Commit 495dcb56 authored by Gao Feng's avatar Gao Feng Committed by Pablo Neira Ayuso

netfilter: SYNPROXY: Return NF_STOLEN instead of NF_DROP during handshaking

Current SYNPROXY codes return NF_DROP during normal TCP handshaking,
it is not friendly to caller. Because the nf_hook_slow would treat
the NF_DROP as an error, and return -EPERM.
As a result, it may cause the top caller think it meets one error.

For example, the following codes are from cfv_rx_poll()
	err = netif_receive_skb(skb);
	if (unlikely(err)) {
		++cfv->ndev->stats.rx_dropped;
	} else {
		++cfv->ndev->stats.rx_packets;
		cfv->ndev->stats.rx_bytes += skb_len;
	}
When SYNPROXY returns NF_DROP, then netif_receive_skb returns -EPERM.
As a result, the cfv driver would treat it as an error, and increase
the rx_dropped counter.

So use NF_STOLEN instead of NF_DROP now because there is no error
happened indeed, and free the skb directly.
Signed-off-by: default avatarGao Feng <fgao@ikuai8.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent aee12a0a
...@@ -293,12 +293,16 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par) ...@@ -293,12 +293,16 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
XT_SYNPROXY_OPT_ECN); XT_SYNPROXY_OPT_ECN);
synproxy_send_client_synack(net, skb, th, &opts); synproxy_send_client_synack(net, skb, th, &opts);
return NF_DROP; consume_skb(skb);
return NF_STOLEN;
} else if (th->ack && !(th->fin || th->rst || th->syn)) { } else if (th->ack && !(th->fin || th->rst || th->syn)) {
/* ACK from client */ /* ACK from client */
synproxy_recv_client_ack(net, skb, th, &opts, ntohl(th->seq)); if (synproxy_recv_client_ack(net, skb, th, &opts, ntohl(th->seq))) {
return NF_DROP; consume_skb(skb);
return NF_STOLEN;
} else {
return NF_DROP;
}
} }
return XT_CONTINUE; return XT_CONTINUE;
...@@ -367,10 +371,13 @@ static unsigned int ipv4_synproxy_hook(void *priv, ...@@ -367,10 +371,13 @@ static unsigned int ipv4_synproxy_hook(void *priv,
* number match the one of first SYN. * number match the one of first SYN.
*/ */
if (synproxy_recv_client_ack(net, skb, th, &opts, if (synproxy_recv_client_ack(net, skb, th, &opts,
ntohl(th->seq) + 1)) ntohl(th->seq) + 1)) {
this_cpu_inc(snet->stats->cookie_retrans); this_cpu_inc(snet->stats->cookie_retrans);
consume_skb(skb);
return NF_DROP; return NF_STOLEN;
} else {
return NF_DROP;
}
} }
synproxy->isn = ntohl(th->ack_seq); synproxy->isn = ntohl(th->ack_seq);
......
...@@ -307,12 +307,17 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par) ...@@ -307,12 +307,17 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
XT_SYNPROXY_OPT_ECN); XT_SYNPROXY_OPT_ECN);
synproxy_send_client_synack(net, skb, th, &opts); synproxy_send_client_synack(net, skb, th, &opts);
return NF_DROP; consume_skb(skb);
return NF_STOLEN;
} else if (th->ack && !(th->fin || th->rst || th->syn)) { } else if (th->ack && !(th->fin || th->rst || th->syn)) {
/* ACK from client */ /* ACK from client */
synproxy_recv_client_ack(net, skb, th, &opts, ntohl(th->seq)); if (synproxy_recv_client_ack(net, skb, th, &opts, ntohl(th->seq))) {
return NF_DROP; consume_skb(skb);
return NF_STOLEN;
} else {
return NF_DROP;
}
} }
return XT_CONTINUE; return XT_CONTINUE;
...@@ -388,10 +393,13 @@ static unsigned int ipv6_synproxy_hook(void *priv, ...@@ -388,10 +393,13 @@ static unsigned int ipv6_synproxy_hook(void *priv,
* number match the one of first SYN. * number match the one of first SYN.
*/ */
if (synproxy_recv_client_ack(net, skb, th, &opts, if (synproxy_recv_client_ack(net, skb, th, &opts,
ntohl(th->seq) + 1)) ntohl(th->seq) + 1)) {
this_cpu_inc(snet->stats->cookie_retrans); this_cpu_inc(snet->stats->cookie_retrans);
consume_skb(skb);
return NF_DROP; return NF_STOLEN;
} else {
return NF_DROP;
}
} }
synproxy->isn = ntohl(th->ack_seq); synproxy->isn = ntohl(th->ack_seq);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment