diff options
| author | Ali Abdallah <ali.abdallah@suse.com> | 2021-05-27 09:19:06 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-07-06 14:15:12 +0200 |
| commit | 1da4cd82dd180224503e745ccf3220e3490d8897 (patch) | |
| tree | 2e0b43b452a3c6f07f726a6edd26161520256504 /Documentation | |
| parent | netfilter: conntrack: improve RST handling when tuple is re-used (diff) | |
| download | linux-1da4cd82dd180224503e745ccf3220e3490d8897.tar.xz linux-1da4cd82dd180224503e745ccf3220e3490d8897.zip | |
netfilter: conntrack: add new sysctl to disable RST check
This patch adds a new sysctl tcp_ignore_invalid_rst to disable marking
out of segments RSTs as INVALID.
Signed-off-by: Ali Abdallah <aabdallah@suse.de>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'Documentation')
| -rw-r--r-- | Documentation/networking/nf_conntrack-sysctl.rst | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/Documentation/networking/nf_conntrack-sysctl.rst b/Documentation/networking/nf_conntrack-sysctl.rst index 0467b30e4abe..d31ed6c1cb0d 100644 --- a/Documentation/networking/nf_conntrack-sysctl.rst +++ b/Documentation/networking/nf_conntrack-sysctl.rst @@ -110,6 +110,12 @@ nf_conntrack_tcp_be_liberal - BOOLEAN Be conservative in what you do, be liberal in what you accept from others. If it's non-zero, we mark only out of window RST segments as INVALID. +nf_conntrack_tcp_ignore_invalid_rst - BOOLEAN + - 0 - disabled (default) + - 1 - enabled + + If it's 1, we don't mark out of window RST segments as INVALID. + nf_conntrack_tcp_loose - BOOLEAN - 0 - disabled - not 0 - enabled (default) |