* [PATCH 0/2 nf-next] Fix mss value announced to the client
@ 2019-07-10 10:05 Fernando Fernandez Mancera
2019-07-10 10:05 ` [PATCH 1/2 nf-next] netfilter: synproxy: fix erroneous tcp mss option Fernando Fernandez Mancera
2019-07-10 10:05 ` [PATCH 2/2 nf-next] netfilter: synproxy: rename mss synproxy_options field Fernando Fernandez Mancera
0 siblings, 2 replies; 6+ messages in thread
From: Fernando Fernandez Mancera @ 2019-07-10 10:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: Fernando Fernandez Mancera
This is a port of Ibrahim's patch. It includes all the changes requested and it
also fixes the mss value announced in the nftables synproxy module. Maybe it
would be a good idea to squash it so please feel free to do it. :-)
Fernando Fernandez Mancera (2):
netfilter: synproxy: fix erroneous tcp mss option
netfilter: synproxy: rename mss synproxy_options field
include/net/netfilter/nf_conntrack_synproxy.h | 3 ++-
net/ipv4/netfilter/ipt_SYNPROXY.c | 2 ++
net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 ++
net/netfilter/nf_synproxy_core.c | 12 ++++++------
net/netfilter/nft_synproxy.c | 2 ++
5 files changed, 14 insertions(+), 7 deletions(-)
--
2.20.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2 nf-next] netfilter: synproxy: fix erroneous tcp mss option
2019-07-10 10:05 [PATCH 0/2 nf-next] Fix mss value announced to the client Fernando Fernandez Mancera
@ 2019-07-10 10:05 ` Fernando Fernandez Mancera
2019-07-16 11:21 ` Pablo Neira Ayuso
2019-07-10 10:05 ` [PATCH 2/2 nf-next] netfilter: synproxy: rename mss synproxy_options field Fernando Fernandez Mancera
1 sibling, 1 reply; 6+ messages in thread
From: Fernando Fernandez Mancera @ 2019-07-10 10:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: Fernando Fernandez Mancera
Now synproxy sends the mss value set by the user on client syn-ack packet
instead of the mss value that client announced.
Fixes: 48b1de4c110a ("netfilter: add SYNPROXY core/target")
Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
---
include/net/netfilter/nf_conntrack_synproxy.h | 1 +
net/ipv4/netfilter/ipt_SYNPROXY.c | 2 ++
net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 ++
net/netfilter/nf_synproxy_core.c | 4 ++--
net/netfilter/nft_synproxy.c | 2 ++
5 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/include/net/netfilter/nf_conntrack_synproxy.h b/include/net/netfilter/nf_conntrack_synproxy.h
index 8f00125b06f4..44513b93bd55 100644
--- a/include/net/netfilter/nf_conntrack_synproxy.h
+++ b/include/net/netfilter/nf_conntrack_synproxy.h
@@ -68,6 +68,7 @@ struct synproxy_options {
u8 options;
u8 wscale;
u16 mss;
+ u16 mss_encode;
u32 tsval;
u32 tsecr;
};
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 8e7f84ec783d..0e70f3f65f6f 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -36,6 +36,8 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
opts.options |= XT_SYNPROXY_OPT_ECN;
opts.options &= info->options;
+ opts.mss_encode = opts.mss;
+ opts.mss = info->mss;
if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
synproxy_init_timestamp_cookie(info, &opts);
else
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index e77ea1ed5edd..5cdb4a69d277 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -36,6 +36,8 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
opts.options |= XT_SYNPROXY_OPT_ECN;
opts.options &= info->options;
+ opts.mss_encode = opts.mss;
+ opts.mss = info->mss;
if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
synproxy_init_timestamp_cookie(info, &opts);
else
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index b101f187eda8..09718e5a9e41 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -470,7 +470,7 @@ synproxy_send_client_synack(struct net *net,
struct iphdr *iph, *niph;
struct tcphdr *nth;
unsigned int tcp_hdr_size;
- u16 mss = opts->mss;
+ u16 mss = opts->mss_encode;
iph = ip_hdr(skb);
@@ -884,7 +884,7 @@ synproxy_send_client_synack_ipv6(struct net *net,
