From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 05/12] netfilter: conntrack: lower timeout to RETRANS seconds if window is 0
Date: Wed, 13 Dec 2017 19:45:13 +0100 [thread overview]
Message-ID: <20171213184520.8193-6-pablo@netfilter.org> (raw)
In-Reply-To: <20171213184520.8193-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
When zero window is announced we can get into a situation where
connection stays around forever:
1. One side announces zero window.
2. Other side closes.
In this case, no FIN is sent (stuck in send queue).
Unless other side opens the window up again conntrack
stays in ESTABLISHED state for a very long time.
Lets alleviate this by lowering the timeout to RETRANS (5 minutes),
the other end should be sending zero window probes to keep the
connection established as long as a socket still exists.
Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_proto_tcp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index b12fc07111d0..37ef35b861f2 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1039,6 +1039,9 @@ static int tcp_packet(struct nf_conn *ct,
IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
timeout = timeouts[TCP_CONNTRACK_UNACK];
+ else if (ct->proto.tcp.last_win == 0 &&
+ timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
+ timeout = timeouts[TCP_CONNTRACK_RETRANS];
else
timeout = timeouts[new_state];
spin_unlock_bh(&ct->lock);
--
2.11.0
next prev parent reply other threads:[~2017-12-13 18:45 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-13 18:45 [PATCH 00/12] Netfilter fixes for net Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 01/12] netfilter: remove redundant assignment to e Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 02/12] netfilter: exit_net cleanup check added Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 03/12] netfilter: nf_ct_h323: Convert CHECK_BOUND macro to function Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 04/12] netfilter: nf_ct_h323: Extend nf_h323_error_boundary to work on bits as well Pablo Neira Ayuso
2017-12-13 18:45 ` Pablo Neira Ayuso [this message]
2017-12-13 18:45 ` [PATCH 06/12] netfilter: conntrack: clamp timeouts to INT_MAX Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 07/12] netfilter: nfnetlink_cthelper: Add missing permission checks Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 08/12] netfilter: xt_bpf: add overflow checks Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 09/12] netfilter: xt_osf: Add missing permission checks Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 10/12] netfilter: ipt_CLUSTERIP: fix clusterip_net_exit build regression Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 11/12] netfilter: exthdr: add missign attributes to policy Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 12/12] netfilter: ip6t_MASQUERADE: add dependency on conntrack module Pablo Neira Ayuso
2017-12-13 19:13 ` [PATCH 00/12] Netfilter fixes for net David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171213184520.8193-6-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).