~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_conntrack_proto_tcp.c

Version: ~ [ linux-5.8 ] ~ [ linux-5.7.12 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.55 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.136 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.191 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.232 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.232 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* (C) 1999-2001 Paul `Rusty' Russell
  2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  3  * (C) 2002-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  4  * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
  5  *
  6  * This program is free software; you can redistribute it and/or modify
  7  * it under the terms of the GNU General Public License version 2 as
  8  * published by the Free Software Foundation.
  9  */
 10 
 11 #include <linux/types.h>
 12 #include <linux/timer.h>
 13 #include <linux/module.h>
 14 #include <linux/in.h>
 15 #include <linux/tcp.h>
 16 #include <linux/spinlock.h>
 17 #include <linux/skbuff.h>
 18 #include <linux/ipv6.h>
 19 #include <net/ip6_checksum.h>
 20 #include <asm/unaligned.h>
 21 
 22 #include <net/tcp.h>
 23 
 24 #include <linux/netfilter.h>
 25 #include <linux/netfilter_ipv4.h>
 26 #include <linux/netfilter_ipv6.h>
 27 #include <net/netfilter/nf_conntrack.h>
 28 #include <net/netfilter/nf_conntrack_l4proto.h>
 29 #include <net/netfilter/nf_conntrack_ecache.h>
 30 #include <net/netfilter/nf_conntrack_seqadj.h>
 31 #include <net/netfilter/nf_conntrack_synproxy.h>
 32 #include <net/netfilter/nf_log.h>
 33 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 34 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 35 
 36 /* "Be conservative in what you do,
 37     be liberal in what you accept from others."
 38     If it's non-zero, we mark only out of window RST segments as INVALID. */
 39 static int nf_ct_tcp_be_liberal __read_mostly = 0;
 40 
 41 /* If it is set to zero, we disable picking up already established
 42    connections. */
 43 static int nf_ct_tcp_loose __read_mostly = 1;
 44 
 45 /* Max number of the retransmitted packets without receiving an (acceptable)
 46    ACK from the destination. If this number is reached, a shorter timer
 47    will be started. */
 48 static int nf_ct_tcp_max_retrans __read_mostly = 3;
 49 
 50   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
 51      closely.  They're more complex. --RR */
 52 
 53 static const char *const tcp_conntrack_names[] = {
 54         "NONE",
 55         "SYN_SENT",
 56         "SYN_RECV",
 57         "ESTABLISHED",
 58         "FIN_WAIT",
 59         "CLOSE_WAIT",
 60         "LAST_ACK",
 61         "TIME_WAIT",
 62         "CLOSE",
 63         "SYN_SENT2",
 64 };
 65 
 66 #define SECS * HZ
 67 #define MINS * 60 SECS
 68 #define HOURS * 60 MINS
 69 #define DAYS * 24 HOURS
 70 
 71 static unsigned int tcp_timeouts[TCP_CONNTRACK_TIMEOUT_MAX] __read_mostly = {
 72         [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
 73         [TCP_CONNTRACK_SYN_RECV]        = 60 SECS,
 74         [TCP_CONNTRACK_ESTABLISHED]     = 5 DAYS,
 75         [TCP_CONNTRACK_FIN_WAIT]        = 2 MINS,
 76         [TCP_CONNTRACK_CLOSE_WAIT]      = 60 SECS,
 77         [TCP_CONNTRACK_LAST_ACK]        = 30 SECS,
 78         [TCP_CONNTRACK_TIME_WAIT]       = 2 MINS,
 79         [TCP_CONNTRACK_CLOSE]           = 10 SECS,
 80         [TCP_CONNTRACK_SYN_SENT2]       = 2 MINS,
 81 /* RFC1122 says the R2 limit should be at least 100 seconds.
 82    Linux uses 15 packets as limit, which corresponds
 83    to ~13-30min depending on RTO. */
 84         [TCP_CONNTRACK_RETRANS]         = 5 MINS,
 85         [TCP_CONNTRACK_UNACK]           = 5 MINS,
 86 };
 87 
 88 #define sNO TCP_CONNTRACK_NONE
 89 #define sSS TCP_CONNTRACK_SYN_SENT
 90 #define sSR TCP_CONNTRACK_SYN_RECV
 91 #define sES TCP_CONNTRACK_ESTABLISHED
 92 #define sFW TCP_CONNTRACK_FIN_WAIT
 93 #define sCW TCP_CONNTRACK_CLOSE_WAIT
 94 #define sLA TCP_CONNTRACK_LAST_ACK
 95 #define sTW TCP_CONNTRACK_TIME_WAIT
 96 #define sCL TCP_CONNTRACK_CLOSE
 97 #define sS2 TCP_CONNTRACK_SYN_SENT2
 98 #define sIV TCP_CONNTRACK_MAX
 99 #define sIG TCP_CONNTRACK_IGNORE
100 
101 /* What TCP flags are set from RST/SYN/FIN/ACK. */
102 enum tcp_bit_set {
103         TCP_SYN_SET,
104         TCP_SYNACK_SET,
105         TCP_FIN_SET,
106         TCP_ACK_SET,
107         TCP_RST_SET,
108         TCP_NONE_SET,
109 };
110 
111 /*
112  * The TCP state transition table needs a few words...
113  *
114  * We are the man in the middle. All the packets go through us
115  * but might get lost in transit to the destination.
116  * It is assumed that the destinations can't receive segments
117  * we haven't seen.