struct ipv6hdr *iph, *niph;
struct tcphdr *nth;
unsigned int tcp_hdr_size;
- u16 mss = opts->mss;
+ u16 mss = opts->mss_encode;
iph = ipv6_hdr(skb);
diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
index 80060ade8a5b..928e661d1517 100644
--- a/net/netfilter/nft_synproxy.c
+++ b/net/netfilter/nft_synproxy.c
@@ -31,6 +31,8 @@ static void nft_synproxy_tcp_options(struct synproxy_options *opts,
opts->options |= NF_SYNPROXY_OPT_ECN;
opts->options &= priv->info.options;
+ opts->mss_encode = opts->mss;
+ opts->mss = info->mss;
if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
synproxy_init_timestamp_cookie(info, opts);
else
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2 nf-next] netfilter: synproxy: rename mss synproxy_options field
2019-07-10 10:05 [PATCH 0/2 nf-next] Fix mss value announced to the client Fernando Fernandez Mancera
2019-07-10 10:05 ` [PATCH 1/2 nf-next] netfilter: synproxy: fix erroneous tcp mss option Fernando Fernandez Mancera
@ 2019-07-10 10:05 ` Fernando Fernandez Mancera
2019-07-16 11:22 ` Pablo Neira Ayuso
1 sibling, 1 reply; 6+ messages in thread
From: Fernando Fernandez Mancera @ 2019-07-10 10:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: Fernando Fernandez Mancera
After introduce "mss_encode" field in the synproxy_options struct the field
"mss" is a little confusing. It has been renamed to "mss_option".
Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
---
include/net/netfilter/nf_conntrack_synproxy.h | 2 +-
net/ipv4/netfilter/ipt_SYNPROXY.c | 4 ++--
net/ipv6/netfilter/ip6t_SYNPROXY.c | 4 ++--
net/netfilter/nf_synproxy_core.c | 8 ++++----
net/netfilter/nft_synproxy.c | 4 ++--
5 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/include/net/netfilter/nf_conntrack_synproxy.h b/include/net/netfilter/nf_conntrack_synproxy.h
index 44513b93bd55..2f0171d24997 100644
--- a/include/net/netfilter/nf_conntrack_synproxy.h
+++ b/include/net/netfilter/nf_conntrack_synproxy.h
@@ -67,7 +67,7 @@ static inline struct synproxy_net *synproxy_pernet(struct net *net)
struct synproxy_options {
u8 options;
u8 wscale;
- u16 mss;
+ u16 mss_option;
u16 mss_encode;
u32 tsval;
u32 tsecr;
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 0e70f3f65f6f..748dc3ce58d3 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -36,8 +36,8 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
opts.options |= XT_SYNPROXY_OPT_ECN;
opts.options &= info->options;
- opts.mss_encode = opts.mss;
- opts.mss = info->mss;
+ opts.mss_encode = opts.mss_option;
+ opts.mss_option = info->mss;
if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
synproxy_init_timestamp_cookie(info, &opts);
else
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index 5cdb4a69d277..fd1f52a21bf1 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -36,8 +36,8 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
opts.options |= XT_SYNPROXY_OPT_ECN;
opts.options &= info->options;
- opts.mss_encode = opts.mss;
- opts.mss = info->mss;
+ opts.mss_encode = opts.mss_option;
+ opts.mss_option = info->mss;
if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
synproxy_init_timestamp_cookie(info, &opts);
else
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index 09718e5a9e41..6676a3842a0c 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -56,7 +56,7 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
switch (opcode) {
case TCPOPT_MSS:
if (opsize == TCPOLEN_MSS) {
- opts->mss = get_unaligned_be16(ptr);
+ opts->mss_option = get_unaligned_be16(ptr);
opts->options |= NF_SYNPROXY_OPT_MSS;
}
break;
@@ -115,7 +115,7 @@ synproxy_build_options(struct tcphdr *th, const struct synproxy_options *opts)
if (options & NF_SYNPROXY_OPT_MSS)
*ptr++ = htonl((TCPOPT_MSS << 24) |
(TCPOLEN_MSS << 16) |
- opts->mss);
+ opts->mss_option);
if (options & NF_SYNPROXY_OPT_TIMESTAMP) {
if (options & NF_SYNPROXY_OPT_SACK_PERM)
@@ -642,7 +642,7 @@ synproxy_recv_client_ack(struct net *net,
