SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/netfilter/nf_conntrack_proto_tcp.c

   1 /* (C) 1999-2001 Paul `Rusty' Russell
   2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/types.h>
  10 #include <linux/timer.h>
  11 #include <linux/module.h>
  12 #include <linux/in.h>
  13 #include <linux/tcp.h>
  14 #include <linux/spinlock.h>
  15 #include <linux/skbuff.h>
  16 #include <linux/ipv6.h>
  17 #include <net/ip6_checksum.h>
  18
  19 #include <net/tcp.h>
  20
  21 #include <linux/netfilter.h>
  22 #include <linux/netfilter_ipv4.h>
  23 #include <linux/netfilter_ipv6.h>
  24 #include <net/netfilter/nf_conntrack.h>
  25 #include <net/netfilter/nf_conntrack_l4proto.h>
  26 #include <net/netfilter/nf_conntrack_ecache.h>
  27 #include <net/netfilter/nf_log.h>
  28
  29 /* Protects ct->proto.tcp */
  30 static DEFINE_RWLOCK(tcp_lock);
  31
  32 /* "Be conservative in what you do,
  33     be liberal in what you accept from others."
  34     If it's non-zero, we mark only out of window RST segments as INVALID. */
  35 static int nf_ct_tcp_be_liberal __read_mostly = 0;
  36
  37 /* If it is set to zero, we disable picking up already established
  38    connections. */
  39 static int nf_ct_tcp_loose __read_mostly = 1;
  40
  41 /* Max number of the retransmitted packets without receiving an (acceptable)
  42    ACK from the destination. If this number is reached, a shorter timer
  43    will be started. */
  44 static int nf_ct_tcp_max_retrans __read_mostly = 3;
  45
  46   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
  47      closely.  They're more complex. --RR */
  48
  49 static const char *const tcp_conntrack_names[] = {
  50         "NONE",
  51         "SYN_SENT",
  52         "SYN_RECV",
  53         "ESTABLISHED",
  54         "FIN_WAIT",
  55         "CLOSE_WAIT",
  56         "LAST_ACK",
  57         "TIME_WAIT",
  58         "CLOSE",
  59         "LISTEN"
  60 };
  61
  62 #define SECS * HZ
  63 #define MINS * 60 SECS
  64 #define HOURS * 60 MINS
  65 #define DAYS * 24 HOURS
  66
  67 /* RFC1122 says the R2 limit should be at least 100 seconds.
  68    Linux uses 15 packets as limit, which corresponds
  69    to ~13-30min depending on RTO. */
  70 static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly    =   5 MINS;
  71 static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly =   5 MINS;
  72
  73 static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
  74         [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
  75         [TCP_CONNTRACK_SYN_RECV]        = 60 SECS,
  76         [TCP_CONNTRACK_ESTABLISHED]     = 5 DAYS,
  77         [TCP_CONNTRACK_FIN_WAIT]        = 2 MINS,
  78         [TCP_CONNTRACK_CLOSE_WAIT]      = 60 SECS,
  79         [TCP_CONNTRACK_LAST_ACK]        = 30 SECS,
  80         [TCP_CONNTRACK_TIME_WAIT]       = 2 MINS,
  81         [TCP_CONNTRACK_CLOSE]           = 10 SECS,
  82 };
  83
  84 #define sNO TCP_CONNTRACK_NONE
  85 #define sSS TCP_CONNTRACK_SYN_SENT
  86 #define sSR TCP_CONNTRACK_SYN_RECV
  87 #define sES TCP_CONNTRACK_ESTABLISHED
  88 #define sFW TCP_CONNTRACK_FIN_WAIT
  89 #define sCW TCP_CONNTRACK_CLOSE_WAIT
  90 #define sLA TCP_CONNTRACK_LAST_ACK
  91 #define sTW TCP_CONNTRACK_TIME_WAIT
  92 #define sCL TCP_CONNTRACK_CLOSE
  93 #define sLI TCP_CONNTRACK_LISTEN
  94 #define sIV TCP_CONNTRACK_MAX
  95 #define sIG TCP_CONNTRACK_IGNORE
  96
  97 /* What TCP flags are set from RST/SYN/FIN/ACK. */
  98 enum tcp_bit_set {
  99         TCP_SYN_SET,
 100         TCP_SYNACK_SET,
 101         TCP_FIN_SET,
 102         TCP_ACK_SET,
 103         TCP_RST_SET,
 104         TCP_NONE_SET,
 105 };
 106
 107 /*
 108  * The TCP state transition table needs a few words...
 109  *
 110  * We are the man in the middle. All the packets go through us
 111  * but might get lost in transit to the destination.
 112  * It is assumed that the destinations can't receive segments
 113  * we haven't seen.
 114  *
 115  * The checked segment is in window, but our windows are *not*
 116  * equivalent with the ones of the sender/receiver. We always
 117  * try to guess the state of the current sender.
 118  *
 119  * The meaning of the states are:
 120  *
 121  * NONE:        initial state
 122  * SYN_SENT:    SYN-only packet seen
 123  * SYN_RECV:    SYN-ACK packet seen
 124  * ESTABLISHED: ACK packet seen
 125  * FIN_WAIT:    FIN packet seen
 126  * CLOSE_WAIT:  ACK seen (after FIN)
 127  * LAST_ACK:    FIN seen (after FIN)
 128  * TIME_WAIT:   last ACK seen
 129  * CLOSE:       closed connection (RST)
 130  *
 131  * LISTEN state is not used.
 132  *
 133  * Packets marked as IGNORED (sIG):
 134  *      if they may be either invalid or valid
 135  *      and the receiver may send back a connection
 136  *      closing RST or a SYN/ACK.
 137  *
 138  * Packets marked as INVALID (sIV):
 139  *      if they are invalid
 140  *      or we do not support the request (simultaneous open)
 141  */
 142 static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
 143         {
 144 /* ORIGINAL */
 145 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 146 /*syn*/    { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sIV },
 147 /*
 148  *      sNO -> sSS      Initialize a new connection
 149  *      sSS -> sSS      Retransmitted SYN
 150  *      sSR -> sIG      Late retransmitted SYN?
 151  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
 152  *                      are errors. Receiver will reply with RST
 153  *                      and close the connection.
 154  *                      Or we are not in sync and hold a dead connection.
 155  *      sFW -> sIG
 156  *      sCW -> sIG
 157  *      sLA -> sIG
 158  *      sTW -> sSS      Reopened connection (RFC 1122).
 159  *      sCL -> sSS
 160  */
 161 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 162 /*synack*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
 163 /*
 164  * A SYN/ACK from the client is always invalid:
 165  *      - either it tries to set up a simultaneous open, which is
 166  *        not supported;
 167  *      - or the firewall has just been inserted between the two hosts
 168  *        during the session set-up. The SYN will be retransmitted
 169  *        by the true client (or it'll time out).
