Commit 1da4cd82 authored by Ali Abdallah's avatar Ali Abdallah Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: add new sysctl to disable RST check 



This patch adds a new sysctl tcp_ignore_invalid_rst to disable marking
out of segments RSTs as INVALID.

Signed-off-by: default avatarAli Abdallah <aabdallah@suse.de>
Acked-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c4edc3cc

Documentation/networking/nf_conntrack-sysctl.rst

+6 −0
Original line number Diff line number Diff line
@@ -110,6 +110,12 @@ nf_conntrack_tcp_be_liberal - BOOLEAN 
	Be conservative in what you do, be liberal in what you accept from others.

	If it's non-zero, we mark only out of window RST segments as INVALID.



nf_conntrack_tcp_ignore_invalid_rst - BOOLEAN

	- 0 - disabled (default)

	- 1 - enabled



	If it's 1, we don't mark out of window RST segments as INVALID.



nf_conntrack_tcp_loose - BOOLEAN

	- 0 - disabled

	- not 0 - enabled (default)

include/net/netns/conntrack.h

+1 −0
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ struct nf_tcp_net { 
	u8 tcp_loose;

	u8 tcp_be_liberal;

	u8 tcp_max_retrans;

	u8 tcp_ignore_invalid_rst;

#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)

	unsigned int offload_timeout;

	unsigned int offload_pickup;

net/netfilter/nf_conntrack_proto_tcp.c

+5 −1
Original line number Diff line number Diff line
@@ -1068,7 +1068,8 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, 
			if (seq == 0 && !nf_conntrack_tcp_established(ct))

				break;



			if (before(seq, ct->proto.tcp.seen[!dir].td_maxack)) {

			if (before(seq, ct->proto.tcp.seen[!dir].td_maxack) &&

			    !tn->tcp_ignore_invalid_rst) {

				/* Invalid RST  */

				spin_unlock_bh(&ct->lock);

				nf_ct_l4proto_log_invalid(skb, ct, state, "invalid rst");
@@ -1466,6 +1467,9 @@ void nf_conntrack_tcp_init_net(struct net *net) 
	 */

	tn->tcp_be_liberal = 0;



	/* If it's non-zero, we turn off RST sequence number check */

	tn->tcp_ignore_invalid_rst = 0;



	/* Max number of the retransmitted packets without receiving an (acceptable)

	 * ACK from the destination. If this number is reached, a shorter timer

	 * will be started.

net/netfilter/nf_conntrack_standalone.c

+10 −0
Original line number Diff line number Diff line
@@ -579,6 +579,7 @@ enum nf_ct_sysctl_index { 
#endif

	NF_SYSCTL_CT_PROTO_TCP_LOOSE,

	NF_SYSCTL_CT_PROTO_TCP_LIBERAL,

	NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST,

	NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS,

	NF_SYSCTL_CT_PROTO_TIMEOUT_UDP,

	NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM,
@@ -798,6 +799,14 @@ static struct ctl_table nf_ct_sysctl_table[] = { 
		.extra1 	= SYSCTL_ZERO,

		.extra2 	= SYSCTL_ONE,

	},

	[NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST] = {

		.procname	= "nf_conntrack_tcp_ignore_invalid_rst",

		.maxlen		= sizeof(u8),

		.mode		= 0644,

		.proc_handler	= proc_dou8vec_minmax,

		.extra1		= SYSCTL_ZERO,

		.extra2		= SYSCTL_ONE,

	},

	[NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS] = {

		.procname	= "nf_conntrack_tcp_max_retrans",

		.maxlen		= sizeof(u8),
@@ -1004,6 +1013,7 @@ static void nf_conntrack_standalone_init_tcp_sysctl(struct net *net, 
	XASSIGN(LOOSE, &tn->tcp_loose);

	XASSIGN(LIBERAL, &tn->tcp_be_liberal);

	XASSIGN(MAX_RETRANS, &tn->tcp_max_retrans);

	XASSIGN(IGNORE_INVALID_RST, &tn->tcp_ignore_invalid_rst);

#undef XASSIGN



#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)