118  *
119  * The checked segment is in window, but our windows are *not*
120  * equivalent with the ones of the sender/receiver. We always
121  * try to guess the state of the current sender.
122  *
123  * The meaning of the states are:
124  *
125  * NONE:        initial state
126  * SYN_SENT:    SYN-only packet seen
127  * SYN_SENT2:   SYN-only packet seen from reply dir, simultaneous open
128  * SYN_RECV:    SYN-ACK packet seen
129  * ESTABLISHED: ACK packet seen
130  * FIN_WAIT:    FIN packet seen
131  * CLOSE_WAIT:  ACK seen (after FIN)
132  * LAST_ACK:    FIN seen (after FIN)
133  * TIME_WAIT:   last ACK seen
134  * CLOSE:       closed connection (RST)
135  *
136  * Packets marked as IGNORED (sIG):
137  *      if they may be either invalid or valid
138  *      and the receiver may send back a connection
139  *      closing RST or a SYN/ACK.
140  *
141  * Packets marked as INVALID (sIV):
142  *      if we regard them as truly invalid packets
143  */
144 static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
145         {
146 /* ORIGINAL */
147 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
148 /*syn*/    { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sS2 },
149 /*
150  *      sNO -> sSS      Initialize a new connection
151  *      sSS -> sSS      Retransmitted SYN
152  *      sS2 -> sS2      Late retransmitted SYN
153  *      sSR -> sIG
154  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
155  *                      are errors. Receiver will reply with RST
156  *                      and close the connection.
157  *                      Or we are not in sync and hold a dead connection.
158  *      sFW -> sIG
159  *      sCW -> sIG
160  *      sLA -> sIG
161  *      sTW -> sSS      Reopened connection (RFC 1122).
162  *      sCL -> sSS
163  */
164 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
165 /*synack*/ { sIV, sIV, sSR, sIV, sIV, sIV, sIV, sIV, sIV, sSR },
166 /*
167  *      sNO -> sIV      Too late and no reason to do anything
168  *      sSS -> sIV      Client can't send SYN and then SYN/ACK
169  *      sS2 -> sSR      SYN/ACK sent to SYN2 in simultaneous open
170  *      sSR -> sSR      Late retransmitted SYN/ACK in simultaneous open
171  *      sES -> sIV      Invalid SYN/ACK packets sent by the client
172  *      sFW -> sIV
173  *      sCW -> sIV
174  *      sLA -> sIV
175  *      sTW -> sIV
176  *      sCL -> sIV
177  */
178 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
179 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
180 /*
181  *      sNO -> sIV      Too late and no reason to do anything...
182  *      sSS -> sIV      Client migth not send FIN in this state:
183  *                      we enforce waiting for a SYN/ACK reply first.
184  *      sS2 -> sIV
185  *      sSR -> sFW      Close started.
186  *      sES -> sFW
187  *      sFW -> sLA      FIN seen in both directions, waiting for
188  *                      the last ACK.
189  *                      Migth be a retransmitted FIN as well...
190  *      sCW -> sLA
191  *      sLA -> sLA      Retransmitted FIN. Remain in the same state.
192  *      sTW -> sTW
193  *      sCL -> sCL
194  */
195 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
196 /*ack*/    { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
197 /*
198  *      sNO -> sES      Assumed.
199  *      sSS -> sIV      ACK is invalid: we haven't seen a SYN/ACK yet.
200  *      sS2 -> sIV
201  *      sSR -> sES      Established state is reached.
202  *      sES -> sES      :-)
203  *      sFW -> sCW      Normal close request answered by ACK.
204  *      sCW -> sCW
205  *      sLA -> sTW      Last ACK detected.
206  *      sTW -> sTW      Retransmitted last ACK. Remain in the same state.
207  *      sCL -> sCL
208  */
209 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
210 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
211 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
212         },
213         {
214 /* REPLY */
215 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
216 /*syn*/    { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sSS, sIV, sS2 },
217 /*
218  *      sNO -> sIV      Never reached.
219  *      sSS -> sS2      Simultaneous open
220  *      sS2 -> sS2      Retransmitted simultaneous SYN
221  *      sSR -> sIV      Invalid SYN packets sent by the server
222  *      sES -> sIV
223  *      sFW -> sIV
224  *      sCW -> sIV
225  *      sLA -> sIV
226  *      sTW -> sSS      Reopened connection, but server may have switched role
227  *      sCL -> sIV
228  */
229 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
230 /*synack*/ { sIV, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
231 /*
232  *      sSS -> sSR      Standard open.
233  *      sS2 -> sSR      Simultaneous open
234  *      sSR -> sIG      Retransmitted SYN/ACK, ignore it.
235  *      sES -> sIG      Late retransmitted SYN/ACK?
236  *      sFW -> sIG      Might be SYN/ACK answering ignored SYN
237  *      sCW -> sIG
238  *      sLA -> sIG
239  *      sTW -> sIG
240  *      sCL -> sIG
241  */
242 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
243 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
244 /*
245  *      sSS -> sIV      Server might not send FIN in this state.
246  *      sS2 -> sIV
247  *      sSR -> sFW      Close started.
248  *      sES -> sFW
249  *      sFW -> sLA      FIN seen in both directions.
250  *      sCW -> sLA
251  *      sLA -> sLA      Retransmitted FIN.
252  *      sTW -> sTW
253  *      sCL -> sCL
254  */
255 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
256 /*ack*/    { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIG },
257 /*
258  *      sSS -> sIG      Might be a half-open connection.