 170  */
 171 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 172 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 173 /*
 174  *      sNO -> sIV      Too late and no reason to do anything...
 175  *      sSS -> sIV      Client migth not send FIN in this state:
 176  *                      we enforce waiting for a SYN/ACK reply first.
 177  *      sSR -> sFW      Close started.
 178  *      sES -> sFW
 179  *      sFW -> sLA      FIN seen in both directions, waiting for
 180  *                      the last ACK.
 181  *                      Migth be a retransmitted FIN as well...
 182  *      sCW -> sLA
 183  *      sLA -> sLA      Retransmitted FIN. Remain in the same state.
 184  *      sTW -> sTW
 185  *      sCL -> sCL
 186  */
 187 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 188 /*ack*/    { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 189 /*
 190  *      sNO -> sES      Assumed.
 191  *      sSS -> sIV      ACK is invalid: we haven't seen a SYN/ACK yet.
 192  *      sSR -> sES      Established state is reached.
 193  *      sES -> sES      :-)
 194  *      sFW -> sCW      Normal close request answered by ACK.
 195  *      sCW -> sCW
 196  *      sLA -> sTW      Last ACK detected.
 197  *      sTW -> sTW      Retransmitted last ACK. Remain in the same state.
 198  *      sCL -> sCL
 199  */
 200 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 201 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
 202 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 203         },
 204         {
 205 /* REPLY */
 206 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 207 /*syn*/    { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
 208 /*
 209  *      sNO -> sIV      Never reached.
 210  *      sSS -> sIV      Simultaneous open, not supported
 211  *      sSR -> sIV      Simultaneous open, not supported.
 212  *      sES -> sIV      Server may not initiate a connection.
 213  *      sFW -> sIV
 214  *      sCW -> sIV
 215  *      sLA -> sIV
 216  *      sTW -> sIV      Reopened connection, but server may not do it.
 217  *      sCL -> sIV
 218  */
 219 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 220 /*synack*/ { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIV },
 221 /*
 222  *      sSS -> sSR      Standard open.
 223  *      sSR -> sSR      Retransmitted SYN/ACK.
 224  *      sES -> sIG      Late retransmitted SYN/ACK?
 225  *      sFW -> sIG      Might be SYN/ACK answering ignored SYN
 226  *      sCW -> sIG
 227  *      sLA -> sIG
 228  *      sTW -> sIG
 229  *      sCL -> sIG
 230  */
 231 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 232 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 233 /*
 234  *      sSS -> sIV      Server might not send FIN in this state.
 235  *      sSR -> sFW      Close started.
 236  *      sES -> sFW
 237  *      sFW -> sLA      FIN seen in both directions.
 238  *      sCW -> sLA
 239  *      sLA -> sLA      Retransmitted FIN.
 240  *      sTW -> sTW
 241  *      sCL -> sCL
 242  */
 243 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 244 /*ack*/    { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 245 /*
 246  *      sSS -> sIG      Might be a half-open connection.
 247  *      sSR -> sSR      Might answer late resent SYN.
 248  *      sES -> sES      :-)
 249  *      sFW -> sCW      Normal close request answered by ACK.
 250  *      sCW -> sCW
 251  *      sLA -> sTW      Last ACK detected.
 252  *      sTW -> sTW      Retransmitted last ACK.
 253  *      sCL -> sCL
 254  */
 255 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 256 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
 257 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 258         }
 259 };
 260
 261 static bool tcp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
 262                              struct nf_conntrack_tuple *tuple)
 263 {
 264         const struct tcphdr *hp;
 265         struct tcphdr _hdr;
 266
 267         /* Actually only need first 8 bytes. */
 268         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
 269         if (hp == NULL)
 270                 return false;
 271
 272         tuple->src.u.tcp.port = hp->source;
 273         tuple->dst.u.tcp.port = hp->dest;
 274
 275         return true;
 276 }
 277
 278 static bool tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
 279                              const struct nf_conntrack_tuple *orig)
 280 {
 281         tuple->src.u.tcp.port = orig->dst.u.tcp.port;
 282         tuple->dst.u.tcp.port = orig->src.u.tcp.port;
 283         return true;
 284 }
 285
 286 /* Print out the per-protocol part of the tuple. */
 287 static int tcp_print_tuple(struct seq_file *s,
 288                            const struct nf_conntrack_tuple *tuple)
 289 {
 290         return seq_printf(s, "sport=%hu dport=%hu ",
 291                           ntohs(tuple->src.u.tcp.port),
 292                           ntohs(tuple->dst.u.tcp.port));
 293 }
 294
 295 /* Print out the private part of the conntrack. */
 296 static int tcp_print_conntrack(struct seq_file *s, const struct nf_conn *ct)
 297 {
 298         enum tcp_conntrack state;
 299
 300         read_lock_bh(&tcp_lock);
 301         state = ct->proto.tcp.state;
 302         read_unlock_bh(&tcp_lock);
 303
 304         return seq_printf(s, "%s ", tcp_conntrack_names[state]);
 305 }
 306
 307 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
 308 {
 309         if (tcph->rst) return TCP_RST_SET;
 310         else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
 311         else if (tcph->fin) return TCP_FIN_SET;
 312         else if (tcph->ack) return TCP_ACK_SET;
 313         else return TCP_NONE_SET;
 314 }
 315
 316 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
 317    in IP Filter' by Guido van Rooij.
 318
 319    http://www.nluug.nl/events/sane2000/papers.html
 320    http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
 321
 322    The boundaries and the conditions are changed according to RFC793:
 323    the packet must intersect the window (i.e. segments may be
 324    after the right or before the left edge) and thus receivers may ACK
 325    segments after the right edge of the window.
 326
 327         td_maxend = max(sack + max(win,1)) seen in reply packets
 328         td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
 329         td_maxwin += seq + len - sender.td_maxend
 330                         if seq + len > sender.td_maxend
 331         td_end    = max(seq + len) seen in sent packets
 332
 333    I.   Upper bound for valid data:     seq <= sender.td_maxend
 334    II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
 335    III. Upper bound for valid (s)ack:   sack <= receiver.td_end
 336    IV.  Lower bound for valid (s)ack:   sack >= receiver.td_end - MAXACKWINDOW
 337
 338    where sack is the highest right edge of sack block found in the packet
 339    or ack in the case of packet without SACK option.
 340
 341    The upper bound limit for a valid (s)ack is not ignored -
 342    we doesn't have to deal with fragments.
