diff options
| author | /C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org </C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org> | 2007-09-12 12:48:34 +0000 |
|---|---|---|
| committer | /C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org </C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org> | 2007-09-12 12:48:34 +0000 |
| commit | f23d9e790a27d29462c2fb6185253349375cef12 (patch) | |
| tree | 42ac552d6b21210abefc1a4e9a812e688456264e /src/cache_iterators.c | |
| parent | e5dce422389f6740b1eccd38b6e2583b893a15a9 (diff) | |
Remove window tracking disabling limitation (requires Linux kernel >= 2.6.22)
Diffstat (limited to 'src/cache_iterators.c')
| -rw-r--r-- | src/cache_iterators.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/src/cache_iterators.c b/src/cache_iterators.c index 36f7364..287f92f 100644 --- a/src/cache_iterators.c +++ b/src/cache_iterators.c @@ -78,6 +78,7 @@ void cache_dump(struct cache *c, int fd, int type) static int do_commit(void *data1, void *data2) { int ret; + u_int8_t flags; struct cache *c = data1; struct us_conntrack *u = data2; struct nf_conntrack *ct = u->ct; @@ -97,10 +98,14 @@ static int do_commit(void *data1, void *data2) */ nfct_set_attr_u32(ct, ATTR_TIMEOUT, CONFIG(commit_timeout)); - if (ret == -1) { - dlog(STATE(log), "failed to build: %s", strerror(errno)); - return 0; - } + /* + * TCP flags to overpass window tracking for recovered connections + */ + flags = IP_CT_TCP_FLAG_BE_LIBERAL | IP_CT_TCP_FLAG_SACK_PERM; + nfct_set_attr_u8(ct, ATTR_TCP_FLAGS_ORIG, flags); + nfct_set_attr_u8(ct, ATTR_TCP_MASK_ORIG, flags); + nfct_set_attr_u8(ct, ATTR_TCP_FLAGS_REPL, flags); + nfct_set_attr_u8(ct, ATTR_TCP_MASK_REPL, flags); ret = nfct_query(STATE(dump), NFCT_Q_CREATE_UPDATE, ct); if (ret == -1) { |