~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_conntrack_proto_tcp.c

Version: ~ [ linux-5.3-rc5 ] ~ [ linux-5.2.9 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.67 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.139 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.189 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.189 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.72 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* (C) 1999-2001 Paul `Rusty' Russell
  2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  3  * (C) 2002-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  4  * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
  5  *
  6  * This program is free software; you can redistribute it and/or modify
  7  * it under the terms of the GNU General Public License version 2 as
  8  * published by the Free Software Foundation.
  9  */
 10 
 11 #include <linux/types.h>
 12 #include <linux/timer.h>
 13 #include <linux/module.h>
 14 #include <linux/in.h>
 15 #include <linux/tcp.h>
 16 #include <linux/spinlock.h>
 17 #include <linux/skbuff.h>
 18 #include <linux/ipv6.h>
 19 #include <net/ip6_checksum.h>
 20 #include <asm/unaligned.h>
 21 
 22 #include <net/tcp.h>
 23 
 24 #include <linux/netfilter.h>
 25 #include <linux/netfilter_ipv4.h>
 26 #include <linux/netfilter_ipv6.h>
 27 #include <net/netfilter/nf_conntrack.h>
 28 #include <net/netfilter/nf_conntrack_l4proto.h>
 29 #include <net/netfilter/nf_conntrack_ecache.h>
 30 #include <net/netfilter/nf_log.h>
 31 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 32 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 33 
 34 /* "Be conservative in what you do,
 35     be liberal in what you accept from others."
 36     If it's non-zero, we mark only out of window RST segments as INVALID. */
 37 static int nf_ct_tcp_be_liberal __read_mostly = 0;
 38 
 39 /* If it is set to zero, we disable picking up already established
 40    connections. */
 41 static int nf_ct_tcp_loose __read_mostly = 1;
 42 
 43 /* Max number of the retransmitted packets without receiving an (acceptable)
 44    ACK from the destination. If this number is reached, a shorter timer
 45    will be started. */
 46 static int nf_ct_tcp_max_retrans __read_mostly = 3;
 47 
 48   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
 49      closely.  They're more complex. --RR */
 50 
 51 static const char *const tcp_conntrack_names[] = {
 52         "NONE",
 53         "SYN_SENT",
 54         "SYN_RECV",
 55         "ESTABLISHED",
 56         "FIN_WAIT",
 57         "CLOSE_WAIT",
 58         "LAST_ACK",
 59         "TIME_WAIT",
 60         "CLOSE",
 61         "SYN_SENT2",
 62 };
 63 
 64 #define SECS * HZ
 65 #define MINS * 60 SECS
 66 #define HOURS * 60 MINS
 67 #define DAYS * 24 HOURS
 68 
 69 static unsigned int tcp_timeouts[TCP_CONNTRACK_TIMEOUT_MAX] __read_mostly = {
 70         [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
 71         [TCP_CONNTRACK_SYN_RECV]        = 60 SECS,
 72         [TCP_CONNTRACK_ESTABLISHED]     = 5 DAYS,
 73         [TCP_CONNTRACK_FIN_WAIT]        = 2 MINS,
 74         [TCP_CONNTRACK_CLOSE_WAIT]      = 60 SECS,
 75         [TCP_CONNTRACK_LAST_ACK]        = 30 SECS,
 76         [TCP_CONNTRACK_TIME_WAIT]       = 2 MINS,
 77         [TCP_CONNTRACK_CLOSE]           = 10 SECS,
 78         [TCP_CONNTRACK_SYN_SENT2]       = 2 MINS,
 79 /* RFC1122 says the R2 limit should be at least 100 seconds.
 80    Linux uses 15 packets as limit, which corresponds
 81    to ~13-30min depending on RTO. */
 82         [TCP_CONNTRACK_RETRANS]         = 5 MINS,
 83         [TCP_CONNTRACK_UNACK]           = 5 MINS,
 84 };
 85 
 86 #define sNO TCP_CONNTRACK_NONE
 87 #define sSS TCP_CONNTRACK_SYN_SENT
 88 #define sSR TCP_CONNTRACK_SYN_RECV
 89 #define sES TCP_CONNTRACK_ESTABLISHED
 90 #define sFW TCP_CONNTRACK_FIN_WAIT
 91 #define sCW TCP_CONNTRACK_CLOSE_WAIT
 92 #define sLA TCP_CONNTRACK_LAST_ACK
 93 #define sTW TCP_CONNTRACK_TIME_WAIT
 94 #define sCL TCP_CONNTRACK_CLOSE
 95 #define sS2 TCP_CONNTRACK_SYN_SENT2
 96 #define sIV TCP_CONNTRACK_MAX
 97 #define sIG TCP_CONNTRACK_IGNORE
 98 
 99 /* What TCP flags are set from RST/SYN/FIN/ACK. */
100 enum tcp_bit_set {
101         TCP_SYN_SET,
102         TCP_SYNACK_SET,
103         TCP_FIN_SET,
104         TCP_ACK_SET,
105         TCP_RST_SET,
106         TCP_NONE_SET,
107 };
108 
109 /*
110  * The TCP state transition table needs a few words...
111  *
112  * We are the man in the middle. All the packets go through us
113  * but might get lost in transit to the destination.
114  * It is assumed that the destinations can't receive segments
115  * we haven't seen.
116  *
117  * The checked segment is in window, but our windows are *not*
118  * equivalent with the ones of the sender/receiver. We always
119  * try to guess the state of the current sender.
120  *
121  * The meaning of the states are:
122  *
123  * NONE:        initial state
124  * SYN_SENT:    SYN-only packet seen
125  * SYN_SENT2:   SYN-only packet seen from reply dir, simultaneous open
126  * SYN_RECV:    SYN-ACK packet seen
127  * ESTABLISHED: ACK packet seen
128  * FIN_WAIT:    FIN packet seen
129  * CLOSE_WAIT:  ACK seen (after FIN)
130  * LAST_ACK:    FIN seen (after FIN)
131  * TIME_WAIT:   last ACK seen
132  * CLOSE:       closed connection (RST)
133  *
134  * Packets marked as IGNORED (sIG):
135  *      if they may be either invalid or valid
136  *      and the receiver may send back a connection
137  *      closing RST or a SYN/ACK.
138  *
139  * Packets marked as INVALID (sIV):
140  *      if we regard them as truly invalid packets
141  */
142 static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
143         {
144 /* ORIGINAL */
145 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
146 /*syn*/    { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sS2 },
147 /*
148  *      sNO -> sSS      Initialize a new connection
149  *      sSS -> sSS      Retransmitted SYN
150  *      sS2 -> sS2      Late retransmitted SYN
151  *      sSR -> sIG
152  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
153  *                      are errors. Receiver will reply with RST
154  *                      and close the connection.
155  *                      Or we are not in sync and hold a dead connection.
156  *      sFW -> sIG
157  *      sCW -> sIG
158  *      sLA -> sIG
159  *      sTW -> sSS      Reopened connection (RFC 1122).
160  *      sCL -> sSS
161  */
162 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
163 /*synack*/ { sIV, sIV, sSR, sIV, sIV, sIV, sIV, sIV, sIV, sSR },
164 /*
165  *      sNO -> sIV      Too late and no reason to do anything
166  *      sSS -> sIV      Client can't send SYN and then SYN/ACK
167  *      sS2 -> sSR      SYN/ACK sent to SYN2 in simultaneous open
168  *      sSR -> sSR      Late retransmitted SYN/ACK in simultaneous open
169  *      sES -> sIV      Invalid SYN/ACK packets sent by the client
170  *      sFW -> sIV
171  *      sCW -> sIV
172  *      sLA -> sIV
173  *      sTW -> sIV
174  *      sCL -> sIV
175  */
176 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
177 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
178 /*
179  *      sNO -> sIV      Too late and no reason to do anything...
180  *      sSS -> sIV      Client migth not send FIN in this state:
181  *                      we enforce waiting for a SYN/ACK reply first.
182  *      sS2 -> sIV
183  *      sSR -> sFW      Close started.
184  *      sES -> sFW
185  *      sFW -> sLA      FIN seen in both directions, waiting for
186  *                      the last ACK.
187  *                      Migth be a retransmitted FIN as well...
188  *      sCW -> sLA
189  *      sLA -> sLA      Retransmitted FIN. Remain in the same state.
190  *      sTW -> sTW
191  *      sCL -> sCL
192  */
193 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
194 /*ack*/    { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
195 /*
196  *      sNO -> sES      Assumed.