259  *      sS2 -> sIG
260  *      sSR -> sSR      Might answer late resent SYN.
261  *      sES -> sES      :-)
262  *      sFW -> sCW      Normal close request answered by ACK.
263  *      sCW -> sCW
264  *      sLA -> sTW      Last ACK detected.
265  *      sTW -> sTW      Retransmitted last ACK.
266  *      sCL -> sCL
267  */
268 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
269 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
270 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
271         }
272 };
273 
274 static inline struct nf_tcp_net *tcp_pernet(struct net *net)
275 {
276         return &net->ct.nf_ct_proto.tcp;
277 }
278 
279 static bool tcp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
280                              struct nf_conntrack_tuple *tuple)
281 {
282         const struct tcphdr *hp;
283         struct tcphdr _hdr;
284 
285         /* Actually only need first 8 bytes. */
286         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
287         if (hp == NULL)
288                 return false;
289 
290         tuple->src.u.tcp.port = hp->source;
291         tuple->dst.u.tcp.port = hp->dest;
292 
293         return true;
294 }
295 
296 static bool tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
297                              const struct nf_conntrack_tuple *orig)
298 {
299         tuple->src.u.tcp.port = orig->dst.u.tcp.port;
300         tuple->dst.u.tcp.port = orig->src.u.tcp.port;
301         return true;
302 }
303 
304 /* Print out the per-protocol part of the tuple. */
305 static int tcp_print_tuple(struct seq_file *s,
306                            const struct nf_conntrack_tuple *tuple)
307 {
308         return seq_printf(s, "sport=%hu dport=%hu ",
309                           ntohs(tuple->src.u.tcp.port),
310                           ntohs(tuple->dst.u.tcp.port));
311 }
312 
313 /* Print out the private part of the conntrack. */
314 static int tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
315 {
316         enum tcp_conntrack state;
317 
318         spin_lock_bh(&ct->lock);
319         state = ct->proto.tcp.state;
320         spin_unlock_bh(&ct->lock);
321 
322         return seq_printf(s, "%s ", tcp_conntrack_names[state]);
323 }
324 
325 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
326 {
327         if (tcph->rst) return TCP_RST_SET;
328         else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
329         else if (tcph->fin) return TCP_FIN_SET;
330         else if (tcph->ack) return TCP_ACK_SET;
331         else return TCP_NONE_SET;
332 }
333 
334 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
335    in IP Filter' by Guido van Rooij.
336 
337    http://www.sane.nl/events/sane2000/papers.html
338    http://www.darkart.com/mirrors/www.obfuscation.org/ipf/
339 
340    The boundaries and the conditions are changed according to RFC793:
341    the packet must intersect the window (i.e. segments may be
342    after the right or before the left edge) and thus receivers may ACK
343    segments after the right edge of the window.
344 
345         td_maxend = max(sack + max(win,1)) seen in reply packets
346         td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
347         td_maxwin += seq + len - sender.td_maxend
348                         if seq + len > sender.td_maxend
349         td_end    = max(seq + len) seen in sent packets
350 
351    I.   Upper bound for valid data:     seq <= sender.td_maxend
352    II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
353    III. Upper bound for valid (s)ack:   sack <= receiver.td_end
354    IV.  Lower bound for valid (s)ack:   sack >= receiver.td_end - MAXACKWINDOW
355 
356    where sack is the highest right edge of sack block found in the packet
357    or ack in the case of packet without SACK option.
358 
359    The upper bound limit for a valid (s)ack is not ignored -
360    we doesn't have to deal with fragments.
361 */
362 
363 static inline __u32 segment_seq_plus_len(__u32 seq,
364                                          size_t len,
365                                          unsigned int dataoff,
366                                          const struct tcphdr *tcph)
367 {
368         /* XXX Should I use payload length field in IP/IPv6 header ?
369          * - YK */
370         return (seq + len - dataoff - tcph->doff*4
371                 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
372 }
373 
374 /* Fixme: what about big packets? */
375 #define MAXACKWINCONST                  66000
376 #define MAXACKWINDOW(sender)                                            \
377         ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin     \
378                                               : MAXACKWINCONST)
379 
380 /*
381  * Simplified tcp_parse_options routine from tcp_input.c
382  */
383 static void tcp_options(const struct sk_buff *skb,
384                         unsigned int dataoff,
385                         const struct tcphdr *tcph,
386                         struct ip_ct_tcp_state *state)
387 {
388         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
389         const unsigned char *ptr;
390         int length = (tcph->doff*4) - sizeof(struct tcphdr);
391 
392         if (!length)
393                 return;
394 
395         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
396                                  length, buff);
397         BUG_ON(ptr == NULL);
398 
399         state->td_scale =
400         state->flags = 0;
401 
402         while (length > 0) {
403                 int opcode=*ptr++;
404                 int opsize;
405 
406                 switch (opcode) {
407                 case TCPOPT_EOL:
408                         return;
409                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
410                         length--;
411                         continue;
412                 default:
413                         opsize=*ptr++;
414                         if (opsize < 2) /* "silly options" */
415                                 return;
416                         if (opsize > length)
417                                 return; /* don't parse partial options */
418 
419                         if (opcode == TCPOPT_SACK_PERM
420                             && opsize == TCPOLEN_SACK_PERM)
421                                 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
422                         else if (opcode == TCPOPT_WINDOW
423                                  && opsize == TCPOLEN_WINDOW) {
424                                 state->td_scale = *(u_int8_t *)ptr;
425 
426                                 if (state->td_scale > 14) {
427                                         /* See RFC1323 */
428                                         state->td_scale = 14;
429                                 }
430                                 state->flags |=
431                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
432                         }
433                         ptr += opsize - 2;
434                         length -= opsize;
435                 }
436         }
437 }
438 
439 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
440                      const struct tcphdr *tcph, __u32 *sack)
441 {
442         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
443         const unsigned char *ptr;
444         int length = (tcph->doff*4) - sizeof(struct tcphdr);
445         __u32 tmp;
446 
447         if (!length)
448                 return;
449 
450         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
451                                  length, buff);
452         BUG_ON(ptr == NULL);
453 
454         /* Fast path for timestamp-only option */
455         if (length == TCPOLEN_TSTAMP_ALIGNED
456             && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
457                                        | (TCPOPT_NOP << 16)
458                                        | (TCPOPT_TIMESTAMP << 8)
459                                        | TCPOLEN_TIMESTAMP))
460                 return;
461 
462         while (length > 0) {
463                 int opcode = *ptr++;
464                 int opsize, i;
465 
466                 switch (opcode) {
467                 case TCPOPT_EOL:
468                         return;
469                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
470                         length--;
471                         continue;
472                 default:
473                         opsize = *ptr++;
474                         if (opsize < 2) /* "silly options" */
475                                 return;
476                         if (opsize > length)
477                                 return; /* don't parse partial options */
478 
479                         if (opcode == TCPOPT_SACK
480                             && opsize >= (TCPOLEN_SACK_BASE
481                                           + TCPOLEN_SACK_PERBLOCK)
482                             && !((opsize - TCPOLEN_SACK_BASE)
483                                  % TCPOLEN_SACK_PERBLOCK)) {
484                                 for (i = 0;
485                                      i < (opsize - TCPOLEN_SACK_BASE);
486                                      i += TCPOLEN_SACK_PERBLOCK) {
487                                         tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
488 
489                                         if (after(tmp, *sack))
490                                                 *sack = tmp;
491                                 }
492                                 return;
493                         }
494                         ptr += opsize - 2;
495                         length -= opsize;
496                 }
497         }
498 }
499 
500 static bool tcp_in_window(const struct nf_conn *ct,
501                           struct ip_ct_tcp *state,
502                           enum ip_conntrack_dir dir,
503                           unsigned int index,
504                           const struct sk_buff *skb,
505                           unsigned int dataoff,
506                           const struct tcphdr *tcph,
507                           u_int8_t pf)
508 {
509         struct net *net = nf_ct_net(ct);
510         struct nf_tcp_net *tn = tcp_pernet(net);
511         struct ip_ct_tcp_state *sender = &state->seen[dir];
512         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
513         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
514         __u32 seq, ack, sack, end, win, swin;
515         s32 receiver_offset;
516         bool res, in_recv_win;
517 
518         /*
519          * Get the required data from the packet.
520          */
521         seq = ntohl(tcph->seq);
522         ack = sack = ntohl(tcph->ack_seq);
523         win = ntohs(tcph->window);
524         end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
525 
526         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
527                 tcp_sack(skb, dataoff, tcph, &sack);
528 
529         /* Take into account NAT sequence number mangling */
530         receiver_offset = nf_ct_seq_offset(ct, !dir, ack - 1);
531         ack -= receiver_offset;
532         sack -= receiver_offset;
533 
534         pr_debug("tcp_in_window: START\n");
535         pr_debug("tcp_in_window: ");
536         nf_ct_dump_tuple(tuple);
537         pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
538                  seq, ack, receiver_offset, sack, receiver_offset, win, end);
539         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
540                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
541                  sender->td_end, sender->td_maxend, sender->td_maxwin,
542                  sender->td_scale,
543                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
544                  receiver->td_scale);
545 
546         if (sender->td_maxwin == 0) {
547                 /*
548                  * Initialize sender data.
549                  */
550                 if (tcph->syn) {
551                         /*
552                          * SYN-ACK in reply to a SYN
553                          * or SYN from reply direction in simultaneous open.
554                          */
555                         sender->td_end =
556                         sender->td_maxend = end;
557                         sender->td_maxwin = (win == 0 ? 1 : win);
558 
559                         tcp_options(skb, dataoff, tcph, sender);
560                         /*
561                          * RFC 1323:
562                          * Both sides must send the Window Scale option
563                          * to enable window scaling in either direction.
564                          */
565                         if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
566                               && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
567                                 sender->td_scale =
568                                 receiver->td_scale = 0;
569                         if (!tcph->ack)
570                                 /* Simultaneous open */
571                                 return true;
572                 } else {
573                         /*
574                          * We are in the middle of a connection,
575                          * its history is lost for us.
576                          * Let's try to use the data from the packet.
577                          */
578                         sender->td_end = end;
579                         swin = win << sender->td_scale;
580                         sender->td_maxwin = (swin == 0 ? 1 : swin);
581                         sender->td_maxend = end + sender->td_maxwin;
582                         /*
583                          * We haven't seen traffic in the other direction yet
584                          * but we have to tweak window tracking to pass III
585                          * and IV until that happens.
586                          */
587                         if (receiver->td_maxwin == 0)
588                                 receiver->td_end = receiver->td_maxend = sack;
589                 }
590         } else if (((state->state == TCP_CONNTRACK_SYN_SENT
591                      && dir == IP_CT_DIR_ORIGINAL)
592                    || (state->state == TCP_CONNTRACK_SYN_RECV
593                      && dir == IP_CT_DIR_REPLY))
594                    && after(end, sender->td_end)) {
595                 /*
596                  * RFC 793: "if a TCP is reinitialized ... then it need
597                  * not wait at all; it must only be sure to use sequence
598                  * numbers larger than those recently used."
599                  */
600                 sender->td_end =
601                 sender->td_maxend = end;
602                 sender->td_maxwin = (win == 0 ? 1 : win);
603 
604                 tcp_options(skb, dataoff, tcph, sender);
605         }
606 
607         if (!(tcph->ack)) {
608                 /*
609                  * If there is no ACK, just pretend it was set and OK.
610                  */
611                 ack = sack = receiver->td_end;
612         } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
613                     (TCP_FLAG_ACK|TCP_FLAG_RST))
614                    && (ack == 0)) {
615                 /*
616                  * Broken TCP stacks, that set ACK in RST packets as well
617                  * with zero ack value.
618                  */
619                 ack = sack = receiver->td_end;
620         }
621 
622         if (tcph->rst && seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)
623                 /*
624                  * RST sent answering SYN.
625                  */
626                 seq = end = sender->td_end;
627 
628         pr_debug("tcp_in_window: ");
629         nf_ct_dump_tuple(tuple);
630         pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
631                  seq, ack, receiver_offset, sack, receiver_offset, win, end);
632         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
633                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
634                  sender->td_end, sender->td_maxend, sender->td_maxwin,
635                  sender->td_scale,
636                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
637                  receiver->td_scale);
638 
639         /* Is the ending sequence in the receive window (if available)? */
640         in_recv_win = !receiver->td_maxwin ||
641                       after(end, sender->td_end - receiver->td_maxwin - 1);
642 
643         pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
644                  before(seq, sender->td_maxend + 1),
645                  (in_recv_win ? 1 : 0),
646                  before(sack, receiver->td_end + 1),
647                  after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
648 
649         if (before(seq, sender->td_maxend + 1) &&
650             in_recv_win &&
651             before(sack, receiver->td_end + 1) &&
652             after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
653                 /*
654                  * Take into account window scaling (RFC 1323).
655                  */
656                 if (!tcph->syn)
657                         win <<= sender->td_scale;
658 
659                 /*
660                  * Update sender data.
661                  */
662                 swin = win + (sack - ack);
663                 if (sender->td_maxwin < swin)
664                         sender->td_maxwin = swin;
665                 if (after(end, sender->td_end)) {
666                         sender->td_end = end;
667                         sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
668                 }
669                 if (tcph->ack) {
670                         if (!(sender->flags & IP_CT_TCP_FLAG_MAXACK_SET)) {
671                                 sender->td_maxack = ack;
672                                 sender->flags |= IP_CT_TCP_FLAG_MAXACK_SET;
673                         } else if (after(ack, sender->td_maxack))
674                                 sender->td_maxack = ack;
675                 }
676 
677                 /*
678                  * Update receiver data.
679                  */
680                 if (receiver->td_maxwin != 0 && after(end, sender->td_maxend))
681                         receiver->td_maxwin += end - sender->td_maxend;
682                 if (after(sack + win, receiver->td_maxend - 1)) {
683                         receiver->td_maxend = sack + win;
684                         if (win == 0)
685                                 receiver->td_maxend++;
686                 }
687                 if (ack == receiver->td_end)
688                         receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
689 
690                 /*
691                  * Check retransmissions.
692                  */
693                 if (index == TCP_ACK_SET) {
694                         if (state->last_dir == dir
695                             && state->last_seq == seq
696                             && state->last_ack == ack
697                             && state->last_end == end
698                             && state->last_win == win)
699                                 state->retrans++;
700                         else {
701                                 state->last_dir = dir;
702                                 state->last_seq = seq;
703                                 state->last_ack = ack;
704                                 state->last_end = end;
705                                 state->last_win = win;
706                                 state->retrans = 0;
707                         }
708                 }
709                 res = true;
710         } else {
711                 res = false;
712                 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
713                     tn->tcp_be_liberal)
714                         res = true;
715                 if (!res && LOG_INVALID(net, IPPROTO_TCP))
716                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
717                         "nf_ct_tcp: %s ",
718                         before(seq, sender->td_maxend + 1) ?
719                         in_recv_win ?
720                         before(sack, receiver->td_end + 1) ?
