netdev - Please backport commit to 3.12+

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 6 Nov 2015 17:21:19 +0100
From:	Willy Tarreau <w@....eu>
To:	stable@...nel.org
Cc:	netfilter-devel@...r.kernel.org, davem@...emloft.net,
	netdev@...r.kernel.org, Pablo Neira Ayuso <pablo@...filter.org>
Subject: Please backport commit to 3.12+

Hi,

We recently faced the issue described in the patch below on 3.14.56. This fix
was merged in 4.2-rc7. I checked Davem's queue and stable queue and it's not
there yet. Could we please have it in 3.12 and above ? (feature was introduced
in 3.11). I can confirm that it properly fixes the problem for us.

Mainline commit is :

  commit 3c16241c445303a90529565e7437e1f240acfef2
  Author: Phil Sutter <phil@....cc>
  Date:   Tue Jul 28 00:53:26 2015 +0200

    netfilter: SYNPROXY: fix sending window update to client
    
    Upon receipt of SYNACK from the server, ipt_SYNPROXY first sends back an ACK to
    finish the server handshake, then calls nf_ct_seqadj_init() to initiate
    sequence number adjustment of forwarded packets to the client and finally sends
    a window update to the client to unblock it's TX queue.
    
    Since synproxy_send_client_ack() does not set synproxy_send_tcp()'s nfct
    parameter, no sequence number adjustment happens and the client receives the
    window update with incorrect sequence number. Depending on client TCP
    implementation, this leads to a significant delay (until a window probe is
    being sent).
    
    Signed-off-by: Phil Sutter <phil@....cc>
    Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org>

Thanks,
Willy

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html