]> git.ipfire.org Git - thirdparty/suricata.git/commit
stream: tcp: Handle retransmitted SYN with TSval
authorMichael Tremer <michael.tremer@ipfire.org>
Fri, 11 Mar 2022 11:08:10 +0000 (11:08 +0000)
committerVictor Julien <vjulien@oisf.net>
Tue, 14 Jun 2022 08:11:29 +0000 (10:11 +0200)
commit117278cb77d9015a1014316cfc055c20bfdd653c
treeee57aec446479a0e950417867a4d1dd5395f786f
parent85cad60b55cbe3a54cd11b93e894babf362b7de4
stream: tcp: Handle retransmitted SYN with TSval

For connections that use TCP timestamps for which the first SYN packet
does not reach the server, any replies to retransmitted SYNs will be
tropped.

This is happening in StateSynSentValidateTimestamp, where the timestamp
value in a SYN-ACK packet must match the one from the SYN packet.
However, since the server never received the first SYN packet, it will
respond with an updated timestamp from any of the following SYN packets.

The timestamp value inside suricata is not being updated at any time
which should happen. This patch fixes that problem.

Bug: #4376.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
(cherry picked from commit f50af12068d0af529acdaa4e45f0d4acc8c372d1)
src/stream-tcp.c