target/linux/generic/pending-5.10/613-netfilter_optional_tcp_window_check.patch

   1 From: Felix Fietkau <nbd@nbd.name>
   2 Subject: netfilter: optional tcp window check
   3
   4 Signed-off-by: Felix Fietkau <nbd@nbd.name>
   5 ---
   6  net/netfilter/nf_conntrack_proto_tcp.c | 13 +++++++++++++
   7  1 file changed, 13 insertions(+)
   8
   9 --- a/net/netfilter/nf_conntrack_proto_tcp.c
  10 +++ b/net/netfilter/nf_conntrack_proto_tcp.c
  11 @@ -31,6 +31,9 @@
  12  #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
  13  #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
  14
  15 +/* Do not check the TCP window for incoming packets  */
  16 +static int nf_ct_tcp_no_window_check __read_mostly = 1;
  17 +
  18  /* "Be conservative in what you do,
  19      be liberal in what you accept from others."
  20      If it's non-zero, we mark only out of window RST segments as INVALID. */
  21 @@ -476,6 +479,9 @@ static bool tcp_in_window(const struct n
  22         s32 receiver_offset;
  23         bool res, in_recv_win;
  24
  25 +       if (nf_ct_tcp_no_window_check)
  26 +               return true;
  27 +
  28         /*
  29          * Get the required data from the packet.
  30          */
  31 @@ -1139,7 +1145,7 @@ int nf_conntrack_tcp_packet(struct nf_co
  32                  IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
  33                  timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
  34                 timeout = timeouts[TCP_CONNTRACK_UNACK];
  35 -       else if (ct->proto.tcp.last_win == 0 &&
  36 +       else if (!nf_ct_tcp_no_window_check && ct->proto.tcp.last_win == 0 &&
  37                  timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
  38                 timeout = timeouts[TCP_CONNTRACK_RETRANS];
  39         else
  40 --- a/net/netfilter/nf_conntrack_standalone.c
  41 +++ b/net/netfilter/nf_conntrack_standalone.c
  42 @@ -25,6 +25,9 @@
  43  #include <net/netfilter/nf_conntrack_timestamp.h>
  44  #include <linux/rculist_nulls.h>
  45
  46 +/* Do not check the TCP window for incoming packets  */
  47 +static int nf_ct_tcp_no_window_check __read_mostly = 1;
  48 +
  49  static bool enable_hooks __read_mostly;
  50  MODULE_PARM_DESC(enable_hooks, "Always enable conntrack hooks");
  51  module_param(enable_hooks, bool, 0000);
  52 @@ -657,6 +660,7 @@ enum nf_ct_sysctl_index {
  53         NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM,
  54  #endif
  55
  56 +       NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK,
  57         __NF_SYSCTL_CT_LAST_SYSCTL,
  58  };
  59
  60 @@ -993,6 +997,13 @@ static struct ctl_table nf_ct_sysctl_tab
  61                 .proc_handler   = proc_dointvec_jiffies,
  62         },
  63  #endif
  64 +       [NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK] = {
  65 +               .procname       = "nf_conntrack_tcp_no_window_check",
  66 +               .data           = &nf_ct_tcp_no_window_check,
  67 +               .maxlen         = sizeof(unsigned int),
  68 +               .mode           = 0644,
  69 +               .proc_handler   = proc_dointvec,
  70 +       },
  71         {}
  72  };
  73