From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.223.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76F503B4E9D for ; Tue, 26 May 2026 21:58:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=195.135.223.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779832732; cv=none; b=Wokjp9AB14KI3203gUBv9+Y60NAkdg07ejQqD/4CSfFeK66Xkibf7sC0ioqL/nEAT4oWoZwuqtigI4CJ1AtT7sPe7ihEHK3CClh0OMgqbdbMNjkMSkkiOJCtdOwHiGR9cQpynkT/0YfimNbKlaGNF358DpFdWsIk6On0Q6LtRUY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779832732; c=relaxed/simple; bh=rtD48gbCesQ/D7jcQPUyMafQfuCFKt72YgVmVuRvES4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Sj1V70m37QlfWjXf2Rmjt+Q9+zJRyQXY61EFVsGNKcLnogUvKOuJ/QK5eG2dZPbdL6Brz3BNM/ZKaOZLCFY32zuG6qvGnArnOxe3HLXjcPxi/cRaYlf4pUobHKuoOQVjQFKc25pdA0OKv84edukSrfHyiYDLHt1dS9v/qjqmOpc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=suse.de; spf=pass smtp.mailfrom=suse.de; arc=none smtp.client-ip=195.135.223.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=suse.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.de Received: from imap1.dmz-prg2.suse.org (imap1.dmz-prg2.suse.org [IPv6:2a07:de40:b281:104:10:150:64:97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id D4E7266D5A; Tue, 26 May 2026 21:58:49 +0000 (UTC) Authentication-Results: smtp-out2.suse.de; none Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 6ED205A419; Tue, 26 May 2026 21:58:49 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id 2MgZGJkXFmrTZAAAD6G6ig (envelope-from ); Tue, 26 May 2026 21:58:49 +0000 From: Fernando Fernandez Mancera To: netfilter-devel@vger.kernel.org Cc: coreteam@netfilter.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc, Fernando Fernandez Mancera Subject: [PATCH 2/5 nf-next v4] netfilter: synproxy: adjust duplicate timestamp options Date: Tue, 26 May 2026 23:58:28 +0200 Message-ID: <20260526215831.6726-3-fmancera@suse.de> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260526215831.6726-1-fmancera@suse.de> References: <20260526215831.6726-1-fmancera@suse.de> Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Rspamd-Queue-Id: D4E7266D5A X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spam-Flag: NO X-Rspamd-Action: no action X-Spam-Level: X-Rspamd-Server: rspamd2.dmz-prg2.suse.org X-Spam-Score: -4.00 X-Spamd-Result: default: False [-4.00 / 50.00]; REPLY(-4.00)[] RFC 9293 does not mention anything about duplicated options and each networking stack handles it in their own way. Currently, Linux kernel is processing options sequentially and in case of duplicated timestamp options, the value from the latest one overrides the others. As SYNPROXY is modifying only the first timestamp option found, a packet can reach the backend server and it might parse the wrong timestamp value. Let's just continue parsing the following options and in case a duplicated timestamp is found, adjust it too. Fixes: 48b1de4c110a ("netfilter: add SYNPROXY core/target") Signed-off-by: Fernando Fernandez Mancera --- net/netfilter/nf_synproxy_core.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c index e523b64bf839..6bd63f5ab75d 100644 --- a/net/netfilter/nf_synproxy_core.c +++ b/net/netfilter/nf_synproxy_core.c @@ -229,7 +229,6 @@ synproxy_tstamp_adjust(struct sk_buff *skb, unsigned int protoff, } inet_proto_csum_replace4(&th->check, skb, old, *ptr, false); - return true; } optoff += op[1]; } -- 2.53.0