From: Fernando Fernandez Mancera Date: Tue, 26 May 2026 21:58:28 +0000 (+0200) Subject: netfilter: synproxy: adjust duplicate timestamp options X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=22bb132cfb9b94847d52d73614284b8c5ea8d36e;p=thirdparty%2Fkernel%2Fstable.git netfilter: synproxy: adjust duplicate timestamp options RFC 9293 does not mention anything about duplicated options and each networking stack handles it in their own way. Currently, Linux kernel is processing options sequentially and in case of duplicated timestamp options, the value from the latest one overrides the others. As SYNPROXY is modifying only the first timestamp option found, a packet can reach the backend server and it might parse the wrong timestamp value. Let's just continue parsing the following options and in case a duplicated timestamp is found, adjust it too. Fixes: 48b1de4c110a ("netfilter: add SYNPROXY core/target") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso --- diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c index f99c22f57b7e..a0bcf188810d 100644 --- a/net/netfilter/nf_synproxy_core.c +++ b/net/netfilter/nf_synproxy_core.c @@ -233,7 +233,6 @@ synproxy_tstamp_adjust(struct sk_buff *skb, unsigned int protoff, } inet_proto_csum_replace4(&th->check, skb, old, *ptr, false); - return true; } optoff += op[1]; }