197  *      sSS -> sIV      ACK is invalid: we haven't seen a SYN/ACK yet.
198  *      sS2 -> sIV
199  *      sSR -> sES      Established state is reached.
200  *      sES -> sES      :-)
201  *      sFW -> sCW      Normal close request answered by ACK.
202  *      sCW -> sCW
203  *      sLA -> sTW      Last ACK detected.
204  *      sTW -> sTW      Retransmitted last ACK. Remain in the same state.
205  *      sCL -> sCL
206  */
207 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
208 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
209 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
210         },
211         {
212 /* REPLY */
213 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
214 /*syn*/    { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sS2 },
215 /*
216  *      sNO -> sIV      Never reached.
217  *      sSS -> sS2      Simultaneous open
218  *      sS2 -> sS2      Retransmitted simultaneous SYN
219  *      sSR -> sIV      Invalid SYN packets sent by the server
220  *      sES -> sIV
221  *      sFW -> sIV
222  *      sCW -> sIV
223  *      sLA -> sIV
224  *      sTW -> sIV      Reopened connection, but server may not do it.
225  *      sCL -> sIV
226  */
227 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
228 /*synack*/ { sIV, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
229 /*
230  *      sSS -> sSR      Standard open.
231  *      sS2 -> sSR      Simultaneous open
232  *      sSR -> sIG      Retransmitted SYN/ACK, ignore it.
233  *      sES -> sIG      Late retransmitted SYN/ACK?
234  *      sFW -> sIG      Might be SYN/ACK answering ignored SYN
235  *      sCW -> sIG
236  *      sLA -> sIG
237  *      sTW -> sIG
238  *      sCL -> sIG
239  */
240 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
241 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
242 /*
243  *      sSS -> sIV      Server might not send FIN in this state.
244  *      sS2 -> sIV
245  *      sSR -> sFW      Close started.
246  *      sES -> sFW
247  *      sFW -> sLA      FIN seen in both directions.
248  *      sCW -> sLA
249  *      sLA -> sLA      Retransmitted FIN.
250  *      sTW -> sTW
251  *      sCL -> sCL
252  */
253 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
254 /*ack*/    { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIG },
255 /*
256  *      sSS -> sIG      Might be a half-open connection.
257  *      sS2 -> sIG
258  *      sSR -> sSR      Might answer late resent SYN.
259  *      sES -> sES      :-)
260  *      sFW -> sCW      Normal close request answered by ACK.
261  *      sCW -> sCW
262  *      sLA -> sTW      Last ACK detected.
263  *      sTW -> sTW      Retransmitted last ACK.
264  *      sCL -> sCL
265  */
266 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
267 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
268 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
269         }
270 };
271 
272 static inline struct nf_tcp_net *tcp_pernet(struct net *net)
273 {
274         return &net->ct.nf_ct_proto.tcp;
275 }
276 
277 static bool tcp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
278                              struct nf_conntrack_tuple *tuple)
279 {
280         const struct tcphdr *hp;
281         struct tcphdr _hdr;
282 
283         /* Actually only need first 8 bytes. */
284         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
285         if (hp == NULL)
286                 return false;
287 
288         tuple->src.u.tcp.port = hp->source;
289         tuple->dst.u.tcp.port = hp->dest;
290 
291         return true;
292 }
293 
294 static bool tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
295                              const struct nf_conntrack_tuple *orig)
296 {
297         tuple->src.u.tcp.port = orig->dst.u.tcp.port;
298         tuple->dst.u.tcp.port = orig->src.u.tcp.port;
299         return true;
300 }
301 
302 /* Print out the per-protocol part of the tuple. */
303 static int tcp_print_tuple(struct seq_file *s,
304                            const struct nf_conntrack_tuple *tuple)
305 {
306         return seq_printf(s, "sport=%hu dport=%hu ",
307                           ntohs(tuple->src.u.tcp.port),
308                           ntohs(tuple->dst.u.tcp.port));
309 }
310 
311 /* Print out the private part of the conntrack. */
312 static int tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
313 {
314         enum tcp_conntrack state;
315 
316         spin_lock_bh(&ct->lock);
317         state = ct->proto.tcp.state;
318         spin_unlock_bh(&ct->lock);
319 
320         return seq_printf(s, "%s ", tcp_conntrack_names[state]);
321 }
322 
323 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
324 {
325         if (tcph->rst) return TCP_RST_SET;
326         else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
327         else if (tcph->fin) return TCP_FIN_SET;
328         else if (tcph->ack) return TCP_ACK_SET;
329         else return TCP_NONE_SET;
330 }
331 
332 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
333    in IP Filter' by Guido van Rooij.
334 
335    http://www.sane.nl/events/sane2000/papers.html
336    http://www.darkart.com/mirrors/www.obfuscation.org/ipf/
337 
338    The boundaries and the conditions are changed according to RFC793:
339    the packet must intersect the window (i.e. segments may be
340    after the right or before the left edge) and thus receivers may ACK
341    segments after the right edge of the window.
342 
343         td_maxend = max(sack + max(win,1)) seen in reply packets
344         td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
345         td_maxwin += seq + len - sender.td_maxend
346                         if seq + len > sender.td_maxend
347         td_end    = max(seq + len) seen in sent packets
348 
349    I.   Upper bound for valid data:     seq <= sender.td_maxend
350    II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
351    III. Upper bound for valid (s)ack:   sack <= receiver.td_end
352    IV.  Lower bound for valid (s)ack:   sack >= receiver.td_end - MAXACKWINDOW
353 
354    where sack is the highest right edge of sack block found in the packet
355    or ack in the case of packet without SACK option.
356 
357    The upper bound limit for a valid (s)ack is not ignored -
358    we doesn't have to deal with fragments.
359 */
360 
361 static inline __u32 segment_seq_plus_len(__u32 seq,
362                                          size_t len,
363                                          unsigned int dataoff,
364                                          const struct tcphdr *tcph)
365 {
366         /* XXX Should I use payload length field in IP/IPv6 header ?
367          * - YK */
368         return (seq + len - dataoff - tcph->doff*4
369                 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
370 }
371 
372 /* Fixme: what about big packets? */
373 #define MAXACKWINCONST                  66000
374 #define MAXACKWINDOW(sender)                                            \
375         ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin     \
376                                               : MAXACKWINCONST)
377 
378 /*
379  * Simplified tcp_parse_options routine from tcp_input.c
380  */
381 static void tcp_options(const struct sk_buff *skb,
382                         unsigned int dataoff,
383                         const struct tcphdr *tcph,
384                         struct ip_ct_tcp_state *state)
385 {
386         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
387         const unsigned char *ptr;
388         int length = (tcph->doff*4) - sizeof(struct tcphdr);
389 
390         if (!length)
391                 return;
392 
393         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
394                                  length, buff);
395         BUG_ON(ptr == NULL);
396 
397         state->td_scale =
398         state->flags = 0;
399 
400         while (length > 0) {
401                 int opcode=*ptr++;
402                 int opsize;
403 
404                 switch (opcode) {
405                 case TCPOPT_EOL:
406                         return;
407                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
408                         length--;
409                         continue;
410                 default:
411                         opsize=*ptr++;
412                         if (opsize < 2) /* "silly options" */
413                                 return;
414                         if (opsize > length)
415                                 return; /* don't parse partial options */
416 
417                         if (opcode == TCPOPT_SACK_PERM
418                             && opsize == TCPOLEN_SACK_PERM)
419                                 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
420                         else if (opcode == TCPOPT_WINDOW
421                                  && opsize == TCPOLEN_WINDOW) {
422                                 state->td_scale = *(u_int8_t *)ptr;
423 
424                                 if (state->td_scale > 14) {
425                                         /* See RFC1323 */
426                                         state->td_scale = 14;
427                                 }
428                                 state->flags |=
429                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
430                         }
431                         ptr += opsize - 2;
432                         length -= opsize;
433                 }
434         }
435 }
436 
437 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
438                      const struct tcphdr *tcph, __u32 *sack)
439 {
440         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
441         const unsigned char *ptr;
442         int length = (tcph->doff*4) - sizeof(struct tcphdr);
443         __u32 tmp;
444 
445         if (!length)
446                 return;
447 
448         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
449                                  length, buff);
450         BUG_ON(ptr == NULL);
451 
452         /* Fast path for timestamp-only option */
453         if (length == TCPOLEN_TSTAMP_ALIGNED
454             && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
455                                        | (TCPOPT_NOP << 16)
456                                        | (TCPOPT_TIMESTAMP << 8)
457                                        | TCPOLEN_TIMESTAMP))
458                 return;
459 
460         while (length > 0) {
461                 int opcode = *ptr++;
462                 int opsize, i;
463 
464                 switch (opcode) {
465                 case TCPOPT_EOL:
466                         return;
467                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
468                         length--;
469                         continue;
470                 default:
471                         opsize = *ptr++;
472                         if (opsize < 2) /* "silly options" */
473                                 return;
474                         if (opsize > length)
475                                 return; /* don't parse partial options */
476 
477                         if (opcode == TCPOPT_SACK
478                             && opsize >= (TCPOLEN_SACK_BASE
479                                           + TCPOLEN_SACK_PERBLOCK)
480                             && !((opsize - TCPOLEN_SACK_BASE)
481                                  % TCPOLEN_SACK_PERBLOCK)) {
482                                 for (i = 0;
483                                      i < (opsize - TCPOLEN_SACK_BASE);
484                                      i += TCPOLEN_SACK_PERBLOCK) {
485                                         tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
486 
487                                         if (after(tmp, *sack))
488                                                 *sack = tmp;
489                                 }
490                                 return;
491                         }
492                         ptr += opsize - 2;
493                         length -= opsize;
494                 }
495         }
496 }
497 
498 #ifdef CONFIG_NF_NAT_NEEDED
499 static inline s16 nat_offset(const struct nf_conn *ct,
500                              enum ip_conntrack_dir dir,
501                              u32 seq)
502 {
503         typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
504 
505         return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
506 }
507 #define NAT_OFFSET(ct, dir, seq) \
508         (nat_offset(ct, dir, seq))
509 #else
510 #define NAT_OFFSET(ct, dir, seq)        0
511 #endif
512 
513 static bool tcp_in_window(const struct nf_conn *ct,
514                           struct ip_ct_tcp *state,
515                           enum ip_conntrack_dir dir,
516                           unsigned int index,
517                           const struct sk_buff *skb,
518                           unsigned int dataoff,
519                           const struct tcphdr *tcph,
520                           u_int8_t pf)
521 {
522         struct net *net = nf_ct_net(ct);
523         struct nf_tcp_net *tn = tcp_pernet(net);
524         struct ip_ct_tcp_state *sender = &state->seen[dir];
525         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
526         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
527         __u32 seq, ack, sack, end, win, swin;
528         s16 receiver_offset;
529         bool res, in_recv_win;
530 
531         /*
532          * Get the required data from the packet.
