SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/netfilter/nf_conntrack_proto_tcp.c

   1 /* (C) 1999-2001 Paul `Rusty' Russell
   2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/types.h>
  10 #include <linux/timer.h>
  11 #include <linux/module.h>
  12 #include <linux/in.h>
  13 #include <linux/tcp.h>
  14 #include <linux/spinlock.h>
  15 #include <linux/skbuff.h>
  16 #include <linux/ipv6.h>
  17 #include <net/ip6_checksum.h>
  18 #include <asm/unaligned.h>
  19
  20 #include <net/tcp.h>
  21
  22 #include <linux/netfilter.h>
  23 #include <linux/netfilter_ipv4.h>
  24 #include <linux/netfilter_ipv6.h>
  25 #include <net/netfilter/nf_conntrack.h>
  26 #include <net/netfilter/nf_conntrack_l4proto.h>
  27 #include <net/netfilter/nf_conntrack_ecache.h>
  28 #include <net/netfilter/nf_log.h>
  29 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
  30 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
  31
  32 /* Protects ct->proto.tcp */
  33 static DEFINE_RWLOCK(tcp_lock);
  34
  35 /* "Be conservative in what you do,
  36     be liberal in what you accept from others."
  37     If it's non-zero, we mark only out of window RST segments as INVALID. */
  38 static int nf_ct_tcp_be_liberal __read_mostly = 0;
  39
  40 /* If it is set to zero, we disable picking up already established
  41    connections. */
  42 static int nf_ct_tcp_loose __read_mostly = 1;
  43
  44 /* Max number of the retransmitted packets without receiving an (acceptable)
  45    ACK from the destination. If this number is reached, a shorter timer
  46    will be started. */
  47 static int nf_ct_tcp_max_retrans __read_mostly = 3;
  48
  49   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
  50      closely.  They're more complex. --RR */
  51
  52 static const char *const tcp_conntrack_names[] = {
  53         "NONE",
  54         "SYN_SENT",
  55         "SYN_RECV",
  56         "ESTABLISHED",
  57         "FIN_WAIT",
  58         "CLOSE_WAIT",
  59         "LAST_ACK",
  60         "TIME_WAIT",
  61         "CLOSE",
  62         "SYN_SENT2",
  63 };
  64
  65 #define SECS * HZ
  66 #define MINS * 60 SECS
  67 #define HOURS * 60 MINS
  68 #define DAYS * 24 HOURS
  69
  70 /* RFC1122 says the R2 limit should be at least 100 seconds.
  71    Linux uses 15 packets as limit, which corresponds
  72    to ~13-30min depending on RTO. */
  73 static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly    =   5 MINS;
  74 static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly =   5 MINS;
  75
  76 static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
  77         [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
  78         [TCP_CONNTRACK_SYN_RECV]        = 60 SECS,
  79         [TCP_CONNTRACK_ESTABLISHED]     = 5 DAYS,
  80         [TCP_CONNTRACK_FIN_WAIT]        = 2 MINS,
  81         [TCP_CONNTRACK_CLOSE_WAIT]      = 60 SECS,
  82         [TCP_CONNTRACK_LAST_ACK]        = 30 SECS,
  83         [TCP_CONNTRACK_TIME_WAIT]       = 2 MINS,
  84         [TCP_CONNTRACK_CLOSE]           = 10 SECS,
  85         [TCP_CONNTRACK_SYN_SENT2]       = 2 MINS,
  86 };
  87
  88 #define sNO TCP_CONNTRACK_NONE
  89 #define sSS TCP_CONNTRACK_SYN_SENT
  90 #define sSR TCP_CONNTRACK_SYN_RECV
  91 #define sES TCP_CONNTRACK_ESTABLISHED
  92 #define sFW TCP_CONNTRACK_FIN_WAIT
  93 #define sCW TCP_CONNTRACK_CLOSE_WAIT
  94 #define sLA TCP_CONNTRACK_LAST_ACK
  95 #define sTW TCP_CONNTRACK_TIME_WAIT
  96 #define sCL TCP_CONNTRACK_CLOSE
  97 #define sS2 TCP_CONNTRACK_SYN_SENT2
  98 #define sIV TCP_CONNTRACK_MAX
  99 #define sIG TCP_CONNTRACK_IGNORE
 100
 101 /* What TCP flags are set from RST/SYN/FIN/ACK. */
 102 enum tcp_bit_set {
 103         TCP_SYN_SET,
 104         TCP_SYNACK_SET,
 105         TCP_FIN_SET,
 106         TCP_ACK_SET,
 107         TCP_RST_SET,
 108         TCP_NONE_SET,
 109 };
 110
 111 /*
 112  * The TCP state transition table needs a few words...
 113  *
 114  * We are the man in the middle. All the packets go through us
 115  * but might get lost in transit to the destination.
 116  * It is assumed that the destinations can't receive segments
 117  * we haven't seen.
 118  *
 119  * The checked segment is in window, but our windows are *not*
 120  * equivalent with the ones of the sender/receiver. We always
 121  * try to guess the state of the current sender.
 122  *
 123  * The meaning of the states are:
 124  *
 125  * NONE:        initial state
 126  * SYN_SENT:    SYN-only packet seen
 127  * SYN_SENT2:   SYN-only packet seen from reply dir, simultaneous open
 128  * SYN_RECV:    SYN-ACK packet seen
 129  * ESTABLISHED: ACK packet seen
 130  * FIN_WAIT:    FIN packet seen
 131  * CLOSE_WAIT:  ACK seen (after FIN)
 132  * LAST_ACK:    FIN seen (after FIN)
 133  * TIME_WAIT:   last ACK seen
 134  * CLOSE:       closed connection (RST)
 135  *
 136  * Packets marked as IGNORED (sIG):
 137  *      if they may be either invalid or valid
 138  *      and the receiver may send back a connection
 139  *      closing RST or a SYN/ACK.
 140  *
 141  * Packets marked as INVALID (sIV):
 142  *      if we regard them as truly invalid packets
 143  */
 144 static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
 145         {
 146 /* ORIGINAL */
 147 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 148 /*syn*/    { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sS2 },
 149 /*
 150  *      sNO -> sSS      Initialize a new connection
 151  *      sSS -> sSS      Retransmitted SYN
 152  *      sS2 -> sS2      Late retransmitted SYN
 153  *      sSR -> sIG
 154  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
 155  *                      are errors. Receiver will reply with RST
 156  *                      and close the connection.
 157  *                      Or we are not in sync and hold a dead connection.
 158  *      sFW -> sIG
 159  *      sCW -> sIG
 160  *      sLA -> sIG
 161  *      sTW -> sSS      Reopened connection (RFC 1122).
