netfilter: SYNPROXY: Return NF_STOLEN instead of NF_DROP during handshaking
authorGao Feng <fgao@ikuai8.com>
Thu, 20 Apr 2017 06:01:45 +0000 (14:01 +0800)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 26 Apr 2017 07:30:22 +0000 (09:30 +0200)
commit495dcb56d09ddb63afe30e799af41876c3f061cc
treea1f3b7af426436ea25763e5c8f5fe58d29c63263
parentaee12a0a3727e16fb837367c4755cb6daaf45109
netfilter: SYNPROXY: Return NF_STOLEN instead of NF_DROP during handshaking

Current SYNPROXY codes return NF_DROP during normal TCP handshaking,
it is not friendly to caller. Because the nf_hook_slow would treat
the NF_DROP as an error, and return -EPERM.
As a result, it may cause the top caller think it meets one error.

For example, the following codes are from cfv_rx_poll()
err = netif_receive_skb(skb);
if (unlikely(err)) {
++cfv->ndev->stats.rx_dropped;
} else {
++cfv->ndev->stats.rx_packets;
cfv->ndev->stats.rx_bytes += skb_len;
}
When SYNPROXY returns NF_DROP, then netif_receive_skb returns -EPERM.
As a result, the cfv driver would treat it as an error, and increase
the rx_dropped counter.

So use NF_STOLEN instead of NF_DROP now because there is no error
happened indeed, and free the skb directly.

Signed-off-by: Gao Feng <fgao@ikuai8.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv4/netfilter/ipt_SYNPROXY.c
net/ipv6/netfilter/ip6t_SYNPROXY.c