look up again. */ + WRITE_UNLOCK(&tcp_lock); + if (del_timer(&conntrack->timeout)) + conntrack->timeout.function((unsigned long)conntrack);
@@ -1012,56 +948,31 @@ + if (index == TCP_RST_SET + && test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status) + && conntrack->proto.tcp.stored_seq <= TCP_SYNACK_SET -+ && after(ntohl(tcph->ack), conntrack->proto.tcp.last_seq)) { ++ && after(ntohl(tcph.ack), conntrack->proto.tcp.last_seq)) { + /* Ignore RST closing down invalid SYN we had let trough. */ + WRITE_UNLOCK(&tcp_lock); -+ if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) -+ nf_log_ip((char *)iph, len, -+ "ip_conntrack_tcp: INVALID: invalid RST (ignored) "); ++/* if (NET_RATELIMIT(ip_ct_tcp_log_invalid)) ++ nf_log_ip((char *)skb->nh.iph, skb->len, ++ "ip_conntrack_tcp: INVALID: invalid RST (ignored) ");*/ + return NF_ACCEPT; + } + /* Just fall trough */ + default: + /* Keep compilers happy. */ - } - -- conntrack->proto.tcp.state = newconntrack; -- -- /* Poor man's window tracking: record SYN/ACK for handshake check */ -- if (oldtcpstate == TCP_CONNTRACK_SYN_SENT -- && CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY -- && tcph->syn && tcph->ack) -- conntrack->proto.tcp.handshake_ack -- = htonl(ntohl(tcph->seq) + 1); -- -- /* If only reply is a RST, we can consider ourselves not to -- have an established connection: this is a fairly common -- problem case, so we can delete the conntrack -- immediately. --RR */ -- if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status) && tcph->rst) { ++ } ++ + conntrack->proto.tcp.stored_seq = index; -+ if (!tcp_in_window(&conntrack->proto.tcp, dir, iph, len, tcph)) { ++ if (!tcp_in_window(&conntrack->proto.tcp, dir, skb->nh.iph, skb->len, &tcph)) { + /* Invalid packet */ WRITE_UNLOCK(&tcp_lock); -- if (del_timer(&conntrack->timeout)) -- conntrack->timeout.function((unsigned long)conntrack); -- } else { -- /* Set ASSURED if we see see valid ack in ESTABLISHED after SYN_RECV */ -- if (oldtcpstate == TCP_CONNTRACK_SYN_RECV -- && CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL -- && tcph->ack && !tcph->syn -- && tcph->ack_seq == conntrack->proto.tcp.handshake_ack) -- set_bit(IPS_ASSURED_BIT, &conntrack->status); +- ip_ct_refresh(conntrack, *tcp_timeouts[newconntrack]); + return -NF_ACCEPT; -+ } + } + /* If FIN was trimmed off, don't change state. */ + new_state = tcp_conntracks[dir][conntrack->proto.tcp.stored_seq][old_state]; - -- WRITE_UNLOCK(&tcp_lock); -- ip_ct_refresh(conntrack, *tcp_timeouts[newconntrack]); + DEBUGP("tcp_conntracks: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n", -+ NIPQUAD(iph->saddr), ntohs(tcph->source), NIPQUAD(iph->daddr), ntohs(tcph->dest), -+ (tcph->syn ? 1 : 0), (tcph->ack ? 1 : 0), (tcph->fin ? 1 : 0), (tcph->rst ? 1 : 0), ++ NIPQUAD(iph->saddr), ntohs(tcph.source), NIPQUAD(iph->daddr), ntohs(tcph.dest), ++ (tcph.syn ? 1 : 0), (tcph.ack ? 1 : 0), (tcph.fin ? 1 : 0), (tcph.rst ? 1 : 0), + old_state, new_state); + + conntrack->proto.tcp.state = new_state;
@@ -1074,7 +985,7 @@ + have an established connection: this is a fairly common + problem case, so we can delete the conntrack + immediately. --RR */ -+ if (tcph->rst) { ++ if (tcph.rst) { + WRITE_UNLOCK(&tcp_lock); + if (del_timer(&conntrack->timeout)) + conntrack->timeout.function((unsigned long)conntrack);