 162  *      sCL -> sSS
 163  */
 164 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 165 /*synack*/ { sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
 166 /*
 167  *      sNO -> sIV      Too late and no reason to do anything
 168  *      sSS -> sIV      Client can't send SYN and then SYN/ACK
 169  *      sS2 -> sSR      SYN/ACK sent to SYN2 in simultaneous open
 170  *      sSR -> sIG
 171  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
 172  *                      are errors. Receiver will reply with RST
 173  *                      and close the connection.
 174  *                      Or we are not in sync and hold a dead connection.
 175  *      sFW -> sIG
 176  *      sCW -> sIG
 177  *      sLA -> sIG
 178  *      sTW -> sIG
 179  *      sCL -> sIG
 180  */
 181 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 182 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 183 /*
 184  *      sNO -> sIV      Too late and no reason to do anything...
 185  *      sSS -> sIV      Client migth not send FIN in this state:
 186  *                      we enforce waiting for a SYN/ACK reply first.
 187  *      sS2 -> sIV
 188  *      sSR -> sFW      Close started.
 189  *      sES -> sFW
 190  *      sFW -> sLA      FIN seen in both directions, waiting for
 191  *                      the last ACK.
 192  *                      Migth be a retransmitted FIN as well...
 193  *      sCW -> sLA
 194  *      sLA -> sLA      Retransmitted FIN. Remain in the same state.
 195  *      sTW -> sTW
 196  *      sCL -> sCL
 197  */
 198 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 199 /*ack*/    { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 200 /*
 201  *      sNO -> sES      Assumed.
 202  *      sSS -> sIV      ACK is invalid: we haven't seen a SYN/ACK yet.
 203  *      sS2 -> sIV
 204  *      sSR -> sES      Established state is reached.
 205  *      sES -> sES      :-)
 206  *      sFW -> sCW      Normal close request answered by ACK.
 207  *      sCW -> sCW
 208  *      sLA -> sTW      Last ACK detected.
 209  *      sTW -> sTW      Retransmitted last ACK. Remain in the same state.
 210  *      sCL -> sCL
 211  */
 212 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 213 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
 214 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 215         },
 216         {
 217 /* REPLY */
 218 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 219 /*syn*/    { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sS2 },
 220 /*
 221  *      sNO -> sIV      Never reached.
 222  *      sSS -> sS2      Simultaneous open
 223  *      sS2 -> sS2      Retransmitted simultaneous SYN
 224  *      sSR -> sIV      Invalid SYN packets sent by the server
 225  *      sES -> sIV
 226  *      sFW -> sIV
 227  *      sCW -> sIV
 228  *      sLA -> sIV
 229  *      sTW -> sIV      Reopened connection, but server may not do it.
 230  *      sCL -> sIV
 231  */
 232 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 233 /*synack*/ { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
 234 /*
 235  *      sSS -> sSR      Standard open.
 236  *      sS2 -> sSR      Simultaneous open
 237  *      sSR -> sSR      Retransmitted SYN/ACK.
 238  *      sES -> sIG      Late retransmitted SYN/ACK?
 239  *      sFW -> sIG      Might be SYN/ACK answering ignored SYN
 240  *      sCW -> sIG
 241  *      sLA -> sIG
 242  *      sTW -> sIG
 243  *      sCL -> sIG
 244  */
 245 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 246 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 247 /*
 248  *      sSS -> sIV      Server might not send FIN in this state.
 249  *      sS2 -> sIV
 250  *      sSR -> sFW      Close started.
 251  *      sES -> sFW
 252  *      sFW -> sLA      FIN seen in both directions.
 253  *      sCW -> sLA
 254  *      sLA -> sLA      Retransmitted FIN.
 255  *      sTW -> sTW
 256  *      sCL -> sCL
 257  */
 258 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 259 /*ack*/    { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIG },
 260 /*
 261  *      sSS -> sIG      Might be a half-open connection.
 262  *      sS2 -> sIG
 263  *      sSR -> sSR      Might answer late resent SYN.
 264  *      sES -> sES      :-)
 265  *      sFW -> sCW      Normal close request answered by ACK.
 266  *      sCW -> sCW
 267  *      sLA -> sTW      Last ACK detected.
 268  *      sTW -> sTW      Retransmitted last ACK.
 269  *      sCL -> sCL
 270  */
 271 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 272 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
 273 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 274         }
 275 };
 276
 277 static bool tcp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
 278                              struct nf_conntrack_tuple *tuple)
 279 {
 280         const struct tcphdr *hp;
 281         struct tcphdr _hdr;
 282
 283         /* Actually only need first 8 bytes. */
 284         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
 285         if (hp == NULL)
 286                 return false;
 287
 288         tuple->src.u.tcp.port = hp->source;
 289         tuple->dst.u.tcp.port = hp->dest;
 290
 291         return true;
 292 }
 293
 294 static bool tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
 295                              const struct nf_conntrack_tuple *orig)
 296 {
 297         tuple->src.u.tcp.port = orig->dst.u.tcp.port;
 298         tuple->dst.u.tcp.port = orig->src.u.tcp.port;
 299         return true;
 300 }
 301
 302 /* Print out the per-protocol part of the tuple. */
 303 static int tcp_print_tuple(struct seq_file *s,
 304                            const struct nf_conntrack_tuple *tuple)
 305 {
 306         return seq_printf(s, "sport=%hu dport=%hu ",
 307                           ntohs(tuple->src.u.tcp.port),
 308                           ntohs(tuple->dst.u.tcp.port));
 309 }
 310
 311 /* Print out the private part of the conntrack. */
 312 static int tcp_print_conntrack(struct seq_file *s, const struct nf_conn *ct)
 313 {
 314         enum tcp_conntrack state;
 315
 316         read_lock_bh(&tcp_lock);
 317         state = ct->proto.tcp.state;
 318         read_unlock_bh(&tcp_lock);
 319
 320         return seq_printf(s, "%s ", tcp_conntrack_names[state]);
 321 }
 322
 323 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
 324 {
 325         if (tcph->rst) return TCP_RST_SET;
 326         else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
 327         else if (tcph->fin) return TCP_FIN_SET;
 328         else if (tcph->ack) return TCP_ACK_SET;
 329         else return TCP_NONE_SET;
 330 }
 331
 332 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
 333    in IP Filter' by Guido van Rooij.
 334
 335    http://www.nluug.nl/events/sane2000/papers.html
 336    http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
 337
 338    The boundaries and the conditions are changed according to RFC793:
 339    the packet must intersect the window (i.e. segments may be
 340    after the right or before the left edge) and thus receivers may ACK
 341    segments after the right edge of the window.
 342
 343         td_maxend = max(sack + max(win,1)) seen in reply packets
 344         td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
 345         td_maxwin += seq + len - sender.td_maxend
 346                         if seq + len > sender.td_maxend
 347         td_end    = max(seq + len) seen in sent packets
 348
 349    I.   Upper bound for valid data:     seq <= sender.td_maxend
 350    II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
 351    III. Upper bound for valid (s)ack:   sack <= receiver.td_end
 352    IV.  Lower bound for valid (s)ack:   sack >= receiver.td_end - MAXACKWINDOW
 353
 354    where sack is the highest right edge of sack block found in the packet
 355    or ack in the case of packet without SACK option.
