summaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2009-06-29 14:07:56 +0200
committerPatrick McHardy <kaber@trash.net>2009-06-29 14:07:56 +0200
commita3a9f79e361e864f0e9d75ebe2a0cb43d17c4272 (patch)
treee38bb7cc051cf197a813d553713e3071d375a1b9 /include
parent308ff823ebd749a94d3b6ac26b95bc0eb114c39e (diff)
downloadop-kernel-dev-a3a9f79e361e864f0e9d75ebe2a0cb43d17c4272.zip
op-kernel-dev-a3a9f79e361e864f0e9d75ebe2a0cb43d17c4272.tar.gz
netfilter: tcp conntrack: fix unacknowledged data detection with NAT
When NAT helpers change the TCP packet size, the highest seen sequence number needs to be corrected. This is currently only done upwards, when the packet size is reduced the sequence number is unchanged. This causes TCP conntrack to falsely detect unacknowledged data and decrease the timeout. Fix by updating the highest seen sequence number in both directions after packet mangling. Tested-by: Krzysztof Piotr Oledzki <ole@ans.pl> Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'include')
-rw-r--r--include/net/netfilter/nf_conntrack.h4
1 files changed, 2 insertions, 2 deletions
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index a632689..cbdd628 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -258,8 +258,8 @@ static inline bool nf_ct_kill(struct nf_conn *ct)
/* Update TCP window tracking data when NAT mangles the packet */
extern void nf_conntrack_tcp_update(const struct sk_buff *skb,
unsigned int dataoff,
- struct nf_conn *ct,
- int dir);
+ struct nf_conn *ct, int dir,
+ s16 offset);
/* Fake conntrack entry for untracked connections */
extern struct nf_conn nf_conntrack_untracked;
OpenPOWER on IntegriCloud