84 lines
2.7 KiB
Diff
84 lines
2.7 KiB
Diff
From: Felix Fietkau <nbd@nbd.name>
|
|
Subject: netfilter: optional tcp window check
|
|
|
|
Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
|
Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
|
|
---
|
|
net/netfilter/nf_conntrack_proto_tcp.c | 13 +++++++++++++
|
|
1 file changed, 13 insertions(+)
|
|
|
|
--- a/net/netfilter/nf_conntrack_proto_tcp.c
|
|
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
|
|
@@ -465,6 +465,9 @@ static bool tcp_in_window(struct nf_conn
|
|
s32 receiver_offset;
|
|
bool res, in_recv_win;
|
|
|
|
+ if (tn->tcp_no_window_check)
|
|
+ return true;
|
|
+
|
|
/*
|
|
* Get the required data from the packet.
|
|
*/
|
|
@@ -1191,7 +1194,7 @@ int nf_conntrack_tcp_packet(struct nf_co
|
|
IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
|
|
timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
|
|
timeout = timeouts[TCP_CONNTRACK_UNACK];
|
|
- else if (ct->proto.tcp.last_win == 0 &&
|
|
+ else if (!tn->tcp_no_window_check && ct->proto.tcp.last_win == 0 &&
|
|
timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
|
|
timeout = timeouts[TCP_CONNTRACK_RETRANS];
|
|
else
|
|
@@ -1507,6 +1510,9 @@ void nf_conntrack_tcp_init_net(struct ne
|
|
*/
|
|
tn->tcp_be_liberal = 0;
|
|
|
|
+ /* Skip Windows Check */
|
|
+ tn->tcp_no_window_check = 0;
|
|
+
|
|
/* If it's non-zero, we turn off RST sequence number check */
|
|
tn->tcp_ignore_invalid_rst = 0;
|
|
|
|
--- a/net/netfilter/nf_conntrack_standalone.c
|
|
+++ b/net/netfilter/nf_conntrack_standalone.c
|
|
@@ -633,6 +633,7 @@ enum nf_ct_sysctl_index {
|
|
#endif
|
|
NF_SYSCTL_CT_PROTO_TCP_LOOSE,
|
|
NF_SYSCTL_CT_PROTO_TCP_LIBERAL,
|
|
+ NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK,
|
|
NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST,
|
|
NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS,
|
|
NF_SYSCTL_CT_PROTO_TIMEOUT_UDP,
|
|
@@ -848,6 +849,14 @@ static struct ctl_table nf_ct_sysctl_tab
|
|
.extra1 = SYSCTL_ZERO,
|
|
.extra2 = SYSCTL_ONE,
|
|
},
|
|
+ [NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK] = {
|
|
+ .procname = "nf_conntrack_tcp_no_window_check",
|
|
+ .maxlen = sizeof(u8),
|
|
+ .mode = 0644,
|
|
+ .proc_handler = proc_dou8vec_minmax,
|
|
+ .extra1 = SYSCTL_ZERO,
|
|
+ .extra2 = SYSCTL_ONE,
|
|
+ },
|
|
[NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST] = {
|
|
.procname = "nf_conntrack_tcp_ignore_invalid_rst",
|
|
.maxlen = sizeof(u8),
|
|
@@ -1058,6 +1067,7 @@ static void nf_conntrack_standalone_init
|
|
|
|
XASSIGN(LOOSE, &tn->tcp_loose);
|
|
XASSIGN(LIBERAL, &tn->tcp_be_liberal);
|
|
+ XASSIGN(NO_WINDOW_CHECK, &tn->tcp_no_window_check);
|
|
XASSIGN(MAX_RETRANS, &tn->tcp_max_retrans);
|
|
XASSIGN(IGNORE_INVALID_RST, &tn->tcp_ignore_invalid_rst);
|
|
#undef XASSIGN
|
|
--- a/include/net/netns/conntrack.h
|
|
+++ b/include/net/netns/conntrack.h
|
|
@@ -26,6 +26,7 @@ struct nf_tcp_net {
|
|
unsigned int timeouts[TCP_CONNTRACK_TIMEOUT_MAX];
|
|
u8 tcp_loose;
|
|
u8 tcp_be_liberal;
|
|
+ u8 tcp_no_window_check;
|
|
u8 tcp_max_retrans;
|
|
u8 tcp_ignore_invalid_rst;
|
|
#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
|