 356
 357    The upper bound limit for a valid (s)ack is not ignored -
 358    we doesn't have to deal with fragments.
 359 */
 360
 361 static inline __u32 segment_seq_plus_len(__u32 seq,
 362                                          size_t len,
 363                                          unsigned int dataoff,
 364                                          const struct tcphdr *tcph)
 365 {
 366         /* XXX Should I use payload length field in IP/IPv6 header ?
 367          * - YK */
 368         return (seq + len - dataoff - tcph->doff*4
 369                 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
 370 }
 371
 372 /* Fixme: what about big packets? */
 373 #define MAXACKWINCONST                  66000
 374 #define MAXACKWINDOW(sender)                                            \
 375         ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin     \
 376                                               : MAXACKWINCONST)
 377
 378 /*
 379  * Simplified tcp_parse_options routine from tcp_input.c
 380  */
 381 static void tcp_options(const struct sk_buff *skb,
 382                         unsigned int dataoff,
 383                         const struct tcphdr *tcph,
 384                         struct ip_ct_tcp_state *state)
 385 {
 386         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 387         const unsigned char *ptr;
 388         int length = (tcph->doff*4) - sizeof(struct tcphdr);
 389
 390         if (!length)
 391                 return;
 392
 393         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
 394                                  length, buff);
 395         BUG_ON(ptr == NULL);
 396
 397         state->td_scale =
 398         state->flags = 0;
 399
 400         while (length > 0) {
 401                 int opcode=*ptr++;
 402                 int opsize;
 403
 404                 switch (opcode) {
 405                 case TCPOPT_EOL:
 406                         return;
 407                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
 408                         length--;
 409                         continue;
 410                 default:
 411                         opsize=*ptr++;
 412                         if (opsize < 2) /* "silly options" */
 413                                 return;
 414                         if (opsize > length)
 415                                 break;  /* don't parse partial options */
 416
 417                         if (opcode == TCPOPT_SACK_PERM
 418                             && opsize == TCPOLEN_SACK_PERM)
 419                                 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
 420                         else if (opcode == TCPOPT_WINDOW
 421                                  && opsize == TCPOLEN_WINDOW) {
 422                                 state->td_scale = *(u_int8_t *)ptr;
 423
 424                                 if (state->td_scale > 14) {
 425                                         /* See RFC1323 */
 426                                         state->td_scale = 14;
 427                                 }
 428                                 state->flags |=
 429                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
 430                         }
 431                         ptr += opsize - 2;
 432                         length -= opsize;
 433                 }
 434         }
 435 }
 436
 437 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
 438                      const struct tcphdr *tcph, __u32 *sack)
 439 {
 440         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 441         const unsigned char *ptr;
 442         int length = (tcph->doff*4) - sizeof(struct tcphdr);
 443         __u32 tmp;
 444
 445         if (!length)
 446                 return;
 447
 448         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
 449                                  length, buff);
 450         BUG_ON(ptr == NULL);
 451
 452         /* Fast path for timestamp-only option */
 453         if (length == TCPOLEN_TSTAMP_ALIGNED*4
 454             && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
 455                                        | (TCPOPT_NOP << 16)
 456                                        | (TCPOPT_TIMESTAMP << 8)
 457                                        | TCPOLEN_TIMESTAMP))
 458                 return;
 459
 460         while (length > 0) {
 461                 int opcode = *ptr++;
 462                 int opsize, i;
 463
 464                 switch (opcode) {
 465                 case TCPOPT_EOL:
 466                         return;
 467                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
 468                         length--;
 469                         continue;
 470                 default:
 471                         opsize = *ptr++;
 472                         if (opsize < 2) /* "silly options" */
 473                                 return;
 474                         if (opsize > length)
 475                                 break;  /* don't parse partial options */
 476
 477                         if (opcode == TCPOPT_SACK
 478                             && opsize >= (TCPOLEN_SACK_BASE
 479                                           + TCPOLEN_SACK_PERBLOCK)
 480                             && !((opsize - TCPOLEN_SACK_BASE)
 481                                  % TCPOLEN_SACK_PERBLOCK)) {
 482                                 for (i = 0;
 483                                      i < (opsize - TCPOLEN_SACK_BASE);
 484                                      i += TCPOLEN_SACK_PERBLOCK) {
 485                                         tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
 486
 487                                         if (after(tmp, *sack))
 488                                                 *sack = tmp;
 489                                 }
 490                                 return;
 491                         }
 492                         ptr += opsize - 2;
 493                         length -= opsize;
 494                 }
 495         }
 496 }
 497
 498 static bool tcp_in_window(const struct nf_conn *ct,
 499                           struct ip_ct_tcp *state,
 500                           enum ip_conntrack_dir dir,
 501                           unsigned int index,
 502                           const struct sk_buff *skb,
 503                           unsigned int dataoff,
 504                           const struct tcphdr *tcph,
 505                           u_int8_t pf)
 506 {
 507         struct net *net = nf_ct_net(ct);
 508         struct ip_ct_tcp_state *sender = &state->seen[dir];
 509         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
 510         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
 511         __u32 seq, ack, sack, end, win, swin;
 512         bool res;
 513
 514         /*
 515          * Get the required data from the packet.
 516          */
 517         seq = ntohl(tcph->seq);
 518         ack = sack = ntohl(tcph->ack_seq);
 519         win = ntohs(tcph->window);
 520         end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
 521
 522         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
 523                 tcp_sack(skb, dataoff, tcph, &sack);
 524
 525         pr_debug("tcp_in_window: START\n");
 526         pr_debug("tcp_in_window: ");
 527         nf_ct_dump_tuple(tuple);
 528         pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
 529                  seq, ack, sack, win, end);
 530         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 531                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 532                  sender->td_end, sender->td_maxend, sender->td_maxwin,
 533                  sender->td_scale,
 534                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 535                  receiver->td_scale);
 536
 537         if (sender->td_maxwin == 0) {
 538                 /*
 539                  * Initialize sender data.
 540                  */
 541                 if (tcph->syn) {
 542                         /*
 543                          * SYN-ACK in reply to a SYN
 544                          * or SYN from reply direction in simultaneous open.
 545                          */
 546                         sender->td_end =
 547                         sender->td_maxend = end;
 548                         sender->td_maxwin = (win == 0 ? 1 : win);
 549
 550                         tcp_options(skb, dataoff, tcph, sender);
 551                         /*
 552                          * RFC 1323:
 553                          * Both sides must send the Window Scale option
 554                          * to enable window scaling in either direction.
 555                          */
 556                         if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
 557                               && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
 558                                 sender->td_scale =
 559                                 receiver->td_scale = 0;
 560                         if (!tcph->ack)
 561                                 /* Simultaneous open */
 562                                 return true;
 563                 } else {
 564                         /*
 565                          * We are in the middle of a connection,
 566                          * its history is lost for us.