533          */
534         seq = ntohl(tcph->seq);
535         ack = sack = ntohl(tcph->ack_seq);
536         win = ntohs(tcph->window);
537         end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
538 
539         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
540                 tcp_sack(skb, dataoff, tcph, &sack);
541 
542         /* Take into account NAT sequence number mangling */
543         receiver_offset = NAT_OFFSET(ct, !dir, ack - 1);
544         ack -= receiver_offset;
545         sack -= receiver_offset;
546 
547         pr_debug("tcp_in_window: START\n");
548         pr_debug("tcp_in_window: ");
549         nf_ct_dump_tuple(tuple);
550         pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
551                  seq, ack, receiver_offset, sack, receiver_offset, win, end);
552         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
553                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
554                  sender->td_end, sender->td_maxend, sender->td_maxwin,
555                  sender->td_scale,
556                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
557                  receiver->td_scale);
558 
559         if (sender->td_maxwin == 0) {
560                 /*
561                  * Initialize sender data.
562                  */
563                 if (tcph->syn) {
564                         /*
565                          * SYN-ACK in reply to a SYN
566                          * or SYN from reply direction in simultaneous open.
567                          */
568                         sender->td_end =
569                         sender->td_maxend = end;
570                         sender->td_maxwin = (win == 0 ? 1 : win);
571 
572                         tcp_options(skb, dataoff, tcph, sender);
573                         /*
574                          * RFC 1323:
575                          * Both sides must send the Window Scale option
576                          * to enable window scaling in either direction.
577                          */
578                         if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
579                               && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
580                                 sender->td_scale =
581                                 receiver->td_scale = 0;
582                         if (!tcph->ack)
583                                 /* Simultaneous open */
584                                 return true;
585                 } else {
586                         /*
587                          * We are in the middle of a connection,
588                          * its history is lost for us.
589                          * Let's try to use the data from the packet.
590                          */
591                         sender->td_end = end;
592                         swin = win << sender->td_scale;
593                         sender->td_maxwin = (swin == 0 ? 1 : swin);
594                         sender->td_maxend = end + sender->td_maxwin;
595                         /*
596                          * We haven't seen traffic in the other direction yet
597                          * but we have to tweak window tracking to pass III
598                          * and IV until that happens.
599                          */
600                         if (receiver->td_maxwin == 0)
601                                 receiver->td_end = receiver->td_maxend = sack;
602                 }
603         } else if (((state->state == TCP_CONNTRACK_SYN_SENT
604                      && dir == IP_CT_DIR_ORIGINAL)
605                    || (state->state == TCP_CONNTRACK_SYN_RECV
606                      && dir == IP_CT_DIR_REPLY))
607                    && after(end, sender->td_end)) {
608                 /*
609                  * RFC 793: "if a TCP is reinitialized ... then it need
610                  * not wait at all; it must only be sure to use sequence
611                  * numbers larger than those recently used."
612                  */
613                 sender->td_end =
614                 sender->td_maxend = end;
615                 sender->td_maxwin = (win == 0 ? 1 : win);
616 
617                 tcp_options(skb, dataoff, tcph, sender);
618         }
619 
620         if (!(tcph->ack)) {
621                 /*
622                  * If there is no ACK, just pretend it was set and OK.
623                  */
624                 ack = sack = receiver->td_end;
625         } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
626                     (TCP_FLAG_ACK|TCP_FLAG_RST))
627                    && (ack == 0)) {
628                 /*
629                  * Broken TCP stacks, that set ACK in RST packets as well
630                  * with zero ack value.
631                  */
632                 ack = sack = receiver->td_end;
633         }
634 
635         if (tcph->rst && seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)
636                 /*
637                  * RST sent answering SYN.
638                  */
639                 seq = end = sender->td_end;
640 
641         pr_debug("tcp_in_window: ");
642         nf_ct_dump_tuple(tuple);
643         pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
644                  seq, ack, receiver_offset, sack, receiver_offset, win, end);
645         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
646                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
647                  sender->td_end, sender->td_maxend, sender->td_maxwin,
648                  sender->td_scale,
649                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
650                  receiver->td_scale);
651 
652         /* Is the ending sequence in the receive window (if available)? */
653         in_recv_win = !receiver->td_maxwin ||
654                       after(end, sender->td_end - receiver->td_maxwin - 1);
655 
656         pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
657                  before(seq, sender->td_maxend + 1),
658                  (in_recv_win ? 1 : 0),
659                  before(sack, receiver->td_end + 1),
660                  after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
661 
662         if (before(seq, sender->td_maxend + 1) &&
663             in_recv_win &&
664             before(sack, receiver->td_end + 1) &&
665             after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
666                 /*
667                  * Take into account window scaling (RFC 1323).
668                  */
669                 if (!tcph->syn)
670                         win <<= sender->td_scale;
671 
672                 /*
673                  * Update sender data.
674                  */
675                 swin = win + (sack - ack);
676                 if (sender->td_maxwin < swin)
677                         sender->td_maxwin = swin;
678                 if (after(end, sender->td_end)) {
679                         sender->td_end = end;
680                         sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
681                 }
682                 if (tcph->ack) {
683                         if (!(sender->flags & IP_CT_TCP_FLAG_MAXACK_SET)) {
684                                 sender->td_maxack = ack;
685                                 sender->flags |= IP_CT_TCP_FLAG_MAXACK_SET;
686                         } else if (after(ack, sender->td_maxack))
687                                 sender->td_maxack = ack;
688                 }
689 
690                 /*
691                  * Update receiver data.
692                  */
693                 if (receiver->td_maxwin != 0 && after(end, sender->td_maxend))
694                         receiver->td_maxwin += end - sender->td_maxend;
695                 if (after(sack + win, receiver->td_maxend - 1)) {
696                         receiver->td_maxend = sack + win;
697                         if (win == 0)
698                                 receiver->td_maxend++;
699                 }
700                 if (ack == receiver->td_end)
701                         receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
702 
703                 /*
704                  * Check retransmissions.
