linux/net/netfilter/nf_conntrack_proto_tcp.c
<<
>>
Prefs
   1/* (C) 1999-2001 Paul `Rusty' Russell
   2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   3 *
   4 * This program is free software; you can redistribute it and/or modify
   5 * it under the terms of the GNU General Public License version 2 as
   6 * published by the Free Software Foundation.
   7 */
   8
   9#include <linux/types.h>
  10#include <linux/timer.h>
  11#include <linux/module.h>
  12#include <linux/in.h>
  13#include <linux/tcp.h>
  14#include <linux/spinlock.h>
  15#include <linux/skbuff.h>
  16#include <linux/ipv6.h>
  17#include <net/ip6_checksum.h>
  18
  19#include <net/tcp.h>
  20
  21#include <linux/netfilter.h>
  22#include <linux/netfilter_ipv4.h>
  23#include <linux/netfilter_ipv6.h>
  24#include <net/netfilter/nf_conntrack.h>
  25#include <net/netfilter/nf_conntrack_l4proto.h>
  26#include <net/netfilter/nf_conntrack_ecache.h>
  27#include <net/netfilter/nf_log.h>
  28
  29/* Protects ct->proto.tcp */
  30static DEFINE_RWLOCK(tcp_lock);
  31
  32/* "Be conservative in what you do,
  33    be liberal in what you accept from others."
  34    If it's non-zero, we mark only out of window RST segments as INVALID. */
  35static int nf_ct_tcp_be_liberal __read_mostly = 0;
  36
  37/* If it is set to zero, we disable picking up already established
  38   connections. */
  39static int nf_ct_tcp_loose __read_mostly = 1;
  40
  41/* Max number of the retransmitted packets without receiving an (acceptable)
  42   ACK from the destination. If this number is reached, a shorter timer
  43   will be started. */
  44static int nf_ct_tcp_max_retrans __read_mostly = 3;
  45
  46  /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
  47     closely.  They're more complex. --RR */
  48
  49static const char *const tcp_conntrack_names[] = {
  50        "NONE",
  51        "SYN_SENT",
  52        "SYN_RECV",
  53        "ESTABLISHED",
  54        "FIN_WAIT",
  55        "CLOSE_WAIT",
  56        "LAST_ACK",
  57        "TIME_WAIT",
  58        "CLOSE",
  59        "LISTEN"
  60};
  61
  62#define SECS * HZ
  63#define MINS * 60 SECS
  64#define HOURS * 60 MINS
  65#define DAYS * 24 HOURS
  66
  67/* RFC1122 says the R2 limit should be at least 100 seconds.
  68   Linux uses 15 packets as limit, which corresponds
  69   to ~13-30min depending on RTO. */
  70static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly    =   5 MINS;
  71static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly =   5 MINS;
  72
  73static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
  74        [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
  75        [TCP_CONNTRACK_SYN_RECV]        = 60 SECS,
  76        [TCP_CONNTRACK_ESTABLISHED]     = 5 DAYS,
  77        [TCP_CONNTRACK_FIN_WAIT]        = 2 MINS,
  78        [TCP_CONNTRACK_CLOSE_WAIT]      = 60 SECS,
  79        [TCP_CONNTRACK_LAST_ACK]        = 30 SECS,
  80        [TCP_CONNTRACK_TIME_WAIT]       = 2 MINS,
  81        [TCP_CONNTRACK_CLOSE]           = 10 SECS,
  82};
  83
  84#define sNO TCP_CONNTRACK_NONE
  85#define sSS TCP_CONNTRACK_SYN_SENT
  86#define sSR TCP_CONNTRACK_SYN_RECV
  87#define sES TCP_CONNTRACK_ESTABLISHED
  88#define sFW TCP_CONNTRACK_FIN_WAIT
  89#define sCW TCP_CONNTRACK_CLOSE_WAIT
  90#define sLA TCP_CONNTRACK_LAST_ACK
  91#define sTW TCP_CONNTRACK_TIME_WAIT
  92#define sCL TCP_CONNTRACK_CLOSE
  93#define sLI TCP_CONNTRACK_LISTEN
  94#define sIV TCP_CONNTRACK_MAX
  95#define sIG TCP_CONNTRACK_IGNORE
  96
  97/* What TCP flags are set from RST/SYN/FIN/ACK. */
  98enum tcp_bit_set {
  99        TCP_SYN_SET,
 100        TCP_SYNACK_SET,
 101        TCP_FIN_SET,
 102        TCP_ACK_SET,
 103        TCP_RST_SET,
 104        TCP_NONE_SET,
 105};
 106
 107/*
 108 * The TCP state transition table needs a few words...
 109 *
 110 * We are the man in the middle. All the packets go through us
 111 * but might get lost in transit to the destination.
 112 * It is assumed that the destinations can't receive segments
 113 * we haven't seen.
 114 *
 115 * The checked segment is in window, but our windows are *not*
 116 * equivalent with the ones of the sender/receiver. We always
 117 * try to guess the state of the current sender.
 118 *
 119 * The meaning of the states are:
 120 *
 121 * NONE:        initial state
 122 * SYN_SENT:    SYN-only packet seen
 123 * SYN_RECV:    SYN-ACK packet seen
 124 * ESTABLISHED: ACK packet seen
 125 * FIN_WAIT:    FIN packet seen
 126 * CLOSE_WAIT:  ACK seen (after FIN)
 127 * LAST_ACK:    FIN seen (after FIN)
 128 * TIME_WAIT:   last ACK seen
 129 * CLOSE:       closed connection (RST)
 130 *
 131 * LISTEN state is not used.
 132 *
 133 * Packets marked as IGNORED (sIG):
 134 *      if they may be either invalid or valid
 135 *      and the receiver may send back a connection
 136 *      closing RST or a SYN/ACK.
 137 *
 138 * Packets marked as INVALID (sIV):
 139 *      if they are invalid
 140 *      or we do not support the request (simultaneous open)
 141 */
 142static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
 143        {
 144/* ORIGINAL */
 145/*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 146/*syn*/    { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sIV },
 147/*
 148 *      sNO -> sSS      Initialize a new connection
 149 *      sSS -> sSS      Retransmitted SYN
 150 *      sSR -> sIG      Late retransmitted SYN?
 151 *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
 152 *                      are errors. Receiver will reply with RST
 153 *                      and close the connection.
 154 *                      Or we are not in sync and hold a dead connection.
 155 *      sFW -> sIG
 156 *      sCW -> sIG
 157 *      sLA -> sIG
 158 *      sTW -> sSS      Reopened connection (RFC 1122).