 567                          * Let's try to use the data from the packet.
 568                          */
 569                         sender->td_end = end;
 570                         sender->td_maxwin = (win == 0 ? 1 : win);
 571                         sender->td_maxend = end + sender->td_maxwin;
 572                 }
 573         } else if (((state->state == TCP_CONNTRACK_SYN_SENT
 574                      && dir == IP_CT_DIR_ORIGINAL)
 575                    || (state->state == TCP_CONNTRACK_SYN_RECV
 576                      && dir == IP_CT_DIR_REPLY))
 577                    && after(end, sender->td_end)) {
 578                 /*
 579                  * RFC 793: "if a TCP is reinitialized ... then it need
 580                  * not wait at all; it must only be sure to use sequence
 581                  * numbers larger than those recently used."
 582                  */
 583                 sender->td_end =
 584                 sender->td_maxend = end;
 585                 sender->td_maxwin = (win == 0 ? 1 : win);
 586
 587                 tcp_options(skb, dataoff, tcph, sender);
 588         }
 589
 590         if (!(tcph->ack)) {
 591                 /*
 592                  * If there is no ACK, just pretend it was set and OK.
 593                  */
 594                 ack = sack = receiver->td_end;
 595         } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
 596                     (TCP_FLAG_ACK|TCP_FLAG_RST))
 597                    && (ack == 0)) {
 598                 /*
 599                  * Broken TCP stacks, that set ACK in RST packets as well
 600                  * with zero ack value.
 601                  */
 602                 ack = sack = receiver->td_end;
 603         }
 604
 605         if (seq == end
 606             && (!tcph->rst
 607                 || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
 608                 /*
 609                  * Packets contains no data: we assume it is valid
 610                  * and check the ack value only.
 611                  * However RST segments are always validated by their
 612                  * SEQ number, except when seq == 0 (reset sent answering
 613                  * SYN.
 614                  */
 615                 seq = end = sender->td_end;
 616
 617         pr_debug("tcp_in_window: ");
 618         nf_ct_dump_tuple(tuple);
 619         pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
 620                  seq, ack, sack, win, end);
 621         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 622                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 623                  sender->td_end, sender->td_maxend, sender->td_maxwin,
 624                  sender->td_scale,
 625                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 626                  receiver->td_scale);
 627
 628         pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
 629                  before(seq, sender->td_maxend + 1),
 630                  after(end, sender->td_end - receiver->td_maxwin - 1),
 631                  before(sack, receiver->td_end + 1),
 632                  after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
 633
 634         if (before(seq, sender->td_maxend + 1) &&
 635             after(end, sender->td_end - receiver->td_maxwin - 1) &&
 636             before(sack, receiver->td_end + 1) &&
 637             after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
 638                 /*
 639                  * Take into account window scaling (RFC 1323).
 640                  */
 641                 if (!tcph->syn)
 642                         win <<= sender->td_scale;
 643
 644                 /*
 645                  * Update sender data.
 646                  */
 647                 swin = win + (sack - ack);
 648                 if (sender->td_maxwin < swin)
 649                         sender->td_maxwin = swin;
 650                 if (after(end, sender->td_end)) {
 651                         sender->td_end = end;
 652                         sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 653                 }
 654                 /*
 655                  * Update receiver data.
 656                  */
 657                 if (after(end, sender->td_maxend))
 658                         receiver->td_maxwin += end - sender->td_maxend;
 659                 if (after(sack + win, receiver->td_maxend - 1)) {
 660                         receiver->td_maxend = sack + win;
 661                         if (win == 0)
 662                                 receiver->td_maxend++;
 663                 }
 664                 if (ack == receiver->td_end)
 665                         receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 666
 667                 /*
 668                  * Check retransmissions.
 669                  */
 670                 if (index == TCP_ACK_SET) {
 671                         if (state->last_dir == dir
 672                             && state->last_seq == seq
 673                             && state->last_ack == ack
 674                             && state->last_end == end
 675                             && state->last_win == win)
 676                                 state->retrans++;
 677                         else {
 678                                 state->last_dir = dir;
 679                                 state->last_seq = seq;
 680                                 state->last_ack = ack;
 681                                 state->last_end = end;
 682                                 state->last_win = win;
 683                                 state->retrans = 0;
 684                         }
 685                 }
 686                 res = true;
 687         } else {
 688                 res = false;
 689                 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
 690                     nf_ct_tcp_be_liberal)
 691                         res = true;
 692                 if (!res && LOG_INVALID(net, IPPROTO_TCP))
 693                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 694                         "nf_ct_tcp: %s ",
 695                         before(seq, sender->td_maxend + 1) ?
 696                         after(end, sender->td_end - receiver->td_maxwin - 1) ?
 697                         before(sack, receiver->td_end + 1) ?
 698                         after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
 699                         : "ACK is under the lower bound (possible overly delayed ACK)"
 700                         : "ACK is over the upper bound (ACKed data not seen yet)"
 701                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
 702                         : "SEQ is over the upper bound (over the window of the receiver)");
 703         }
 704
 705         pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
 706                  "receiver end=%u maxend=%u maxwin=%u\n",
 707                  res, sender->td_end, sender->td_maxend, sender->td_maxwin,
 708                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
 709
 710         return res;
 711 }
 712
 713 #ifdef CONFIG_NF_NAT_NEEDED
 714 /* Update sender->td_end after NAT successfully mangled the packet */
 715 /* Caller must linearize skb at tcp header. */
 716 void nf_conntrack_tcp_update(const struct sk_buff *skb,
 717                              unsigned int dataoff,
 718                              struct nf_conn *ct,
 719                              int dir)
 720 {
 721         const struct tcphdr *tcph = (const void *)skb->data + dataoff;
 722         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
 723         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
 724         __u32 end;
 725
 726         end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
 727
 728         write_lock_bh(&tcp_lock);
 729         /*
 730          * We have to worry for the ack in the reply packet only...
