diff options
| author |   Ole Troan <ot@cisco.com> | 2022-03-17 11:58:38 +0100 |
|---|---|---|
| committer |   Ole Tr�an <otroan@employees.org> | 2022-04-21 10:35:58 +0000 |
| commit | 5297447bd64ab253ab3ab3e144605dd39f995f12 (patch) | |
| tree | d351435893287349ebb9ca5736a627ff53cc28f9 /src/svm/svm_test.c | |
| parent | e0c875551fa0cd49131671be0f521801e06764f8 (diff) | |
nat: tweak rfc7857 tcp connection tracking
The RFC7857 state machine introduced in 56c492a is a trade-off.
It tries to retain sessions as much as possible and also offers
some protection against spurious RST by re-establishing sessions if data
is received after the RST. From experience in the wild, this algorithm is
a little too liberal, as it leaves too many spurious established sessions
in the session table.
E.g. a oberserved pattern is:
client server
<- FIN, ACK
ACK ->
ACK ->
RST, ACK ->
With the current state machine this would leave the session in established state.
These proposed changes do:
- require 3-way handshake to establish session.
(current requires only to see SYNs from both sides)
- RST will move session to transitory without recovery if data is sent after
- Only a single FIN is needed to move to transitory
Fixes: 56c492aa0502751de2dd9d890096a82c5f04776d
Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I92e593e00b2efe48d04997642d85bd59e0eaa2ea
Signed-off-by: Ole Troan <ot@cisco.com>
Diffstat (limited to 'src/svm/svm_test.c')
0 files changed, 0 insertions, 0 deletions