 343 */
 344
 345 static inline __u32 segment_seq_plus_len(__u32 seq,
 346                                          size_t len,
 347                                          unsigned int dataoff,
 348                                          const struct tcphdr *tcph)
 349 {
 350         /* XXX Should I use payload length field in IP/IPv6 header ?
 351          * - YK */
 352         return (seq + len - dataoff - tcph->doff*4
 353                 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
 354 }
 355
 356 /* Fixme: what about big packets? */
 357 #define MAXACKWINCONST                  66000
 358 #define MAXACKWINDOW(sender)                                            \
 359         ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin     \
 360                                               : MAXACKWINCONST)
 361
 362 /*
 363  * Simplified tcp_parse_options routine from tcp_input.c
 364  */
 365 static void tcp_options(const struct sk_buff *skb,
 366                         unsigned int dataoff,
 367                         const struct tcphdr *tcph,
 368                         struct ip_ct_tcp_state *state)
 369 {
 370         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 371         const unsigned char *ptr;
 372         int length = (tcph->doff*4) - sizeof(struct tcphdr);
 373
 374         if (!length)
 375                 return;
 376
 377         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
 378                                  length, buff);
 379         BUG_ON(ptr == NULL);
 380
 381         state->td_scale =
 382         state->flags = 0;
 383
 384         while (length > 0) {
 385                 int opcode=*ptr++;
 386                 int opsize;
 387
 388                 switch (opcode) {
 389                 case TCPOPT_EOL:
 390                         return;
 391                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
 392                         length--;
 393                         continue;
 394                 default:
 395                         opsize=*ptr++;
 396                         if (opsize < 2) /* "silly options" */
 397                                 return;
 398                         if (opsize > length)
 399                                 break;  /* don't parse partial options */
 400
 401                         if (opcode == TCPOPT_SACK_PERM
 402                             && opsize == TCPOLEN_SACK_PERM)
 403                                 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
 404                         else if (opcode == TCPOPT_WINDOW
 405                                  && opsize == TCPOLEN_WINDOW) {
 406                                 state->td_scale = *(u_int8_t *)ptr;
 407
 408                                 if (state->td_scale > 14) {
 409                                         /* See RFC1323 */
 410                                         state->td_scale = 14;
 411                                 }
 412                                 state->flags |=
 413                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
 414                         }
 415                         ptr += opsize - 2;
 416                         length -= opsize;
 417                 }
 418         }
 419 }
 420
 421 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
 422                      const struct tcphdr *tcph, __u32 *sack)
 423 {
 424         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 425         const unsigned char *ptr;
 426         int length = (tcph->doff*4) - sizeof(struct tcphdr);
 427         __u32 tmp;
 428
 429         if (!length)
 430                 return;
 431
 432         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
 433                                  length, buff);
 434         BUG_ON(ptr == NULL);
 435
 436         /* Fast path for timestamp-only option */
 437         if (length == TCPOLEN_TSTAMP_ALIGNED*4
 438             && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
 439                                        | (TCPOPT_NOP << 16)
 440                                        | (TCPOPT_TIMESTAMP << 8)
 441                                        | TCPOLEN_TIMESTAMP))
 442                 return;
 443
 444         while (length > 0) {
 445                 int opcode = *ptr++;
 446                 int opsize, i;
 447
 448                 switch (opcode) {
 449                 case TCPOPT_EOL:
 450                         return;
 451                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
 452                         length--;
 453                         continue;
 454                 default:
 455                         opsize = *ptr++;
 456                         if (opsize < 2) /* "silly options" */
 457                                 return;
 458                         if (opsize > length)
 459                                 break;  /* don't parse partial options */
 460
 461                         if (opcode == TCPOPT_SACK
 462                             && opsize >= (TCPOLEN_SACK_BASE
 463                                           + TCPOLEN_SACK_PERBLOCK)
 464                             && !((opsize - TCPOLEN_SACK_BASE)
 465                                  % TCPOLEN_SACK_PERBLOCK)) {
 466                                 for (i = 0;
 467                                      i < (opsize - TCPOLEN_SACK_BASE);
 468                                      i += TCPOLEN_SACK_PERBLOCK) {
 469                                         tmp = ntohl(*((__be32 *)(ptr+i)+1));
 470
 471                                         if (after(tmp, *sack))
 472                                                 *sack = tmp;
 473                                 }
 474                                 return;
 475                         }
 476                         ptr += opsize - 2;
 477                         length -= opsize;
 478                 }
 479         }
 480 }
 481
 482 static bool tcp_in_window(const struct nf_conn *ct,
 483                           struct ip_ct_tcp *state,
 484                           enum ip_conntrack_dir dir,
 485                           unsigned int index,
 486                           const struct sk_buff *skb,
 487                           unsigned int dataoff,
 488                           const struct tcphdr *tcph,
 489                           u_int8_t pf)
 490 {
 491         struct net *net = nf_ct_net(ct);
 492         struct ip_ct_tcp_state *sender = &state->seen[dir];
 493         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
 494         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
 495         __u32 seq, ack, sack, end, win, swin;
 496         bool res;
 497
 498         /*
 499          * Get the required data from the packet.
 500          */
 501         seq = ntohl(tcph->seq);
 502         ack = sack = ntohl(tcph->ack_seq);
 503         win = ntohs(tcph->window);
 504         end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
 505
 506         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
 507                 tcp_sack(skb, dataoff, tcph, &sack);
 508
 509         pr_debug("tcp_in_window: START\n");
 510         pr_debug("tcp_in_window: ");
 511         nf_ct_dump_tuple(tuple);
 512         pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
 513                  seq, ack, sack, win, end);
 514         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 515                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 516                  sender->td_end, sender->td_maxend, sender->td_maxwin,
 517                  sender->td_scale,
 518                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 519                  receiver->td_scale);
 520
 521         if (sender->td_end == 0) {
 522                 /*
 523                  * Initialize sender data.
 524                  */
 525                 if (tcph->syn && tcph->ack) {
 526                         /*
 527                          * Outgoing SYN-ACK in reply to a SYN.
 528                          */
 529                         sender->td_end =
 530                         sender->td_maxend = end;
 531                         sender->td_maxwin = (win == 0 ? 1 : win);
 532
 533                         tcp_options(skb, dataoff, tcph, sender);
 534                         /*
 535                          * RFC 1323:
 536                          * Both sides must send the Window Scale option
 537                          * to enable window scaling in either direction.
 538                          */
 539                         if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
 540                               && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
 541                                 sender->td_scale =
 542                                 receiver->td_scale = 0;
 543                 } else {
 544                         /*
 545                          * We are in the middle of a connection,
 546                          * its history is lost for us.
 547                          * Let's try to use the data from the packet.
