On Fri, Jul 28, 2017 at 02:03:04PM +0800, Lin Zhang wrote:
> In function {ipv4,ipv6}_synproxy_hook we expect a normal tcp packet,
> but the real server maybe reply an icmp error packet related to the
> exist tcp conntrack, so we will access wrong tcp data.
>
> For fix it, we simply pass IP_CT_RELATED_REPLY packets.
>
> Signed-off-by: Lin Zhang <[email protected]>
> ---
> net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +-
> net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c
> b/net/ipv4/netfilter/ipt_SYNPROXY.c
> index f1528f7..3971fd9 100644
> --- a/net/ipv4/netfilter/ipt_SYNPROXY.c
> +++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
> @@ -330,7 +330,7 @@ static unsigned int ipv4_synproxy_hook(void *priv,
> if (synproxy == NULL)
> return NF_ACCEPT;
>
> - if (nf_is_loopback_packet(skb))
> + if (nf_is_loopback_packet(skb) || ctinfo == IP_CT_RELATED_REPLY)
If the intention is to inspect TCP traffic only, I would suggest you
just check for the protocol field here instead. So we are sure we only
deal with TCP traffic indeed.
Thanks.
