2 files changed, 22 insertions, 0 deletions

diff --git a/include/linux/netfilter/nf_conntrack_tcp.h b/include/linux/netfilter/nf_conntrack_tcp.h
index 3066789b972a..b2f384d42611 100644
--- a/include/linux/netfilter/nf_conntrack_tcp.h
+++ b/include/linux/netfilter/nf_conntrack_tcp.h
@@ -35,6 +35,9 @@ enum tcp_conntrack {
 /* Has unacknowledged data */
 #define IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED      0x10
 
+/* The field td_maxack has been set */
+#define IP_CT_TCP_FLAG_MAXACK_SET               0x20
+
 struct nf_ct_tcp_flags {
         __u8 flags;
         __u8 mask;
@@ -46,6 +49,7 @@ struct ip_ct_tcp_state {
         u_int32_t       td_end;         /* max of seq + len */
         u_int32_t       td_maxend;      /* max of ack + max(win, 1) */
         u_int32_t       td_maxwin;      /* max(win) */
+        u_int32_t       td_maxack;      /* max of ack */
         u_int8_t        td_scale;       /* window scale factor */
         u_int8_t        flags;          /* per direction options */
 };
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index b5ccf2b4b2e7..97a6e93d742e 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -634,6 +634,14 @@ static bool tcp_in_window(const struct nf_conn *ct,
                         sender->td_end = end;
                         sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
                 }
+                if (tcph->ack) {
+                        if (!(sender->flags & IP_CT_TCP_FLAG_MAXACK_SET)) {
+                                sender->td_maxack = ack;
+                                sender->flags |= IP_CT_TCP_FLAG_MAXACK_SET;
+                        } else if (after(ack, sender->td_maxack))
+                                sender->td_maxack = ack;
+                }
+
                 /*
                  * Update receiver data.
                  */
@@ -919,6 +927,16 @@ static int tcp_packet(struct nf_conn *ct,
                 return -NF_ACCEPT;
         case TCP_CONNTRACK_CLOSE:
                 if (index == TCP_RST_SET
+                    && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
+                    && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) {
+                        /* Invalid RST  */
+                        write_unlock_bh(&tcp_lock);
+                        if (LOG_INVALID(net, IPPROTO_TCP))
+                                nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
+                                          "nf_ct_tcp: invalid RST ");
+                        return -NF_ACCEPT;
+                }
+                if (index == TCP_RST_SET
                     && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
                          && ct->proto.tcp.last_index == TCP_SYN_SET)
                         || (!test_bit(IPS_ASSURED_BIT, &ct->status)