@@ -1087,32 +998,39 @@ + && new_state == TCP_CONNTRACK_ESTABLISHED) + set_bit(IPS_ASSURED_BIT, &conntrack->status); + } - } ++ } + WRITE_UNLOCK(&tcp_lock); + ip_ct_refresh(conntrack, timeout); - return NF_ACCEPT; +- return NF_ACCEPT; ++ return NF_ACCEPT; } -@@ -221,21 +832,80 @@ - static int tcp_new(struct ip_conntrack *conntrack, - struct iphdr *iph, size_t len) + ++ + /* Called when a new connection for this protocol found. */ + static int tcp_new(struct ip_conntrack *conntrack, const struct sk_buff *skb) { - enum tcp_conntrack newconntrack; + enum tcp_conntrack new_state; - struct tcphdr *tcph = (struct tcphdr *)((u_int32_t *)iph + iph->ihl); + struct tcphdr tcph; + +#ifdef DEBUGP_VARS + struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[0]; + struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[1]; +#endif + ++ /* FIXME: do the same as unclean does? Anyway I needed */ + if (skb_copy_bits(skb, skb->nh.iph->ihl * 4, &tcph, sizeof(tcph)) != 0) + return -1; + + /* Skip unclean packets */ -+ if (unclean(iph, len)) ++ if (unclean(skb->nh.iph, skb->len)) + return 0; - ++ /* Don't need lock here: this conntrack not in circulation yet */ - newconntrack + new_state - = tcp_conntracks[0][get_conntrack_index(tcph)] + = tcp_conntracks[0][get_conntrack_index(&tcph)] [TCP_CONNTRACK_NONE]; /* Invalid: delete conntrack */
@@ -1123,17 +1041,18 @@ } - conntrack->proto.tcp.state = newconntrack; +- return 1; + if (new_state == TCP_CONNTRACK_SYN_SENT) { + /* SYN packet */ + conntrack->proto.tcp.seen[0].td_end = -+ SEGMENT_SEQ_PLUS_LEN(ntohl(tcph->seq), len, iph, tcph); -+ conntrack->proto.tcp.seen[0].td_maxwin = ntohs(tcph->window); ++ segment_seq_plus_len(ntohl(tcph.seq), skb->len, skb->nh.iph, &tcph); ++ conntrack->proto.tcp.seen[0].td_maxwin = ntohs(tcph.window); + if (conntrack->proto.tcp.seen[0].td_maxwin == 0) + conntrack->proto.tcp.seen[0].td_maxwin = 1; + conntrack->proto.tcp.seen[0].td_maxend = + conntrack->proto.tcp.seen[0].td_end; + -+ tcp_options(iph, len, tcph, &conntrack->proto.tcp.seen[0]); ++ tcp_options(skb->nh.iph, skb->len, &tcph, &conntrack->proto.tcp.seen[0]); + conntrack->proto.tcp.seen[1].flags = 0; + conntrack->proto.tcp.seen[0].loose = + conntrack->proto.tcp.seen[1].loose = 0;
@@ -1147,8 +1066,8 @@ + * Let's try to use the data from the packet. + */ + conntrack->proto.tcp.seen[0].td_end = -+ SEGMENT_SEQ_PLUS_LEN(ntohl(tcph->seq), len, iph, tcph); -+ conntrack->proto.tcp.seen[0].td_maxwin = ntohs(tcph->window); ++ segment_seq_plus_len(ntohl(tcph.seq), skb->len, skb->nh.iph, &tcph); ++ conntrack->proto.tcp.seen[0].td_maxwin = ntohs(tcph.window); + if (conntrack->proto.tcp.seen[0].td_maxwin == 0) + conntrack->proto.tcp.seen[0].td_maxwin = 1; + conntrack->proto.tcp.seen[0].td_maxend =
@@ -1162,7 +1081,7 @@ + conntrack->proto.tcp.seen[0].loose = + conntrack->proto.tcp.seen[1].loose = ip_ct_tcp_loose; + } -+ ++ + conntrack->proto.tcp.seen[1].td_end = 0; + conntrack->proto.tcp.seen[1].td_maxend = 0; + conntrack->proto.tcp.seen[1].td_maxwin = 1;
