netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options

stable inclusion
from stable-4.19.238
commit 126f86e865ef1e776e853b97b4af2af3d69d4b1c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I5A6BA


CVE: NA

--------------------------------

[ Upstream commit f2dd495a ]

Do not reset IP_CT_TCP_FLAG_BE_LIBERAL flag in out-of-sync scenarios
coming before the TCP window tracking, otherwise such connections will
fail in the window check.

Update tcp_options() to leave this flag in place and add a new helper
function to reset the tcp window state.

Based on patch from Sven Auhagen.

Fixes: c4832c7b ("netfilter: nf_ct_tcp: improve out-of-sync situation in TCP tracking")
Tested-by: Sven Auhagen <sven.auhagen@voleatech.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com>