}
this_cpu_inc(snet->stats->cookie_valid);
- opts->mss = mss;
+ opts->mss_option = mss;
opts->options |= NF_SYNPROXY_OPT_MSS;
if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
@@ -1060,7 +1060,7 @@ synproxy_recv_client_ack_ipv6(struct net *net,
}
this_cpu_inc(snet->stats->cookie_valid);
- opts->mss = mss;
+ opts->mss_option = mss;
opts->options |= NF_SYNPROXY_OPT_MSS;
if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
index 928e661d1517..db4c23f5dfcb 100644
--- a/net/netfilter/nft_synproxy.c
+++ b/net/netfilter/nft_synproxy.c
@@ -31,8 +31,8 @@ static void nft_synproxy_tcp_options(struct synproxy_options *opts,
opts->options |= NF_SYNPROXY_OPT_ECN;
opts->options &= priv->info.options;
- opts->mss_encode = opts->mss;
- opts->mss = info->mss;
+ opts->mss_encode = opts->mss_option;
+ opts->mss_option = info->mss;
if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
synproxy_init_timestamp_cookie(info, opts);
else
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2 nf-next] netfilter: synproxy: fix erroneous tcp mss option
2019-07-10 10:05 ` [PATCH 1/2 nf-next] netfilter: synproxy: fix erroneous tcp mss option Fernando Fernandez Mancera
@ 2019-07-16 11:21 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-16 11:21 UTC (permalink / raw)
To: Fernando Fernandez Mancera; +Cc: netfilter-devel
On Wed, Jul 10, 2019 at 12:05:57PM +0200, Fernando Fernandez Mancera wrote:
> Now synproxy sends the mss value set by the user on client syn-ack packet
> instead of the mss value that client announced.
Applied to nf.git, thanks Fernando.
Could you also make a backport of this patch? Use kernel 5.1 as
reference, you should take Ibrahim's patch and adapt it to place the
mss_encode in the synproxy_options.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2 nf-next] netfilter: synproxy: rename mss synproxy_options field
2019-07-10 10:05 ` [PATCH 2/2 nf-next] netfilter: synproxy: rename mss synproxy_options field Fernando Fernandez Mancera
@ 2019-07-16 11:22 ` Pablo Neira Ayuso
2019-08-03 16:39 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-16 11:22 UTC (permalink / raw)
To: Fernando Fernandez Mancera; +Cc: netfilter-devel
On Wed, Jul 10, 2019 at 12:05:59PM +0200, Fernando Fernandez Mancera wrote:
> After introduce "mss_encode" field in the synproxy_options struct the field
> "mss" is a little confusing. It has been renamed to "mss_option".
This patch 2/2 will be sitting in the queue until until nf-next merge
window opens up again. I'll leave it here in patchwork so I don't
forget.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2 nf-next] netfilter: synproxy: rename mss synproxy_options field
2019-07-16 11:22 ` Pablo Neira Ayuso
@ 2019-08-03 16:39 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-08-03 16:39 UTC (permalink / raw)
To: Fernando Fernandez Mancera; +Cc: netfilter-devel
On Tue, Jul 16, 2019 at 01:22:43PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Jul 10, 2019 at 12:05:59PM +0200, Fernando Fernandez Mancera wrote:
> > After introduce "mss_encode" field in the synproxy_options struct the field
> > "mss" is a little confusing. It has been renamed to "mss_option".
>
> This patch 2/2 will be sitting in the queue until until nf-next merge
> window opens up again. I'll leave it here in patchwork so I don't
> forget.
Patch is applied, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-08-03 16:40 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-10 10:05 [PATCH 0/2 nf-next] Fix mss value announced to the client Fernando Fernandez Mancera
2019-07-10 10:05 ` [PATCH 1/2 nf-next] netfilter: synproxy: fix erroneous tcp mss option Fernando Fernandez Mancera
2019-07-16 11:21 ` Pablo Neira Ayuso
2019-07-10 10:05 ` [PATCH 2/2 nf-next] netfilter: synproxy: rename mss synproxy_options field Fernando Fernandez Mancera
2019-07-16 11:22 ` Pablo Neira Ayuso
2019-08-03 16:39 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).