 548                          */
 549                         sender->td_end = end;
 550                         sender->td_maxwin = (win == 0 ? 1 : win);
 551                         sender->td_maxend = end + sender->td_maxwin;
 552                 }
 553         } else if (((state->state == TCP_CONNTRACK_SYN_SENT
 554                      && dir == IP_CT_DIR_ORIGINAL)
 555                    || (state->state == TCP_CONNTRACK_SYN_RECV
 556                      && dir == IP_CT_DIR_REPLY))
 557                    && after(end, sender->td_end)) {
 558                 /*
 559                  * RFC 793: "if a TCP is reinitialized ... then it need
 560                  * not wait at all; it must only be sure to use sequence
 561                  * numbers larger than those recently used."
 562                  */
 563                 sender->td_end =
 564                 sender->td_maxend = end;
 565                 sender->td_maxwin = (win == 0 ? 1 : win);
 566
 567                 tcp_options(skb, dataoff, tcph, sender);
 568         }
 569
 570         if (!(tcph->ack)) {
 571                 /*
 572                  * If there is no ACK, just pretend it was set and OK.
 573                  */
 574                 ack = sack = receiver->td_end;
 575         } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
 576                     (TCP_FLAG_ACK|TCP_FLAG_RST))
 577                    && (ack == 0)) {
 578                 /*
 579                  * Broken TCP stacks, that set ACK in RST packets as well
 580                  * with zero ack value.
 581                  */
 582                 ack = sack = receiver->td_end;
 583         }
 584
 585         if (seq == end
 586             && (!tcph->rst
 587                 || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
 588                 /*
 589                  * Packets contains no data: we assume it is valid
 590                  * and check the ack value only.
 591                  * However RST segments are always validated by their
 592                  * SEQ number, except when seq == 0 (reset sent answering
 593                  * SYN.
 594                  */
 595                 seq = end = sender->td_end;
 596
 597         pr_debug("tcp_in_window: ");
 598         nf_ct_dump_tuple(tuple);
 599         pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
 600                  seq, ack, sack, win, end);
 601         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 602                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 603                  sender->td_end, sender->td_maxend, sender->td_maxwin,
 604                  sender->td_scale,
 605                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 606                  receiver->td_scale);
 607
 608         pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
 609                  before(seq, sender->td_maxend + 1),
 610                  after(end, sender->td_end - receiver->td_maxwin - 1),
 611                  before(sack, receiver->td_end + 1),
 612                  after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
 613
 614         if (before(seq, sender->td_maxend + 1) &&
 615             after(end, sender->td_end - receiver->td_maxwin - 1) &&
 616             before(sack, receiver->td_end + 1) &&
 617             after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
 618                 /*
 619                  * Take into account window scaling (RFC 1323).
 620                  */
 621                 if (!tcph->syn)
 622                         win <<= sender->td_scale;
 623
 624                 /*
 625                  * Update sender data.
 626                  */
 627                 swin = win + (sack - ack);
 628                 if (sender->td_maxwin < swin)
 629                         sender->td_maxwin = swin;
 630                 if (after(end, sender->td_end)) {
 631                         sender->td_end = end;
 632                         sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 633                 }
 634                 /*
 635                  * Update receiver data.
 636                  */
 637                 if (after(end, sender->td_maxend))
 638                         receiver->td_maxwin += end - sender->td_maxend;
 639                 if (after(sack + win, receiver->td_maxend - 1)) {
 640                         receiver->td_maxend = sack + win;
 641                         if (win == 0)
 642                                 receiver->td_maxend++;
 643                 }
 644                 if (ack == receiver->td_end)
 645                         receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 646
 647                 /*
 648                  * Check retransmissions.
 649                  */
 650                 if (index == TCP_ACK_SET) {
 651                         if (state->last_dir == dir
 652                             && state->last_seq == seq
 653                             && state->last_ack == ack
 654                             && state->last_end == end
 655                             && state->last_win == win)
 656                                 state->retrans++;
 657                         else {
 658                                 state->last_dir = dir;
 659                                 state->last_seq = seq;
 660                                 state->last_ack = ack;
 661                                 state->last_end = end;
 662                                 state->last_win = win;
 663                                 state->retrans = 0;
 664                         }
 665                 }
 666                 res = true;
 667         } else {
 668                 res = false;
 669                 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
 670                     nf_ct_tcp_be_liberal)
 671                         res = true;
 672                 if (!res && LOG_INVALID(net, IPPROTO_TCP))
 673                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 674                         "nf_ct_tcp: %s ",
 675                         before(seq, sender->td_maxend + 1) ?
 676                         after(end, sender->td_end - receiver->td_maxwin - 1) ?
 677                         before(sack, receiver->td_end + 1) ?
 678                         after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
 679                         : "ACK is under the lower bound (possible overly delayed ACK)"
 680                         : "ACK is over the upper bound (ACKed data not seen yet)"
 681                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
 682                         : "SEQ is over the upper bound (over the window of the receiver)");
 683         }
 684
 685         pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
 686                  "receiver end=%u maxend=%u maxwin=%u\n",
 687                  res, sender->td_end, sender->td_maxend, sender->td_maxwin,
 688                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
 689
 690         return res;
 691 }
 692
 693 #ifdef CONFIG_NF_NAT_NEEDED
 694 /* Update sender->td_end after NAT successfully mangled the packet */
 695 /* Caller must linearize skb at tcp header. */
 696 void nf_conntrack_tcp_update(const struct sk_buff *skb,
 697                              unsigned int dataoff,
 698                              struct nf_conn *ct,
 699                              int dir)
 700 {
 701         const struct tcphdr *tcph = (const void *)skb->data + dataoff;
 702         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
 703         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
 704         __u32 end;
 705
 706         end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
 707
 708         write_lock_bh(&tcp_lock);
 709         /*
 710          * We have to worry for the ack in the reply packet only...