721                         after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
722                         : "ACK is under the lower bound (possible overly delayed ACK)"
723                         : "ACK is over the upper bound (ACKed data not seen yet)"
724                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
725                         : "SEQ is over the upper bound (over the window of the receiver)");
726         }
727 
728         pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
729                  "receiver end=%u maxend=%u maxwin=%u\n",
730                  res, sender->td_end, sender->td_maxend, sender->td_maxwin,
731                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
732 
733         return res;
734 }
735 
736 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
737 static const u8 tcp_valid_flags[(TCPHDR_FIN|TCPHDR_SYN|TCPHDR_RST|TCPHDR_ACK|
738                                  TCPHDR_URG) + 1] =
739 {
740         [TCPHDR_SYN]                            = 1,
741         [TCPHDR_SYN|TCPHDR_URG]                 = 1,
742         [TCPHDR_SYN|TCPHDR_ACK]                 = 1,
743         [TCPHDR_RST]                            = 1,
744         [TCPHDR_RST|TCPHDR_ACK]                 = 1,
745         [TCPHDR_FIN|TCPHDR_ACK]                 = 1,
746         [TCPHDR_FIN|TCPHDR_ACK|TCPHDR_URG]      = 1,
747         [TCPHDR_ACK]                            = 1,
748         [TCPHDR_ACK|TCPHDR_URG]                 = 1,
749 };
750 
751 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
752 static int tcp_error(struct net *net, struct nf_conn *tmpl,
753                      struct sk_buff *skb,
754                      unsigned int dataoff,
755                      enum ip_conntrack_info *ctinfo,
756                      u_int8_t pf,
757                      unsigned int hooknum)
758 {
759         const struct tcphdr *th;
760         struct tcphdr _tcph;
761         unsigned int tcplen = skb->len - dataoff;
762         u_int8_t tcpflags;
763 
764         /* Smaller that minimal TCP header? */
765         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
766         if (th == NULL) {
767                 if (LOG_INVALID(net, IPPROTO_TCP))
768                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
769                                 "nf_ct_tcp: short packet ");
770                 return -NF_ACCEPT;
771         }
772 
773         /* Not whole TCP header or malformed packet */
774         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
775                 if (LOG_INVALID(net, IPPROTO_TCP))
776                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
777                                 "nf_ct_tcp: truncated/malformed packet ");
778                 return -NF_ACCEPT;
779         }
780 
781         /* Checksum invalid? Ignore.
782          * We skip checking packets on the outgoing path
783          * because the checksum is assumed to be correct.
784          */
785         /* FIXME: Source route IP option packets --RR */
786         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
787             nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
788                 if (LOG_INVALID(net, IPPROTO_TCP))
789                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
790                                   "nf_ct_tcp: bad TCP checksum ");
791                 return -NF_ACCEPT;
792         }
793 
794         /* Check TCP flags. */
795         tcpflags = (tcp_flag_byte(th) & ~(TCPHDR_ECE|TCPHDR_CWR|TCPHDR_PSH));
796         if (!tcp_valid_flags[tcpflags]) {
797                 if (LOG_INVALID(net, IPPROTO_TCP))
798                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
799                                   "nf_ct_tcp: invalid TCP flag combination ");
800                 return -NF_ACCEPT;
801         }
802 
803         return NF_ACCEPT;
804 }
805 
806 static unsigned int *tcp_get_timeouts(struct net *net)
807 {
808         return tcp_pernet(net)->timeouts;
809 }
810 
811 /* Returns verdict for packet, or -1 for invalid. */
812 static int tcp_packet(struct nf_conn *ct,
813                       const struct sk_buff *skb,
814                       unsigned int dataoff,
815                       enum ip_conntrack_info ctinfo,
816                       u_int8_t pf,
817                       unsigned int hooknum,
818                       unsigned int *timeouts)
819 {
820         struct net *net = nf_ct_net(ct);
821         struct nf_tcp_net *tn = tcp_pernet(net);
822         struct nf_conntrack_tuple *tuple;
823         enum tcp_conntrack new_state, old_state;
824         enum ip_conntrack_dir dir;
825         const struct tcphdr *th;
826         struct tcphdr _tcph;
827         unsigned long timeout;
828         unsigned int index;
829 
830         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
831         BUG_ON(th == NULL);
832 
833         spin_lock_bh(&ct->lock);
834         old_state = ct->proto.tcp.state;
835         dir = CTINFO2DIR(ctinfo);
836         index = get_conntrack_index(th);
837         new_state = tcp_conntracks[dir][index][old_state];
838         tuple = &ct->tuplehash[dir].tuple;
839 
840         switch (new_state) {
841         case TCP_CONNTRACK_SYN_SENT:
842                 if (old_state < TCP_CONNTRACK_TIME_WAIT)
843                         break;
844                 /* RFC 1122: "When a connection is closed actively,
845                  * it MUST linger in TIME-WAIT state for a time 2xMSL
846                  * (Maximum Segment Lifetime). However, it MAY accept
847                  * a new SYN from the remote TCP to reopen the connection
848                  * directly from TIME-WAIT state, if..."
849                  * We ignore the conditions because we are in the
850                  * TIME-WAIT state anyway.
851                  *
852                  * Handle aborted connections: we and the server
853                  * think there is an existing connection but the client
854                  * aborts it and starts a new one.
855                  */
856                 if (((ct->proto.tcp.seen[dir].flags
857                       | ct->proto.tcp.seen[!dir].flags)
858                      & IP_CT_TCP_FLAG_CLOSE_INIT)
859                     || (ct->proto.tcp.last_dir == dir
860                         && ct->proto.tcp.last_index == TCP_RST_SET)) {
861                         /* Attempt to reopen a closed/aborted connection.
862                          * Delete this connection and look up again. */
863                         spin_unlock_bh(&ct->lock);
864 
865                         /* Only repeat if we can actually remove the timer.
866                          * Destruction may already be in progress in process
867                          * context and we must give it a chance to terminate.
868                          */
869                         if (nf_ct_kill(ct))
870                                 return -NF_REPEAT;
871                         return NF_DROP;
872                 }
873                 /* Fall through */
874         case TCP_CONNTRACK_IGNORE:
875                 /* Ignored packets:
876                  *
877                  * Our connection entry may be out of sync, so ignore
878                  * packets which may signal the real connection between
879                  * the client and the server.
