developer | 5d148cb | 2023-06-02 13:08:11 +0800 | [diff] [blame] | 1 | From 1f85572a62a39799a9bac846d46965d9a57a1e24 Mon Sep 17 00:00:00 2001 |
| 2 | From: Sam Shih <sam.shih@mediatek.com> |
| 3 | Date: Fri, 2 Jun 2023 13:06:28 +0800 |
| 4 | Subject: [PATCH] |
| 5 | [networking][999-2704-netfilter_optional_tcp_window_check.patch] |
developer | a72d186 | 2023-05-15 14:27:55 +0800 | [diff] [blame] | 6 | |
developer | a72d186 | 2023-05-15 14:27:55 +0800 | [diff] [blame] | 7 | --- |
developer | 5d148cb | 2023-06-02 13:08:11 +0800 | [diff] [blame] | 8 | net/netfilter/nf_conntrack_proto_tcp.c | 8 +++++++- |
| 9 | net/netfilter/nf_conntrack_standalone.c | 11 +++++++++++ |
| 10 | 2 files changed, 18 insertions(+), 1 deletion(-) |
developer | a72d186 | 2023-05-15 14:27:55 +0800 | [diff] [blame] | 11 | |
developer | 5d148cb | 2023-06-02 13:08:11 +0800 | [diff] [blame] | 12 | diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c |
| 13 | index aed967e2f..e219b6f34 100644 |
developer | a72d186 | 2023-05-15 14:27:55 +0800 | [diff] [blame] | 14 | --- a/net/netfilter/nf_conntrack_proto_tcp.c |
| 15 | +++ b/net/netfilter/nf_conntrack_proto_tcp.c |
| 16 | @@ -31,6 +31,9 @@ |
| 17 | #include <net/netfilter/ipv4/nf_conntrack_ipv4.h> |
| 18 | #include <net/netfilter/ipv6/nf_conntrack_ipv6.h> |
| 19 | |
| 20 | +/* Do not check the TCP window for incoming packets */ |
| 21 | +static int nf_ct_tcp_no_window_check __read_mostly = 1; |
| 22 | + |
| 23 | /* "Be conservative in what you do, |
| 24 | be liberal in what you accept from others." |
| 25 | If it's non-zero, we mark only out of window RST segments as INVALID. */ |
developer | 5d148cb | 2023-06-02 13:08:11 +0800 | [diff] [blame] | 26 | @@ -476,6 +479,9 @@ static bool tcp_in_window(const struct nf_conn *ct, |
developer | a72d186 | 2023-05-15 14:27:55 +0800 | [diff] [blame] | 27 | s32 receiver_offset; |
| 28 | bool res, in_recv_win; |
| 29 | |
| 30 | + if (nf_ct_tcp_no_window_check) |
| 31 | + return true; |
| 32 | + |
| 33 | /* |
| 34 | * Get the required data from the packet. |
| 35 | */ |
developer | 5d148cb | 2023-06-02 13:08:11 +0800 | [diff] [blame] | 36 | @@ -1139,7 +1145,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, |
developer | a72d186 | 2023-05-15 14:27:55 +0800 | [diff] [blame] | 37 | IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED && |
| 38 | timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK]) |
| 39 | timeout = timeouts[TCP_CONNTRACK_UNACK]; |
| 40 | - else if (ct->proto.tcp.last_win == 0 && |
| 41 | + else if (!nf_ct_tcp_no_window_check && ct->proto.tcp.last_win == 0 && |
| 42 | timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS]) |
| 43 | timeout = timeouts[TCP_CONNTRACK_RETRANS]; |
| 44 | else |
developer | 5d148cb | 2023-06-02 13:08:11 +0800 | [diff] [blame] | 45 | diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c |
| 46 | index 73415bf51..236954e4f 100644 |
developer | a72d186 | 2023-05-15 14:27:55 +0800 | [diff] [blame] | 47 | --- a/net/netfilter/nf_conntrack_standalone.c |
| 48 | +++ b/net/netfilter/nf_conntrack_standalone.c |
| 49 | @@ -25,6 +25,9 @@ |
| 50 | #include <net/netfilter/nf_conntrack_timestamp.h> |
| 51 | #include <linux/rculist_nulls.h> |
| 52 | |
| 53 | +/* Do not check the TCP window for incoming packets */ |
| 54 | +static int nf_ct_tcp_no_window_check __read_mostly = 1; |
| 55 | + |
| 56 | static bool enable_hooks __read_mostly; |
| 57 | MODULE_PARM_DESC(enable_hooks, "Always enable conntrack hooks"); |
| 58 | module_param(enable_hooks, bool, 0000); |
| 59 | @@ -649,6 +652,7 @@ enum nf_ct_sysctl_index { |
| 60 | NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM, |
| 61 | #endif |
| 62 | |
| 63 | + NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK, |
| 64 | __NF_SYSCTL_CT_LAST_SYSCTL, |
| 65 | }; |
| 66 | |
developer | 5d148cb | 2023-06-02 13:08:11 +0800 | [diff] [blame] | 67 | @@ -969,6 +973,13 @@ static struct ctl_table nf_ct_sysctl_table[] = { |
developer | a72d186 | 2023-05-15 14:27:55 +0800 | [diff] [blame] | 68 | .proc_handler = proc_dointvec_jiffies, |
| 69 | }, |
| 70 | #endif |
| 71 | + [NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK] = { |
| 72 | + .procname = "nf_conntrack_tcp_no_window_check", |
| 73 | + .data = &nf_ct_tcp_no_window_check, |
| 74 | + .maxlen = sizeof(unsigned int), |
| 75 | + .mode = 0644, |
| 76 | + .proc_handler = proc_dointvec, |
| 77 | + }, |
| 78 | {} |
| 79 | }; |
| 80 | |
developer | 5d148cb | 2023-06-02 13:08:11 +0800 | [diff] [blame] | 81 | -- |
| 82 | 2.34.1 |
| 83 | |