 711          */
 712         if (after(end, ct->proto.tcp.seen[dir].td_end))
 713                 ct->proto.tcp.seen[dir].td_end = end;
 714         ct->proto.tcp.last_end = end;
 715         write_unlock_bh(&tcp_lock);
 716         pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
 717                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 718                  sender->td_end, sender->td_maxend, sender->td_maxwin,
 719                  sender->td_scale,
 720                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 721                  receiver->td_scale);
 722 }
 723 EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
 724 #endif
 725
 726 #define TH_FIN  0x01
 727 #define TH_SYN  0x02
 728 #define TH_RST  0x04
 729 #define TH_PUSH 0x08
 730 #define TH_ACK  0x10
 731 #define TH_URG  0x20
 732 #define TH_ECE  0x40
 733 #define TH_CWR  0x80
 734
 735 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
 736 static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
 737 {
 738         [TH_SYN]                        = 1,
 739         [TH_SYN|TH_URG]                 = 1,
 740         [TH_SYN|TH_ACK]                 = 1,
 741         [TH_RST]                        = 1,
 742         [TH_RST|TH_ACK]                 = 1,
 743         [TH_FIN|TH_ACK]                 = 1,
 744         [TH_FIN|TH_ACK|TH_URG]          = 1,
 745         [TH_ACK]                        = 1,
 746         [TH_ACK|TH_URG]                 = 1,
 747 };
 748
 749 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
 750 static int tcp_error(struct net *net,
 751                      struct sk_buff *skb,
 752                      unsigned int dataoff,
 753                      enum ip_conntrack_info *ctinfo,
 754                      u_int8_t pf,
 755                      unsigned int hooknum)
 756 {
 757         const struct tcphdr *th;
 758         struct tcphdr _tcph;
 759         unsigned int tcplen = skb->len - dataoff;
 760         u_int8_t tcpflags;
 761
 762         /* Smaller that minimal TCP header? */
 763         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
 764         if (th == NULL) {
 765                 if (LOG_INVALID(net, IPPROTO_TCP))
 766                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 767                                 "nf_ct_tcp: short packet ");
 768                 return -NF_ACCEPT;
 769         }
 770
 771         /* Not whole TCP header or malformed packet */
 772         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
 773                 if (LOG_INVALID(net, IPPROTO_TCP))
 774                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 775                                 "nf_ct_tcp: truncated/malformed packet ");
 776                 return -NF_ACCEPT;
 777         }
 778
 779         /* Checksum invalid? Ignore.
 780          * We skip checking packets on the outgoing path
 781          * because the checksum is assumed to be correct.
 782          */
 783         /* FIXME: Source route IP option packets --RR */
 784         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
 785             nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
 786                 if (LOG_INVALID(net, IPPROTO_TCP))
 787                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 788                                   "nf_ct_tcp: bad TCP checksum ");
 789                 return -NF_ACCEPT;
 790         }
 791
 792         /* Check TCP flags. */
 793         tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR|TH_PUSH));
 794         if (!tcp_valid_flags[tcpflags]) {
 795                 if (LOG_INVALID(net, IPPROTO_TCP))
 796                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 797                                   "nf_ct_tcp: invalid TCP flag combination ");
 798                 return -NF_ACCEPT;
 799         }
 800
 801         return NF_ACCEPT;
 802 }
 803
 804 /* Returns verdict for packet, or -1 for invalid. */
 805 static int tcp_packet(struct nf_conn *ct,
 806                       const struct sk_buff *skb,
 807                       unsigned int dataoff,
 808                       enum ip_conntrack_info ctinfo,
 809                       u_int8_t pf,
 810                       unsigned int hooknum)
 811 {
 812         struct net *net = nf_ct_net(ct);
 813         struct nf_conntrack_tuple *tuple;
 814         enum tcp_conntrack new_state, old_state;
 815         enum ip_conntrack_dir dir;
 816         const struct tcphdr *th;
 817         struct tcphdr _tcph;
 818         unsigned long timeout;
 819         unsigned int index;
 820
 821         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
 822         BUG_ON(th == NULL);
 823
 824         write_lock_bh(&tcp_lock);
 825         old_state = ct->proto.tcp.state;
 826         dir = CTINFO2DIR(ctinfo);
 827         index = get_conntrack_index(th);
 828         new_state = tcp_conntracks[dir][index][old_state];
 829         tuple = &ct->tuplehash[dir].tuple;
 830
 831         switch (new_state) {
 832         case TCP_CONNTRACK_SYN_SENT:
 833                 if (old_state < TCP_CONNTRACK_TIME_WAIT)
 834                         break;
 835                 /* RFC 1122: "When a connection is closed actively,
 836                  * it MUST linger in TIME-WAIT state for a time 2xMSL
 837                  * (Maximum Segment Lifetime). However, it MAY accept
 838                  * a new SYN from the remote TCP to reopen the connection
 839                  * directly from TIME-WAIT state, if..."
 840                  * We ignore the conditions because we are in the
 841                  * TIME-WAIT state anyway.
 842                  *
 843                  * Handle aborted connections: we and the server
 844                  * think there is an existing connection but the client
 845                  * aborts it and starts a new one.
 846                  */
 847                 if (((ct->proto.tcp.seen[dir].flags
 848                       | ct->proto.tcp.seen[!dir].flags)
 849                      & IP_CT_TCP_FLAG_CLOSE_INIT)
 850                     || (ct->proto.tcp.last_dir == dir
 851                         && ct->proto.tcp.last_index == TCP_RST_SET)) {
 852                         /* Attempt to reopen a closed/aborted connection.
 853                          * Delete this connection and look up again. */
 854                         write_unlock_bh(&tcp_lock);
 855
 856                         /* Only repeat if we can actually remove the timer.
 857                          * Destruction may already be in progress in process
 858                          * context and we must give it a chance to terminate.
 859                          */
 860                         if (nf_ct_kill(ct))
 861                                 return -NF_REPEAT;
 862                         return NF_DROP;
 863                 }
 864                 /* Fall through */
 865         case TCP_CONNTRACK_IGNORE:
 866                 /* Ignored packets:
 867                  *
 868                  * Our connection entry may be out of sync, so ignore
 869                  * packets which may signal the real connection between
 870                  * the client and the server.
 871                  *
 872                  * a) SYN in ORIGINAL
 873                  * b) SYN/ACK in REPLY
 874                  * c) ACK in reply direction after initial SYN in original.
 875                  *
 876                  * If the ignored packet is invalid, the receiver will send
 877                  * a RST we'll catch below.
 878                  */
 879                 if (index == TCP_SYNACK_SET
 880                     && ct->proto.tcp.last_index == TCP_SYN_SET
 881                     && ct->proto.tcp.last_dir != dir
 882                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
 883                         /* b) This SYN/ACK acknowledges a SYN that we earlier
 884                          * ignored as invalid. This means that the client and
 885                          * the server are both in sync, while the firewall is
 886                          * not. We kill this session and block the SYN/ACK so
 887                          * that the client cannot but retransmit its SYN and
 888                          * thus initiate a clean new session.
