netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options

netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options

BugLink: https://bugs.launchpad.net/bugs/1969110
[ Upstream commit f2dd495a8d589371289981d5ed33e6873df94ecc ]

Do not reset IP_CT_TCP_FLAG_BE_LIBERAL flag in out-of-sync scenarios
coming before the TCP window tracking, otherwise such connections will
fail in the window check.

Update tcp_options() to leave this flag in place and add a new helper
function to reset the tcp window state.

Based on patch from Sven Auhagen.

Fixes: c4832c7bbc3f ("netfilter: nf_ct_tcp: improve out-of-sync situation in TCP tracking")
Tested-by: Sven Auhagen <sven.auhagen@voleatech.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 6195af5ad80198d43e8ec969d06731db2368c4c3)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>