 159 *      sCL -> sSS
 160 */
 161/*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 162/*synack*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
 163/*
 164 * A SYN/ACK from the client is always invalid:
 165 *      - either it tries to set up a simultaneous open, which is
 166 *        not supported;
 167 *      - or the firewall has just been inserted between the two hosts
 168 *        during the session set-up. The SYN will be retransmitted
 169 *        by the true client (or it'll time out).
 170 */
 171/*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 172/*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 173/*
 174 *      sNO -> sIV      Too late and no reason to do anything...
 175 *      sSS -> sIV      Client migth not send FIN in this state:
 176 *                      we enforce waiting for a SYN/ACK reply first.
 177 *      sSR -> sFW      Close started.
 178 *      sES -> sFW
 179 *      sFW -> sLA      FIN seen in both directions, waiting for
 180 *                      the last ACK.
 181 *                      Migth be a retransmitted FIN as well...
 182 *      sCW -> sLA
 183 *      sLA -> sLA      Retransmitted FIN. Remain in the same state.
 184 *      sTW -> sTW
 185 *      sCL -> sCL
 186 */
 187/*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 188/*ack*/    { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 189/*
 190 *      sNO -> sES      Assumed.
 191 *      sSS -> sIV      ACK is invalid: we haven't seen a SYN/ACK yet.
 192 *      sSR -> sES      Established state is reached.
 193 *      sES -> sES      :-)
 194 *      sFW -> sCW      Normal close request answered by ACK.
 195 *      sCW -> sCW
 196 *      sLA -> sTW      Last ACK detected.
 197 *      sTW -> sTW      Retransmitted last ACK. Remain in the same state.
 198 *      sCL -> sCL
 199 */
 200/*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 201/*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
 202/*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 203        },
 204        {
 205/* REPLY */
 206/*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 207/*syn*/    { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
 208/*
 209 *      sNO -> sIV      Never reached.
 210 *      sSS -> sIV      Simultaneous open, not supported
 211 *      sSR -> sIV      Simultaneous open, not supported.
 212 *      sES -> sIV      Server may not initiate a connection.
 213 *      sFW -> sIV
 214 *      sCW -> sIV
 215 *      sLA -> sIV
 216 *      sTW -> sIV      Reopened connection, but server may not do it.
 217 *      sCL -> sIV
 218 */
 219/*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 220/*synack*/ { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIV },
 221/*
 222 *      sSS -> sSR      Standard open.
 223 *      sSR -> sSR      Retransmitted SYN/ACK.
 224 *      sES -> sIG      Late retransmitted SYN/ACK?
 225 *      sFW -> sIG      Might be SYN/ACK answering ignored SYN
 226 *      sCW -> sIG
 227 *      sLA -> sIG
 228 *      sTW -> sIG
 229 *      sCL -> sIG
 230 */
 231/*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 232/*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 233/*
 234 *      sSS -> sIV      Server might not send FIN in this state.
 235 *      sSR -> sFW      Close started.
 236 *      sES -> sFW
 237 *      sFW -> sLA      FIN seen in both directions.
 238 *      sCW -> sLA
 239 *      sLA -> sLA      Retransmitted FIN.
 240 *      sTW -> sTW
 241 *      sCL -> sCL
 242 */
 243/*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 244/*ack*/    { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 245/*
 246 *      sSS -> sIG      Might be a half-open connection.
 247 *      sSR -> sSR      Might answer late resent SYN.
 248 *      sES -> sES      :-)
 249 *      sFW -> sCW      Normal close request answered by ACK.
 250 *      sCW -> sCW
 251 *      sLA -> sTW      Last ACK detected.
 252 *      sTW -> sTW      Retransmitted last ACK.
 253 *      sCL -> sCL
 254 */
 255/*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 256/*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
 257/*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 258        }
 259};
 260
 261static bool tcp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
 262                             struct nf_conntrack_tuple *tuple)
 263{
 264        const struct tcphdr *hp;
 265        struct tcphdr _hdr;
 266
 267        /* Actually only need first 8 bytes. */
 268        hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
 269        if (hp == NULL)
 270                return false;
 271
 272        tuple->src.u.tcp.port = hp->source;
 273        tuple->dst.u.tcp.port = hp->dest;
 274
 275        return true;
 276}
 277
 278static bool tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
 279                             const struct nf_conntrack_tuple *orig)
 280{
 281        tuple->src.u.tcp.port = orig->dst.u.tcp.port;
 282        tuple->dst.u.tcp.port = orig->src.u.tcp.port;
 283        return true;
 284}
 285
 286/* Print out the per-protocol part of the tuple. */
 287static int tcp_print_tuple(struct seq_file *s,
 288                           const struct nf_conntrack_tuple *tuple)
 289{
 290        return seq_printf(s, "sport=%hu dport=%hu ",
 291                          ntohs(tuple->src.u.tcp.port),
 292                          ntohs(tuple->dst.u.tcp.port));
 293}
 294
 295/* Print out the private part of the conntrack. */
 296static int tcp_print_conntrack(struct seq_file *s, const struct nf_conn *ct)
 297{
 298        enum tcp_conntrack state;
 299
 300        read_lock_bh(&tcp_lock);
 301        state = ct->proto.tcp.state;
 302        read_unlock_bh(&tcp_lock);
 303
 304        return seq_printf(s, "%s ", tcp_conntrack_names[state]);
 305}
 306
 307static unsigned int get_conntrack_index(const struct tcphdr *tcph)
 308{
 309        if (tcph->rst) return TCP_RST_SET;
 310        else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
 311        else if (tcph->fin) return TCP_FIN_SET;
 312        else if (tcph->ack) return TCP_ACK_SET;
 313        else return TCP_NONE_SET;
 314}
 315
 316/* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
 317   in IP Filter' by Guido van Rooij.
 318
 319   http://www.nluug.nl/events/sane2000/papers.html
 320   http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
 321
 322   The boundaries and the conditions are changed according to RFC793:
 323   the packet must intersect the window (i.e. segments may be
 324   after the right or before the left edge) and thus receivers may ACK
 325   segments after the right edge of the window.
 326
 327        td_maxend = max(sack + max(win,1)) seen in reply packets
 328        td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
 329        td_maxwin += seq + len - sender.td_maxend
 330                        if seq + len > sender.td_maxend
 331        td_end    = max(seq + len) seen in sent packets
 332
 333   I.   Upper bound for valid data:     seq <= sender.td_maxend
 334   II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
 335   III. Upper bound for valid (s)ack:   sack <= receiver.td_end
 336   IV.  Lower bound for valid (s)ack:   sack >= receiver.td_end - MAXACKWINDOW
 337
 338   where sack is the highest right edge of sack block found in the packet
 339   or ack in the case of packet without SACK option.
 340
 341   The upper bound limit for a valid (s)ack is not ignored -
 342   we doesn't have to deal with fragments.