@@ -1175,13 +1094,13 @@ + DEBUGP("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i receiver end=%u maxend=%u maxwin=%u scale=%i\n", + sender->td_end, sender->td_maxend, sender->td_maxwin, sender->td_scale, + receiver->td_end, receiver->td_maxend, receiver->td_maxwin, receiver->td_scale); - return 1; ++ return 1; } -diff -urN --exclude-from=/usr/src/diff.exclude linux-2.4.23-pending/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_conntrack_standalone.c ---- linux-2.4.23-pending/net/ipv4/netfilter/ip_conntrack_standalone.c 2003-12-04 16:56:14.000000000 +0100 -+++ linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_conntrack_standalone.c 2003-12-09 09:30:21.000000000 +0100 -@@ -289,6 +289,11 @@ + static int tcp_exp_matches_pkt(struct ip_conntrack_expect *exp, +--- linux-2.6.3-old/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-02-18 04:57:46.000000000 +0100 ++++ linux-2.6.3-patched/net/ipv4/netfilter/ip_conntrack_standalone.c 2004-03-07 19:12:08.000000000 +0100 +@@ -285,6 +285,11 @@ extern unsigned long ip_ct_tcp_timeout_last_ack; extern unsigned long ip_ct_tcp_timeout_time_wait; extern unsigned long ip_ct_tcp_timeout_close;
@@ -1193,7 +1112,7 @@ /* From ip_conntrack_proto_udp.c */ extern unsigned long ip_ct_udp_timeout; -@@ -345,6 +350,21 @@ +@@ -338,6 +343,21 @@ {NET_IPV4_NF_CONNTRACK_GENERIC_TIMEOUT, "ip_conntrack_generic_timeout", &ip_ct_generic_timeout, sizeof(unsigned int), 0644, NULL, &proc_dointvec_jiffies},
@@ -1215,15 +1134,29 @@ {0} }; -diff -urN --exclude-from=/usr/src/diff.exclude linux-2.4.23-pending/net/ipv4/netfilter/ip_nat_helper.c linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_nat_helper.c ---- linux-2.4.23-pending/net/ipv4/netfilter/ip_nat_helper.c 2003-11-28 19:26:21.000000000 +0100 -+++ linux-2.4.23-tcp-win/net/ipv4/netfilter/ip_nat_helper.c 2003-12-09 09:30:21.000000000 +0100 -@@ -452,6 +452,8 @@ +--- linux-2.6.3-old/net/ipv4/netfilter/ip_nat_helper.c 2004-02-18 04:57:17.000000000 +0100 ++++ linux-2.6.3-patched/net/ipv4/netfilter/ip_nat_helper.c 2004-03-07 20:07:27.000000000 +0100 +@@ -353,8 +353,8 @@ + enum ip_conntrack_info ctinfo) + { + struct tcphdr *tcph; +- int dir, newseq, newack; +- struct ip_nat_seq *this_way, *other_way; ++ int dir, newseq, newack, ret; ++ struct ip_nat_seq *this_way, *other_way; + + dir = CTINFO2DIR(ctinfo); - ip_nat_sack_adjust(skb, ct, ctinfo); +@@ -395,7 +395,11 @@ + tcph->seq = newseq; + tcph->ack_seq = newack; -+ ip_conntrack_tcp_update(skb, ct, dir); +- return ip_nat_sack_adjust(pskb, tcph, ct, ctinfo); ++ ret = ip_nat_sack_adjust(pskb, tcph, ct, ctinfo); ++ ++ ip_conntrack_tcp_update(*pskb, ct, dir); + - return 0; ++ return ret; } + static inline int
include/linux/netfilter_ipv4/ip_conntrack.h +5 -0
@@ -251,6 +251,11 @@/* Call me when a conntrack is destroyed. */ extern void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack); +/* Update TCP window tracking data when NAT mangles the packet */ +extern void ip_conntrack_tcp_update (struct sk_buff *skb, +struct ip_conntrack *conntrack, +int dir); +/* Returns new sk_buff, or NULL */ struct sk_buff *ip_ct_gather_frags (struct sk_buff *skb);
include/linux/netfilter_ipv4/ip_conntrack_tcp.h +25 -9
