Allow final ack in some cases

lixmal · lixmal · commit da4914191c0d · 2024-12-25T23:51:31.000+01:00
diff --git a/client/firewall/uspfilter/conntrack/tcp.go b/client/firewall/uspfilter/conntrack/tcp.go
@@ -277,6 +277,11 @@ func (t *TCPTracker) isValidStateForFlags(state TCPState, flags uint8) bool {
 		return flags&TCPFin != 0 || flags&TCPAck != 0
 	case TCPStateLastAck:
 		return flags&TCPAck != 0
+	case TCPStateClosed:
+		// Accept retransmitted ACKs in closed state
+		// This is important because the final ACK might be lost
+		// and the peer will retransmit their FIN-ACK
+		return flags&TCPAck != 0
 	}
 	return false
 }

Original file line number	Diff line number	Diff line change
`@@ -277,6 +277,11 @@ func (t *TCPTracker) isValidStateForFlags(state TCPState, flags uint8) bool {`
`277`	`277`	`return flags&TCPFin != 0 \|\| flags&TCPAck != 0`
`278`	`278`	`case TCPStateLastAck:`
`279`	`279`	`return flags&TCPAck != 0`
	`280`	`+ case TCPStateClosed:`
	`281`	`+ // Accept retransmitted ACKs in closed state`
	`282`	`+ // This is important because the final ACK might be lost`
	`283`	`+ // and the peer will retransmit their FIN-ACK`
	`284`	`+ return flags&TCPAck != 0`
`280`	`285`	`}`
`281`	`286`	`return false`
`282`	`287`	`}`