* [PATCH] [NETFILTER]: Allow SYN+PSH as valid flag combination
[not found] ` <20051111.114801.112784817.davem@davemloft.net>
@ 2005-11-12 10:39 ` Harald Welte
2005-11-12 20:14 ` David S. Miller
0 siblings, 1 reply; 2+ messages in thread
From: Harald Welte @ 2005-11-12 10:39 UTC (permalink / raw)
To: David S. Miller; +Cc: Linux Netdev List, netfilter-devel, vlad, kaber
[-- Attachment #1: Type: text/plain, Size: 2544 bytes --]
On Fri, Nov 11, 2005 at 11:48:01AM -0800, David S. Miller wrote:
> From: Patrick McHardy <kaber@trash.net>
> Date: Fri, 11 Nov 2005 14:58:01 +0100
>
> > Unfortunately this is unlikely to happen, and if Linux itself
> > accepts SYN|PSH, I don't see a reason why ip_conntrack shouldn't
> > as well.
>
> I totally agree.
Me, too. However, we also need to update nf_conntrack now:
[NETFILTER] {ip,nf}_conntrack TCP: Accept SYN+PUSH like SYN
Some devices (e.g. Qlogic iSCSI HBA hardware like QLA4010 up to firmware
3.0.0.4) initiates TCP with SYN and PUSH flags set.
The Linux TCP/IP stack deals fine with that, but the connection tracking
code doesn't.
This patch alters TCP connection tracking to accept SYN+PUSH as a valid
flag combination.
Signed-off-by: Vlad Drukker <vlad@storewiz.com>
Signed-off-by: Harald Welte <laforge@netfilter.org>
---
commit 933c4adfa34fbc151dd9908b2ce59335b22e6fe4
tree 041e7fc4116cd3b2774429cf8da9caee6e77a74b
parent 106c77b9b51b61bcd926ab5100761b2832791b74
author Harald Welte <laforge@netfilter.org> Sat, 12 Nov 2005 11:36:56 +0100
committer Harald Welte <laforge@netfilter.org> Sat, 12 Nov 2005 11:36:56 +0100
net/ipv4/netfilter/ip_conntrack_proto_tcp.c | 1 +
net/netfilter/nf_conntrack_proto_tcp.c | 1 +
2 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -814,6 +814,7 @@ static u8 tcp_valid_flags[(TH_FIN|TH_SYN
{
[TH_SYN] = 1,
[TH_SYN|TH_ACK] = 1,
+ [TH_SYN|TH_PUSH] = 1,
[TH_SYN|TH_ACK|TH_PUSH] = 1,
[TH_RST] = 1,
[TH_RST|TH_ACK] = 1,
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -779,6 +779,7 @@ static u8 tcp_valid_flags[(TH_FIN|TH_SYN
{
[TH_SYN] = 1,
[TH_SYN|TH_ACK] = 1,
+ [TH_SYN|TH_PUSH] = 1,
[TH_SYN|TH_ACK|TH_PUSH] = 1,
[TH_RST] = 1,
[TH_RST|TH_ACK] = 1,
--
- Harald Welte <laforge@netfilter.org> http://netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread