diff options
| author |   Florian Westphal <fw@strlen.de> | 2017-11-19 21:27:28 +0100 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2017-11-20 13:30:24 +0100 |
| commit | fbcd253d2448b8f168241e38f629a36c4c8c1e94 (patch) | |
| tree | f9b255dc45fa4d29bccdad5f379a48cc7c565999 /net/netfilter/nf_conntrack_proto_tcp.c | |
| parent | netfilter: nf_ct_h323: Extend nf_h323_error_boundary to work on bits as well (diff) | |
| download | linux-dev-fbcd253d2448b8f168241e38f629a36c4c8c1e94.tar.xz linux-dev-fbcd253d2448b8f168241e38f629a36c4c8c1e94.zip | |
netfilter: conntrack: lower timeout to RETRANS seconds if window is 0
When zero window is announced we can get into a situation where
connection stays around forever:
1. One side announces zero window.
2. Other side closes.
In this case, no FIN is sent (stuck in send queue).
Unless other side opens the window up again conntrack
stays in ESTABLISHED state for a very long time.
Lets alleviate this by lowering the timeout to RETRANS (5 minutes),
the other end should be sending zero window probes to keep the
connection established as long as a socket still exists.
Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_conntrack_proto_tcp.c')
| -rw-r--r-- | net/netfilter/nf_conntrack_proto_tcp.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c index b12fc07111d0..37ef35b861f2 100644 --- a/net/netfilter/nf_conntrack_proto_tcp.c +++ b/net/netfilter/nf_conntrack_proto_tcp.c @@ -1039,6 +1039,9 @@ static int tcp_packet(struct nf_conn *ct, IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED && timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK]) timeout = timeouts[TCP_CONNTRACK_UNACK]; + else if (ct->proto.tcp.last_win == 0 && + timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS]) + timeout = timeouts[TCP_CONNTRACK_RETRANS]; else timeout = timeouts[new_state]; spin_unlock_bh(&ct->lock); |