Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 806ef544 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options 



[ Upstream commit f2dd495a8d589371289981d5ed33e6873df94ecc ]

Do not reset IP_CT_TCP_FLAG_BE_LIBERAL flag in out-of-sync scenarios
coming before the TCP window tracking, otherwise such connections will
fail in the window check.

Update tcp_options() to leave this flag in place and add a new helper
function to reset the tcp window state.

Based on patch from Sven Auhagen.

Fixes: c4832c7b ("netfilter: nf_ct_tcp: improve out-of-sync situation in TCP tracking")
Tested-by: default avatarSven Auhagen <sven.auhagen@voleatech.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent cec71a71

net/netfilter/nf_conntrack_proto_tcp.c

+13 −4
Original line number Diff line number Diff line
@@ -354,8 +354,8 @@ static void tcp_options(const struct sk_buff *skb, 
				 length, buff);

	BUG_ON(ptr == NULL);



	state->td_scale =

	state->flags = 0;

	state->td_scale = 0;

	state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;



	while (length > 0) {

		int opcode=*ptr++;
@@ -840,6 +840,16 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct) 
	       test_bit(IPS_ASSURED_BIT, &ct->status);

}



static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state)

{

	state->td_end		= 0;

	state->td_maxend	= 0;

	state->td_maxwin	= 0;

	state->td_maxack	= 0;

	state->td_scale		= 0;

	state->flags		&= IP_CT_TCP_FLAG_BE_LIBERAL;

}



/* Returns verdict for packet, or -1 for invalid. */

int nf_conntrack_tcp_packet(struct nf_conn *ct,

			    struct sk_buff *skb,
@@ -946,8 +956,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, 
			ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;

			ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =

				ct->proto.tcp.last_flags;

			memset(&ct->proto.tcp.seen[dir], 0,

			       sizeof(struct ip_ct_tcp_state));

			nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]);

			break;

		}

		ct->proto.tcp.last_index = index;