 889                          */
 890                         write_unlock_bh(&tcp_lock);
 891                         if (LOG_INVALID(net, IPPROTO_TCP))
 892                                 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 893                                           "nf_ct_tcp: killing out of sync session ");
 894                         nf_ct_kill(ct);
 895                         return NF_DROP;
 896                 }
 897                 ct->proto.tcp.last_index = index;
 898                 ct->proto.tcp.last_dir = dir;
 899                 ct->proto.tcp.last_seq = ntohl(th->seq);
 900                 ct->proto.tcp.last_end =
 901                     segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
 902
 903                 write_unlock_bh(&tcp_lock);
 904                 if (LOG_INVALID(net, IPPROTO_TCP))
 905                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 906                                   "nf_ct_tcp: invalid packet ignored ");
 907                 return NF_ACCEPT;
 908         case TCP_CONNTRACK_MAX:
 909                 /* Invalid packet */
 910                 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
 911                          dir, get_conntrack_index(th), old_state);
 912                 write_unlock_bh(&tcp_lock);
 913                 if (LOG_INVALID(net, IPPROTO_TCP))
 914                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 915                                   "nf_ct_tcp: invalid state ");
 916                 return -NF_ACCEPT;
 917         case TCP_CONNTRACK_CLOSE:
 918                 if (index == TCP_RST_SET
 919                     && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
 920                          && ct->proto.tcp.last_index == TCP_SYN_SET)
 921                         || (!test_bit(IPS_ASSURED_BIT, &ct->status)
 922                             && ct->proto.tcp.last_index == TCP_ACK_SET))
 923                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
 924                         /* RST sent to invalid SYN or ACK we had let through
 925                          * at a) and c) above:
 926                          *
 927                          * a) SYN was in window then
 928                          * c) we hold a half-open connection.
 929                          *
 930                          * Delete our connection entry.
 931                          * We skip window checking, because packet might ACK
 932                          * segments we ignored. */
 933                         goto in_window;
 934                 }
 935                 /* Just fall through */
 936         default:
 937                 /* Keep compilers happy. */
 938                 break;
 939         }
 940
 941         if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
 942                            skb, dataoff, th, pf)) {
 943                 write_unlock_bh(&tcp_lock);
 944                 return -NF_ACCEPT;
 945         }
 946      in_window:
 947         /* From now on we have got in-window packets */
 948         ct->proto.tcp.last_index = index;
 949         ct->proto.tcp.last_dir = dir;
 950
 951         pr_debug("tcp_conntracks: ");
 952         nf_ct_dump_tuple(tuple);
 953         pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
 954                  (th->syn ? 1 : 0), (th->ack ? 1 : 0),
 955                  (th->fin ? 1 : 0), (th->rst ? 1 : 0),
 956                  old_state, new_state);
 957
 958         ct->proto.tcp.state = new_state;
 959         if (old_state != new_state
 960             && new_state == TCP_CONNTRACK_FIN_WAIT)
 961                 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
 962
 963         if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
 964             tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
 965                 timeout = nf_ct_tcp_timeout_max_retrans;
 966         else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
 967                  IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
 968                  tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
 969                 timeout = nf_ct_tcp_timeout_unacknowledged;
 970         else
 971                 timeout = tcp_timeouts[new_state];
 972         write_unlock_bh(&tcp_lock);
 973
 974         nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, ct);
 975         if (new_state != old_state)
 976                 nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
 977
 978         if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
 979                 /* If only reply is a RST, we can consider ourselves not to
 980                    have an established connection: this is a fairly common
 981                    problem case, so we can delete the conntrack
 982                    immediately.  --RR */
 983                 if (th->rst) {
 984                         nf_ct_kill_acct(ct, ctinfo, skb);
 985                         return NF_ACCEPT;
 986                 }
 987         } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
 988                    && (old_state == TCP_CONNTRACK_SYN_RECV
 989                        || old_state == TCP_CONNTRACK_ESTABLISHED)
 990                    && new_state == TCP_CONNTRACK_ESTABLISHED) {
 991                 /* Set ASSURED if we see see valid ack in ESTABLISHED
 992                    after SYN_RECV or a valid answer for a picked up
 993                    connection. */
 994                 set_bit(IPS_ASSURED_BIT, &ct->status);
 995                 nf_conntrack_event_cache(IPCT_STATUS, ct);
 996         }
 997         nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
 998
 999         return NF_ACCEPT;
1000 }
1001
1002 /* Called when a new connection for this protocol found. */
1003 static bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
1004                     unsigned int dataoff)
1005 {
1006         enum tcp_conntrack new_state;
1007         const struct tcphdr *th;
1008         struct tcphdr _tcph;
1009         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
1010         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
1011
1012         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1013         BUG_ON(th == NULL);
1014
1015         /* Don't need lock here: this conntrack not in circulation yet */
1016         new_state
1017                 = tcp_conntracks[0][get_conntrack_index(th)]
1018                 [TCP_CONNTRACK_NONE];
1019
1020         /* Invalid: delete conntrack */
1021         if (new_state >= TCP_CONNTRACK_MAX) {
1022                 pr_debug("nf_ct_tcp: invalid new deleting.\n");
1023                 return false;
1024         }
1025
1026         if (new_state == TCP_CONNTRACK_SYN_SENT) {
1027                 /* SYN packet */
1028                 ct->proto.tcp.seen[0].td_end =
1029                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1030                                              dataoff, th);
1031                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1032                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1033                         ct->proto.tcp.seen[0].td_maxwin = 1;
1034                 ct->proto.tcp.seen[0].td_maxend =
1035                         ct->proto.tcp.seen[0].td_end;
1036
1037                 tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
1038                 ct->proto.tcp.seen[1].flags = 0;
1039         } else if (nf_ct_tcp_loose == 0) {
1040                 /* Don't try to pick up connections. */
1041                 return false;
1042         } else {
1043                 /*
1044                  * We are in the middle of a connection,
1045                  * its history is lost for us.
1046                  * Let's try to use the data from the packet.