 731          */
 732         if (after(end, ct->proto.tcp.seen[dir].td_end))
 733                 ct->proto.tcp.seen[dir].td_end = end;
 734         ct->proto.tcp.last_end = end;
 735         write_unlock_bh(&tcp_lock);
 736         pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
 737                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 738                  sender->td_end, sender->td_maxend, sender->td_maxwin,
 739                  sender->td_scale,
 740                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 741                  receiver->td_scale);
 742 }
 743 EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
 744 #endif
 745
 746 #define TH_FIN  0x01
 747 #define TH_SYN  0x02
 748 #define TH_RST  0x04
 749 #define TH_PUSH 0x08
 750 #define TH_ACK  0x10
 751 #define TH_URG  0x20
 752 #define TH_ECE  0x40
 753 #define TH_CWR  0x80
 754
 755 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
 756 static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
 757 {
 758         [TH_SYN]                        = 1,
 759         [TH_SYN|TH_URG]                 = 1,
 760         [TH_SYN|TH_ACK]                 = 1,
 761         [TH_RST]                        = 1,
 762         [TH_RST|TH_ACK]                 = 1,
 763         [TH_FIN|TH_ACK]                 = 1,
 764         [TH_FIN|TH_ACK|TH_URG]          = 1,
 765         [TH_ACK]                        = 1,
 766         [TH_ACK|TH_URG]                 = 1,
 767 };
 768
 769 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
 770 static int tcp_error(struct net *net,
 771                      struct sk_buff *skb,
 772                      unsigned int dataoff,
 773                      enum ip_conntrack_info *ctinfo,
 774                      u_int8_t pf,
 775                      unsigned int hooknum)
 776 {
 777         const struct tcphdr *th;
 778         struct tcphdr _tcph;
 779         unsigned int tcplen = skb->len - dataoff;
 780         u_int8_t tcpflags;
 781
 782         /* Smaller that minimal TCP header? */
 783         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
 784         if (th == NULL) {
 785                 if (LOG_INVALID(net, IPPROTO_TCP))
 786                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 787                                 "nf_ct_tcp: short packet ");
 788                 return -NF_ACCEPT;
 789         }
 790
 791         /* Not whole TCP header or malformed packet */
 792         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
 793                 if (LOG_INVALID(net, IPPROTO_TCP))
 794                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 795                                 "nf_ct_tcp: truncated/malformed packet ");
 796                 return -NF_ACCEPT;
 797         }
 798
 799         /* Checksum invalid? Ignore.
 800          * We skip checking packets on the outgoing path
 801          * because the checksum is assumed to be correct.
 802          */
 803         /* FIXME: Source route IP option packets --RR */
 804         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
 805             nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
 806                 if (LOG_INVALID(net, IPPROTO_TCP))
 807                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 808                                   "nf_ct_tcp: bad TCP checksum ");
 809                 return -NF_ACCEPT;
 810         }
 811
 812         /* Check TCP flags. */
 813         tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR|TH_PUSH));
 814         if (!tcp_valid_flags[tcpflags]) {
 815                 if (LOG_INVALID(net, IPPROTO_TCP))
 816                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 817                                   "nf_ct_tcp: invalid TCP flag combination ");
 818                 return -NF_ACCEPT;
 819         }
 820
 821         return NF_ACCEPT;
 822 }
 823
 824 /* Returns verdict for packet, or -1 for invalid. */
 825 static int tcp_packet(struct nf_conn *ct,
 826                       const struct sk_buff *skb,
 827                       unsigned int dataoff,
 828                       enum ip_conntrack_info ctinfo,
 829                       u_int8_t pf,
 830                       unsigned int hooknum)
 831 {
 832         struct net *net = nf_ct_net(ct);
 833         struct nf_conntrack_tuple *tuple;
 834         enum tcp_conntrack new_state, old_state;
 835         enum ip_conntrack_dir dir;
 836         const struct tcphdr *th;
 837         struct tcphdr _tcph;
 838         unsigned long timeout;
 839         unsigned int index;
 840
 841         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
 842         BUG_ON(th == NULL);
 843
 844         write_lock_bh(&tcp_lock);
 845         old_state = ct->proto.tcp.state;
 846         dir = CTINFO2DIR(ctinfo);
 847         index = get_conntrack_index(th);
 848         new_state = tcp_conntracks[dir][index][old_state];
 849         tuple = &ct->tuplehash[dir].tuple;
 850
 851         switch (new_state) {
 852         case TCP_CONNTRACK_SYN_SENT:
 853                 if (old_state < TCP_CONNTRACK_TIME_WAIT)
 854                         break;
 855                 /* RFC 1122: "When a connection is closed actively,
 856                  * it MUST linger in TIME-WAIT state for a time 2xMSL
 857                  * (Maximum Segment Lifetime). However, it MAY accept
 858                  * a new SYN from the remote TCP to reopen the connection
 859                  * directly from TIME-WAIT state, if..."
 860                  * We ignore the conditions because we are in the
 861                  * TIME-WAIT state anyway.
 862                  *
 863                  * Handle aborted connections: we and the server
 864                  * think there is an existing connection but the client
 865                  * aborts it and starts a new one.
 866                  */
 867                 if (((ct->proto.tcp.seen[dir].flags
 868                       | ct->proto.tcp.seen[!dir].flags)
 869                      & IP_CT_TCP_FLAG_CLOSE_INIT)
 870                     || (ct->proto.tcp.last_dir == dir
 871                         && ct->proto.tcp.last_index == TCP_RST_SET)) {
 872                         /* Attempt to reopen a closed/aborted connection.
 873                          * Delete this connection and look up again. */
 874                         write_unlock_bh(&tcp_lock);
 875
 876                         /* Only repeat if we can actually remove the timer.
 877                          * Destruction may already be in progress in process
 878                          * context and we must give it a chance to terminate.
 879                          */
 880                         if (nf_ct_kill(ct))
 881                                 return -NF_REPEAT;
 882                         return NF_DROP;
 883                 }
 884                 /* Fall through */
 885         case TCP_CONNTRACK_IGNORE:
 886                 /* Ignored packets:
 887                  *
 888                  * Our connection entry may be out of sync, so ignore
 889                  * packets which may signal the real connection between
 890                  * the client and the server.
 891                  *
 892                  * a) SYN in ORIGINAL
 893                  * b) SYN/ACK in REPLY
 894                  * c) ACK in reply direction after initial SYN in original.
 895                  *
 896                  * If the ignored packet is invalid, the receiver will send
 897                  * a RST we'll catch below.
 898                  */
 899                 if (index == TCP_SYNACK_SET
 900                     && ct->proto.tcp.last_index == TCP_SYN_SET
 901                     && ct->proto.tcp.last_dir != dir
 902                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
 903                         /* b) This SYN/ACK acknowledges a SYN that we earlier
 904                          * ignored as invalid. This means that the client and
 905                          * the server are both in sync, while the firewall is
 906                          * not. We kill this session and block the SYN/ACK so
 907                          * that the client cannot but retransmit its SYN and
 908                          * thus initiate a clean new session.