 343*/
 344
 345static inline __u32 segment_seq_plus_len(__u32 seq,
 346                                         size_t len,
 347                                         unsigned int dataoff,
 348                                         const struct tcphdr *tcph)
 349{
 350        /* XXX Should I use payload length field in IP/IPv6 header ?
 351         * - YK */
 352        return (seq + len - dataoff - tcph->doff*4
 353                + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
 354}
 355
 356/* Fixme: what about big packets? */
 357#define MAXACKWINCONST                  66000
 358#define MAXACKWINDOW(sender)                                            \
 359        ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin     \
 360                                              : MAXACKWINCONST)
 361
 362/*
 363 * Simplified tcp_parse_options routine from tcp_input.c
 364 */
 365static void tcp_options(const struct sk_buff *skb,
 366                        unsigned int dataoff,
 367                        const struct tcphdr *tcph,
 368                        struct ip_ct_tcp_state *state)
 369{
 370        unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 371        const unsigned char *ptr;
 372        int length = (tcph->doff*4) - sizeof(struct tcphdr);
 373
 374        if (!length)
 375                return;
 376
 377        ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
 378                                 length, buff);
 379        BUG_ON(ptr == NULL);
 380
 381        state->td_scale =
 382        state->flags = 0;
 383
 384        while (length > 0) {
 385                int opcode=*ptr++;
 386                int opsize;
 387
 388                switch (opcode) {
 389                case TCPOPT_EOL:
 390                        return;
 391                case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
 392                        length--;
 393                        continue;
 394                default:
 395                        opsize=*ptr++;
 396                        if (opsize < 2) /* "silly options" */
 397                                return;
 398                        if (opsize > length)
 399                                break;  /* don't parse partial options */
 400
 401                        if (opcode == TCPOPT_SACK_PERM
 402                            && opsize == TCPOLEN_SACK_PERM)
 403                                state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
 404                        else if (opcode == TCPOPT_WINDOW
 405                                 && opsize == TCPOLEN_WINDOW) {
 406                                state->td_scale = *(u_int8_t *)ptr;
 407
 408                                if (state->td_scale > 14) {
 409                                        /* See RFC1323 */
 410                                        state->td_scale = 14;
 411                                }
 412                                state->flags |=
 413                                        IP_CT_TCP_FLAG_WINDOW_SCALE;
 414                        }
 415                        ptr += opsize - 2;
 416                        length -= opsize;
 417                }
 418        }
 419}
 420
 421static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
 422                     const struct tcphdr *tcph, __u32 *sack)
 423{
 424        unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 425        const unsigned char *ptr;
 426        int length = (tcph->doff*4) - sizeof(struct tcphdr);
 427        __u32 tmp;
 428
 429        if (!length)
 430                return;
 431
 432        ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
 433                                 length, buff);
 434        BUG_ON(ptr == NULL);
 435
 436        /* Fast path for timestamp-only option */
 437        if (length == TCPOLEN_TSTAMP_ALIGNED*4
 438            && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
 439                                       | (TCPOPT_NOP << 16)
 440                                       | (TCPOPT_TIMESTAMP << 8)
 441                                       | TCPOLEN_TIMESTAMP))
 442                return;
 443
 444        while (length > 0) {
 445                int opcode = *ptr++;
 446                int opsize, i;
 447
 448                switch (opcode) {
 449                case TCPOPT_EOL:
 450                        return;
 451                case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
 452                        length--;
 453                        continue;
 454                default:
 455                        opsize = *ptr++;
 456                        if (opsize < 2) /* "silly options" */
 457                                return;
 458                        if (opsize > length)
 459                                break;  /* don't parse partial options */
 460
 461                        if (opcode == TCPOPT_SACK
 462                            && opsize >= (TCPOLEN_SACK_BASE
 463                                          + TCPOLEN_SACK_PERBLOCK)
 464                            && !((opsize - TCPOLEN_SACK_BASE)
 465                                 % TCPOLEN_SACK_PERBLOCK)) {
 466                                for (i = 0;
 467                                     i < (opsize - TCPOLEN_SACK_BASE);
 468                                     i += TCPOLEN_SACK_PERBLOCK) {
 469                                        tmp = ntohl(*((__be32 *)(ptr+i)+1));
 470
 471                                        if (after(tmp, *sack))
 472                                                *sack = tmp;
 473                                }
 474                                return;
 475                        }
 476                        ptr += opsize - 2;
 477                        length -= opsize;
 478                }
 479        }
 480}
 481
 482static bool tcp_in_window(const struct nf_conn *ct,
 483                          struct ip_ct_tcp *state,
 484                          enum ip_conntrack_dir dir,
 485                          unsigned int index,
 486                          const struct sk_buff *skb,
 487                          unsigned int dataoff,
 488                          const struct tcphdr *tcph,
 489                          u_int8_t pf)
 490{
 491        struct net *net = nf_ct_net(ct);
 492        struct ip_ct_tcp_state *sender = &state->seen[dir];
 493        struct ip_ct_tcp_state *receiver = &state->seen[!dir];
 494        const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
 495        __u32 seq, ack, sack, end, win, swin;
 496        bool res;
 497
 498        /*
 499         * Get the required data from the packet.
 500         */
 501        seq = ntohl(tcph->seq);
 502        ack = sack = ntohl(tcph->ack_seq);
 503        win = ntohs(tcph->window);
 504        end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
 505
 506        if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
 507                tcp_sack(skb, dataoff, tcph, &sack);
 508
 509        pr_debug("tcp_in_window: START\n");
 510        pr_debug("tcp_in_window: ");
 511        nf_ct_dump_tuple(tuple);
 512        pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
 513                 seq, ack, sack, win, end);
 514        pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 515                 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 516                 sender->td_end, sender->td_maxend, sender->td_maxwin,
 517                 sender->td_scale,
 518                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 519                 receiver->td_scale);
 520
 521        if (sender->td_end == 0) {
 522                /*
 523                 * Initialize sender data.
 524                 */
 525                if (tcph->syn && tcph->ack) {
 526                        /*
 527                         * Outgoing SYN-ACK in reply to a SYN.
 528                         */
 529                        sender->td_end =
 530                        sender->td_maxend = end;
 531                        sender->td_maxwin = (win == 0 ? 1 : win);
 532
 533                        tcp_options(skb, dataoff, tcph, sender);
 534                        /*
 535                         * RFC 1323:
 536                         * Both sides must send the Window Scale option
 537                         * to enable window scaling in either direction.
 538                         */
 539                        if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
 540                              && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
 541                                sender->td_scale =
 542                                receiver->td_scale = 0;
 543                } else {
 544                        /*
 545                         * We are in the middle of a connection,
 546                         * its history is lost for us.
