lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tproxy: kick out TIME_WAIT sockets in case a new connection comes in with the same tuple

Browse Source 
Without tproxy redirections an incoming SYN kicks out conflicting
TIME_WAIT sockets, in order to handle clients that reuse ports
within the TIME_WAIT period.

The same mechanism didn't work in case TProxy is involved in finding
the proper socket, as the time_wait processing code looked up the
listening socket assuming that the listener addr/port matches those
of the established connection.

This is not the case with TProxy as the listener addr/port is possibly
changed with the tproxy rule.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
Signed-off-by: KOVACS Krisztian <hidden@balabit.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Balazs Scheidler
2010-10-21 12:45:14 +02:00
committed by Patrick McHardy
parent d86bef73b4
commit 106e4c26b1
4 changed files with 90 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
include/net/netfilter/nf_tproxy_core.h
View File

@@ -8,12 +8,16 @@
#include <net/inet_sock.h>
#include <net/tcp.h>
#define NFT_LOOKUP_ANY 0
#define NFT_LOOKUP_LISTENER 1
#define NFT_LOOKUP_ESTABLISHED 2
/* look up and get a reference to a matching socket */
extern struct sock *
nf_tproxy_get_sock_v4(struct net *net, const u8 protocol,
const __be32 saddr, const __be32 daddr,
const __be16 sport, const __be16 dport,
const struct net_device *in, bool listening);
const struct net_device *in, int lookup_type);
static inline void
nf_tproxy_put_sock(struct sock *sk)