netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options

[ Upstream commit f2dd495a8d589371289981d5ed33e6873df94ecc ]

Do not reset IP_CT_TCP_FLAG_BE_LIBERAL flag in out-of-sync scenarios
coming before the TCP window tracking, otherwise such connections will
fail in the window check.

Update tcp_options() to leave this flag in place and add a new helper
function to reset the tcp window state.

Based on patch from Sven Auhagen.

Fixes: c4832c7bbc3f ("netfilter: nf_ct_tcp: improve out-of-sync situation in TCP tracking")
Tested-by: Sven Auhagen <sven.auhagen@voleatech.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 40f8a1252394b324772efe99a5a4ec36a397c34d..66cda5e2d6b9e505de8b111906c232579ed465b4 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -362,8 +362,8 @@ static void tcp_options(const struct sk_buff *skb,
                                 length, buff);
        BUG_ON(ptr == NULL);
 
-       state->td_scale =
-       state->flags = 0;
+       state->td_scale = 0;
+       state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;
 
        while (length > 0) {
                int opcode=*ptr++;
@@ -784,6 +784,16 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct)
               test_bit(IPS_ASSURED_BIT, &ct->status);
 }
 
+static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state)
+{
+       state->td_end           = 0;
+       state->td_maxend        = 0;
+       state->td_maxwin        = 0;
+       state->td_maxack        = 0;
+       state->td_scale         = 0;
+       state->flags            &= IP_CT_TCP_FLAG_BE_LIBERAL;
+}
+
 /* Returns verdict for packet, or -1 for invalid. */
 static int tcp_packet(struct nf_conn *ct,
                      const struct sk_buff *skb,
@@ -882,8 +892,7 @@ static int tcp_packet(struct nf_conn *ct,
                        ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
                        ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
                                ct->proto.tcp.last_flags;
-                       memset(&ct->proto.tcp.seen[dir], 0,
-                              sizeof(struct ip_ct_tcp_state));
+                       nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]);
                        break;
                }
                ct->proto.tcp.last_index = index;