3 files changed, 33 insertions, 51 deletions

diff --git a/include/linux/netfilter/nf_conntrack_tcp.h b/include/linux/netfilter/nf_conntrack_tcp.h
index 2f4e98b90cc0..007af4c2770b 100644
--- a/include/linux/netfilter/nf_conntrack_tcp.h
+++ b/include/linux/netfilter/nf_conntrack_tcp.h
@@ -27,6 +27,9 @@ enum tcp_conntrack {
 /* This sender sent FIN first */
 #define IP_CT_TCP_FLAG_CLOSE_INIT               0x04
 
+/* Be liberal in window checking */
+#define IP_CT_TCP_FLAG_BE_LIBERAL               0x08
+
 #ifdef __KERNEL__
 
 struct ip_ct_tcp_state {
@@ -34,7 +37,6 @@ struct ip_ct_tcp_state {
         u_int32_t       td_maxend;      /* max of ack + max(win, 1) */
         u_int32_t       td_maxwin;      /* max(win) */
         u_int8_t        td_scale;       /* window scale factor */
-        u_int8_t        loose;          /* used when connection picked up from the middle */
         u_int8_t        flags;          /* per direction options */
 };
 
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index 06e4e8a6dd9f..c34f48fe5478 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -50,12 +50,9 @@ static DEFINE_RWLOCK(tcp_lock);
     If it's non-zero, we mark only out of window RST segments as INVALID. */
 int ip_ct_tcp_be_liberal __read_mostly = 0;
 
-/* When connection is picked up from the middle, how many packets are required
-   to pass in each direction when we assume we are in sync - if any side uses
-   window scaling, we lost the game. 
-   If it is set to zero, we disable picking up already established 
+/* If it is set to zero, we disable picking up already established
    connections. */
-int ip_ct_tcp_loose __read_mostly = 3;
+int ip_ct_tcp_loose __read_mostly = 1;
 
 /* Max number of the retransmitted packets without receiving an (acceptable) 
    ACK from the destination. If this number is reached, a shorter timer 
@@ -694,11 +691,10 @@ static int tcp_in_window(struct ip_ct_tcp *state,
                 before(sack, receiver->td_end + 1),
                 after(ack, receiver->td_end - MAXACKWINDOW(sender)));
         
-        if (sender->loose || receiver->loose ||
-            (before(seq, sender->td_maxend + 1) &&
-             after(end, sender->td_end - receiver->td_maxwin - 1) &&
-             before(sack, receiver->td_end + 1) &&
-             after(ack, receiver->td_end - MAXACKWINDOW(sender)))) {
+        if (before(seq, sender->td_maxend + 1) &&
+            after(end, sender->td_end - receiver->td_maxwin - 1) &&
+            before(sack, receiver->td_end + 1) &&
+            after(ack, receiver->td_end - MAXACKWINDOW(sender))) {
                 /*
                  * Take into account window scaling (RFC 1323).
                  */
@@ -743,15 +739,13 @@ static int tcp_in_window(struct ip_ct_tcp *state,
                                 state->retrans = 0;
                         }
                 }
-                /*
-                 * Close the window of disabled window tracking :-)
-                 */
-                if (sender->loose)
-                        sender->loose--;
-                
                 res = 1;
         } else {
-                if (LOG_INVALID(IPPROTO_TCP))
+                res = 0;
+                if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
+                    ip_ct_tcp_be_liberal)
+                        res = 1;
+                if (!res && LOG_INVALID(IPPROTO_TCP))
                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                         "ip_ct_tcp: %s ",
                         before(seq, sender->td_maxend + 1) ?
@@ -762,8 +756,6 @@ static int tcp_in_window(struct ip_ct_tcp *state,
                         : "ACK is over the upper bound (ACKed data not seen yet)"
                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
                         : "SEQ is over the upper bound (over the window of the receiver)");
-
-                res = ip_ct_tcp_be_liberal;
         }
   
         DEBUGP("tcp_in_window: res=%i sender end=%u maxend=%u maxwin=%u "
@@ -1105,8 +1097,6 @@ static int tcp_new(struct ip_conntrack *conntrack,
 
                 tcp_options(skb, iph, th, &conntrack->proto.tcp.seen[0]);
                 conntrack->proto.tcp.seen[1].flags = 0;
-                conntrack->proto.tcp.seen[0].loose = 
-                conntrack->proto.tcp.seen[1].loose = 0;
         } else if (ip_ct_tcp_loose == 0) {
                 /* Don't try to pick up connections. */
                 return 0;
@@ -1127,11 +1117,11 @@ static int tcp_new(struct ip_conntrack *conntrack,
                         conntrack->proto.tcp.seen[0].td_maxwin;
                 conntrack->proto.tcp.seen[0].td_scale = 0;
 
