]> git.ipfire.org Git - people/ms/suricata.git/commit
stream: tcp: Handle retransmitted SYN with TSval fix-broken-tcp-connections
authorMichael Tremer <michael.tremer@ipfire.org>
Fri, 11 Mar 2022 11:08:10 +0000 (11:08 +0000)
committerMichael Tremer <michael.tremer@ipfire.org>
Tue, 3 May 2022 11:15:15 +0000 (11:15 +0000)
commitada6981ea7bf99a94e0854e55f1fc88b4f39dd4e
treec88f1ef205bf1b62ecfc02da759172680718ad8c
parent3a490fb16c939a2c23c5625d6757850391844433
stream: tcp: Handle retransmitted SYN with TSval

For connections that use TCP timestamps for which the first SYN packet
does not reach the server, any replies to retransmitted SYNs will be
tropped.

This is happening in StateSynSentValidateTimestamp, where the timestamp
value in a SYN-ACK packet must match the one from the SYN packet.
However, since the server never received the first SYN packet, it will
respond with an updated timestamp from any of the following SYN packets.

The timestamp value inside suricata is not being updated at any time
which should happen. This patch fixes that problem.

This problem was introduced in 9f0294fadca3dcc18c919424242a41e01f3e8318.

Fixes: #4649 - https://redmine.openinfosecfoundation.org/issues/4649
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
src/stream-tcp.c