Connection Tracking able to ignore TCP RST under specific conditions?

[Erik Schweigert <ejschweigert@gmail.com>]

Hello all,

Problem:

I have run into a network implementation that doesn't conform to the
normal. What occurs is a TCP session will do a:

1. SYN
2. SYN,ACK
3. ACK
4. RST,ACK <---- at which point this closes the connection and the
firewall blocks the rest of the connection
5. SYN <--- The whole sequence is re-done but this time without the RST,ACK
6. SYN,ACK
7. ACK .
8. PSH,ACK

To permit this traffic initially I have created a connection tracking
helper, the problem is that the RST,ACK removes the expectation for
this session. So when the (5) SYN comes in after the (4)RST,ACK the
firewall blocks the connection.

Attempts:

I have tried creating 2 identical expectations, but the RST,ACK clears
both as the port/ip matches on both.  Another thought I had was to
create a timer to insert another expectation after a certain time
period (not a fan of this idea).

Suggestions:?

Is there a way I can trap the RST,ACK...or ignore the RST,ACK if I
have seen 1,2,3 above?

Erik
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html