705                  */
706                 if (index == TCP_ACK_SET) {
707                         if (state->last_dir == dir
708                             && state->last_seq == seq
709                             && state->last_ack == ack
710                             && state->last_end == end
711                             && state->last_win == win)
712                                 state->retrans++;
713                         else {
714                                 state->last_dir = dir;
715                                 state->last_seq = seq;
716                                 state->last_ack = ack;
717                                 state->last_end = end;
718                                 state->last_win = win;
719                                 state->retrans = 0;
720                         }
721                 }
722                 res = true;
723         } else {
724                 res = false;
725                 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
726                     tn->tcp_be_liberal)
727                         res = true;
728                 if (!res && LOG_INVALID(net, IPPROTO_TCP))
729                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
730                         "nf_ct_tcp: %s ",
731                         before(seq, sender->td_maxend + 1) ?
732                         in_recv_win ?
733                         before(sack, receiver->td_end + 1) ?
734                         after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
735                         : "ACK is under the lower bound (possible overly delayed ACK)"
736                         : "ACK is over the upper bound (ACKed data not seen yet)"
737                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
738                         : "SEQ is over the upper bound (over the window of the receiver)");
739         }
740 
741         pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
742                  "receiver end=%u maxend=%u maxwin=%u\n",
743                  res, sender->td_end, sender->td_maxend, sender->td_maxwin,
744                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
745 
746         return res;
747 }
748 
749 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
750 static const u8 tcp_valid_flags[(TCPHDR_FIN|TCPHDR_SYN|TCPHDR_RST|TCPHDR_ACK|
751                                  TCPHDR_URG) + 1] =
752 {
753         [TCPHDR_SYN]                            = 1,
754         [TCPHDR_SYN|TCPHDR_URG]                 = 1,
755         [TCPHDR_SYN|TCPHDR_ACK]                 = 1,
756         [TCPHDR_RST]                            = 1,
757         [TCPHDR_RST|TCPHDR_ACK]                 = 1,
758         [TCPHDR_FIN|TCPHDR_ACK]                 = 1,
759         [TCPHDR_FIN|TCPHDR_ACK|TCPHDR_URG]      = 1,
760         [TCPHDR_ACK]                            = 1,
761         [TCPHDR_ACK|TCPHDR_URG]                 = 1,
762 };
763 
764 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
765 static int tcp_error(struct net *net, struct nf_conn *tmpl,
766                      struct sk_buff *skb,
767                      unsigned int dataoff,
768                      enum ip_conntrack_info *ctinfo,
769                      u_int8_t pf,
770                      unsigned int hooknum)
771 {
772         const struct tcphdr *th;
773         struct tcphdr _tcph;
774         unsigned int tcplen = skb->len - dataoff;
775         u_int8_t tcpflags;
776 
777         /* Smaller that minimal TCP header? */
778         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
779         if (th == NULL) {
780                 if (LOG_INVALID(net, IPPROTO_TCP))
781                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
782                                 "nf_ct_tcp: short packet ");
783                 return -NF_ACCEPT;
784         }
785 
786         /* Not whole TCP header or malformed packet */
787         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
788                 if (LOG_INVALID(net, IPPROTO_TCP))
789                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
790                                 "nf_ct_tcp: truncated/malformed packet ");
791                 return -NF_ACCEPT;
792         }
793 
794         /* Checksum invalid? Ignore.
795          * We skip checking packets on the outgoing path
796          * because the checksum is assumed to be correct.
797          */
798         /* FIXME: Source route IP option packets --RR */
799         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
800             nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
801                 if (LOG_INVALID(net, IPPROTO_TCP))
802                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
803                                   "nf_ct_tcp: bad TCP checksum ");
804                 return -NF_ACCEPT;
805         }
806 
807         /* Check TCP flags. */
808         tcpflags = (tcp_flag_byte(th) & ~(TCPHDR_ECE|TCPHDR_CWR|TCPHDR_PSH));
809         if (!tcp_valid_flags[tcpflags]) {
810                 if (LOG_INVALID(net, IPPROTO_TCP))
811                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
812                                   "nf_ct_tcp: invalid TCP flag combination ");
813                 return -NF_ACCEPT;
814         }
815 
816         return NF_ACCEPT;
817 }
818 
819 static unsigned int *tcp_get_timeouts(struct net *net)
820 {
821         return tcp_pernet(net)->timeouts;
822 }
823 
824 /* Returns verdict for packet, or -1 for invalid. */
825 static int tcp_packet(struct nf_conn *ct,
826                       const struct sk_buff *skb,
827                       unsigned int dataoff,
828                       enum ip_conntrack_info ctinfo,
829                       u_int8_t pf,
830                       unsigned int hooknum,
831                       unsigned int *timeouts)
832 {
833         struct net *net = nf_ct_net(ct);
834         struct nf_tcp_net *tn = tcp_pernet(net);
835         struct nf_conntrack_tuple *tuple;
836         enum tcp_conntrack new_state, old_state;
837         enum ip_conntrack_dir dir;
838         const struct tcphdr *th;
839         struct tcphdr _tcph;
840         unsigned long timeout;
841         unsigned int index;
842 
843         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
844         BUG_ON(th == NULL);
845 
846         spin_lock_bh(&ct->lock);
847         old_state = ct->proto.tcp.state;
848         dir = CTINFO2DIR(ctinfo);
849         index = get_conntrack_index(th);
850         new_state = tcp_conntracks[dir][index][old_state];
851         tuple = &ct->tuplehash[dir].tuple;
852 
853         switch (new_state) {
854         case TCP_CONNTRACK_SYN_SENT:
855                 if (old_state < TCP_CONNTRACK_TIME_WAIT)
856                         break;
857                 /* RFC 1122: "When a connection is closed actively,
858                  * it MUST linger in TIME-WAIT state for a time 2xMSL
859                  * (Maximum Segment Lifetime). However, it MAY accept
860                  * a new SYN from the remote TCP to reopen the connection
861                  * directly from TIME-WAIT state, if..."
862                  * We ignore the conditions because we are in the
863                  * TIME-WAIT state anyway.
864                  *
865                  * Handle aborted connections: we and the server
866                  * think there is an existing connection but the client
867                  * aborts it and starts a new one.
868                  */
869                 if (((ct->proto.tcp.seen[dir].flags
870                       | ct->proto.tcp.seen[!dir].flags)
871                      & IP_CT_TCP_FLAG_CLOSE_INIT)
872                     || (ct->proto.tcp.last_dir == dir
873                         && ct->proto.tcp.last_index == TCP_RST_SET)) {
874                         /* Attempt to reopen a closed/aborted connection.
875                          * Delete this connection and look up again. */
876                         spin_unlock_bh(&ct->lock);
877 
878                         /* Only repeat if we can actually remove the timer.
879                          * Destruction may already be in progress in process
880                          * context and we must give it a chance to terminate.
881                          */
882                         if (nf_ct_kill(ct))
883                                 return -NF_REPEAT;
884                         return NF_DROP;
885                 }
886                 /* Fall through */
887         case TCP_CONNTRACK_IGNORE:
888                 /* Ignored packets:
889                  *
890                  * Our connection entry may be out of sync, so ignore
891                  * packets which may signal the real connection between
892                  * the client and the server.
893                  *
894                  * a) SYN in ORIGINAL
895                  * b) SYN/ACK in REPLY
896                  * c) ACK in reply direction after initial SYN in original.
897                  *
898                  * If the ignored packet is invalid, the receiver will send
899                  * a RST we'll catch below.
900                  */
901                 if (index == TCP_SYNACK_SET
902                     && ct->proto.tcp.last_index == TCP_SYN_SET
903                     && ct->proto.tcp.last_dir != dir
904                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
905                         /* b) This SYN/ACK acknowledges a SYN that we earlier
906                          * ignored as invalid. This means that the client and
907                          * the server are both in sync, while the firewall is
908                          * not. We get in sync from the previously annotated
909                          * values.
910                          */
911                         old_state = TCP_CONNTRACK_SYN_SENT;
912                         new_state = TCP_CONNTRACK_SYN_RECV;
913                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_end =
914                                 ct->proto.tcp.last_end;
915                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxend =
916                                 ct->proto.tcp.last_end;
917                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxwin =
918                                 ct->proto.tcp.last_win == 0 ?