 547                         * Let's try to use the data from the packet.
 548                         */
 549                        sender->td_end = end;
 550                        sender->td_maxwin = (win == 0 ? 1 : win);
 551                        sender->td_maxend = end + sender->td_maxwin;
 552                }
 553        } else if (((state->state == TCP_CONNTRACK_SYN_SENT
 554                     && dir == IP_CT_DIR_ORIGINAL)
 555                   || (state->state == TCP_CONNTRACK_SYN_RECV
 556                     && dir == IP_CT_DIR_REPLY))
 557                   && after(end, sender->td_end)) {
 558                /*
 559                 * RFC 793: "if a TCP is reinitialized ... then it need
 560                 * not wait at all; it must only be sure to use sequence
 561                 * numbers larger than those recently used."
 562                 */
 563                sender->td_end =
 564                sender->td_maxend = end;
 565                sender->td_maxwin = (win == 0 ? 1 : win);
 566
 567                tcp_options(skb, dataoff, tcph, sender);
 568        }
 569
 570        if (!(tcph->ack)) {
 571                /*
 572                 * If there is no ACK, just pretend it was set and OK.
 573                 */
 574                ack = sack = receiver->td_end;
 575        } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
 576                    (TCP_FLAG_ACK|TCP_FLAG_RST))
 577                   && (ack == 0)) {
 578                /*
 579                 * Broken TCP stacks, that set ACK in RST packets as well
 580                 * with zero ack value.
 581                 */
 582                ack = sack = receiver->td_end;
 583        }
 584
 585        if (seq == end
 586            && (!tcph->rst
 587                || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
 588                /*
 589                 * Packets contains no data: we assume it is valid
 590                 * and check the ack value only.
 591                 * However RST segments are always validated by their
 592                 * SEQ number, except when seq == 0 (reset sent answering
 593                 * SYN.
 594                 */
 595                seq = end = sender->td_end;
 596
 597        pr_debug("tcp_in_window: ");
 598        nf_ct_dump_tuple(tuple);
 599        pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
 600                 seq, ack, sack, win, end);
 601        pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 602                 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 603                 sender->td_end, sender->td_maxend, sender->td_maxwin,
 604                 sender->td_scale,
 605                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 606                 receiver->td_scale);
 607
 608        pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
 609                 before(seq, sender->td_maxend + 1),
 610                 after(end, sender->td_end - receiver->td_maxwin - 1),
 611                 before(sack, receiver->td_end + 1),
 612                 after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
 613
 614        if (before(seq, sender->td_maxend + 1) &&
 615            after(end, sender->td_end - receiver->td_maxwin - 1) &&
 616            before(sack, receiver->td_end + 1) &&
 617            after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
 618                /*
 619                 * Take into account window scaling (RFC 1323).
 620                 */
 621                if (!tcph->syn)
 622                        win <<= sender->td_scale;
 623
 624                /*
 625                 * Update sender data.
 626                 */
 627                swin = win + (sack - ack);
 628                if (sender->td_maxwin < swin)
 629                        sender->td_maxwin = swin;
 630                if (after(end, sender->td_end)) {
 631                        sender->td_end = end;
 632                        sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 633                }
 634                /*
 635                 * Update receiver data.
 636                 */
 637                if (after(end, sender->td_maxend))
 638                        receiver->td_maxwin += end - sender->td_maxend;
 639                if (after(sack + win, receiver->td_maxend - 1)) {
 640                        receiver->td_maxend = sack + win;
 641                        if (win == 0)
 642                                receiver->td_maxend++;
 643                }
 644                if (ack == receiver->td_end)
 645                        receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 646
 647                /*
 648                 * Check retransmissions.
 649                 */
 650                if (index == TCP_ACK_SET) {
 651                        if (state->last_dir == dir
 652                            && state->last_seq == seq
 653                            && state->last_ack == ack
 654                            && state->last_end == end
 655                            && state->last_win == win)
 656                                state->retrans++;
 657                        else {
 658                                state->last_dir = dir;
 659                                state->last_seq = seq;
 660                                state->last_ack = ack;
 661                                state->last_end = end;
 662                                state->last_win = win;
 663                                state->retrans = 0;
 664                        }
 665                }
 666                res = true;
 667        } else {
 668                res = false;
 669                if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
 670                    nf_ct_tcp_be_liberal)
 671                        res = true;
 672                if (!res && LOG_INVALID(net, IPPROTO_TCP))
 673                        nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 674                        "nf_ct_tcp: %s ",
 675                        before(seq, sender->td_maxend + 1) ?
 676                        after(end, sender->td_end - receiver->td_maxwin - 1) ?
 677                        before(sack, receiver->td_end + 1) ?
 678                        after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
 679                        : "ACK is under the lower bound (possible overly delayed ACK)"
 680                        : "ACK is over the upper bound (ACKed data not seen yet)"
 681                        : "SEQ is under the lower bound (already ACKed data retransmitted)"
 682                        : "SEQ is over the upper bound (over the window of the receiver)");
 683        }
 684
 685        pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
 686                 "receiver end=%u maxend=%u maxwin=%u\n",
 687                 res, sender->td_end, sender->td_maxend, sender->td_maxwin,
 688                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
 689
 690        return res;
 691}
 692
 693#ifdef CONFIG_NF_NAT_NEEDED
 694/* Update sender->td_end after NAT successfully mangled the packet */
 695/* Caller must linearize skb at tcp header. */
 696void nf_conntrack_tcp_update(const struct sk_buff *skb,
 697                             unsigned int dataoff,
 698                             struct nf_conn *ct,
 699                             int dir)
 700{
 701        const struct tcphdr *tcph = (const void *)skb->data + dataoff;
 702        const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
 703        const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
 704        __u32 end;
 705
 706        end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
 707
 708        write_lock_bh(&tcp_lock);
 709        /*
 710         * We have to worry for the ack in the reply packet only...