@@ -4,25 +4,41 @@enum tcp_conntrack {TCP_CONNTRACK_NONE , -TCP_CONNTRACK_ESTABLISHED ,TCP_CONNTRACK_SYN_SENT ,TCP_CONNTRACK_SYN_RECV , +TCP_CONNTRACK_ESTABLISHED ,TCP_CONNTRACK_FIN_WAIT , -TCP_CONNTRACK_TIME_WAIT , -TCP_CONNTRACK_CLOSE ,TCP_CONNTRACK_CLOSE_WAIT ,TCP_CONNTRACK_LAST_ACK , +TCP_CONNTRACK_TIME_WAIT , +TCP_CONNTRACK_CLOSE ,TCP_CONNTRACK_LISTEN , -TCP_CONNTRACK_MAX +TCP_CONNTRACK_MAX , +TCP_CONNTRACK_IGNORE +}; + +/* Window scaling is advertised by the sender */ +#define IP_CT_TCP_STATE_FLAG_WINDOW_SCALE 0x01 + +struct ip_ct_tcp_state { +u_int32_t td_end;/* max of seq + len */ +u_int32_t td_maxend;/* max of ack + max(win, 1) */ +u_int32_t td_maxwin;/* max(win) */ +u_int8_t td_scale;/* window scale factor */ +u_int8_t loose;/* used when connection picked up from the middle */ +u_int8_t flags;/* per direction state flags */ };struct ip_ct_tcp { -enum tcp_conntrack state; - -/* Poor man's window tracking: sequence number of valid ACK -handshake completion packet */ -u_int32_t handshake_ack; +struct ip_ct_tcp_state seen[2 ];/* connection parameters per direction */ +u_int8_t state;/* state of the connection (enum tcp_conntrack) */ +/* For detecting stale connections */ +u_int8_t last_dir;/* Direction of the last packet (enum ip_conntrack_dir) */ +u_int8_t retrans;/* Number of retransmitted packets */ +u_int8_t stored_seq;/* What is stored in last_seq */ +u_int32_t last_seq;/* Last sequence number seen in dir */ +u_int32_t last_end;/* Last seq + len */ };#endif /* _IP_CONNTRACK_TCP_H */
include/linux/sysctl.h +5 -0
@@ -380,6 +380,11 @@NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT_STREAM =11 ,NET_IPV4_NF_CONNTRACK_ICMP_TIMEOUT =12 ,NET_IPV4_NF_CONNTRACK_GENERIC_TIMEOUT =13 , +NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_MAX_RETRANS =15 , +NET_IPV4_NF_CONNTRACK_TCP_LOG_INVALID =16 , +NET_IPV4_NF_CONNTRACK_TCP_LOOSE =17 , +NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL =18 , + NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS=19, };/* /proc/sys/net/ipv6 */
net/ipv4/netfilter/ip_conntrack_core.c +6 -5
@@ -842,11 +842,12 @@IP_NF_ASSERT ((*pskb)->nfct); ret = proto->packet (ct, *pskb, ctinfo); -if (ret ==-1 ) { -/* Invalid */ -nf_conntrack_put ((*pskb)->nfct); - (*pskb)->nfct =NULL ; -return NF_ACCEPT ; +if (ret <0 ) { +/* Invalid: inverse of the return code tells +* to the netfilter core what to do. */ +nf_conntrack_put ((*pskb)->nfct); + (*pskb)->nfct =NULL ; +return -ret; }if (ret !=NF_DROP && ct->helper) {
net/ipv4/netfilter/ip_conntrack_proto_tcp.c +786 -109
993 lines not on this page · raw message
net/ipv4/netfilter/ip_conntrack_standalone.c +20 -0
@@ -285,6 +285,11 @@extern unsigned long ip_ct_tcp_timeout_last_ack;extern unsigned long ip_ct_tcp_timeout_time_wait;extern unsigned long ip_ct_tcp_timeout_close; +extern unsigned long ip_ct_tcp_timeout_max_retrans; +extern int ip_ct_tcp_log_invalid; +extern int ip_ct_tcp_loose; +extern int ip_ct_tcp_be_liberal; +extern int ip_ct_tcp_max_retrans;/* From ip_conntrack_proto_udp.c */ extern unsigned long ip_ct_udp_timeout;
@@ -338,6 +343,21 @@ {NET_IPV4_NF_CONNTRACK_GENERIC_TIMEOUT ,"ip_conntrack_generic_timeout" , &ip_ct_generic_timeout,sizeof (unsigned int ),0644 ,NULL , &proc_dointvec_jiffies}, + {NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_MAX_RETRANS, "ip_conntrack_tcp_timeout_max_retrans", + &ip_ct_tcp_timeout_max_retrans,sizeof (unsigned int ),0644 ,NULL , + &proc_dointvec_jiffies}, + {NET_IPV4_NF_CONNTRACK_TCP_LOG_INVALID, "ip_conntrack_tcp_log_invalid", + &ip_ct_tcp_log_invalid,sizeof (unsigned int ),0644 ,NULL , + &proc_dointvec}, + {NET_IPV4_NF_CONNTRACK_TCP_LOOSE, "ip_conntrack_tcp_loose", + &ip_ct_tcp_loose,sizeof (unsigned int ),0644 ,NULL , + &proc_dointvec}, + {NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL, "ip_conntrack_tcp_be_liberal", + &ip_ct_tcp_be_liberal,sizeof (unsigned int ),0644 ,NULL , + &proc_dointvec}, + {NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS, "ip_conntrack_tcp_max_retrans", + &ip_ct_tcp_max_retrans,sizeof (unsigned int ),0644 ,NULL , + &proc_dointvec}, {0} };