1047                  */
1048                 ct->proto.tcp.seen[0].td_end =
1049                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1050                                              dataoff, th);
1051                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1052                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1053                         ct->proto.tcp.seen[0].td_maxwin = 1;
1054                 ct->proto.tcp.seen[0].td_maxend =
1055                         ct->proto.tcp.seen[0].td_end +
1056                         ct->proto.tcp.seen[0].td_maxwin;
1057                 ct->proto.tcp.seen[0].td_scale = 0;
1058
1059                 /* We assume SACK and liberal window checking to handle
1060                  * window scaling */
1061                 ct->proto.tcp.seen[0].flags =
1062                 ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1063                                               IP_CT_TCP_FLAG_BE_LIBERAL;
1064         }
1065
1066         ct->proto.tcp.seen[1].td_end = 0;
1067         ct->proto.tcp.seen[1].td_maxend = 0;
1068         ct->proto.tcp.seen[1].td_maxwin = 1;
1069         ct->proto.tcp.seen[1].td_scale = 0;
1070
1071         /* tcp_packet will set them */
1072         ct->proto.tcp.state = TCP_CONNTRACK_NONE;
1073         ct->proto.tcp.last_index = TCP_NONE_SET;
1074
1075         pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1076                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1077                  sender->td_end, sender->td_maxend, sender->td_maxwin,
1078                  sender->td_scale,
1079                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1080                  receiver->td_scale);
1081         return true;
1082 }
1083
1084 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1085
1086 #include <linux/netfilter/nfnetlink.h>
1087 #include <linux/netfilter/nfnetlink_conntrack.h>
1088
1089 static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
1090                          const struct nf_conn *ct)
1091 {
1092         struct nlattr *nest_parms;
1093         struct nf_ct_tcp_flags tmp = {};
1094
1095         read_lock_bh(&tcp_lock);
1096         nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP | NLA_F_NESTED);
1097         if (!nest_parms)
1098                 goto nla_put_failure;
1099
1100         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state);
1101
1102         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
1103                    ct->proto.tcp.seen[0].td_scale);
1104
1105         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
1106                    ct->proto.tcp.seen[1].td_scale);
1107
1108         tmp.flags = ct->proto.tcp.seen[0].flags;
1109         NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
1110                 sizeof(struct nf_ct_tcp_flags), &tmp);
1111
1112         tmp.flags = ct->proto.tcp.seen[1].flags;
1113         NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
1114                 sizeof(struct nf_ct_tcp_flags), &tmp);
1115         read_unlock_bh(&tcp_lock);
1116
1117         nla_nest_end(skb, nest_parms);
1118
1119         return 0;
1120
1121 nla_put_failure:
1122         read_unlock_bh(&tcp_lock);
1123         return -1;
1124 }
1125
1126 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
1127         [CTA_PROTOINFO_TCP_STATE]           = { .type = NLA_U8 },
1128         [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
1129         [CTA_PROTOINFO_TCP_WSCALE_REPLY]    = { .type = NLA_U8 },
1130         [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
1131         [CTA_PROTOINFO_TCP_FLAGS_REPLY]     = { .len =  sizeof(struct nf_ct_tcp_flags) },
1132 };
1133
1134 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
1135 {
1136         struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
1137         struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
1138         int err;
1139
1140         /* updates could not contain anything about the private
1141          * protocol info, in that case skip the parsing */
1142         if (!pattr)
1143                 return 0;
1144
1145         err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
1146         if (err < 0)
1147                 return err;
1148
1149         if (tb[CTA_PROTOINFO_TCP_STATE] &&
1150             nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
1151                 return -EINVAL;
1152
1153         write_lock_bh(&tcp_lock);
1154         if (tb[CTA_PROTOINFO_TCP_STATE])
1155                 ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
1156
1157         if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
1158                 struct nf_ct_tcp_flags *attr =
1159                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
1160                 ct->proto.tcp.seen[0].flags &= ~attr->mask;
1161                 ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
1162         }
1163
1164         if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
1165                 struct nf_ct_tcp_flags *attr =
1166                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
1167                 ct->proto.tcp.seen[1].flags &= ~attr->mask;
1168                 ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
1169         }
1170
1171         if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
1172             tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
1173             ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
1174             ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1175                 ct->proto.tcp.seen[0].td_scale =
1176                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
1177                 ct->proto.tcp.seen[1].td_scale =
1178                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
1179         }
1180         write_unlock_bh(&tcp_lock);
1181
1182         return 0;
1183 }
1184 #endif
1185
1186 #ifdef CONFIG_SYSCTL
1187 static unsigned int tcp_sysctl_table_users;
1188 static struct ctl_table_header *tcp_sysctl_header;
1189 static struct ctl_table tcp_sysctl_table[] = {
1190         {
1191                 .procname       = "nf_conntrack_tcp_timeout_syn_sent",
1192                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1193                 .maxlen         = sizeof(unsigned int),
1194                 .mode           = 0644,
1195                 .proc_handler   = proc_dointvec_jiffies,
1196         },
1197         {
1198                 .procname       = "nf_conntrack_tcp_timeout_syn_recv",
1199                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1200                 .maxlen         = sizeof(unsigned int),
1201                 .mode           = 0644,
1202                 .proc_handler   = proc_dointvec_jiffies,
1203         },
1204         {
1205                 .procname       = "nf_conntrack_tcp_timeout_established",
1206                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1207                 .maxlen         = sizeof(unsigned int),
1208                 .mode           = 0644,
1209                 .proc_handler   = proc_dointvec_jiffies,
1210         },
1211         {
1212                 .procname       = "nf_conntrack_tcp_timeout_fin_wait",
1213                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1214                 .maxlen         = sizeof(unsigned int),
1215                 .mode           = 0644,
1216                 .proc_handler   = proc_dointvec_jiffies,
1217         },
1218         {
1219                 .procname       = "nf_conntrack_tcp_timeout_close_wait",
1220                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1221                 .maxlen         = sizeof(unsigned int),
1222                 .mode           = 0644,
1223                 .proc_handler   = proc_dointvec_jiffies,
1224         },
1225         {
1226                 .procname       = "nf_conntrack_tcp_timeout_last_ack",
1227                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1228                 .maxlen         = sizeof(unsigned int),
1229                 .mode           = 0644,
1230                 .proc_handler   = proc_dointvec_jiffies,
1231         },
1232         {
1233                 .procname       = "nf_conntrack_tcp_timeout_time_wait",
1234                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1235                 .maxlen         = sizeof(unsigned int),
1236                 .mode           = 0644,
1237                 .proc_handler   = proc_dointvec_jiffies,
1238         },
1239         {
1240                 .procname       = "nf_conntrack_tcp_timeout_close",
1241                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1242                 .maxlen         = sizeof(unsigned int),
1243                 .mode           = 0644,
1244                 .proc_handler   = proc_dointvec_jiffies,
1245         },
1246         {
1247                 .procname       = "nf_conntrack_tcp_timeout_max_retrans",
1248                 .data           = &nf_ct_tcp_timeout_max_retrans,