919                                         1 : ct->proto.tcp.last_win;
920                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_scale =
921                                 ct->proto.tcp.last_wscale;
922                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
923                                 ct->proto.tcp.last_flags;
924                         memset(&ct->proto.tcp.seen[dir], 0,
925                                sizeof(struct ip_ct_tcp_state));
926                         break;
927                 }
928                 ct->proto.tcp.last_index = index;
929                 ct->proto.tcp.last_dir = dir;
930                 ct->proto.tcp.last_seq = ntohl(th->seq);
931                 ct->proto.tcp.last_end =
932                     segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
933                 ct->proto.tcp.last_win = ntohs(th->window);
934 
935                 /* a) This is a SYN in ORIGINAL. The client and the server
936                  * may be in sync but we are not. In that case, we annotate
937                  * the TCP options and let the packet go through. If it is a
938                  * valid SYN packet, the server will reply with a SYN/ACK, and
939                  * then we'll get in sync. Otherwise, the server ignores it. */
940                 if (index == TCP_SYN_SET && dir == IP_CT_DIR_ORIGINAL) {
941                         struct ip_ct_tcp_state seen = {};
942 
943                         ct->proto.tcp.last_flags =
944                         ct->proto.tcp.last_wscale = 0;
945                         tcp_options(skb, dataoff, th, &seen);
946                         if (seen.flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
947                                 ct->proto.tcp.last_flags |=
948                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
949                                 ct->proto.tcp.last_wscale = seen.td_scale;
950                         }
951                         if (seen.flags & IP_CT_TCP_FLAG_SACK_PERM) {
952                                 ct->proto.tcp.last_flags |=
953                                         IP_CT_TCP_FLAG_SACK_PERM;
954                         }
955                 }
956                 spin_unlock_bh(&ct->lock);
957                 if (LOG_INVALID(net, IPPROTO_TCP))
958                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
959                                   "nf_ct_tcp: invalid packet ignored in "
960                                   "state %s ", tcp_conntrack_names[old_state]);
961                 return NF_ACCEPT;
962         case TCP_CONNTRACK_MAX:
963                 /* Invalid packet */
964                 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
965                          dir, get_conntrack_index(th), old_state);
966                 spin_unlock_bh(&ct->lock);
967                 if (LOG_INVALID(net, IPPROTO_TCP))
968                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
969                                   "nf_ct_tcp: invalid state ");
970                 return -NF_ACCEPT;
971         case TCP_CONNTRACK_CLOSE:
972                 if (index == TCP_RST_SET
973                     && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
974                     && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) {
975                         /* Invalid RST  */
976                         spin_unlock_bh(&ct->lock);
977                         if (LOG_INVALID(net, IPPROTO_TCP))
978                                 nf_log_packet(net, pf, 0, skb, NULL, NULL,
979                                               NULL, "nf_ct_tcp: invalid RST ");
980                         return -NF_ACCEPT;
981                 }
982                 if (index == TCP_RST_SET
983                     && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
984                          && ct->proto.tcp.last_index == TCP_SYN_SET)
985                         || (!test_bit(IPS_ASSURED_BIT, &ct->status)
986                             && ct->proto.tcp.last_index == TCP_ACK_SET))
987                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
988                         /* RST sent to invalid SYN or ACK we had let through
989                          * at a) and c) above:
990                          *
991                          * a) SYN was in window then
992                          * c) we hold a half-open connection.
993                          *
994                          * Delete our connection entry.
995                          * We skip window checking, because packet might ACK
996                          * segments we ignored. */
997                         goto in_window;
998                 }
999                 /* Just fall through */
1000         default:
1001                 /* Keep compilers happy. */
1002                 break;
1003         }
1004 
1005         if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
1006                            skb, dataoff, th, pf)) {
1007                 spin_unlock_bh(&ct->lock);
1008                 return -NF_ACCEPT;
1009         }
1010      in_window:
1011         /* From now on we have got in-window packets */
1012         ct->proto.tcp.last_index = index;
1013         ct->proto.tcp.last_dir = dir;
1014 
1015         pr_debug("tcp_conntracks: ");
1016         nf_ct_dump_tuple(tuple);
1017         pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
1018                  (th->syn ? 1 : 0), (th->ack ? 1 : 0),
1019                  (th->fin ? 1 : 0), (th->rst ? 1 : 0),
1020                  old_state, new_state);
1021 
1022         ct->proto.tcp.state = new_state;
1023         if (old_state != new_state
1024             && new_state == TCP_CONNTRACK_FIN_WAIT)
1025                 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
1026 
1027         if (ct->proto.tcp.retrans >= tn->tcp_max_retrans &&
1028             timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
1029                 timeout = timeouts[TCP_CONNTRACK_RETRANS];
1030         else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
1031                  IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
1032                  timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
1033                 timeout = timeouts[TCP_CONNTRACK_UNACK];
1034         else
1035                 timeout = timeouts[new_state];
1036         spin_unlock_bh(&ct->lock);
1037 
1038         if (new_state != old_state)
1039                 nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
1040 
1041         if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
1042                 /* If only reply is a RST, we can consider ourselves not to
1043                    have an established connection: this is a fairly common
1044                    problem case, so we can delete the conntrack
1045                    immediately.  --RR */
1046                 if (th->rst) {
1047                         nf_ct_kill_acct(ct, ctinfo, skb);
1048                         return NF_ACCEPT;
1049                 }
1050                 /* ESTABLISHED without SEEN_REPLY, i.e. mid-connection
1051                  * pickup with loose=1. Avoid large ESTABLISHED timeout.
1052                  */
1053                 if (new_state == TCP_CONNTRACK_ESTABLISHED &&
1054                     timeout > timeouts[TCP_CONNTRACK_UNACK])
1055                         timeout = timeouts[TCP_CONNTRACK_UNACK];
1056         } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
1057                    && (old_state == TCP_CONNTRACK_SYN_RECV
1058                        || old_state == TCP_CONNTRACK_ESTABLISHED)
1059                    && new_state == TCP_CONNTRACK_ESTABLISHED) {
1060                 /* Set ASSURED if we see see valid ack in ESTABLISHED
1061                    after SYN_RECV or a valid answer for a picked up
1062                    connection. */
1063                 set_bit(IPS_ASSURED_BIT, &ct->status);
1064                 nf_conntrack_event_cache(IPCT_ASSURED, ct);
1065         }
1066         nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
1067 
1068         return NF_ACCEPT;
1069 }
1070 
1071 /* Called when a new connection for this protocol found. */
1072 static bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
1073                     unsigned int dataoff, unsigned int *timeouts)
1074 {
1075         enum tcp_conntrack new_state;
1076         const struct tcphdr *th;
1077         struct tcphdr _tcph;
1078         struct net *net = nf_ct_net(ct);
1079         struct nf_tcp_net *tn = tcp_pernet(net);
1080         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
1081         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
1082 
1083         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1084         BUG_ON(th == NULL);
1085 
1086         /* Don't need lock here: this conntrack not in circulation yet */
1087         new_state = tcp_conntracks[0][get_conntrack_index(th)][TCP_CONNTRACK_NONE];
1088 
1089         /* Invalid: delete conntrack */
1090         if (new_state >= TCP_CONNTRACK_MAX) {
1091                 pr_debug("nf_ct_tcp: invalid new deleting.\n");
1092                 return false;
1093         }
1094 
1095         if (new_state == TCP_CONNTRACK_SYN_SENT) {
1096                 memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp));
1097                 /* SYN packet */
1098                 ct->proto.tcp.seen[0].td_end =
1099                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1100                                              dataoff, th);
1101                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1102                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1103                         ct->proto.tcp.seen[0].td_maxwin = 1;
1104                 ct->proto.tcp.seen[0].td_maxend =
1105                         ct->proto.tcp.seen[0].td_end;
1106 
1107                 tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
1108         } else if (tn->tcp_loose == 0) {
1109                 /* Don't try to pick up connections. */
1110                 return false;
1111         } else {
1112                 memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp));
1113                 /*
1114                  * We are in the middle of a connection,
1115                  * its history is lost for us.
1116                  * Let's try to use the data from the packet.