net/ipv4/netfilter/ip_nat_helper.c +7 -3
@@ -353,8 +353,8 @@ enum ip_conntrack_info ctinfo) {struct tcphdr *tcph; -int dir, newseq, newack; -struct ip_nat_seq *this_way, *other_way; +int dir, newseq, newack, ret; +struct ip_nat_seq *this_way, *other_way; dir =CTINFO2DIR (ctinfo);
@@ -395,7 +395,11 @@ tcph->seq = newseq; tcph->ack_seq = newack; -return ip_nat_sack_adjust (pskb, tcph, ct, ctinfo); + ret =ip_nat_sack_adjust (pskb, tcph, ct, ctinfo); + +ip_conntrack_tcp_update (*pskb, ct, dir); + +return ret; } static inline int
Hi Pablo,
Quoted 3 lines · Pablo Neira
I spent my sunday evening in porting the tcp window tracking system to the 2.6.x tree. Attached to this email the incremental fix to the CVS and the merge to the 2.6.x tree.
Sorry, that was a waste of time. I had already done the porting, but because pom-ng is not fully ready yet, I haven't put it into the cvs.
Quoted 2 lines
- I drop the old helpers modifications. I think that they are not needed anymore.
Yes, true.
Quoted 3 lines
- I commented all the
nf_log_ipstuff because the API has changed for 2.6.x tree and I was sure of the correct use of the new one (nf_log_packet?).
Yes, the interface changed. The raw patch in pom-ng is also ported to 2.6 and uses the new API.
Quoted 2 lines
BTW I think that I experimented some problems with the nf-log patch for 2.6.x tree, I'll have a look at them.
Please report if you find any problem with it. The cvs contains the lates version, which should work.
Best regards,
Jozsef
-
E-mail : [email protected], [email protected] PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary
Hi Jozsef,
Quoted 4 lines · Jozsef Kadlecsik
Sorry, that was a waste of time. I had already done the porting, but because pom-ng is not fully ready yet, I haven't put it into the cvs.
It's ok, it wasn't a full waste of time. I learnt a bit about the current implementation which was one of my goal as well as spending my sunday evening on something interesting I think. When I started doing the porting I also thought about this possibility. :-)
Quoted 9 lines
Quoted 4 lines
BTW I think that I experimented some problems with the nf-log patch for 2.6.x tree, I'll have a look at them.
Please report if you find any problem with it. The cvs contains the lates version, which should work.
ok, I'll have a look at it calmly and if I find something I'll let you know.
regards,
Pablo
Quoted 6 lines · Jozsef Kadlecsik
Quoted 3 lines
I spent my sunday evening in porting the tcp window tracking system to the 2.6.x tree. Attached to this email the incremental fix to the CVS and the merge to the 2.6.x tree.
Sorry, that was a waste of time. I had already done the porting, but because pom-ng is not fully ready yet, I haven't put it into the cvs.
I have added my 2.6 port of the tcp-window-tracking code to pom-ng in cvs.
Best regards,
Jozsef
-
E-mail : [email protected], [email protected] PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary