netdev - Re: [PATCH] netfilter: don't scale the size of the window up twice

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 4 Apr 2012 17:08:54 +0200
From:	Pablo Neira Ayuso <pablo@...filter.org>
To:	Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>
Cc:	Patrick McHardy <kaber@...sh.net>,
	"David S. Miller" <davem@...emloft.net>,
	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org,
	Changli Gao <xiaosuo@...il.com>
Subject: Re: [PATCH] netfilter: don't scale the size of the window up twice

On Mon, Apr 02, 2012 at 11:25:06AM +0800, Changli Gao wrote:
> For a picked up connection, the window win is scaled twice: one is by the
> initialization code, and the other is by the sender updating code.
> 
> I use the temporary variable swin instead of modifying the variable win.
> 
> Signed-off-by: Changli Gao <xiaosuo@...il.com>
> ---
>  net/netfilter/nf_conntrack_proto_tcp.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
> index 361eade..0d07a1d 100644
> --- a/net/netfilter/nf_conntrack_proto_tcp.c
> +++ b/net/netfilter/nf_conntrack_proto_tcp.c
> @@ -584,8 +584,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
>  			 * Let's try to use the data from the packet.
>  			 */
>  			sender->td_end = end;
> -			win <<= sender->td_scale;
> -			sender->td_maxwin = (win == 0 ? 1 : win);
> +			swin = win << sender->td_scale;
> +			sender->td_maxwin = (swin == 0 ? 1 : swin);
>  			sender->td_maxend = end + sender->td_maxwin;
>  			/*
>  			 * We haven't seen traffic in the other direction yet

Jozsef, do you remember if this is intentional?

I'm going to test this patch in my testbed to make sure this does not
break conntrackd.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html