 909                          */
 910                         write_unlock_bh(&tcp_lock);
 911                         if (LOG_INVALID(net, IPPROTO_TCP))
 912                                 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 913                                           "nf_ct_tcp: killing out of sync session ");
 914                         nf_ct_kill(ct);
 915                         return NF_DROP;
 916                 }
 917                 ct->proto.tcp.last_index = index;
 918                 ct->proto.tcp.last_dir = dir;
 919                 ct->proto.tcp.last_seq = ntohl(th->seq);
 920                 ct->proto.tcp.last_end =
 921                     segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
 922
 923                 write_unlock_bh(&tcp_lock);
 924                 if (LOG_INVALID(net, IPPROTO_TCP))
 925                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 926                                   "nf_ct_tcp: invalid packet ignored ");
 927                 return NF_ACCEPT;
 928         case TCP_CONNTRACK_MAX:
 929                 /* Invalid packet */
 930                 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
 931                          dir, get_conntrack_index(th), old_state);
 932                 write_unlock_bh(&tcp_lock);
 933                 if (LOG_INVALID(net, IPPROTO_TCP))
 934                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 935                                   "nf_ct_tcp: invalid state ");
 936                 return -NF_ACCEPT;
 937         case TCP_CONNTRACK_CLOSE:
 938                 if (index == TCP_RST_SET
 939                     && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
 940                          && ct->proto.tcp.last_index == TCP_SYN_SET)
 941                         || (!test_bit(IPS_ASSURED_BIT, &ct->status)
 942                             && ct->proto.tcp.last_index == TCP_ACK_SET))
 943                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
 944                         /* RST sent to invalid SYN or ACK we had let through
 945                          * at a) and c) above:
 946                          *
 947                          * a) SYN was in window then
 948                          * c) we hold a half-open connection.
 949                          *
 950                          * Delete our connection entry.
 951                          * We skip window checking, because packet might ACK
 952                          * segments we ignored. */
 953                         goto in_window;
 954                 }
 955                 /* Just fall through */
 956         default:
 957                 /* Keep compilers happy. */
 958                 break;
 959         }
 960
 961         if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
 962                            skb, dataoff, th, pf)) {
 963                 write_unlock_bh(&tcp_lock);
 964                 return -NF_ACCEPT;
 965         }
 966      in_window:
 967         /* From now on we have got in-window packets */
 968         ct->proto.tcp.last_index = index;
 969         ct->proto.tcp.last_dir = dir;
 970
 971         pr_debug("tcp_conntracks: ");
 972         nf_ct_dump_tuple(tuple);
 973         pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
 974                  (th->syn ? 1 : 0), (th->ack ? 1 : 0),
 975                  (th->fin ? 1 : 0), (th->rst ? 1 : 0),
 976                  old_state, new_state);
 977
 978         ct->proto.tcp.state = new_state;
 979         if (old_state != new_state
 980             && new_state == TCP_CONNTRACK_FIN_WAIT)
 981                 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
 982
 983         if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
 984             tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
 985                 timeout = nf_ct_tcp_timeout_max_retrans;
 986         else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
 987                  IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
 988                  tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
 989                 timeout = nf_ct_tcp_timeout_unacknowledged;
 990         else
 991                 timeout = tcp_timeouts[new_state];
 992         write_unlock_bh(&tcp_lock);
 993
 994         if (new_state != old_state)
 995                 nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
 996
 997         if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
 998                 /* If only reply is a RST, we can consider ourselves not to
 999                    have an established connection: this is a fairly common
1000                    problem case, so we can delete the conntrack
1001                    immediately.  --RR */
1002                 if (th->rst) {
1003                         nf_ct_kill_acct(ct, ctinfo, skb);
1004                         return NF_ACCEPT;
1005                 }
1006         } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
1007                    && (old_state == TCP_CONNTRACK_SYN_RECV
1008                        || old_state == TCP_CONNTRACK_ESTABLISHED)
1009                    && new_state == TCP_CONNTRACK_ESTABLISHED) {
1010                 /* Set ASSURED if we see see valid ack in ESTABLISHED
1011                    after SYN_RECV or a valid answer for a picked up
1012                    connection. */
1013                 set_bit(IPS_ASSURED_BIT, &ct->status);
1014                 nf_conntrack_event_cache(IPCT_STATUS, ct);
1015         }
1016         nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
1017
1018         return NF_ACCEPT;
1019 }
1020
1021 /* Called when a new connection for this protocol found. */
1022 static bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
1023                     unsigned int dataoff)
1024 {
1025         enum tcp_conntrack new_state;
1026         const struct tcphdr *th;
1027         struct tcphdr _tcph;
1028         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
1029         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
1030
1031         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1032         BUG_ON(th == NULL);
1033
1034         /* Don't need lock here: this conntrack not in circulation yet */
1035         new_state
1036                 = tcp_conntracks[0][get_conntrack_index(th)]
1037                 [TCP_CONNTRACK_NONE];
1038
1039         /* Invalid: delete conntrack */
1040         if (new_state >= TCP_CONNTRACK_MAX) {
1041                 pr_debug("nf_ct_tcp: invalid new deleting.\n");
1042                 return false;
1043         }
1044
1045         if (new_state == TCP_CONNTRACK_SYN_SENT) {
1046                 /* SYN packet */
1047                 ct->proto.tcp.seen[0].td_end =
1048                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1049                                              dataoff, th);
1050                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1051                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1052                         ct->proto.tcp.seen[0].td_maxwin = 1;
1053                 ct->proto.tcp.seen[0].td_maxend =
1054                         ct->proto.tcp.seen[0].td_end;
1055
1056                 tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
1057                 ct->proto.tcp.seen[1].flags = 0;
1058         } else if (nf_ct_tcp_loose == 0) {
1059                 /* Don't try to pick up connections. */
1060                 return false;
1061         } else {
1062                 /*
1063                  * We are in the middle of a connection,
1064                  * its history is lost for us.
1065                  * Let's try to use the data from the packet.