 711         */
 712        if (after(end, ct->proto.tcp.seen[dir].td_end))
 713                ct->proto.tcp.seen[dir].td_end = end;
 714        ct->proto.tcp.last_end = end;
 715        write_unlock_bh(&tcp_lock);
 716        pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
 717                 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 718                 sender->td_end, sender->td_maxend, sender->td_maxwin,
 719                 sender->td_scale,
 720                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 721                 receiver->td_scale);
 722}
 723EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
 724#endif
 725
 726#define TH_FIN  0x01
 727#define TH_SYN  0x02
 728#define TH_RST  0x04
 729#define TH_PUSH 0x08
 730#define TH_ACK  0x10
 731#define TH_URG  0x20
 732#define TH_ECE  0x40
 733#define TH_CWR  0x80
 734
 735/* table of valid flag combinations - PUSH, ECE and CWR are always valid */
 736static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
 737{
 738        [TH_SYN]                        = 1,
 739        [TH_SYN|TH_URG]                 = 1,
 740        [TH_SYN|TH_ACK]                 = 1,
 741        [TH_RST]                        = 1,
 742        [TH_RST|TH_ACK]                 = 1,
 743        [TH_FIN|TH_ACK]                 = 1,
 744        [TH_FIN|TH_ACK|TH_URG]          = 1,
 745        [TH_ACK]                        = 1,
 746        [TH_ACK|TH_URG]                 = 1,
 747};
 748
 749/* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
 750static int tcp_error(struct net *net,
 751                     struct sk_buff *skb,
 752                     unsigned int dataoff,
 753                     enum ip_conntrack_info *ctinfo,
 754                     u_int8_t pf,
 755                     unsigned int hooknum)
 756{
 757        const struct tcphdr *th;
 758        struct tcphdr _tcph;
 759        unsigned int tcplen = skb->len - dataoff;
 760        u_int8_t tcpflags;
 761
 762        /* Smaller that minimal TCP header? */
 763        th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
 764        if (th == NULL) {
 765                if (LOG_INVALID(net, IPPROTO_TCP))
 766                        nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 767                                "nf_ct_tcp: short packet ");
 768                return -NF_ACCEPT;
 769        }
 770
 771        /* Not whole TCP header or malformed packet */
 772        if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
 773                if (LOG_INVALID(net, IPPROTO_TCP))
 774                        nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 775                                "nf_ct_tcp: truncated/malformed packet ");
 776                return -NF_ACCEPT;
 777        }
 778
 779        /* Checksum invalid? Ignore.
 780         * We skip checking packets on the outgoing path
 781         * because the checksum is assumed to be correct.
 782         */
 783        /* FIXME: Source route IP option packets --RR */
 784        if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
 785            nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
 786                if (LOG_INVALID(net, IPPROTO_TCP))
 787                        nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 788                                  "nf_ct_tcp: bad TCP checksum ");
 789                return -NF_ACCEPT;
 790        }
 791
 792        /* Check TCP flags. */
 793        tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR|TH_PUSH));
 794        if (!tcp_valid_flags[tcpflags]) {
 795                if (LOG_INVALID(net, IPPROTO_TCP))
 796                        nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 797                                  "nf_ct_tcp: invalid TCP flag combination ");
 798                return -NF_ACCEPT;
 799        }
 800
 801        return NF_ACCEPT;
 802}
 803
 804/* Returns verdict for packet, or -1 for invalid. */
 805static int tcp_packet(struct nf_conn *ct,
 806                      const struct sk_buff *skb,
 807                      unsigned int dataoff,
 808                      enum ip_conntrack_info ctinfo,
 809                      u_int8_t pf,
 810                      unsigned int hooknum)
 811{
 812        struct net *net = nf_ct_net(ct);
 813        struct nf_conntrack_tuple *tuple;
 814        enum tcp_conntrack new_state, old_state;
 815        enum ip_conntrack_dir dir;
 816        const struct tcphdr *th;
 817        struct tcphdr _tcph;
 818        unsigned long timeout;
 819        unsigned int index;
 820
 821        th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
 822        BUG_ON(th == NULL);
 823
 824        write_lock_bh(&tcp_lock);
 825        old_state = ct->proto.tcp.state;
 826        dir = CTINFO2DIR(ctinfo);
 827        index = get_conntrack_index(th);
 828        new_state = tcp_conntracks[dir][index][old_state];
 829        tuple = &ct->tuplehash[dir].tuple;
 830
 831        switch (new_state) {
 832        case TCP_CONNTRACK_SYN_SENT:
 833                if (old_state < TCP_CONNTRACK_TIME_WAIT)
 834                        break;
 835                /* RFC 1122: "When a connection is closed actively,
 836                 * it MUST linger in TIME-WAIT state for a time 2xMSL
 837                 * (Maximum Segment Lifetime). However, it MAY accept
 838                 * a new SYN from the remote TCP to reopen the connection
 839                 * directly from TIME-WAIT state, if..."
 840                 * We ignore the conditions because we are in the
 841                 * TIME-WAIT state anyway.
 842                 *
 843                 * Handle aborted connections: we and the server
 844                 * think there is an existing connection but the client
 845                 * aborts it and starts a new one.
 846                 */
 847                if (((ct->proto.tcp.seen[dir].flags
 848                      | ct->proto.tcp.seen[!dir].flags)
 849                     & IP_CT_TCP_FLAG_CLOSE_INIT)
 850                    || (ct->proto.tcp.last_dir == dir
 851                        && ct->proto.tcp.last_index == TCP_RST_SET)) {
 852                        /* Attempt to reopen a closed/aborted connection.
 853                         * Delete this connection and look up again. */
 854                        write_unlock_bh(&tcp_lock);
 855
 856                        /* Only repeat if we can actually remove the timer.
 857                         * Destruction may already be in progress in process
 858                         * context and we must give it a chance to terminate.
 859                         */
 860                        if (nf_ct_kill(ct))
 861                                return -NF_REPEAT;
 862                        return -NF_DROP;
 863                }
 864                /* Fall through */
 865        case TCP_CONNTRACK_IGNORE:
 866                /* Ignored packets:
 867                 *
 868                 * Our connection entry may be out of sync, so ignore
 869                 * packets which may signal the real connection between
 870                 * the client and the server.
 871                 *
 872                 * a) SYN in ORIGINAL
 873                 * b) SYN/ACK in REPLY
 874                 * c) ACK in reply direction after initial SYN in original.
 875                 *
 876                 * If the ignored packet is invalid, the receiver will send
 877                 * a RST we'll catch below.
 878                 */
 879                if (index == TCP_SYNACK_SET
 880                    && ct->proto.tcp.last_index == TCP_SYN_SET
 881                    && ct->proto.tcp.last_dir != dir
 882                    && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
 883                        /* b) This SYN/ACK acknowledges a SYN that we earlier
 884                         * ignored as invalid. This means that the client and
 885                         * the server are both in sync, while the firewall is
 886                         * not. We kill this session and block the SYN/ACK so
 887                         * that the client cannot but retransmit its SYN and
 888                         * thus initiate a clean new session.
