Jesper Dangaard Brouer b3cad287d1 conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition ... In compliance with RFC5961, the network stack send challenge ACK in response to spurious SYN packets, since commit 0c228e833c ("tcp: Restore RFC5961-compliant behavior for SYN packets"). This pose a problem for netfilter conntrack in state LAST_ACK, because this challenge ACK is (falsely) seen as ACKing last FIN, causing a false state transition (into TIME_WAIT). The challenge ACK is hard to distinguish from real last ACK. Thus, solution introduce a flag that tracks the potential for seeing a challenge ACK, in case a SYN packet is let through and current state is LAST_ACK. When conntrack transition LAST_ACK to TIME_WAIT happens, this flag is used for determining if we are expecting a challenge ACK. Scapy based reproducer script avail here: https://github.com/netoptimizer/network-testing/blob/master/scapy/tcp_hacks_3WHS_LAST_ACK.py Fixes: 0c228e833c ("tcp: Restore RFC5961-compliant behavior for SYN packets") Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2015-05-15 20:50:56 +02:00
..
asm-generic	errno.h: Improve ENOSYS's comment	2015-04-17 09:03:58 -04:00
drm	drm/nouveau/gem: allow user-space to specify an object should be coherent	2015-04-14 17:00:46 +10:00
linux	conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition	2015-05-15 20:50:56 +02:00
misc	cxl: Add documentation for userspace APIs	2014-10-08 20:16:19 +11:00
mtd	mtd: lpddr: add driver for LPDDR2-NVM PCM memories	2014-05-20 17:45:17 -07:00
rdma	IB/core: Add on demand paging caps to ib_uverbs_ex_query_device	2015-02-18 08:36:26 -08:00
scsi
sound	ALSA: asound.h - use SNDRV_CTL_ELEM_ID_NAME_MAXLEN	2015-04-18 09:05:55 +02:00
video
xen	xen: install xen/gntdev.h and xen/gntalloc.h	2014-02-11 10:12:36 -05:00
Kbuild	cxl: Add userspace header file	2014-10-08 20:15:57 +11:00