Jozsef Kadlecsik 874ab9233e netfilter: nf_ct_tcp: TCP simultaneous open support
The patch below adds supporting TCP simultaneous open to conntrack. The
unused LISTEN state is replaced by a new state (SYN_SENT2) denoting the
second SYN sent from the reply direction in the new case. The state table
is updated and the function tcp_in_window is modified to handle
simultaneous open.

The functionality can fairly easily be tested by socat. A sample tcpdump
recording

23:21:34.244733 IP (tos 0x0, ttl 64, id 49224, offset 0, flags [DF], proto TCP (6), length 60) 192.168.0.254.2020 > 192.168.0.1.2020: S, cksum 0xe75f (correct), 3383710133:3383710133(0) win 5840 <mss 1460,sackOK,timestamp 173445629 0,nop,wscale 7>
23:21:34.244783 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) 192.168.0.1.2020 > 192.168.0.254.2020: R, cksum 0x0253 (correct), 0:0(0) ack 3383710134 win 0
23:21:36.038680 IP (tos 0x0, ttl 64, id 28092, offset 0, flags [DF], proto TCP (6), length 60) 192.168.0.1.2020 > 192.168.0.254.2020: S, cksum 0x704b (correct), 2634546729:2634546729(0) win 5840 <mss 1460,sackOK,timestamp 824213 0,nop,wscale 1>
23:21:36.038777 IP (tos 0x0, ttl 64, id 49225, offset 0, flags [DF], proto TCP (6), length 60) 192.168.0.254.2020 > 192.168.0.1.2020: S, cksum 0xb179 (correct), 3383710133:3383710133(0) ack 2634546730 win 5840 <mss 1460,sackOK,timestamp 173447423 824213,nop,wscale 7>
23:21:36.038847 IP (tos 0x0, ttl 64, id 28093, offset 0, flags [DF], proto TCP (6), length 52) 192.168.0.1.2020 > 192.168.0.254.2020: ., cksum 0xebad (correct), ack 3383710134 win 2920 <nop,nop,timestamp 824213 173447423>

and the corresponding netlink events:

    [NEW] tcp      6 120 SYN_SENT src=192.168.0.254 dst=192.168.0.1 sport=2020 dport=2020 [UNREPLIED] src=192.168.0.1 dst=192.168.0.254 sport=2020 dport=2020
 [UPDATE] tcp      6 120 LISTEN src=192.168.0.254 dst=192.168.0.1 sport=2020 dport=2020 src=192.168.0.1 dst=192.168.0.254 sport=2020 dport=2020
 [UPDATE] tcp      6 60 SYN_RECV src=192.168.0.254 dst=192.168.0.1 sport=2020 dport=2020 src=192.168.0.1 dst=192.168.0.254 sport=2020 dport=2020
 [UPDATE] tcp      6 432000 ESTABLISHED src=192.168.0.254 dst=192.168.0.1 sport=2020 dport=2020 src=192.168.0.1 dst=192.168.0.254 sport=2020 dport=2020 [ASSURED]

The RST packet was dropped in the raw table, thus it did not reach
conntrack.  nfnetlink_conntrack is unpatched so it shows the new SYN_SENT2
state as the old unused LISTEN.

With TCP simultaneous open support we satisfy REQ-2 in RFC 5382  ;-) .