 889                         */
 890                        write_unlock_bh(&tcp_lock);
 891                        if (LOG_INVALID(net, IPPROTO_TCP))
 892                                nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 893                                          "nf_ct_tcp: killing out of sync session ");
 894                        nf_ct_kill(ct);
 895                        return -NF_DROP;
 896                }
 897                ct->proto.tcp.last_index = index;
 898                ct->proto.tcp.last_dir = dir;
 899                ct->proto.tcp.last_seq = ntohl(th->seq);
 900                ct->proto.tcp.last_end =
 901                    segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
 902
 903                write_unlock_bh(&tcp_lock);
 904                if (LOG_INVALID(net, IPPROTO_TCP))
 905                        nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 906                                  "nf_ct_tcp: invalid packet ignored ");
 907                return NF_ACCEPT;
 908        case TCP_CONNTRACK_MAX:
 909                /* Invalid packet */
 910                pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
 911                         dir, get_conntrack_index(th), old_state);
 912                write_unlock_bh(&tcp_lock);
 913                if (LOG_INVALID(net, IPPROTO_TCP))
 914                        nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 915                                  "nf_ct_tcp: invalid state ");
 916                return -NF_ACCEPT;
 917        case TCP_CONNTRACK_CLOSE:
 918                if (index == TCP_RST_SET
 919                    && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
 920                         && ct->proto.tcp.last_index == TCP_SYN_SET)
 921                        || (!test_bit(IPS_ASSURED_BIT, &ct->status)
 922                            && ct->proto.tcp.last_index == TCP_ACK_SET))
 923                    && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
 924                        /* RST sent to invalid SYN or ACK we had let through
 925                         * at a) and c) above:
 926                         *
 927                         * a) SYN was in window then
 928                         * c) we hold a half-open connection.
 929                         *
 930                         * Delete our connection entry.
 931                         * We skip window checking, because packet might ACK
 932                         * segments we ignored. */
 933                        goto in_window;
 934                }
 935                /* Just fall through */
 936        default:
 937                /* Keep compilers happy. */
 938                break;
 939        }
 940
 941        if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
 942                           skb, dataoff, th, pf)) {
 943                write_unlock_bh(&tcp_lock);
 944                return -NF_ACCEPT;
 945        }
 946     in_window:
 947        /* From now on we have got in-window packets */
 948        ct->proto.tcp.last_index = index;
 949        ct->proto.tcp.last_dir = dir;
 950
 951        pr_debug("tcp_conntracks: ");
 952        nf_ct_dump_tuple(tuple);
 953        pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
 954                 (th->syn ? 1 : 0), (th->ack ? 1 : 0),
 955                 (th->fin ? 1 : 0), (th->rst ? 1 : 0),
 956                 old_state, new_state);
 957
 958        ct->proto.tcp.state = new_state;
 959        if (old_state != new_state
 960            && new_state == TCP_CONNTRACK_FIN_WAIT)
 961                ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
 962
 963        if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
 964            tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
 965                timeout = nf_ct_tcp_timeout_max_retrans;
 966        else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
 967                 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
 968                 tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
 969                timeout = nf_ct_tcp_timeout_unacknowledged;
 970        else
 971                timeout = tcp_timeouts[new_state];
 972        write_unlock_bh(&tcp_lock);
 973
 974        nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, ct);
 975        if (new_state != old_state)
 976                nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
 977
 978        if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
 979                /* If only reply is a RST, we can consider ourselves not to
 980                   have an established connection: this is a fairly common
 981                   problem case, so we can delete the conntrack
 982                   immediately.  --RR */
 983                if (th->rst) {
 984                        nf_ct_kill_acct(ct, ctinfo, skb);
 985                        return NF_ACCEPT;
 986                }
 987        } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
 988                   && (old_state == TCP_CONNTRACK_SYN_RECV
 989                       || old_state == TCP_CONNTRACK_ESTABLISHED)
 990                   && new_state == TCP_CONNTRACK_ESTABLISHED) {
 991                /* Set ASSURED if we see see valid ack in ESTABLISHED
 992                   after SYN_RECV or a valid answer for a picked up
 993                   connection. */
 994                set_bit(IPS_ASSURED_BIT, &ct->status);
 995                nf_conntrack_event_cache(IPCT_STATUS, ct);
 996        }
 997        nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
 998
 999        return NF_ACCEPT;
1000}
1001
1002/* Called when a new connection for this protocol found. */
1003static bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
1004                    unsigned int dataoff)
1005{
1006        enum tcp_conntrack new_state;
1007        const struct tcphdr *th;
1008        struct tcphdr _tcph;
1009        const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
1010        const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
1011
1012        th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1013        BUG_ON(th == NULL);
1014
1015        /* Don't need lock here: this conntrack not in circulation yet */
1016        new_state
1017                = tcp_conntracks[0][get_conntrack_index(th)]
1018                [TCP_CONNTRACK_NONE];
1019
1020        /* Invalid: delete conntrack */
1021        if (new_state >= TCP_CONNTRACK_MAX) {
1022                pr_debug("nf_ct_tcp: invalid new deleting.\n");
1023                return false;
1024        }
1025
1026        if (new_state == TCP_CONNTRACK_SYN_SENT) {
1027                /* SYN packet */
1028                ct->proto.tcp.seen[0].td_end =
1029                        segment_seq_plus_len(ntohl(th->seq), skb->len,
1030                                             dataoff, th);
1031                ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1032                if (ct->proto.tcp.seen[0].td_maxwin == 0)
1033                        ct->proto.tcp.seen[0].td_maxwin = 1;
1034                ct->proto.tcp.seen[0].td_maxend =
1035                        ct->proto.tcp.seen[0].td_end;
1036
1037                tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
1038                ct->proto.tcp.seen[1].flags = 0;
1039        } else if (nf_ct_tcp_loose == 0) {
1040                /* Don't try to pick up connections. */
1041                return false;
1042        } else {
1043                /*
1044                 * We are in the middle of a connection,
1045                 * its history is lost for us.
1046                 * Let's try to use the data from the packet.
