netfilter: nf_conntrack: allow server to become a client in TW handling
netfilter: nf_conntrack: allow server to become a client in TW handling

When a port that was used to listen for inbound connections gets closed
and reused for outgoing connections (like rsh ends up doing for stderr
flow), current we may reject the SYN/ACK packet for the new connection
because tcp_conntracks states forbirds a port to become a client while
there is still a TIME_WAIT entry in there for it.

As TCP may expire the TIME_WAIT socket in 60s and conntrack's timeout
for it is 120s, there is a ~60s window that the application can end up
opening a port that conntrack will end up blocking.

This patch fixes this by simply allowing such state transition: if we
see a SYN, in TIME_WAIT state, on REPLY direction, move it to sSS. Note
that the rest of the code already handles this situation, more
specificly in tcp_packet(), first switch clause.

Signed-off-by: Marcelo Ricardo Leitner <518d07701a80fb29f0da45c7c615106b9be9d5c6@redhat.com>
Acked-by: Jozsef Kadlecsik <5a7b97a838c5f3992292d1fd9e7ad830cc55ada6@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs