From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: PATCH: "invalid SYNIN=" - a patch and a question Date: Thu, 11 Oct 2007 06:04:39 +0200 Message-ID: <470DA0D7.10803@trash.net> References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit Cc: Krzysztof Oledzki , Netfilter Developer Mailing List To: Jozsef Kadlecsik Return-path: Received: from stinky.trash.net ([213.144.137.162]:46829 "EHLO stinky.trash.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750810AbXJKEEo (ORCPT ); Thu, 11 Oct 2007 00:04:44 -0400 In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org List-Id: netfilter-devel.vger.kernel.org Jozsef Kadlecsik wrote: > With your description I could reproduce the bug and actually you were > completely right: the code above is incorrect. Somehow I was able to > misread RFC1122 and mixed the roles :-(: > > When a connection is >>closed actively<<, it MUST linger in > TIME-WAIT state for a time 2xMSL (Maximum Segment Lifetime). > However, it MAY >>accept<< a new SYN from the remote TCP to > reopen the connection directly from TIME-WAIT state, if it: > [...] > > The fix is as follows: if the receiver initiated an active close, then the > sender may reopen the connection - otherwise try to figure out if we hold > a dead connection. > > Signed-off-by: Jozsef Kadlecsik Applied, thanks Jozsef. I'll push this to -stable once it hits upstream.