1047                 */
1048                ct->proto.tcp.seen[0].td_end =
1049                        segment_seq_plus_len(ntohl(th->seq), skb->len,
1050                                             dataoff, th);
1051                ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1052                if (ct->proto.tcp.seen[0].td_maxwin == 0)
1053                        ct->proto.tcp.seen[0].td_maxwin = 1;
1054                ct->proto.tcp.seen[0].td_maxend =
1055                        ct->proto.tcp.seen[0].td_end +
1056                        ct->proto.tcp.seen[0].td_maxwin;
1057                ct->proto.tcp.seen[0].td_scale = 0;
1058
1059                /* We assume SACK and liberal window checking to handle
1060                 * window scaling */
1061                ct->proto.tcp.seen[0].flags =
1062                ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1063                                              IP_CT_TCP_FLAG_BE_LIBERAL;
1064        }
1065
1066        ct->proto.tcp.seen[1].td_end = 0;
1067        ct->proto.tcp.seen[1].td_maxend = 0;
1068        ct->proto.tcp.seen[1].td_maxwin = 1;
1069        ct->proto.tcp.seen[1].td_scale = 0;
1070
1071        /* tcp_packet will set them */
1072        ct->proto.tcp.state = TCP_CONNTRACK_NONE;
1073        ct->proto.tcp.last_index = TCP_NONE_SET;
1074
1075        pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1076                 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1077                 sender->td_end, sender->td_maxend, sender->td_maxwin,
1078                 sender->td_scale,
1079                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1080                 receiver->td_scale);
1081        return true;
1082}
1083
1084#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1085
1086#include <linux/netfilter/nfnetlink.h>
1087#include <linux/netfilter/nfnetlink_conntrack.h>
1088
1089static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
1090                         const struct nf_conn *ct)
1091{
1092        struct nlattr *nest_parms;
1093        struct nf_ct_tcp_flags tmp = {};
1094
1095        read_lock_bh(&tcp_lock);
1096        nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP | NLA_F_NESTED);
1097        if (!nest_parms)
1098                goto nla_put_failure;
1099
1100        NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state);
1101
1102        NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
1103                   ct->proto.tcp.seen[0].td_scale);
1104
1105        NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
1106                   ct->proto.tcp.seen[1].td_scale);
1107
1108        tmp.flags = ct->proto.tcp.seen[0].flags;
1109        NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
1110                sizeof(struct nf_ct_tcp_flags), &tmp);
1111
1112        tmp.flags = ct->proto.tcp.seen[1].flags;
1113        NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
1114                sizeof(struct nf_ct_tcp_flags), &tmp);
1115        read_unlock_bh(&tcp_lock);
1116
1117        nla_nest_end(skb, nest_parms);
1118
1119        return 0;
1120
1121nla_put_failure:
1122        read_unlock_bh(&tcp_lock);
1123        return -1;
1124}
1125
1126static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
1127        [CTA_PROTOINFO_TCP_STATE]           = { .type = NLA_U8 },
1128        [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
1129        [CTA_PROTOINFO_TCP_WSCALE_REPLY]    = { .type = NLA_U8 },
1130        [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
1131        [CTA_PROTOINFO_TCP_FLAGS_REPLY]     = { .len =  sizeof(struct nf_ct_tcp_flags) },
1132};
1133
1134static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
1135{
1136        struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
1137        struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
1138        int err;
1139
1140        /* updates could not contain anything about the private
1141         * protocol info, in that case skip the parsing */
1142        if (!pattr)
1143                return 0;
1144
1145        err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
1146        if (err < 0)
1147                return err;
1148
1149        if (tb[CTA_PROTOINFO_TCP_STATE] &&
1150            nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
1151                return -EINVAL;
1152
1153        write_lock_bh(&tcp_lock);
1154        if (tb[CTA_PROTOINFO_TCP_STATE])
1155                ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
1156
1157        if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
1158                struct nf_ct_tcp_flags *attr =
1159                        nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
1160                ct->proto.tcp.seen[0].flags &= ~attr->mask;
1161                ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
1162        }
1163
1164        if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
1165                struct nf_ct_tcp_flags *attr =
1166                        nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
1167                ct->proto.tcp.seen[1].flags &= ~attr->mask;
1168                ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
1169        }
1170
1171        if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
1172            tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
1173            ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
1174            ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1175                ct->proto.tcp.seen[0].td_scale =
1176                        nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
1177                ct->proto.tcp.seen[1].td_scale =
1178                        nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
1179        }
1180        write_unlock_bh(&tcp_lock);
1181
1182        return 0;
1183}
1184#endif
1185
1186#ifdef CONFIG_SYSCTL
1187static unsigned int tcp_sysctl_table_users;
1188static struct ctl_table_header *tcp_sysctl_header;
1189static struct ctl_table tcp_sysctl_table[] = {
1190        {
1191                .procname       = "nf_conntrack_tcp_timeout_syn_sent",
1192                .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1193                .maxlen         = sizeof(unsigned int),
1194                .mode           = 0644,
1195                .proc_handler   = &proc_dointvec_jiffies,
1196        },
1197        {
1198                .procname       = "nf_conntrack_tcp_timeout_syn_recv",
1199                .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1200                .maxlen         = sizeof(unsigned int),
1201                .mode           = 0644,
1202                .proc_handler   = &proc_dointvec_jiffies,
1203        },
1204        {
1205                .procname       = "nf_conntrack_tcp_timeout_established",
1206                .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1207                .maxlen         = sizeof(unsigned int),
1208                .mode           = 0644,
1209                .proc_handler   = &proc_dointvec_jiffies,
1210        },
1211        {
1212                .procname       = "nf_conntrack_tcp_timeout_fin_wait",
1213                .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1214                .maxlen         = sizeof(unsigned int),
1215                .mode           = 0644,
1216                .proc_handler   = &proc_dointvec_jiffies,
1217        },
1218        {
1219                .procname       = "nf_conntrack_tcp_timeout_close_wait",
1220                .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1221                .maxlen         = sizeof(unsigned int),
1222                .mode           = 0644,
1223                .proc_handler   = &proc_dointvec_jiffies,
1224        },
1225        {
1226                .procname       = "nf_conntrack_tcp_timeout_last_ack",
1227                .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1228                .maxlen         = sizeof(unsigned int),
1229                .mode           = 0644,
1230                .proc_handler   = &proc_dointvec_jiffies,
1231        },
1232        {
1233                .procname       = "nf_conntrack_tcp_timeout_time_wait",
1234                .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1235                .maxlen         = sizeof(unsigned int),
1236                .mode           = 0644,
1237                .proc_handler   = &proc_dointvec_jiffies,
1238        },
1239        {
1240                .procname       = "nf_conntrack_tcp_timeout_close",
1241                .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1242                .maxlen         = sizeof(unsigned int),
1243                .mode           = 0644,
1244                .proc_handler   = &proc_dointvec_jiffies,
1245        },
1246        {
1247                .procname       = "nf_conntrack_tcp_timeout_max_retrans",
1248                .data           = &nf_ct_tcp_timeout_max_retrans,
