kernel: update linux 3.2 to 3.2.12
[openwrt/svn-archive/archive.git] / target / linux / generic / patches-3.2 / 613-netfilter_optional_tcp_window_check.patch
1 --- a/net/netfilter/nf_conntrack_proto_tcp.c
2 +++ b/net/netfilter/nf_conntrack_proto_tcp.c
3 @@ -29,6 +29,9 @@
4 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
5 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
6
7 +/* Do not check the TCP window for incoming packets */
8 +static int nf_ct_tcp_no_window_check __read_mostly = 1;
9 +
10 /* "Be conservative in what you do,
11 be liberal in what you accept from others."
12 If it's non-zero, we mark only out of window RST segments as INVALID. */
13 @@ -524,6 +527,9 @@ static bool tcp_in_window(const struct n
14 s16 receiver_offset;
15 bool res;
16
17 + if (nf_ct_tcp_no_window_check)
18 + return true;
19 +
20 /*
21 * Get the required data from the packet.
22 */
23 @@ -1321,6 +1327,13 @@ static struct ctl_table tcp_sysctl_table
24 .proc_handler = proc_dointvec,
25 },
26 {
27 + .procname = "nf_conntrack_tcp_no_window_check",
28 + .data = &nf_ct_tcp_no_window_check,
29 + .maxlen = sizeof(unsigned int),
30 + .mode = 0644,
31 + .proc_handler = proc_dointvec,
32 + },
33 + {
34 .procname = "nf_conntrack_tcp_be_liberal",
35 .data = &nf_ct_tcp_be_liberal,
36 .maxlen = sizeof(unsigned int),