[PATCH 5.1 04/96] netfilter: nft_flow_offload: set liberal tracking mode for tcp

[Greg Kroah-Hartman]

From: Florian Westphal <f...@strlen.de>

commit 8437a6209f76f85a2db1abb12a9bde2170801617 upstream.

Without it, whenever a packet has to be pushed up the stack (e.g. because
of mtu mismatch), then conntrack will flag packets as invalid, which in
turn breaks NAT.

Signed-off-by: Florian Westphal <f...@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 net/netfilter/nft_flow_offload.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -72,6 +72,7 @@ static void nft_flow_offload_eval(const
        struct nf_flow_route route;
        struct flow_offload *flow;
        enum ip_conntrack_dir dir;
+       bool is_tcp = false;
        struct nf_conn *ct;
        int ret;
 
@@ -84,6 +85,8 @@ static void nft_flow_offload_eval(const
 
        switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
        case IPPROTO_TCP:
+               is_tcp = true;
+               break;
        case IPPROTO_UDP:
                break;
        default:
@@ -109,6 +112,11 @@ static void nft_flow_offload_eval(const
        if (!flow)
                goto err_flow_alloc;
 
+       if (is_tcp) {
+               ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
+               ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
+       }
+
        ret = flow_offload_add(flowtable, flow);
        if (ret < 0)
                goto err_flow_add;