netfilter: SYNPROXY: fix sending window update to client
authorPhil Sutter <phil@nwl.cc>
Mon, 27 Jul 2015 22:53:26 +0000 (00:53 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 10 Aug 2015 11:55:07 +0000 (13:55 +0200)
commit3c16241c445303a90529565e7437e1f240acfef2
treed487541d2b43e7d8ded82679feecde7d25c1601d
parent96fffb4f23f124f297d51dedc9cf51d19eb88ee1
netfilter: SYNPROXY: fix sending window update to client

Upon receipt of SYNACK from the server, ipt_SYNPROXY first sends back an ACK to
finish the server handshake, then calls nf_ct_seqadj_init() to initiate
sequence number adjustment of forwarded packets to the client and finally sends
a window update to the client to unblock it's TX queue.

Since synproxy_send_client_ack() does not set synproxy_send_tcp()'s nfct
parameter, no sequence number adjustment happens and the client receives the
window update with incorrect sequence number. Depending on client TCP
implementation, this leads to a significant delay (until a window probe is
being sent).

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv4/netfilter/ipt_SYNPROXY.c
net/ipv6/netfilter/ip6t_SYNPROXY.c