Commit 495dcb56 authored by Gao Feng's avatar Gao Feng Committed by Pablo Neira Ayuso
Browse files

netfilter: SYNPROXY: Return NF_STOLEN instead of NF_DROP during handshaking 



Current SYNPROXY codes return NF_DROP during normal TCP handshaking,
it is not friendly to caller. Because the nf_hook_slow would treat
the NF_DROP as an error, and return -EPERM.
As a result, it may cause the top caller think it meets one error.

For example, the following codes are from cfv_rx_poll()
	err = netif_receive_skb(skb);
	if (unlikely(err)) {
		++cfv->ndev->stats.rx_dropped;
	} else {
		++cfv->ndev->stats.rx_packets;
		cfv->ndev->stats.rx_bytes += skb_len;
	}
When SYNPROXY returns NF_DROP, then netif_receive_skb returns -EPERM.
As a result, the cfv driver would treat it as an error, and increase
the rx_dropped counter.

So use NF_STOLEN instead of NF_DROP now because there is no error
happened indeed, and free the skb directly.

Signed-off-by: default avatarGao Feng <fgao@ikuai8.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent aee12a0a

net/ipv4/netfilter/ipt_SYNPROXY.c

+14 −7
Original line number Diff line number Diff line
@@ -293,13 +293,17 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par) 
					  XT_SYNPROXY_OPT_ECN);



		synproxy_send_client_synack(net, skb, th, &opts);

		return NF_DROP;



		consume_skb(skb);

		return NF_STOLEN;

	} else if (th->ack && !(th->fin || th->rst || th->syn)) {

		/* ACK from client */

		synproxy_recv_client_ack(net, skb, th, &opts, ntohl(th->seq));

		if (synproxy_recv_client_ack(net, skb, th, &opts, ntohl(th->seq))) {

			consume_skb(skb);

			return NF_STOLEN;

		} else {

			return NF_DROP;

		}

	}



	return XT_CONTINUE;

}
@@ -367,11 +371,14 @@ static unsigned int ipv4_synproxy_hook(void *priv, 
			 * number match the one of first SYN.

			 */

			if (synproxy_recv_client_ack(net, skb, th, &opts,

						     ntohl(th->seq) + 1))

						     ntohl(th->seq) + 1)) {

				this_cpu_inc(snet->stats->cookie_retrans);



				consume_skb(skb);

				return NF_STOLEN;

			} else {

				return NF_DROP;

			}

		}



		synproxy->isn = ntohl(th->ack_seq);

		if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)

net/ipv6/netfilter/ip6t_SYNPROXY.c

+14 −6
Original line number Diff line number Diff line
@@ -307,13 +307,18 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par) 
					  XT_SYNPROXY_OPT_ECN);



		synproxy_send_client_synack(net, skb, th, &opts);

		return NF_DROP;

		consume_skb(skb);

		return NF_STOLEN;



	} else if (th->ack && !(th->fin || th->rst || th->syn)) {

		/* ACK from client */

		synproxy_recv_client_ack(net, skb, th, &opts, ntohl(th->seq));

		if (synproxy_recv_client_ack(net, skb, th, &opts, ntohl(th->seq))) {

			consume_skb(skb);

			return NF_STOLEN;

		} else {

			return NF_DROP;

		}

	}



	return XT_CONTINUE;

}
@@ -388,11 +393,14 @@ static unsigned int ipv6_synproxy_hook(void *priv, 
			 * number match the one of first SYN.

			 */

			if (synproxy_recv_client_ack(net, skb, th, &opts,

						     ntohl(th->seq) + 1))

						     ntohl(th->seq) + 1)) {

				this_cpu_inc(snet->stats->cookie_retrans);



				consume_skb(skb);

				return NF_STOLEN;

			} else {

				return NF_DROP;

			}

		}



		synproxy->isn = ntohl(th->ack_seq);

		if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)

CRA Git | Maintained and supported by SUSTech CRA and CCSE