netfilter: SYNPROXY: let unrelated packets continue

Packets reaching SYNPROXY were default dropped, as they were most
likely invalid (given the recommended state matching).  This
patch, changes SYNPROXY target to let packets, not consumed,
continue being processed by the stack.

This will be more in line other target modules. As it will allow
more flexible configurations of handling, logging or matching on
packets in INVALID states.

Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 90e489eb1c0a346cfe0c5c15cf52900f908f0a2f..67e17dcda65e64f27b9ca5b244561ab2d7fc594f 100644 (file)
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -285,11 +285,15 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
                                          XT_SYNPROXY_OPT_ECN);
 
                synproxy_send_client_synack(skb, th, &opts);
-       } else if (th->ack && !(th->fin || th->rst || th->syn))
+               return NF_DROP;
+
+       } else if (th->ack && !(th->fin || th->rst || th->syn)) {
                /* ACK from client */
                synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq));
+               return NF_DROP;
+       }
 
-       return NF_DROP;
+       return XT_CONTINUE;
 }
 
 static unsigned int ipv4_synproxy_hook(unsigned int hooknum,

diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index a5af0bfef126973938786e98028acbcb767dea53..19cfea8dbcaa0547c85e40f4217105ef46c7b683 100644 (file)
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -300,11 +300,15 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                                          XT_SYNPROXY_OPT_ECN);
 
                synproxy_send_client_synack(skb, th, &opts);
-       } else if (th->ack && !(th->fin || th->rst || th->syn))
+               return NF_DROP;
+
+       } else if (th->ack && !(th->fin || th->rst || th->syn)) {
                /* ACK from client */
                synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq));
+               return NF_DROP;
+       }
 
-       return NF_DROP;
+       return XT_CONTINUE;
 }
 
 static unsigned int ipv6_synproxy_hook(unsigned int hooknum,