1249                .maxlen         = sizeof(unsigned int),
1250                .mode           = 0644,
1251                .proc_handler   = &proc_dointvec_jiffies,
1252        },
1253        {
1254                .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
1255                .data           = &nf_ct_tcp_timeout_unacknowledged,
1256                .maxlen         = sizeof(unsigned int),
1257                .mode           = 0644,
1258                .proc_handler   = &proc_dointvec_jiffies,
1259        },
1260        {
1261                .ctl_name       = NET_NF_CONNTRACK_TCP_LOOSE,
1262                .procname       = "nf_conntrack_tcp_loose",
1263                .data           = &nf_ct_tcp_loose,
1264                .maxlen         = sizeof(unsigned int),
1265                .mode           = 0644,
1266                .proc_handler   = &proc_dointvec,
1267        },
1268        {
1269                .ctl_name       = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
1270                .procname       = "nf_conntrack_tcp_be_liberal",
1271                .data           = &nf_ct_tcp_be_liberal,
1272                .maxlen         = sizeof(unsigned int),
1273                .mode           = 0644,
1274                .proc_handler   = &proc_dointvec,
1275        },
1276        {
1277                .ctl_name       = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
1278                .procname       = "nf_conntrack_tcp_max_retrans",
1279                .data           = &nf_ct_tcp_max_retrans,
1280                .maxlen         = sizeof(unsigned int),
1281                .mode           = 0644,
1282                .proc_handler   = &proc_dointvec,
1283        },
1284        {
1285                .ctl_name       = 0
1286        }
1287};
1288
1289#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1290static struct ctl_table tcp_compat_sysctl_table[] = {
1291        {
1292                .procname       = "ip_conntrack_tcp_timeout_syn_sent",
1293                .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1294                .maxlen         = sizeof(unsigned int),
1295                .mode           = 0644,
1296                .proc_handler   = &proc_dointvec_jiffies,
1297        },
1298        {
1299                .procname       = "ip_conntrack_tcp_timeout_syn_recv",
1300                .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1301                .maxlen         = sizeof(unsigned int),
1302                .mode           = 0644,
1303                .proc_handler   = &proc_dointvec_jiffies,
1304        },
1305        {
1306                .procname       = "ip_conntrack_tcp_timeout_established",
1307                .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1308                .maxlen         = sizeof(unsigned int),
1309                .mode           = 0644,
1310                .proc_handler   = &proc_dointvec_jiffies,
1311        },
1312        {
1313                .procname       = "ip_conntrack_tcp_timeout_fin_wait",
1314                .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1315                .maxlen         = sizeof(unsigned int),
1316                .mode           = 0644,
1317                .proc_handler   = &proc_dointvec_jiffies,
1318        },
1319        {
1320                .procname       = "ip_conntrack_tcp_timeout_close_wait",
1321                .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1322                .maxlen         = sizeof(unsigned int),
1323                .mode           = 0644,
1324                .proc_handler   = &proc_dointvec_jiffies,
1325        },
1326        {
1327                .procname       = "ip_conntrack_tcp_timeout_last_ack",
1328                .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1329                .maxlen         = sizeof(unsigned int),
1330                .mode           = 0644,
1331                .proc_handler   = &proc_dointvec_jiffies,
1332        },
1333        {
1334                .procname       = "ip_conntrack_tcp_timeout_time_wait",
1335                .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1336                .maxlen         = sizeof(unsigned int),
1337                .mode           = 0644,
1338                .proc_handler   = &proc_dointvec_jiffies,
1339        },
1340        {
1341                .procname       = "ip_conntrack_tcp_timeout_close",
1342                .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1343                .maxlen         = sizeof(unsigned int),
1344                .mode           = 0644,
1345                .proc_handler   = &proc_dointvec_jiffies,
1346        },
1347        {
1348                .procname       = "ip_conntrack_tcp_timeout_max_retrans",
1349                .data           = &nf_ct_tcp_timeout_max_retrans,
1350                .maxlen         = sizeof(unsigned int),
1351                .mode           = 0644,
1352                .proc_handler   = &proc_dointvec_jiffies,
1353        },
1354        {
1355                .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
1356                .procname       = "ip_conntrack_tcp_loose",
1357                .data           = &nf_ct_tcp_loose,
1358                .maxlen         = sizeof(unsigned int),
1359                .mode           = 0644,
1360                .proc_handler   = &proc_dointvec,
1361        },
1362        {
1363                .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
1364                .procname       = "ip_conntrack_tcp_be_liberal",
1365                .data           = &nf_ct_tcp_be_liberal,
1366                .maxlen         = sizeof(unsigned int),
1367                .mode           = 0644,
1368                .proc_handler   = &proc_dointvec,
1369        },
1370        {
1371                .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
1372                .procname       = "ip_conntrack_tcp_max_retrans",
1373                .data           = &nf_ct_tcp_max_retrans,
1374                .maxlen         = sizeof(unsigned int),
1375                .mode           = 0644,
1376                .proc_handler   = &proc_dointvec,
1377        },
1378        {
1379                .ctl_name       = 0
1380        }
1381};
1382#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
1383#endif /* CONFIG_SYSCTL */
1384
1385struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
1386{
1387        .l3proto                = PF_INET,
1388        .l4proto                = IPPROTO_TCP,
1389        .name                   = "tcp",
1390        .pkt_to_tuple           = tcp_pkt_to_tuple,
1391        .invert_tuple           = tcp_invert_tuple,
1392        .print_tuple            = tcp_print_tuple,
1393        .print_conntrack        = tcp_print_conntrack,
1394        .packet                 = tcp_packet,
1395        .new                    = tcp_new,
1396        .error                  = tcp_error,
1397#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1398        .to_nlattr              = tcp_to_nlattr,
1399        .from_nlattr            = nlattr_to_tcp,
1400        .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1401        .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1402        .nla_policy             = nf_ct_port_nla_policy,
1403#endif
1404#ifdef CONFIG_SYSCTL
1405        .ctl_table_users        = &tcp_sysctl_table_users,
1406        .ctl_table_header       = &tcp_sysctl_header,
1407        .ctl_table              = tcp_sysctl_table,
1408#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1409        .ctl_compat_table       = tcp_compat_sysctl_table,
1410#endif
1411#endif
1412};
1413EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
1414
1415struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
1416{
1417        .l3proto                = PF_INET6,
1418        .l4proto                = IPPROTO_TCP,
1419        .name                   = "tcp",
1420        .pkt_to_tuple           = tcp_pkt_to_tuple,
1421        .invert_tuple           = tcp_invert_tuple,
1422        .print_tuple            = tcp_print_tuple,
1423        .print_conntrack        = tcp_print_conntrack,
1424        .packet                 = tcp_packet,
1425        .new                    = tcp_new,
1426        .error                  = tcp_error,
1427#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1428        .to_nlattr              = tcp_to_nlattr,
1429        .from_nlattr            = nlattr_to_tcp,
1430        .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1431        .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1432        .nla_policy             = nf_ct_port_nla_policy,
1433#endif
1434#ifdef CONFIG_SYSCTL
1435        .ctl_table_users        = &tcp_sysctl_table_users,
1436        .ctl_table_header       = &tcp_sysctl_header,
1437        .ctl_table              = tcp_sysctl_table,
1438#endif
1439};
1440EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);
1441