1117                  */
1118                 ct->proto.tcp.seen[0].td_end =
1119                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1120                                              dataoff, th);
1121                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1122                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1123                         ct->proto.tcp.seen[0].td_maxwin = 1;
1124                 ct->proto.tcp.seen[0].td_maxend =
1125                         ct->proto.tcp.seen[0].td_end +
1126                         ct->proto.tcp.seen[0].td_maxwin;
1127 
1128                 /* We assume SACK and liberal window checking to handle
1129                  * window scaling */
1130                 ct->proto.tcp.seen[0].flags =
1131                 ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1132                                               IP_CT_TCP_FLAG_BE_LIBERAL;
1133         }
1134 
1135         /* tcp_packet will set them */
1136         ct->proto.tcp.last_index = TCP_NONE_SET;
1137 
1138         pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1139                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1140                  sender->td_end, sender->td_maxend, sender->td_maxwin,
1141                  sender->td_scale,
1142                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1143                  receiver->td_scale);
1144         return true;
1145 }
1146 
1147 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
1148 
1149 #include <linux/netfilter/nfnetlink.h>
1150 #include <linux/netfilter/nfnetlink_conntrack.h>
1151 
1152 static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
1153                          struct nf_conn *ct)
1154 {
1155         struct nlattr *nest_parms;
1156         struct nf_ct_tcp_flags tmp = {};
1157 
1158         spin_lock_bh(&ct->lock);
1159         nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP | NLA_F_NESTED);
1160         if (!nest_parms)
1161                 goto nla_put_failure;
1162 
1163         if (nla_put_u8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state) ||
1164             nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
1165                        ct->proto.tcp.seen[0].td_scale) ||
1166             nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
1167                        ct->proto.tcp.seen[1].td_scale))
1168                 goto nla_put_failure;
1169 
1170         tmp.flags = ct->proto.tcp.seen[0].flags;
1171         if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
1172                     sizeof(struct nf_ct_tcp_flags), &tmp))
1173                 goto nla_put_failure;
1174 
1175         tmp.flags = ct->proto.tcp.seen[1].flags;
1176         if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
1177                     sizeof(struct nf_ct_tcp_flags), &tmp))
1178                 goto nla_put_failure;
1179         spin_unlock_bh(&ct->lock);
1180 
1181         nla_nest_end(skb, nest_parms);
1182 
1183         return 0;
1184 
1185 nla_put_failure:
1186         spin_unlock_bh(&ct->lock);
1187         return -1;
1188 }
1189 
1190 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
1191         [CTA_PROTOINFO_TCP_STATE]           = { .type = NLA_U8 },
1192         [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
1193         [CTA_PROTOINFO_TCP_WSCALE_REPLY]    = { .type = NLA_U8 },
1194         [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
1195         [CTA_PROTOINFO_TCP_FLAGS_REPLY]     = { .len =  sizeof(struct nf_ct_tcp_flags) },
1196 };
1197 
1198 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
1199 {
1200         struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
1201         struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
1202         int err;
1203 
1204         /* updates could not contain anything about the private
1205          * protocol info, in that case skip the parsing */
1206         if (!pattr)
1207                 return 0;
1208 
1209         err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
1210         if (err < 0)
1211                 return err;
1212 
1213         if (tb[CTA_PROTOINFO_TCP_STATE] &&
1214             nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
1215                 return -EINVAL;
1216 
1217         spin_lock_bh(&ct->lock);
1218         if (tb[CTA_PROTOINFO_TCP_STATE])
1219                 ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
1220 
1221         if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
1222                 struct nf_ct_tcp_flags *attr =
1223                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
1224                 ct->proto.tcp.seen[0].flags &= ~attr->mask;
1225                 ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
1226         }
1227 
1228         if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
1229                 struct nf_ct_tcp_flags *attr =
1230                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
1231                 ct->proto.tcp.seen[1].flags &= ~attr->mask;
1232                 ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
1233         }
1234 
1235         if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
1236             tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
1237             ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
1238             ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1239                 ct->proto.tcp.seen[0].td_scale =
1240                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
1241                 ct->proto.tcp.seen[1].td_scale =
1242                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
1243         }
1244         spin_unlock_bh(&ct->lock);
1245 
1246         return 0;
1247 }
1248 
1249 static int tcp_nlattr_size(void)
1250 {
1251         return nla_total_size(0)           /* CTA_PROTOINFO_TCP */
1252                 + nla_policy_len(tcp_nla_policy, CTA_PROTOINFO_TCP_MAX + 1);
1253 }
1254 
1255 static int tcp_nlattr_tuple_size(void)
1256 {
1257         return nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
1258 }
1259 #endif
1260 
1261 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
1262 
1263 #include <linux/netfilter/nfnetlink.h>
1264 #include <linux/netfilter/nfnetlink_cttimeout.h>
1265 
1266 static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[],
1267                                      struct net *net, void *data)
1268 {
1269         unsigned int *timeouts = data;
1270         struct nf_tcp_net *tn = tcp_pernet(net);
1271         int i;
1272 
1273         /* set default TCP timeouts. */
1274         for (i=0; i<TCP_CONNTRACK_TIMEOUT_MAX; i++)
1275                 timeouts[i] = tn->timeouts[i];
1276 
1277         if (tb[CTA_TIMEOUT_TCP_SYN_SENT]) {
1278                 timeouts[TCP_CONNTRACK_SYN_SENT] =
1279                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT]))*HZ;
1280         }
1281         if (tb[CTA_TIMEOUT_TCP_SYN_RECV]) {
1282                 timeouts[TCP_CONNTRACK_SYN_RECV] =
1283                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_RECV]))*HZ;
1284         }
1285         if (tb[CTA_TIMEOUT_TCP_ESTABLISHED]) {
1286                 timeouts[TCP_CONNTRACK_ESTABLISHED] =
1287                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_ESTABLISHED]))*HZ;
1288         }
1289         if (tb[CTA_TIMEOUT_TCP_FIN_WAIT]) {
1290                 timeouts[TCP_CONNTRACK_FIN_WAIT] =
1291                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_FIN_WAIT]))*HZ;
1292         }
1293         if (tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]) {
1294                 timeouts[TCP_CONNTRACK_CLOSE_WAIT] =
1295                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]))*HZ;
1296         }
1297         if (tb[CTA_TIMEOUT_TCP_LAST_ACK]) {
1298                 timeouts[TCP_CONNTRACK_LAST_ACK] =
1299                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_LAST_ACK]))*HZ;
1300         }
1301         if (tb[CTA_TIMEOUT_TCP_TIME_WAIT]) {
1302                 timeouts[TCP_CONNTRACK_TIME_WAIT] =
1303                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_TIME_WAIT]))*HZ;
1304         }
1305         if (tb[CTA_TIMEOUT_TCP_CLOSE]) {
1306                 timeouts[TCP_CONNTRACK_CLOSE] =
1307                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE]))*HZ;
1308         }
1309         if (tb[CTA_TIMEOUT_TCP_SYN_SENT2]) {
1310                 timeouts[TCP_CONNTRACK_SYN_SENT2] =
1311                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT2]))*HZ;
1312         }
1313         if (tb[CTA_TIMEOUT_TCP_RETRANS]) {
1314                 timeouts[TCP_CONNTRACK_RETRANS] =
1315                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_RETRANS]))*HZ;
1316         }
1317         if (tb[CTA_TIMEOUT_TCP_UNACK]) {
1318                 timeouts[TCP_CONNTRACK_UNACK] =
1319                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_UNACK]))*HZ;
1320         }
1321         return 0;
1322 }
1323 
1324 static int
