On Thu, Sep 13, 2018 at 2:55 AM Darrell Ball <[email protected]> wrote: > > Thanks for looking MingJie > > > On Wed, Sep 12, 2018 at 2:16 AM, Zang MingJie <[email protected]> wrote: >> >> When encounter an invalid packet, all changes made by the packet should >> be reverted. Currently an invalid packet can change the seq number while >> the connection is in SEQ_RECV state. > > > > Did you notice this check ? > > if (src->state < CT_DPIF_TCPS_SYN_SENT) { > /* First packet from this end. Set its state */
Yes, this is exactly where we found the problem. If first reply packet is invalid, it masses all following packets. > > > >> >> >> Signed-off-by: Zang MingJie <[email protected]> >> --- >> lib/conntrack-tcp.c | 10 ++++++++-- >> 1 file changed, 8 insertions(+), 2 deletions(-) >> >> diff --git a/lib/conntrack-tcp.c b/lib/conntrack-tcp.c >> index 86d313d28..7443a3293 100644 >> --- a/lib/conntrack-tcp.c >> +++ b/lib/conntrack-tcp.c >> @@ -151,9 +151,9 @@ tcp_conn_update(struct conn *conn_, struct >> conntrack_bucket *ctb, >> struct conn_tcp *conn = conn_tcp_cast(conn_); >> struct tcp_header *tcp = dp_packet_l4(pkt); >> /* The peer that sent 'pkt' */ >> - struct tcp_peer *src = &conn->peer[reply ? 1 : 0]; >> + struct tcp_peer orig_src, *src = &conn->peer[reply ? 1 : 0]; >> /* The peer that should receive 'pkt' */ >> - struct tcp_peer *dst = &conn->peer[reply ? 0 : 1]; >> + struct tcp_peer orig_dst, *dst = &conn->peer[reply ? 0 : 1]; >> uint8_t sws = 0, dws = 0; >> uint16_t tcp_flags = TCP_FLAGS(tcp->tcp_ctl); >> >> @@ -187,6 +187,10 @@ tcp_conn_update(struct conn *conn_, struct >> conntrack_bucket *ctb, >> dws = TCP_MAX_WSCALE; >> } >> >> + >> + orig_src = *src; >> + orig_dst = *dst; >> + >> /* >> * Sequence tracking algorithm from Guido van Rooij's paper: >> * http://www.madison-gurkha.com/publications/tcp_filtering/ >> @@ -385,6 +389,8 @@ tcp_conn_update(struct conn *conn_, struct >> conntrack_bucket *ctb, >> src->state = dst->state = CT_DPIF_TCPS_TIME_WAIT; >> } >> } else { >> + *src = orig_src; >> + *dst = orig_dst; >> return CT_UPDATE_INVALID; >> } >> >> -- >> 2.19.0.rc1 >> >> _______________________________________________ >> dev mailing list >> [email protected] >> https://mail.openvswitch.org/mailman/listinfo/ovs-dev > > _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