-                /* We assume SACK. Should we assume window scaling too? */
+                /* We assume SACK and liberal window checking to handle
+                 * window scaling */
                 conntrack->proto.tcp.seen[0].flags =
-                conntrack->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM;
-                conntrack->proto.tcp.seen[0].loose = 
-                conntrack->proto.tcp.seen[1].loose = ip_ct_tcp_loose;
+                conntrack->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
+                                                     IP_CT_TCP_FLAG_BE_LIBERAL;
         }
     
         conntrack->proto.tcp.seen[1].td_end = 0;
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 626b0011dd89..6fccdcf43e08 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -60,12 +60,9 @@ static DEFINE_RWLOCK(tcp_lock);
     If it's non-zero, we mark only out of window RST segments as INVALID. */
 int nf_ct_tcp_be_liberal __read_mostly = 0;
 
-/* When connection is picked up from the middle, how many packets are required
-   to pass in each direction when we assume we are in sync - if any side uses
-   window scaling, we lost the game. 
-   If it is set to zero, we disable picking up already established 
+/* If it is set to zero, we disable picking up already established
    connections. */
-int nf_ct_tcp_loose __read_mostly = 3;
+int nf_ct_tcp_loose __read_mostly = 1;
 
 /* Max number of the retransmitted packets without receiving an (acceptable) 
    ACK from the destination. If this number is reached, a shorter timer 
@@ -650,11 +647,10 @@ static int tcp_in_window(struct ip_ct_tcp *state,
                 before(sack, receiver->td_end + 1),
                 after(ack, receiver->td_end - MAXACKWINDOW(sender)));
 
-        if (sender->loose || receiver->loose ||
-            (before(seq, sender->td_maxend + 1) &&
-             after(end, sender->td_end - receiver->td_maxwin - 1) &&
-             before(sack, receiver->td_end + 1) &&
-             after(ack, receiver->td_end - MAXACKWINDOW(sender)))) {
+        if (before(seq, sender->td_maxend + 1) &&
+            after(end, sender->td_end - receiver->td_maxwin - 1) &&
+            before(sack, receiver->td_end + 1) &&
+            after(ack, receiver->td_end - MAXACKWINDOW(sender))) {
                 /*
                  * Take into account window scaling (RFC 1323).
                  */
@@ -699,15 +695,13 @@ static int tcp_in_window(struct ip_ct_tcp *state,
                                 state->retrans = 0;
                         }
                 }
-                /*
-                 * Close the window of disabled window tracking :-)
-                 */
-                if (sender->loose)
-                        sender->loose--;
-
                 res = 1;
         } else {
-                if (LOG_INVALID(IPPROTO_TCP))
+                res = 0;
+                if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
+                    nf_ct_tcp_be_liberal)
+                        res = 1;
+                if (!res && LOG_INVALID(IPPROTO_TCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                         "nf_ct_tcp: %s ",
                         before(seq, sender->td_maxend + 1) ?
@@ -718,8 +712,6 @@ static int tcp_in_window(struct ip_ct_tcp *state,
                         : "ACK is over the upper bound (ACKed data not seen yet)"
                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
                         : "SEQ is over the upper bound (over the window of the receiver)");
-
-                res = nf_ct_tcp_be_liberal;
         }
   
         DEBUGP("tcp_in_window: res=%i sender end=%u maxend=%u maxwin=%u "
@@ -1063,8 +1055,6 @@ static int tcp_new(struct nf_conn *conntrack,
 
                 tcp_options(skb, dataoff, th, &conntrack->proto.tcp.seen[0]);
                 conntrack->proto.tcp.seen[1].flags = 0;
-                conntrack->proto.tcp.seen[0].loose = 
-                conntrack->proto.tcp.seen[1].loose = 0;
         } else if (nf_ct_tcp_loose == 0) {
                 /* Don't try to pick up connections. */
                 return 0;
@@ -1085,11 +1075,11 @@ static int tcp_new(struct nf_conn *conntrack,
                         conntrack->proto.tcp.seen[0].td_maxwin;
                 conntrack->proto.tcp.seen[0].td_scale = 0;
 
-                /* We assume SACK. Should we assume window scaling too? */
+                /* We assume SACK and liberal window checking to handle
+                 * window scaling */
                 conntrack->proto.tcp.seen[0].flags =
-                conntrack->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM;
-                conntrack->proto.tcp.seen[0].loose = 
-                conntrack->proto.tcp.seen[1].loose = nf_ct_tcp_loose;
+                conntrack->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
+                                                     IP_CT_TCP_FLAG_BE_LIBERAL;
         }
     
         conntrack->proto.tcp.seen[1].td_end = 0;