1325 tcp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
1326 {
1327         const unsigned int *timeouts = data;
1328 
1329         if (nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT,
1330                         htonl(timeouts[TCP_CONNTRACK_SYN_SENT] / HZ)) ||
1331             nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_RECV,
1332                          htonl(timeouts[TCP_CONNTRACK_SYN_RECV] / HZ)) ||
1333             nla_put_be32(skb, CTA_TIMEOUT_TCP_ESTABLISHED,
1334                          htonl(timeouts[TCP_CONNTRACK_ESTABLISHED] / HZ)) ||
1335             nla_put_be32(skb, CTA_TIMEOUT_TCP_FIN_WAIT,
1336                          htonl(timeouts[TCP_CONNTRACK_FIN_WAIT] / HZ)) ||
1337             nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE_WAIT,
1338                          htonl(timeouts[TCP_CONNTRACK_CLOSE_WAIT] / HZ)) ||
1339             nla_put_be32(skb, CTA_TIMEOUT_TCP_LAST_ACK,
1340                          htonl(timeouts[TCP_CONNTRACK_LAST_ACK] / HZ)) ||
1341             nla_put_be32(skb, CTA_TIMEOUT_TCP_TIME_WAIT,
1342                          htonl(timeouts[TCP_CONNTRACK_TIME_WAIT] / HZ)) ||
1343             nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE,
1344                          htonl(timeouts[TCP_CONNTRACK_CLOSE] / HZ)) ||
1345             nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT2,
1346                          htonl(timeouts[TCP_CONNTRACK_SYN_SENT2] / HZ)) ||
1347             nla_put_be32(skb, CTA_TIMEOUT_TCP_RETRANS,
1348                          htonl(timeouts[TCP_CONNTRACK_RETRANS] / HZ)) ||
1349             nla_put_be32(skb, CTA_TIMEOUT_TCP_UNACK,
1350                          htonl(timeouts[TCP_CONNTRACK_UNACK] / HZ)))
1351                 goto nla_put_failure;
1352         return 0;
1353 
1354 nla_put_failure:
1355         return -ENOSPC;
1356 }
1357 
1358 static const struct nla_policy tcp_timeout_nla_policy[CTA_TIMEOUT_TCP_MAX+1] = {
1359         [CTA_TIMEOUT_TCP_SYN_SENT]      = { .type = NLA_U32 },
1360         [CTA_TIMEOUT_TCP_SYN_RECV]      = { .type = NLA_U32 },
1361         [CTA_TIMEOUT_TCP_ESTABLISHED]   = { .type = NLA_U32 },
1362         [CTA_TIMEOUT_TCP_FIN_WAIT]      = { .type = NLA_U32 },
1363         [CTA_TIMEOUT_TCP_CLOSE_WAIT]    = { .type = NLA_U32 },
1364         [CTA_TIMEOUT_TCP_LAST_ACK]      = { .type = NLA_U32 },
1365         [CTA_TIMEOUT_TCP_TIME_WAIT]     = { .type = NLA_U32 },
1366         [CTA_TIMEOUT_TCP_CLOSE]         = { .type = NLA_U32 },
1367         [CTA_TIMEOUT_TCP_SYN_SENT2]     = { .type = NLA_U32 },
1368         [CTA_TIMEOUT_TCP_RETRANS]       = { .type = NLA_U32 },
1369         [CTA_TIMEOUT_TCP_UNACK]         = { .type = NLA_U32 },
1370 };
1371 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
1372 
1373 #ifdef CONFIG_SYSCTL
1374 static struct ctl_table tcp_sysctl_table[] = {
1375         {
1376                 .procname       = "nf_conntrack_tcp_timeout_syn_sent",
1377                 .maxlen         = sizeof(unsigned int),
1378                 .mode           = 0644,
1379                 .proc_handler   = proc_dointvec_jiffies,
1380         },
1381         {
1382                 .procname       = "nf_conntrack_tcp_timeout_syn_recv",
1383                 .maxlen         = sizeof(unsigned int),
1384                 .mode           = 0644,
1385                 .proc_handler   = proc_dointvec_jiffies,
1386         },
1387         {
1388                 .procname       = "nf_conntrack_tcp_timeout_established",
1389                 .maxlen         = sizeof(unsigned int),
1390                 .mode           = 0644,
1391                 .proc_handler   = proc_dointvec_jiffies,
1392         },
1393         {
1394                 .procname       = "nf_conntrack_tcp_timeout_fin_wait",
1395                 .maxlen         = sizeof(unsigned int),
1396                 .mode           = 0644,
1397                 .proc_handler   = proc_dointvec_jiffies,
1398         },
1399         {
1400                 .procname       = "nf_conntrack_tcp_timeout_close_wait",
1401                 .maxlen         = sizeof(unsigned int),
1402                 .mode           = 0644,
1403                 .proc_handler   = proc_dointvec_jiffies,
1404         },
1405         {
1406                 .procname       = "nf_conntrack_tcp_timeout_last_ack",
1407                 .maxlen         = sizeof(unsigned int),
1408                 .mode           = 0644,
1409                 .proc_handler   = proc_dointvec_jiffies,
1410         },
1411         {
1412                 .procname       = "nf_conntrack_tcp_timeout_time_wait",
1413                 .maxlen         = sizeof(unsigned int),
1414                 .mode           = 0644,
1415                 .proc_handler   = proc_dointvec_jiffies,
1416         },
1417         {
1418                 .procname       = "nf_conntrack_tcp_timeout_close",
1419                 .maxlen         = sizeof(unsigned int),
1420                 .mode           = 0644,
1421                 .proc_handler   = proc_dointvec_jiffies,
1422         },
1423         {
1424                 .procname       = "nf_conntrack_tcp_timeout_max_retrans",
1425                 .maxlen         = sizeof(unsigned int),
1426                 .mode           = 0644,
1427                 .proc_handler   = proc_dointvec_jiffies,
1428         },
1429         {
1430                 .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
1431                 .maxlen         = sizeof(unsigned int),
1432                 .mode           = 0644,
1433                 .proc_handler   = proc_dointvec_jiffies,
1434         },
1435         {
1436                 .procname       = "nf_conntrack_tcp_loose",
1437                 .maxlen         = sizeof(unsigned int),
1438                 .mode           = 0644,
1439                 .proc_handler   = proc_dointvec,
1440         },
1441         {
1442                 .procname       = "nf_conntrack_tcp_be_liberal",
1443                 .maxlen         = sizeof(unsigned int),
1444                 .mode           = 0644,
1445                 .proc_handler   = proc_dointvec,
1446         },
1447         {
1448                 .procname       = "nf_conntrack_tcp_max_retrans",
1449                 .maxlen         = sizeof(unsigned int),
1450                 .mode           = 0644,
1451                 .proc_handler   = proc_dointvec,
1452         },
1453         { }
1454 };
1455 
1456 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1457 static struct ctl_table tcp_compat_sysctl_table[] = {
1458         {
1459                 .procname       = "ip_conntrack_tcp_timeout_syn_sent",
1460                 .maxlen         = sizeof(unsigned int),
1461                 .mode           = 0644,
1462                 .proc_handler   = proc_dointvec_jiffies,
1463         },
1464         {
1465                 .procname       = "ip_conntrack_tcp_timeout_syn_sent2",
1466                 .maxlen         = sizeof(unsigned int),
1467                 .mode           = 0644,
1468                 .proc_handler   = proc_dointvec_jiffies,
1469         },
1470         {
1471                 .procname       = "ip_conntrack_tcp_timeout_syn_recv",
1472                 .maxlen         = sizeof(unsigned int),
1473                 .mode           = 0644,
1474                 .proc_handler   = proc_dointvec_jiffies,
1475         },
1476         {
1477                 .procname       = "ip_conntrack_tcp_timeout_established",
1478                 .maxlen         = sizeof(unsigned int),
1479                 .mode           = 0644,
1480                 .proc_handler   = proc_dointvec_jiffies,
1481         },
1482         {
1483                 .procname       = "ip_conntrack_tcp_timeout_fin_wait",
1484                 .maxlen         = sizeof(unsigned int),
1485                 .mode           = 0644,
1486                 .proc_handler   = proc_dointvec_jiffies,
1487         },
1488         {
1489                 .procname       = "ip_conntrack_tcp_timeout_close_wait",
1490                 .maxlen         = sizeof(unsigned int),
1491                 .mode           = 0644,
1492                 .proc_handler   = proc_dointvec_jiffies,
1493         },
1494         {
1495                 .procname       = "ip_conntrack_tcp_timeout_last_ack",
1496                 .maxlen         = sizeof(unsigned int),
1497                 .mode           = 0644,
1498                 .proc_handler   = proc_dointvec_jiffies,
1499         },
1500         {
1501                 .procname       = "ip_conntrack_tcp_timeout_time_wait",
1502                 .maxlen         = sizeof(unsigned int),
1503                 .mode           = 0644,
1504                 .proc_handler   = proc_dointvec_jiffies,
1505         },
1506         {
1507                 .procname       = "ip_conntrack_tcp_timeout_close",
1508                 .maxlen         = sizeof(unsigned int),
1509                 .mode           = 0644,
1510                 .proc_handler   = proc_dointvec_jiffies,
1511         },
1512         {
1513                 .procname       = "ip_conntrack_tcp_timeout_max_retrans",
1514                 .maxlen         = sizeof(unsigned int),
1515                 .mode           = 0644,