880                  *
881                  * a) SYN in ORIGINAL
882                  * b) SYN/ACK in REPLY
883                  * c) ACK in reply direction after initial SYN in original.
884                  *
885                  * If the ignored packet is invalid, the receiver will send
886                  * a RST we'll catch below.
887                  */
888                 if (index == TCP_SYNACK_SET
889                     && ct->proto.tcp.last_index == TCP_SYN_SET
890                     && ct->proto.tcp.last_dir != dir
891                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
892                         /* b) This SYN/ACK acknowledges a SYN that we earlier
893                          * ignored as invalid. This means that the client and
894                          * the server are both in sync, while the firewall is
895                          * not. We get in sync from the previously annotated
896                          * values.
897                          */
898                         old_state = TCP_CONNTRACK_SYN_SENT;
899                         new_state = TCP_CONNTRACK_SYN_RECV;
900                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_end =
901                                 ct->proto.tcp.last_end;
902                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxend =
903                                 ct->proto.tcp.last_end;
904                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxwin =
905                                 ct->proto.tcp.last_win == 0 ?
906                                         1 : ct->proto.tcp.last_win;
907                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_scale =
908                                 ct->proto.tcp.last_wscale;
909                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
910                                 ct->proto.tcp.last_flags;
911                         memset(&ct->proto.tcp.seen[dir], 0,
912                                sizeof(struct ip_ct_tcp_state));
913                         break;
914                 }
915                 ct->proto.tcp.last_index = index;
916                 ct->proto.tcp.last_dir = dir;
917                 ct->proto.tcp.last_seq = ntohl(th->seq);
918                 ct->proto.tcp.last_end =
919                     segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
920                 ct->proto.tcp.last_win = ntohs(th->window);
921 
922                 /* a) This is a SYN in ORIGINAL. The client and the server
923                  * may be in sync but we are not. In that case, we annotate
924                  * the TCP options and let the packet go through. If it is a
925                  * valid SYN packet, the server will reply with a SYN/ACK, and
926                  * then we'll get in sync. Otherwise, the server ignores it. */
927                 if (index == TCP_SYN_SET && dir == IP_CT_DIR_ORIGINAL) {
928                         struct ip_ct_tcp_state seen = {};
929 
930                         ct->proto.tcp.last_flags =
931                         ct->proto.tcp.last_wscale = 0;
932                         tcp_options(skb, dataoff, th, &seen);
933                         if (seen.flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
934                                 ct->proto.tcp.last_flags |=
935                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
936                                 ct->proto.tcp.last_wscale = seen.td_scale;
937                         }
938                         if (seen.flags & IP_CT_TCP_FLAG_SACK_PERM) {
939                                 ct->proto.tcp.last_flags |=
940                                         IP_CT_TCP_FLAG_SACK_PERM;
941                         }
942                 }
943                 spin_unlock_bh(&ct->lock);
944                 if (LOG_INVALID(net, IPPROTO_TCP))
945                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
946                                   "nf_ct_tcp: invalid packet ignored in "
947                                   "state %s ", tcp_conntrack_names[old_state]);
948                 return NF_ACCEPT;
949         case TCP_CONNTRACK_MAX:
950                 /* Special case for SYN proxy: when the SYN to the server or
951                  * the SYN/ACK from the server is lost, the client may transmit
952                  * a keep-alive packet while in SYN_SENT state. This needs to
953                  * be associated with the original conntrack entry in order to
954                  * generate a new SYN with the correct sequence number.
955                  */
956                 if (nfct_synproxy(ct) && old_state == TCP_CONNTRACK_SYN_SENT &&
957                     index == TCP_ACK_SET && dir == IP_CT_DIR_ORIGINAL &&
958                     ct->proto.tcp.last_dir == IP_CT_DIR_ORIGINAL &&
959                     ct->proto.tcp.seen[dir].td_end - 1 == ntohl(th->seq)) {
960                         pr_debug("nf_ct_tcp: SYN proxy client keep alive\n");
961                         spin_unlock_bh(&ct->lock);
962                         return NF_ACCEPT;
963                 }
964 
965                 /* Invalid packet */
966                 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
967                          dir, get_conntrack_index(th), old_state);
968                 spin_unlock_bh(&ct->lock);
969                 if (LOG_INVALID(net, IPPROTO_TCP))
970                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
971                                   "nf_ct_tcp: invalid state ");
972                 return -NF_ACCEPT;
973         case TCP_CONNTRACK_CLOSE:
974                 if (index == TCP_RST_SET
975                     && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
976                     && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) {
977                         /* Invalid RST  */
978                         spin_unlock_bh(&ct->lock);
979                         if (LOG_INVALID(net, IPPROTO_TCP))
980                                 nf_log_packet(net, pf, 0, skb, NULL, NULL,
981                                               NULL, "nf_ct_tcp: invalid RST ");
982                         return -NF_ACCEPT;
983                 }
984                 if (index == TCP_RST_SET
985                     && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
986                          && ct->proto.tcp.last_index == TCP_SYN_SET)
987                         || (!test_bit(IPS_ASSURED_BIT, &ct->status)
988                             && ct->proto.tcp.last_index == TCP_ACK_SET))
989                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
990                         /* RST sent to invalid SYN or ACK we had let through
991                          * at a) and c) above:
992                          *
993                          * a) SYN was in window then
994                          * c) we hold a half-open connection.
995                          *
996                          * Delete our connection entry.
