| developer | a72d186 | 2023-05-15 14:27:55 +0800 | [diff] [blame^] | 1 | From: Felix Fietkau <nbd@nbd.name> |
| 2 | Subject: netfilter: optional tcp window check |
| 3 | |
| 4 | Signed-off-by: Felix Fietkau <nbd@nbd.name> |
| 5 | --- |
| 6 | net/netfilter/nf_conntrack_proto_tcp.c | 13 +++++++++++++ |
| 7 | 1 file changed, 13 insertions(+) |
| 8 | |
| 9 | --- a/net/netfilter/nf_conntrack_proto_tcp.c |
| 10 | +++ b/net/netfilter/nf_conntrack_proto_tcp.c |
| 11 | @@ -31,6 +31,9 @@ |
| 12 | #include <net/netfilter/ipv4/nf_conntrack_ipv4.h> |
| 13 | #include <net/netfilter/ipv6/nf_conntrack_ipv6.h> |
| 14 | |
| 15 | +/* Do not check the TCP window for incoming packets */ |
| 16 | +static int nf_ct_tcp_no_window_check __read_mostly = 1; |
| 17 | + |
| 18 | /* "Be conservative in what you do, |
| 19 | be liberal in what you accept from others." |
| 20 | If it's non-zero, we mark only out of window RST segments as INVALID. */ |
| 21 | @@ -476,6 +479,9 @@ static bool tcp_in_window(const struct n |
| 22 | s32 receiver_offset; |
| 23 | bool res, in_recv_win; |
| 24 | |
| 25 | + if (nf_ct_tcp_no_window_check) |
| 26 | + return true; |
| 27 | + |
| 28 | /* |
| 29 | * Get the required data from the packet. |
| 30 | */ |
| 31 | @@ -1139,7 +1145,7 @@ int nf_conntrack_tcp_packet(struct nf_co |
| 32 | IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED && |
| 33 | timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK]) |
| 34 | timeout = timeouts[TCP_CONNTRACK_UNACK]; |
| 35 | - else if (ct->proto.tcp.last_win == 0 && |
| 36 | + else if (!nf_ct_tcp_no_window_check && ct->proto.tcp.last_win == 0 && |
| 37 | timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS]) |
| 38 | timeout = timeouts[TCP_CONNTRACK_RETRANS]; |
| 39 | else |
| 40 | --- a/net/netfilter/nf_conntrack_standalone.c |
| 41 | +++ b/net/netfilter/nf_conntrack_standalone.c |
| 42 | @@ -25,6 +25,9 @@ |
| 43 | #include <net/netfilter/nf_conntrack_timestamp.h> |
| 44 | #include <linux/rculist_nulls.h> |
| 45 | |
| 46 | +/* Do not check the TCP window for incoming packets */ |
| 47 | +static int nf_ct_tcp_no_window_check __read_mostly = 1; |
| 48 | + |
| 49 | static bool enable_hooks __read_mostly; |
| 50 | MODULE_PARM_DESC(enable_hooks, "Always enable conntrack hooks"); |
| 51 | module_param(enable_hooks, bool, 0000); |
| 52 | @@ -649,6 +652,7 @@ enum nf_ct_sysctl_index { |
| 53 | NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM, |
| 54 | #endif |
| 55 | |
| 56 | + NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK, |
| 57 | __NF_SYSCTL_CT_LAST_SYSCTL, |
| 58 | }; |
| 59 | |
| 60 | @@ -969,6 +973,13 @@ static struct ctl_table nf_ct_sysctl_tab |
| 61 | .proc_handler = proc_dointvec_jiffies, |
| 62 | }, |
| 63 | #endif |
| 64 | + [NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK] = { |
| 65 | + .procname = "nf_conntrack_tcp_no_window_check", |
| 66 | + .data = &nf_ct_tcp_no_window_check, |
| 67 | + .maxlen = sizeof(unsigned int), |
| 68 | + .mode = 0644, |
| 69 | + .proc_handler = proc_dointvec, |
| 70 | + }, |
| 71 | {} |
| 72 | }; |
| 73 | |