1066                  */
1067                 ct->proto.tcp.seen[0].td_end =
1068                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1069                                              dataoff, th);
1070                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1071                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1072                         ct->proto.tcp.seen[0].td_maxwin = 1;
1073                 ct->proto.tcp.seen[0].td_maxend =
1074                         ct->proto.tcp.seen[0].td_end +
1075                         ct->proto.tcp.seen[0].td_maxwin;
1076                 ct->proto.tcp.seen[0].td_scale = 0;
1077
1078                 /* We assume SACK and liberal window checking to handle
1079                  * window scaling */
1080                 ct->proto.tcp.seen[0].flags =
1081                 ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1082                                               IP_CT_TCP_FLAG_BE_LIBERAL;
1083         }
1084
1085         ct->proto.tcp.seen[1].td_end = 0;
1086         ct->proto.tcp.seen[1].td_maxend = 0;
1087         ct->proto.tcp.seen[1].td_maxwin = 0;
1088         ct->proto.tcp.seen[1].td_scale = 0;
1089
1090         /* tcp_packet will set them */
1091         ct->proto.tcp.state = TCP_CONNTRACK_NONE;
1092         ct->proto.tcp.last_index = TCP_NONE_SET;
1093
1094         pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1095                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1096                  sender->td_end, sender->td_maxend, sender->td_maxwin,
1097                  sender->td_scale,
1098                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1099                  receiver->td_scale);
1100         return true;
1101 }
1102
1103 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1104
1105 #include <linux/netfilter/nfnetlink.h>
1106 #include <linux/netfilter/nfnetlink_conntrack.h>
1107
1108 static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
1109                          const struct nf_conn *ct)
1110 {
1111         struct nlattr *nest_parms;
1112         struct nf_ct_tcp_flags tmp = {};
1113
1114         read_lock_bh(&tcp_lock);
1115         nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP | NLA_F_NESTED);
1116         if (!nest_parms)
1117                 goto nla_put_failure;
1118
1119         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state);
1120
1121         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
1122                    ct->proto.tcp.seen[0].td_scale);
1123
1124         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
1125                    ct->proto.tcp.seen[1].td_scale);
1126
1127         tmp.flags = ct->proto.tcp.seen[0].flags;
1128         NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
1129                 sizeof(struct nf_ct_tcp_flags), &tmp);
1130
1131         tmp.flags = ct->proto.tcp.seen[1].flags;
1132         NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
1133                 sizeof(struct nf_ct_tcp_flags), &tmp);
1134         read_unlock_bh(&tcp_lock);
1135
1136         nla_nest_end(skb, nest_parms);
1137
1138         return 0;
1139
1140 nla_put_failure:
1141         read_unlock_bh(&tcp_lock);
1142         return -1;
1143 }
1144
1145 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
1146         [CTA_PROTOINFO_TCP_STATE]           = { .type = NLA_U8 },
1147         [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
1148         [CTA_PROTOINFO_TCP_WSCALE_REPLY]    = { .type = NLA_U8 },
1149         [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
1150         [CTA_PROTOINFO_TCP_FLAGS_REPLY]     = { .len =  sizeof(struct nf_ct_tcp_flags) },
1151 };
1152
1153 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
1154 {
1155         struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
1156         struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
1157         int err;
1158
1159         /* updates could not contain anything about the private
1160          * protocol info, in that case skip the parsing */
1161         if (!pattr)
1162                 return 0;
1163
1164         err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
1165         if (err < 0)
1166                 return err;
1167
1168         if (tb[CTA_PROTOINFO_TCP_STATE] &&
1169             nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
1170                 return -EINVAL;
1171
1172         write_lock_bh(&tcp_lock);
1173         if (tb[CTA_PROTOINFO_TCP_STATE])
1174                 ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
1175
1176         if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
1177                 struct nf_ct_tcp_flags *attr =
1178                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
1179                 ct->proto.tcp.seen[0].flags &= ~attr->mask;
1180                 ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
1181         }
1182
1183         if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
1184                 struct nf_ct_tcp_flags *attr =
1185                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
1186                 ct->proto.tcp.seen[1].flags &= ~attr->mask;
1187                 ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
1188         }
1189
1190         if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
1191             tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
1192             ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
1193             ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1194                 ct->proto.tcp.seen[0].td_scale =
1195                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
1196                 ct->proto.tcp.seen[1].td_scale =
1197                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
1198         }
1199         write_unlock_bh(&tcp_lock);
1200
1201         return 0;
1202 }
1203
1204 static int tcp_nlattr_size(void)
1205 {
1206         return nla_total_size(0)           /* CTA_PROTOINFO_TCP */
1207                 + nla_policy_len(tcp_nla_policy, CTA_PROTOINFO_TCP_MAX + 1);
1208 }
1209
1210 static int tcp_nlattr_tuple_size(void)
1211 {
1212         return nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
1213 }
1214 #endif
1215
1216 #ifdef CONFIG_SYSCTL
1217 static unsigned int tcp_sysctl_table_users;
1218 static struct ctl_table_header *tcp_sysctl_header;
1219 static struct ctl_table tcp_sysctl_table[] = {
1220         {
1221                 .procname       = "nf_conntrack_tcp_timeout_syn_sent",
1222                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1223                 .maxlen         = sizeof(unsigned int),
1224                 .mode           = 0644,
1225                 .proc_handler   = proc_dointvec_jiffies,
1226         },
1227         {
1228                 .procname       = "nf_conntrack_tcp_timeout_syn_recv",
1229                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1230                 .maxlen         = sizeof(unsigned int),
1231                 .mode           = 0644,
1232                 .proc_handler   = proc_dointvec_jiffies,
1233         },
1234         {
1235                 .procname       = "nf_conntrack_tcp_timeout_established",
1236                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1237                 .maxlen         = sizeof(unsigned int),
1238                 .mode           = 0644,
1239                 .proc_handler   = proc_dointvec_jiffies,
1240         },
1241         {
1242                 .procname       = "nf_conntrack_tcp_timeout_fin_wait",
1243                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1244                 .maxlen         = sizeof(unsigned int),
1245                 .mode           = 0644,
1246                 .proc_handler   = proc_dointvec_jiffies,
1247         },
1248         {
1249                 .procname       = "nf_conntrack_tcp_timeout_close_wait",
1250                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1251                 .maxlen         = sizeof(unsigned int),
1252                 .mode           = 0644,
1253                 .proc_handler   = proc_dointvec_jiffies,
1254         },
1255         {
1256                 .procname       = "nf_conntrack_tcp_timeout_last_ack",
1257                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1258                 .maxlen         = sizeof(unsigned int),
1259                 .mode           = 0644,
1260                 .proc_handler   = proc_dointvec_jiffies,
1261         },
1262         {
1263                 .procname       = "nf_conntrack_tcp_timeout_time_wait",
1264                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1265                 .maxlen         = sizeof(unsigned int),
1266                 .mode           = 0644,
1267                 .proc_handler   = proc_dointvec_jiffies,
1268         },
1269         {
1270                 .procname       = "nf_conntrack_tcp_timeout_close",
1271                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1272                 .maxlen         = sizeof(unsigned int),
1273                 .mode           = 0644,
1274                 .proc_handler   = proc_dointvec_jiffies,
1275         },
1276         {
1277                 .procname       = "nf_conntrack_tcp_timeout_max_retrans",
1278                 .data           = &nf_ct_tcp_timeout_max_retrans,
1279                 .maxlen         = sizeof(unsigned int),
1280                 .mode           = 0644,
