netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst

Browse source

In case the endpoints and conntrack go out-of-sync, i.e. there is
disagreement wrt. validy of sequence/ack numbers between conntracks
internal state and those of the endpoints, connections can hang for a
long time (until ESTABLISHED timeout).

This adds a check to detect a fin/fin exchange even if those are
invalid.  The timeout is then lowered to UNACKED (default 300s).

Signed-off-by: Florian Westphal <fw@strlen.de>

...

This commit is contained in:

Florian Westphal 2022-08-26 15:32:27 +02:00

parent 09a59001b0

commit 628d694344

1 changed files with 58 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

58

net/netfilter/nf_conntrack_proto_tcp.c

View file