Additional minor correction in this patch is that in order to catch
uninitialized reply directions, "td_maxwin == 0" is used instead of
"td_end == 0" because the former can't be true except in uninitialized
state while td_end may accidentally be equal to zero in the mid of a
connection.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2009-06-02 13:58:56 +02:00
..
2009-04-07 10:23:34 +01:00
2009-03-18 19:45:11 -07:00
2009-03-05 14:39:32 -05:00
2009-01-30 23:38:03 +05:30
2009-01-21 14:02:19 -08:00
2009-01-30 23:38:37 +05:30
2009-02-12 09:40:14 +11:00
2009-04-01 08:59:23 -07:00
2009-01-30 23:39:42 +05:30
2009-04-01 08:59:23 -07:00
2009-01-30 23:40:06 +05:30
2009-05-02 15:36:10 -07:00
2009-04-22 08:35:10 +02:00
2009-04-23 10:06:35 +01:00
2009-01-30 23:44:08 +05:30
2009-04-03 14:53:32 -07:00
2009-03-27 14:43:59 -04:00
2009-03-01 00:19:35 -08:00
2009-01-30 23:46:03 +05:30
2009-04-03 14:53:32 -07:00
2009-01-30 23:46:40 +05:30
2009-01-30 23:48:33 +05:30
2009-02-10 00:41:26 +01:00
2009-03-16 08:32:27 -06:00
2009-02-18 15:37:56 -08:00
2009-03-30 15:14:53 +02:00
2009-01-30 23:51:17 +05:30
2009-04-03 09:48:29 -07:00
2009-01-30 23:51:41 +05:30
2009-04-08 14:13:03 +02:00
2009-04-02 19:04:53 -07:00
2009-01-30 23:52:16 +05:30
2009-01-30 23:53:12 +05:30
2009-01-30 23:53:40 +05:30
2009-01-30 23:54:53 +05:30
2009-01-30 23:55:45 +05:30
2009-01-30 23:56:13 +05:30
2009-01-30 23:56:48 +05:30
2009-05-19 16:02:02 -07:00
2009-01-30 23:57:16 +05:30
2009-02-11 15:27:15 +11:00
2009-02-02 21:40:58 +05:30
2009-04-13 15:04:29 -07:00
2009-04-21 13:41:48 -07:00
2009-04-21 13:41:48 -07:00
2009-01-30 23:58:41 +05:30
2009-01-30 23:59:44 +05:30
2009-01-31 00:00:06 +05:30
2009-05-09 10:49:41 -04:00
2009-01-22 10:18:58 +01:00
2009-04-06 16:06:26 +01:00
2009-04-01 08:59:17 -07:00
2009-01-21 10:39:51 +01:00
2009-04-07 08:12:38 +02:00
2009-04-29 17:32:35 -07:00
2009-01-31 00:00:35 +05:30
2009-05-25 00:55:45 -07:00
2009-04-02 19:04:48 -07:00
2009-03-26 10:56:35 -07:00
2009-01-31 00:01:11 +05:30
2009-03-20 10:48:14 -07:00
2009-01-14 18:09:02 +01:00
2009-03-15 19:59:13 -07:00
2009-04-03 17:41:23 -07:00
2009-04-01 13:28:15 -04:00
2009-04-03 17:41:12 -07:00
2009-03-10 20:33:18 -04:00
2009-04-30 15:32:11 +00:00
2009-04-01 08:59:13 -07:00
2009-04-01 08:59:13 -07:00
2009-01-31 00:02:54 +05:30
2009-01-08 08:31:12 -08:00
2009-01-31 00:03:40 +05:30
2009-04-24 08:54:21 +02:00
2009-04-01 08:59:13 -07:00
2009-03-13 16:09:12 -07:00
2009-03-30 15:22:01 +02:00
2009-03-26 02:18:35 +01:00
2009-01-31 00:05:59 +05:30
2009-02-26 23:42:11 -08:00
2009-03-30 14:28:58 -07:00
2009-04-22 16:54:27 -04:00
2009-05-09 10:49:41 -04:00
2009-04-01 08:59:24 -07:00
2009-02-16 00:03:10 -08:00
2009-04-08 14:33:38 -07:00
2009-01-29 16:56:32 +09:00
2009-02-27 16:53:50 +09:00
2009-04-13 15:04:29 -07:00
2009-01-31 00:06:33 +05:30
2009-05-18 22:11:22 -07:00
2009-04-03 12:23:06 +02:00
2009-02-20 17:57:48 -08:00
2009-04-21 19:40:00 -07:00
2009-04-03 12:23:06 +02:00
2009-04-27 02:45:02 -07:00
2009-03-27 12:18:56 -04:00
2009-01-31 00:07:00 +05:30
2009-04-01 08:59:15 -07:00
2009-04-02 19:05:01 -07:00
2009-02-18 15:37:53 -08:00
2009-02-03 11:23:12 +11:00
2009-03-26 18:14:21 +01:00
2009-04-17 10:50:27 -07:00