target/linux/generic/pending-4.19/613-netfilter_optional_tcp_window_check.patch

   1 From: Felix Fietkau <nbd@nbd.name>
   2 Subject: netfilter: optional tcp window check
   3
   4 Signed-off-by: Felix Fietkau <nbd@nbd.name>
   5 ---
   6  net/netfilter/nf_conntrack_proto_tcp.c | 13 +++++++++++++
   7  1 file changed, 13 insertions(+)
   8
   9 --- a/net/netfilter/nf_conntrack_proto_tcp.c
  10 +++ b/net/netfilter/nf_conntrack_proto_tcp.c
  11 @@ -34,6 +34,9 @@
  12  #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
  13  #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
  14
  15 +/* Do not check the TCP window for incoming packets  */
  16 +static int nf_ct_tcp_no_window_check __read_mostly = 1;
  17 +
  18  /* "Be conservative in what you do,
  19      be liberal in what you accept from others."
  20      If it's non-zero, we mark only out of window RST segments as INVALID. */
  21 @@ -484,6 +487,9 @@ static bool tcp_in_window(const struct n
  22         s32 receiver_offset;
  23         bool res, in_recv_win;
  24
  25 +       if (nf_ct_tcp_no_window_check)
  26 +               return true;
  27 +
  28         /*
  29          * Get the required data from the packet.
  30          */
  31 @@ -1059,7 +1065,7 @@ static int tcp_packet(struct nf_conn *ct
  32                  IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
  33                  timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
  34                 timeout = timeouts[TCP_CONNTRACK_UNACK];
  35 -       else if (ct->proto.tcp.last_win == 0 &&
  36 +       else if (!nf_ct_tcp_no_window_check && ct->proto.tcp.last_win == 0 &&
  37                  timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
  38                 timeout = timeouts[TCP_CONNTRACK_RETRANS];
  39         else
  40 @@ -1508,6 +1514,13 @@ static struct ctl_table tcp_sysctl_table
  41                 .mode           = 0644,
  42                 .proc_handler   = proc_dointvec,
  43         },
  44 +       {
  45 +               .procname       = "nf_conntrack_tcp_no_window_check",
  46 +               .data           = &nf_ct_tcp_no_window_check,
  47 +               .maxlen         = sizeof(unsigned int),
  48 +               .mode           = 0644,
  49 +               .proc_handler   = proc_dointvec,
  50 +       },
  51         { }
  52  };
  53  #endif /* CONFIG_SYSCTL */