1516                 .proc_handler   = proc_dointvec_jiffies,
1517         },
1518         {
1519                 .procname       = "ip_conntrack_tcp_loose",
1520                 .maxlen         = sizeof(unsigned int),
1521                 .mode           = 0644,
1522                 .proc_handler   = proc_dointvec,
1523         },
1524         {
1525                 .procname       = "ip_conntrack_tcp_be_liberal",
1526                 .maxlen         = sizeof(unsigned int),
1527                 .mode           = 0644,
1528                 .proc_handler   = proc_dointvec,
1529         },
1530         {
1531                 .procname       = "ip_conntrack_tcp_max_retrans",
1532                 .maxlen         = sizeof(unsigned int),
1533                 .mode           = 0644,
1534                 .proc_handler   = proc_dointvec,
1535         },
1536         { }
1537 };
1538 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
1539 #endif /* CONFIG_SYSCTL */
1540 
1541 static int tcp_kmemdup_sysctl_table(struct nf_proto_net *pn,
1542                                     struct nf_tcp_net *tn)
1543 {
1544 #ifdef CONFIG_SYSCTL
1545         if (pn->ctl_table)
1546                 return 0;
1547 
1548         pn->ctl_table = kmemdup(tcp_sysctl_table,
1549                                 sizeof(tcp_sysctl_table),
1550                                 GFP_KERNEL);
1551         if (!pn->ctl_table)
1552                 return -ENOMEM;
1553 
1554         pn->ctl_table[0].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT];
1555         pn->ctl_table[1].data = &tn->timeouts[TCP_CONNTRACK_SYN_RECV];
1556         pn->ctl_table[2].data = &tn->timeouts[TCP_CONNTRACK_ESTABLISHED];
1557         pn->ctl_table[3].data = &tn->timeouts[TCP_CONNTRACK_FIN_WAIT];
1558         pn->ctl_table[4].data = &tn->timeouts[TCP_CONNTRACK_CLOSE_WAIT];
1559         pn->ctl_table[5].data = &tn->timeouts[TCP_CONNTRACK_LAST_ACK];
1560         pn->ctl_table[6].data = &tn->timeouts[TCP_CONNTRACK_TIME_WAIT];
1561         pn->ctl_table[7].data = &tn->timeouts[TCP_CONNTRACK_CLOSE];
1562         pn->ctl_table[8].data = &tn->timeouts[TCP_CONNTRACK_RETRANS];
1563         pn->ctl_table[9].data = &tn->timeouts[TCP_CONNTRACK_UNACK];
1564         pn->ctl_table[10].data = &tn->tcp_loose;
1565         pn->ctl_table[11].data = &tn->tcp_be_liberal;
1566         pn->ctl_table[12].data = &tn->tcp_max_retrans;
1567 #endif
1568         return 0;
1569 }
1570 
1571 static int tcp_kmemdup_compat_sysctl_table(struct nf_proto_net *pn,
1572                                            struct nf_tcp_net *tn)
1573 {
1574 #ifdef CONFIG_SYSCTL
1575 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1576         pn->ctl_compat_table = kmemdup(tcp_compat_sysctl_table,
1577                                        sizeof(tcp_compat_sysctl_table),
1578                                        GFP_KERNEL);
1579         if (!pn->ctl_compat_table)
1580                 return -ENOMEM;
1581 
1582         pn->ctl_compat_table[0].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT];
1583         pn->ctl_compat_table[1].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT2];
1584         pn->ctl_compat_table[2].data = &tn->timeouts[TCP_CONNTRACK_SYN_RECV];
1585         pn->ctl_compat_table[3].data = &tn->timeouts[TCP_CONNTRACK_ESTABLISHED];
1586         pn->ctl_compat_table[4].data = &tn->timeouts[TCP_CONNTRACK_FIN_WAIT];
1587         pn->ctl_compat_table[5].data = &tn->timeouts[TCP_CONNTRACK_CLOSE_WAIT];
1588         pn->ctl_compat_table[6].data = &tn->timeouts[TCP_CONNTRACK_LAST_ACK];
1589         pn->ctl_compat_table[7].data = &tn->timeouts[TCP_CONNTRACK_TIME_WAIT];
1590         pn->ctl_compat_table[8].data = &tn->timeouts[TCP_CONNTRACK_CLOSE];
1591         pn->ctl_compat_table[9].data = &tn->timeouts[TCP_CONNTRACK_RETRANS];
1592         pn->ctl_compat_table[10].data = &tn->tcp_loose;
1593         pn->ctl_compat_table[11].data = &tn->tcp_be_liberal;
1594         pn->ctl_compat_table[12].data = &tn->tcp_max_retrans;
1595 #endif
1596 #endif
1597         return 0;
1598 }
1599 
1600 static int tcp_init_net(struct net *net, u_int16_t proto)
1601 {
1602         int ret;
1603         struct nf_tcp_net *tn = tcp_pernet(net);
1604         struct nf_proto_net *pn = &tn->pn;
1605 
1606         if (!pn->users) {
1607                 int i;
1608 
1609                 for (i = 0; i < TCP_CONNTRACK_TIMEOUT_MAX; i++)
1610                         tn->timeouts[i] = tcp_timeouts[i];
1611 
1612                 tn->tcp_loose = nf_ct_tcp_loose;
1613                 tn->tcp_be_liberal = nf_ct_tcp_be_liberal;
1614                 tn->tcp_max_retrans = nf_ct_tcp_max_retrans;
1615         }
1616 
1617         if (proto == AF_INET) {
1618                 ret = tcp_kmemdup_compat_sysctl_table(pn, tn);
1619                 if (ret < 0)
1620                         return ret;
1621 
1622                 ret = tcp_kmemdup_sysctl_table(pn, tn);
1623                 if (ret < 0)
1624                         nf_ct_kfree_compat_sysctl_table(pn);
1625         } else
1626                 ret = tcp_kmemdup_sysctl_table(pn, tn);
1627 
1628         return ret;
1629 }
1630 
1631 static struct nf_proto_net *tcp_get_net_proto(struct net *net)
1632 {
1633         return &net->ct.nf_ct_proto.tcp.pn;
1634 }
1635 
1636 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
1637 {
1638         .l3proto                = PF_INET,
1639         .l4proto                = IPPROTO_TCP,
1640         .name                   = "tcp",
1641         .pkt_to_tuple           = tcp_pkt_to_tuple,
1642         .invert_tuple           = tcp_invert_tuple,
1643         .print_tuple            = tcp_print_tuple,
1644         .print_conntrack        = tcp_print_conntrack,
1645         .packet                 = tcp_packet,
1646         .get_timeouts           = tcp_get_timeouts,
1647         .new                    = tcp_new,
1648         .error                  = tcp_error,
1649 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
1650         .to_nlattr              = tcp_to_nlattr,
1651         .nlattr_size            = tcp_nlattr_size,
1652         .from_nlattr            = nlattr_to_tcp,
1653         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1654         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1655         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1656         .nla_policy             = nf_ct_port_nla_policy,
1657 #endif
1658 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
1659         .ctnl_timeout           = {
1660                 .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
1661                 .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
1662                 .nlattr_max     = CTA_TIMEOUT_TCP_MAX,
1663                 .obj_size       = sizeof(unsigned int) *
1664                                         TCP_CONNTRACK_TIMEOUT_MAX,
1665                 .nla_policy     = tcp_timeout_nla_policy,
1666         },
1667 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
1668         .init_net               = tcp_init_net,
1669         .get_net_proto          = tcp_get_net_proto,
1670 };
1671 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
1672 
1673 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
1674 {
1675         .l3proto                = PF_INET6,
1676         .l4proto                = IPPROTO_TCP,
1677         .name                   = "tcp",
1678         .pkt_to_tuple           = tcp_pkt_to_tuple,
1679         .invert_tuple           = tcp_invert_tuple,
1680         .print_tuple            = tcp_print_tuple,
1681         .print_conntrack        = tcp_print_conntrack,
1682         .packet                 = tcp_packet,
1683         .get_timeouts           = tcp_get_timeouts,
1684         .new                    = tcp_new,
1685         .error                  = tcp_error,
1686 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
1687         .to_nlattr              = tcp_to_nlattr,
1688         .nlattr_size            = tcp_nlattr_size,
1689         .from_nlattr            = nlattr_to_tcp,
1690         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1691         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1692         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1693         .nla_policy             = nf_ct_port_nla_policy,
1694 #endif
1695 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
1696         .ctnl_timeout           = {
1697                 .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
1698                 .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
1699                 .nlattr_max     = CTA_TIMEOUT_TCP_MAX,
1700                 .obj_size       = sizeof(unsigned int) *
1701                                         TCP_CONNTRACK_TIMEOUT_MAX,
1702                 .nla_policy     = tcp_timeout_nla_policy,
1703         },
1704 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
1705         .init_net               = tcp_init_net,
1706         .get_net_proto          = tcp_get_net_proto,
1707 };
1708 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);
1709 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp