forked from openwrt/openwrt
-
-
Notifications
You must be signed in to change notification settings - Fork 26
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Revert "kernel: remove obsolete netfilter tcp window size check bypas…
…s patch" This reverts commit 75e78bc.
- Loading branch information
1 parent
27a23b8
commit 16babe2
Showing
1 changed file
with
83 additions
and
0 deletions.
There are no files selected for viewing
83 changes: 83 additions & 0 deletions
83
target/linux/generic/pending-5.15/613-netfilter_optional_tcp_window_check.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,83 @@ | ||
From: Felix Fietkau <nbd@nbd.name> | ||
Subject: netfilter: optional tcp window check | ||
|
||
Signed-off-by: Felix Fietkau <nbd@nbd.name> | ||
Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com> | ||
--- | ||
net/netfilter/nf_conntrack_proto_tcp.c | 13 +++++++++++++ | ||
1 file changed, 13 insertions(+) | ||
|
||
--- a/net/netfilter/nf_conntrack_proto_tcp.c | ||
+++ b/net/netfilter/nf_conntrack_proto_tcp.c | ||
@@ -465,6 +465,9 @@ static bool tcp_in_window(struct nf_conn | ||
s32 receiver_offset; | ||
bool res, in_recv_win; | ||
|
||
+ if (tn->tcp_no_window_check) | ||
+ return true; | ||
+ | ||
/* | ||
* Get the required data from the packet. | ||
*/ | ||
@@ -1191,7 +1194,7 @@ int nf_conntrack_tcp_packet(struct nf_co | ||
IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED && | ||
timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK]) | ||
timeout = timeouts[TCP_CONNTRACK_UNACK]; | ||
- else if (ct->proto.tcp.last_win == 0 && | ||
+ else if (!tn->tcp_no_window_check && ct->proto.tcp.last_win == 0 && | ||
timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS]) | ||
timeout = timeouts[TCP_CONNTRACK_RETRANS]; | ||
else | ||
@@ -1507,6 +1510,9 @@ void nf_conntrack_tcp_init_net(struct ne | ||
*/ | ||
tn->tcp_be_liberal = 0; | ||
|
||
+ /* Skip Windows Check */ | ||
+ tn->tcp_no_window_check = 0; | ||
+ | ||
/* If it's non-zero, we turn off RST sequence number check */ | ||
tn->tcp_ignore_invalid_rst = 0; | ||
|
||
--- a/net/netfilter/nf_conntrack_standalone.c | ||
+++ b/net/netfilter/nf_conntrack_standalone.c | ||
@@ -633,6 +633,7 @@ enum nf_ct_sysctl_index { | ||
#endif | ||
NF_SYSCTL_CT_PROTO_TCP_LOOSE, | ||
NF_SYSCTL_CT_PROTO_TCP_LIBERAL, | ||
+ NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK, | ||
NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST, | ||
NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS, | ||
NF_SYSCTL_CT_PROTO_TIMEOUT_UDP, | ||
@@ -848,6 +849,14 @@ static struct ctl_table nf_ct_sysctl_tab | ||
.extra1 = SYSCTL_ZERO, | ||
.extra2 = SYSCTL_ONE, | ||
}, | ||
+ [NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK] = { | ||
+ .procname = "nf_conntrack_tcp_no_window_check", | ||
+ .maxlen = sizeof(u8), | ||
+ .mode = 0644, | ||
+ .proc_handler = proc_dou8vec_minmax, | ||
+ .extra1 = SYSCTL_ZERO, | ||
+ .extra2 = SYSCTL_ONE, | ||
+ }, | ||
[NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST] = { | ||
.procname = "nf_conntrack_tcp_ignore_invalid_rst", | ||
.maxlen = sizeof(u8), | ||
@@ -1058,6 +1067,7 @@ static void nf_conntrack_standalone_init | ||
|
||
XASSIGN(LOOSE, &tn->tcp_loose); | ||
XASSIGN(LIBERAL, &tn->tcp_be_liberal); | ||
+ XASSIGN(NO_WINDOW_CHECK, &tn->tcp_no_window_check); | ||
XASSIGN(MAX_RETRANS, &tn->tcp_max_retrans); | ||
XASSIGN(IGNORE_INVALID_RST, &tn->tcp_ignore_invalid_rst); | ||
#undef XASSIGN | ||
--- a/include/net/netns/conntrack.h | ||
+++ b/include/net/netns/conntrack.h | ||
@@ -26,6 +26,7 @@ struct nf_tcp_net { | ||
unsigned int timeouts[TCP_CONNTRACK_TIMEOUT_MAX]; | ||
u8 tcp_loose; | ||
u8 tcp_be_liberal; | ||
+ u8 tcp_no_window_check; | ||
u8 tcp_max_retrans; | ||
u8 tcp_ignore_invalid_rst; | ||
#if IS_ENABLED(CONFIG_NF_FLOW_TABLE) |