1281                 .proc_handler   = proc_dointvec_jiffies,
1282         },
1283         {
1284                 .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
1285                 .data           = &nf_ct_tcp_timeout_unacknowledged,
1286                 .maxlen         = sizeof(unsigned int),
1287                 .mode           = 0644,
1288                 .proc_handler   = proc_dointvec_jiffies,
1289         },
1290         {
1291                 .ctl_name       = NET_NF_CONNTRACK_TCP_LOOSE,
1292                 .procname       = "nf_conntrack_tcp_loose",
1293                 .data           = &nf_ct_tcp_loose,
1294                 .maxlen         = sizeof(unsigned int),
1295                 .mode           = 0644,
1296                 .proc_handler   = proc_dointvec,
1297         },
1298         {
1299                 .ctl_name       = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
1300                 .procname       = "nf_conntrack_tcp_be_liberal",
1301                 .data           = &nf_ct_tcp_be_liberal,
1302                 .maxlen         = sizeof(unsigned int),
1303                 .mode           = 0644,
1304                 .proc_handler   = proc_dointvec,
1305         },
1306         {
1307                 .ctl_name       = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
1308                 .procname       = "nf_conntrack_tcp_max_retrans",
1309                 .data           = &nf_ct_tcp_max_retrans,
1310                 .maxlen         = sizeof(unsigned int),
1311                 .mode           = 0644,
1312                 .proc_handler   = proc_dointvec,
1313         },
1314         {
1315                 .ctl_name       = 0
1316         }
1317 };
1318
1319 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1320 static struct ctl_table tcp_compat_sysctl_table[] = {
1321         {
1322                 .procname       = "ip_conntrack_tcp_timeout_syn_sent",
1323                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1324                 .maxlen         = sizeof(unsigned int),
1325                 .mode           = 0644,
1326                 .proc_handler   = proc_dointvec_jiffies,
1327         },
1328         {
1329                 .procname       = "ip_conntrack_tcp_timeout_syn_sent2",
1330                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT2],
1331                 .maxlen         = sizeof(unsigned int),
1332                 .mode           = 0644,
1333                 .proc_handler   = proc_dointvec_jiffies,
1334         },
1335         {
1336                 .procname       = "ip_conntrack_tcp_timeout_syn_recv",
1337                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1338                 .maxlen         = sizeof(unsigned int),
1339                 .mode           = 0644,
1340                 .proc_handler   = proc_dointvec_jiffies,
1341         },
1342         {
1343                 .procname       = "ip_conntrack_tcp_timeout_established",
1344                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1345                 .maxlen         = sizeof(unsigned int),
1346                 .mode           = 0644,
1347                 .proc_handler   = proc_dointvec_jiffies,
1348         },
1349         {
1350                 .procname       = "ip_conntrack_tcp_timeout_fin_wait",
1351                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1352                 .maxlen         = sizeof(unsigned int),
1353                 .mode           = 0644,
1354                 .proc_handler   = proc_dointvec_jiffies,
1355         },
1356         {
1357                 .procname       = "ip_conntrack_tcp_timeout_close_wait",
1358                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1359                 .maxlen         = sizeof(unsigned int),
1360                 .mode           = 0644,
1361                 .proc_handler   = proc_dointvec_jiffies,
1362         },
1363         {
1364                 .procname       = "ip_conntrack_tcp_timeout_last_ack",
1365                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1366                 .maxlen         = sizeof(unsigned int),
1367                 .mode           = 0644,
1368                 .proc_handler   = proc_dointvec_jiffies,
1369         },
1370         {
1371                 .procname       = "ip_conntrack_tcp_timeout_time_wait",
1372                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1373                 .maxlen         = sizeof(unsigned int),
1374                 .mode           = 0644,
1375                 .proc_handler   = proc_dointvec_jiffies,
1376         },
1377         {
1378                 .procname       = "ip_conntrack_tcp_timeout_close",
1379                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1380                 .maxlen         = sizeof(unsigned int),
1381                 .mode           = 0644,
1382                 .proc_handler   = proc_dointvec_jiffies,
1383         },
1384         {
1385                 .procname       = "ip_conntrack_tcp_timeout_max_retrans",
1386                 .data           = &nf_ct_tcp_timeout_max_retrans,
1387                 .maxlen         = sizeof(unsigned int),
1388                 .mode           = 0644,
1389                 .proc_handler   = proc_dointvec_jiffies,
1390         },
1391         {
1392                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
1393                 .procname       = "ip_conntrack_tcp_loose",
1394                 .data           = &nf_ct_tcp_loose,
1395                 .maxlen         = sizeof(unsigned int),
1396                 .mode           = 0644,
1397                 .proc_handler   = proc_dointvec,
1398         },
1399         {
1400                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
1401                 .procname       = "ip_conntrack_tcp_be_liberal",
1402                 .data           = &nf_ct_tcp_be_liberal,
1403                 .maxlen         = sizeof(unsigned int),
1404                 .mode           = 0644,
1405                 .proc_handler   = proc_dointvec,
1406         },
1407         {
1408                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
1409                 .procname       = "ip_conntrack_tcp_max_retrans",
1410                 .data           = &nf_ct_tcp_max_retrans,
1411                 .maxlen         = sizeof(unsigned int),
1412                 .mode           = 0644,
1413                 .proc_handler   = proc_dointvec,
1414         },
1415         {
1416                 .ctl_name       = 0
1417         }
1418 };
1419 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
1420 #endif /* CONFIG_SYSCTL */
1421
1422 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
1423 {
1424         .l3proto                = PF_INET,
1425         .l4proto                = IPPROTO_TCP,
1426         .name                   = "tcp",
1427         .pkt_to_tuple           = tcp_pkt_to_tuple,
1428         .invert_tuple           = tcp_invert_tuple,
1429         .print_tuple            = tcp_print_tuple,
1430         .print_conntrack        = tcp_print_conntrack,
1431         .packet                 = tcp_packet,
1432         .new                    = tcp_new,
1433         .error                  = tcp_error,
1434 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1435         .to_nlattr              = tcp_to_nlattr,
1436         .nlattr_size            = tcp_nlattr_size,
1437         .from_nlattr            = nlattr_to_tcp,
1438         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1439         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1440         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1441         .nla_policy             = nf_ct_port_nla_policy,
1442 #endif
1443 #ifdef CONFIG_SYSCTL
1444         .ctl_table_users        = &tcp_sysctl_table_users,
1445         .ctl_table_header       = &tcp_sysctl_header,
1446         .ctl_table              = tcp_sysctl_table,
1447 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1448         .ctl_compat_table       = tcp_compat_sysctl_table,
1449 #endif
1450 #endif
1451 };
1452 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
1453
1454 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
1455 {
1456         .l3proto                = PF_INET6,
1457         .l4proto                = IPPROTO_TCP,
1458         .name                   = "tcp",
1459         .pkt_to_tuple           = tcp_pkt_to_tuple,
1460         .invert_tuple           = tcp_invert_tuple,
1461         .print_tuple            = tcp_print_tuple,
1462         .print_conntrack        = tcp_print_conntrack,
1463         .packet                 = tcp_packet,
1464         .new                    = tcp_new,
1465         .error                  = tcp_error,
1466 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1467         .to_nlattr              = tcp_to_nlattr,
1468         .nlattr_size            = tcp_nlattr_size,
1469         .from_nlattr            = nlattr_to_tcp,
1470         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1471         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1472         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1473         .nla_policy             = nf_ct_port_nla_policy,
1474 #endif
1475 #ifdef CONFIG_SYSCTL
1476         .ctl_table_users        = &tcp_sysctl_table_users,
1477         .ctl_table_header       = &tcp_sysctl_header,
1478         .ctl_table              = tcp_sysctl_table,
1479 #endif
1480 };
1481 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);