1 From: Felix Fietkau <nbd@nbd.name>
2 Subject: netfilter: optional tcp window check
4 Signed-off-by: Felix Fietkau <nbd@nbd.name>
5 Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
7 net/netfilter/nf_conntrack_proto_tcp.c | 13 +++++++++++++
8 1 file changed, 13 insertions(+)
10 --- a/net/netfilter/nf_conntrack_proto_tcp.c
11 +++ b/net/netfilter/nf_conntrack_proto_tcp.c
12 @@ -465,6 +465,9 @@ static bool tcp_in_window(struct nf_conn
14 bool res, in_recv_win;
16 + if (tn->tcp_no_window_check)
20 * Get the required data from the packet.
22 @@ -1191,7 +1194,7 @@ int nf_conntrack_tcp_packet(struct nf_co
23 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
24 timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
25 timeout = timeouts[TCP_CONNTRACK_UNACK];
26 - else if (ct->proto.tcp.last_win == 0 &&
27 + else if (!tn->tcp_no_window_check && ct->proto.tcp.last_win == 0 &&
28 timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
29 timeout = timeouts[TCP_CONNTRACK_RETRANS];
31 @@ -1507,6 +1510,9 @@ void nf_conntrack_tcp_init_net(struct ne
33 tn->tcp_be_liberal = 0;
35 + /* Skip Windows Check */
36 + tn->tcp_no_window_check = 0;
38 /* If it's non-zero, we turn off RST sequence number check */
39 tn->tcp_ignore_invalid_rst = 0;
41 --- a/net/netfilter/nf_conntrack_standalone.c
42 +++ b/net/netfilter/nf_conntrack_standalone.c
43 @@ -633,6 +633,7 @@ enum nf_ct_sysctl_index {
45 NF_SYSCTL_CT_PROTO_TCP_LOOSE,
46 NF_SYSCTL_CT_PROTO_TCP_LIBERAL,
47 + NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK,
48 NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST,
49 NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS,
50 NF_SYSCTL_CT_PROTO_TIMEOUT_UDP,
51 @@ -848,6 +849,14 @@ static struct ctl_table nf_ct_sysctl_tab
52 .extra1 = SYSCTL_ZERO,
55 + [NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK] = {
56 + .procname = "nf_conntrack_tcp_no_window_check",
57 + .maxlen = sizeof(u8),
59 + .proc_handler = proc_dou8vec_minmax,
60 + .extra1 = SYSCTL_ZERO,
61 + .extra2 = SYSCTL_ONE,
63 [NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST] = {
64 .procname = "nf_conntrack_tcp_ignore_invalid_rst",
66 @@ -1058,6 +1067,7 @@ static void nf_conntrack_standalone_init
68 XASSIGN(LOOSE, &tn->tcp_loose);
69 XASSIGN(LIBERAL, &tn->tcp_be_liberal);
70 + XASSIGN(NO_WINDOW_CHECK, &tn->tcp_no_window_check);
71 XASSIGN(MAX_RETRANS, &tn->tcp_max_retrans);
72 XASSIGN(IGNORE_INVALID_RST, &tn->tcp_ignore_invalid_rst);
74 --- a/include/net/netns/conntrack.h
75 +++ b/include/net/netns/conntrack.h
76 @@ -26,6 +26,7 @@ struct nf_tcp_net {
77 unsigned int timeouts[TCP_CONNTRACK_TIMEOUT_MAX];
80 + u8 tcp_no_window_check;
82 u8 tcp_ignore_invalid_rst;
83 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)