netfilter: synproxy: fix reset of ct seqadj when reopening a connection

Browse source

SYNPROXY is resetting conntrack seqadj when a closed connection is
re-opened, but it was using nf_ct_seqadj_init() which is a no-op for a
zero offset.

This patch introduces nf_ct_seqadj_reset() which sets the offset values
directly to zero and avoid setting IPS_SEQ_ADJUST_BIT flag, it changes
SYNPROXY code to use it when needed.

Fixes: 48b1de4c11 ("netfilter: add SYNPROXY core/target")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Fernando Fernandez Mancera 2026-08-19 12:24:08 +02:00 • committed by Pablo Neira Ayuso

parent 014d795c73

commit a8708aa9fe

3 changed files with 20 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

include/net/netfilter/nf_conntrack_seqadj.h

View file

17

net/netfilter/nf_conntrack_seqadj.c

View file

4

net/netfilter/nf_synproxy_core.c

View file