netfilter: nft_flow_offload: set liberal tracking mode for tcp [Linux 5.2]

netfilter: nft_flow_offload: set liberal tracking mode for tcp [Linux 5.2]

This Linux kernel change "netfilter: nft_flow_offload: set liberal tracking mode for tcp" is included in the Linux 5.2 release. This change is authored by Florian Westphal <fw [at] strlen.de> on Tue May 21 13:24:31 2019 +0200. The commit for this change in Linux stable tree is 8437a62 (patch).

netfilter: nft_flow_offload: set liberal tracking mode for tcp

Without it, whenever a packet has to be pushed up the stack (e.g. because
of mtu mismatch), then conntrack will flag packets as invalid, which in
turn breaks NAT.

Signed-off-by: Florian Westphal <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>

There are 8 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 net/netfilter/nft_flow_offload.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index 69d7a84..bde63d9 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -72,6 +72,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
    struct nf_flow_route route;
    struct flow_offload *flow;
    enum ip_conntrack_dir dir;
+   bool is_tcp = false;
    struct nf_conn *ct;
    int ret;

@@ -84,6 +85,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,

    switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
    case IPPROTO_TCP:
+       is_tcp = true;
+       break;
    case IPPROTO_UDP:
        break;
    default:
@@ -108,6 +111,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
    if (!flow)
        goto err_flow_alloc;

+   if (is_tcp) {
+       ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
+       ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
+   }
+
    ret = flow_offload_add(flowtable, flow);
    if (ret < 0)
        goto err_flow_add;

Leave a Reply

Your email address will not be published. Required fields are marked *