1249                 .maxlen         = sizeof(unsigned int),
1250                 .mode           = 0644,
1251                 .proc_handler   = proc_dointvec_jiffies,
1252         },
1253         {
1254                 .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
1255                 .data           = &nf_ct_tcp_timeout_unacknowledged,
1256                 .maxlen         = sizeof(unsigned int),
1257                 .mode           = 0644,
1258                 .proc_handler   = proc_dointvec_jiffies,
1259         },
1260         {
1261                 .ctl_name       = NET_NF_CONNTRACK_TCP_LOOSE,
1262                 .procname       = "nf_conntrack_tcp_loose",
1263                 .data           = &nf_ct_tcp_loose,
1264                 .maxlen         = sizeof(unsigned int),
1265                 .mode           = 0644,
1266                 .proc_handler   = proc_dointvec,
1267         },
1268         {
1269                 .ctl_name       = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
1270                 .procname       = "nf_conntrack_tcp_be_liberal",
1271                 .data           = &nf_ct_tcp_be_liberal,
1272                 .maxlen         = sizeof(unsigned int),
1273                 .mode           = 0644,
1274                 .proc_handler   = proc_dointvec,
1275         },
1276         {
1277                 .ctl_name       = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
1278                 .procname       = "nf_conntrack_tcp_max_retrans",
1279                 .data           = &nf_ct_tcp_max_retrans,
1280                 .maxlen         = sizeof(unsigned int),
1281                 .mode           = 0644,
1282                 .proc_handler   = proc_dointvec,
1283         },
1284         {
1285                 .ctl_name       = 0
1286         }
1287 };
1288
1289 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1290 static struct ctl_table tcp_compat_sysctl_table[] = {
1291         {
1292                 .procname       = "ip_conntrack_tcp_timeout_syn_sent",
1293                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1294                 .maxlen         = sizeof(unsigned int),
1295                 .mode           = 0644,
1296                 .proc_handler   = proc_dointvec_jiffies,
1297         },
1298         {
1299                 .procname       = "ip_conntrack_tcp_timeout_syn_recv",
1300                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1301                 .maxlen         = sizeof(unsigned int),
1302                 .mode           = 0644,
1303                 .proc_handler   = proc_dointvec_jiffies,
1304         },
1305         {
1306                 .procname       = "ip_conntrack_tcp_timeout_established",
1307                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1308                 .maxlen         = sizeof(unsigned int),
1309                 .mode           = 0644,
1310                 .proc_handler   = proc_dointvec_jiffies,
1311         },
1312         {
1313                 .procname       = "ip_conntrack_tcp_timeout_fin_wait",
1314                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1315                 .maxlen         = sizeof(unsigned int),
1316                 .mode           = 0644,
1317                 .proc_handler   = proc_dointvec_jiffies,
1318         },
1319         {
1320                 .procname       = "ip_conntrack_tcp_timeout_close_wait",
1321                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1322                 .maxlen         = sizeof(unsigned int),
1323                 .mode           = 0644,
1324                 .proc_handler   = proc_dointvec_jiffies,
1325         },
1326         {
1327                 .procname       = "ip_conntrack_tcp_timeout_last_ack",
1328                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1329                 .maxlen         = sizeof(unsigned int),
1330                 .mode           = 0644,
1331                 .proc_handler   = proc_dointvec_jiffies,
1332         },
1333         {
1334                 .procname       = "ip_conntrack_tcp_timeout_time_wait",
1335                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1336                 .maxlen         = sizeof(unsigned int),
1337                 .mode           = 0644,
1338                 .proc_handler   = proc_dointvec_jiffies,
1339         },
1340         {
1341                 .procname       = "ip_conntrack_tcp_timeout_close",
1342                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1343                 .maxlen         = sizeof(unsigned int),
1344                 .mode           = 0644,
1345                 .proc_handler   = proc_dointvec_jiffies,
1346         },
1347         {
1348                 .procname       = "ip_conntrack_tcp_timeout_max_retrans",
1349                 .data           = &nf_ct_tcp_timeout_max_retrans,
1350                 .maxlen         = sizeof(unsigned int),
1351                 .mode           = 0644,
1352                 .proc_handler   = proc_dointvec_jiffies,
1353         },
1354         {
1355                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
1356                 .procname       = "ip_conntrack_tcp_loose",
1357                 .data           = &nf_ct_tcp_loose,
1358                 .maxlen         = sizeof(unsigned int),
1359                 .mode           = 0644,
1360                 .proc_handler   = proc_dointvec,
1361         },
1362         {
1363                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
1364                 .procname       = "ip_conntrack_tcp_be_liberal",
1365                 .data           = &nf_ct_tcp_be_liberal,
1366                 .maxlen         = sizeof(unsigned int),
1367                 .mode           = 0644,
1368                 .proc_handler   = proc_dointvec,
1369         },
1370         {
1371                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
1372                 .procname       = "ip_conntrack_tcp_max_retrans",
1373                 .data           = &nf_ct_tcp_max_retrans,
1374                 .maxlen         = sizeof(unsigned int),
1375                 .mode           = 0644,
1376                 .proc_handler   = proc_dointvec,
1377         },
1378         {
1379                 .ctl_name       = 0
1380         }
1381 };
1382 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
1383 #endif /* CONFIG_SYSCTL */
1384
1385 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
1386 {
1387         .l3proto                = PF_INET,
1388         .l4proto                = IPPROTO_TCP,
1389         .name                   = "tcp",
1390         .pkt_to_tuple           = tcp_pkt_to_tuple,
1391         .invert_tuple           = tcp_invert_tuple,
1392         .print_tuple            = tcp_print_tuple,
1393         .print_conntrack        = tcp_print_conntrack,
1394         .packet                 = tcp_packet,
1395         .new                    = tcp_new,
1396         .error                  = tcp_error,
1397 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1398         .to_nlattr              = tcp_to_nlattr,
1399         .from_nlattr            = nlattr_to_tcp,
1400         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1401         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1402         .nla_policy             = nf_ct_port_nla_policy,
1403 #endif
1404 #ifdef CONFIG_SYSCTL
1405         .ctl_table_users        = &tcp_sysctl_table_users,
1406         .ctl_table_header       = &tcp_sysctl_header,
1407         .ctl_table              = tcp_sysctl_table,
1408 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1409         .ctl_compat_table       = tcp_compat_sysctl_table,
1410 #endif
1411 #endif
1412 };
1413 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
1414
1415 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
1416 {
1417         .l3proto                = PF_INET6,
1418         .l4proto                = IPPROTO_TCP,
1419         .name                   = "tcp",
1420         .pkt_to_tuple           = tcp_pkt_to_tuple,
1421         .invert_tuple           = tcp_invert_tuple,
1422         .print_tuple            = tcp_print_tuple,
1423         .print_conntrack        = tcp_print_conntrack,
1424         .packet                 = tcp_packet,
1425         .new                    = tcp_new,
1426         .error                  = tcp_error,
1427 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1428         .to_nlattr              = tcp_to_nlattr,
1429         .from_nlattr            = nlattr_to_tcp,
1430         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1431         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1432         .nla_policy             = nf_ct_port_nla_policy,
1433 #endif
1434 #ifdef CONFIG_SYSCTL
1435         .ctl_table_users        = &tcp_sysctl_table_users,
1436         .ctl_table_header       = &tcp_sysctl_header,
1437         .ctl_table              = tcp_sysctl_table,
1438 #endif
1439 };
1440 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);