997                          * We skip window checking, because packet might ACK
998                          * segments we ignored. */
999                         goto in_window;
1000                 }
1001                 /* Just fall through */
1002         default:
1003                 /* Keep compilers happy. */
1004                 break;
1005         }
1006 
1007         if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
1008                            skb, dataoff, th, pf)) {
1009                 spin_unlock_bh(&ct->lock);
1010                 return -NF_ACCEPT;
1011         }
1012      in_window:
1013         /* From now on we have got in-window packets */
1014         ct->proto.tcp.last_index = index;
1015         ct->proto.tcp.last_dir = dir;
1016 
1017         pr_debug("tcp_conntracks: ");
1018         nf_ct_dump_tuple(tuple);
1019         pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
1020                  (th->syn ? 1 : 0), (th->ack ? 1 : 0),
1021                  (th->fin ? 1 : 0), (th->rst ? 1 : 0),
1022                  old_state, new_state);
1023 
1024         ct->proto.tcp.state = new_state;
1025         if (old_state != new_state
1026             && new_state == TCP_CONNTRACK_FIN_WAIT)
1027                 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
1028 
1029         if (ct->proto.tcp.retrans >= tn->tcp_max_retrans &&
1030             timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
1031                 timeout = timeouts[TCP_CONNTRACK_RETRANS];
1032         else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
1033                  IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
1034                  timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
1035                 timeout = timeouts[TCP_CONNTRACK_UNACK];
1036         else
1037                 timeout = timeouts[new_state];
1038         spin_unlock_bh(&ct->lock);
1039 
1040         if (new_state != old_state)
1041                 nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
1042 
1043         if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
1044                 /* If only reply is a RST, we can consider ourselves not to
1045                    have an established connection: this is a fairly common
1046                    problem case, so we can delete the conntrack
1047                    immediately.  --RR */
1048                 if (th->rst) {
1049                         nf_ct_kill_acct(ct, ctinfo, skb);
1050                         return NF_ACCEPT;
1051                 }
1052                 /* ESTABLISHED without SEEN_REPLY, i.e. mid-connection
1053                  * pickup with loose=1. Avoid large ESTABLISHED timeout.
1054                  */
1055                 if (new_state == TCP_CONNTRACK_ESTABLISHED &&
1056                     timeout > timeouts[TCP_CONNTRACK_UNACK])
1057                         timeout = timeouts[TCP_CONNTRACK_UNACK];
1058         } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
1059                    && (old_state == TCP_CONNTRACK_SYN_RECV
1060                        || old_state == TCP_CONNTRACK_ESTABLISHED)
1061                    && new_state == TCP_CONNTRACK_ESTABLISHED) {
1062                 /* Set ASSURED if we see see valid ack in ESTABLISHED
1063                    after SYN_RECV or a valid answer for a picked up
1064                    connection. */
1065                 set_bit(IPS_ASSURED_BIT, &ct->status);
1066                 nf_conntrack_event_cache(IPCT_ASSURED, ct);
1067         }
1068         nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
1069 
1070         return NF_ACCEPT;
1071 }
1072 
1073 /* Called when a new connection for this protocol found. */
1074 static bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
1075                     unsigned int dataoff, unsigned int *timeouts)
1076 {
1077         enum tcp_conntrack new_state;
1078         const struct tcphdr *th;
1079         struct tcphdr _tcph;
1080         struct net *net = nf_ct_net(ct);
1081         struct nf_tcp_net *tn = tcp_pernet(net);
1082         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
1083         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
1084 
1085         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1086         BUG_ON(th == NULL);
1087 
1088         /* Don't need lock here: this conntrack not in circulation yet */
1089         new_state = tcp_conntracks[0][get_conntrack_index(th)][TCP_CONNTRACK_NONE];
1090 
1091         /* Invalid: delete conntrack */
1092         if (new_state >= TCP_CONNTRACK_MAX) {
1093                 pr_debug("nf_ct_tcp: invalid new deleting.\n");
1094                 return false;
1095         }
1096 
1097         if (new_state == TCP_CONNTRACK_SYN_SENT) {
1098                 memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp));
1099                 /* SYN packet */
1100                 ct->proto.tcp.seen[0].td_end =
1101                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1102                                              dataoff, th);
1103                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1104                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1105                         ct->proto.tcp.seen[0].td_maxwin = 1;
1106                 ct->proto.tcp.seen[0].td_maxend =
1107                         ct->proto.tcp.seen[0].td_end;
1108 
1109                 tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
1110         } else if (tn->tcp_loose == 0) {
1111                 /* Don't try to pick up connections. */
1112                 return false;
1113         } else {
1114                 memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp));
1115                 /*
1116                  * We are in the middle of a connection,
1117                  * its history is lost for us.
1118                  * Let's try to use the data from the packet.
1119                  */
1120                 ct->proto.tcp.seen[0].td_end =
1121                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1122                                              dataoff, th);
1123                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1124                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1125                         ct->proto.tcp.seen[0].td_maxwin = 1;
1126                 ct->proto.tcp.seen[0].td_maxend =
1127                         ct->proto.tcp.seen[0].td_end +
1128                         ct->proto.tcp.seen[0].td_maxwin;
1129 
1130                 /* We assume SACK and liberal window checking to handle
1131                  * window scaling */
1132                 ct->proto.tcp.seen[0].flags =
1133                 ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1134                                               IP_CT_TCP_FLAG_BE_LIBERAL;
1135         }
1136 
1137         /* tcp_packet will set them */
1138         ct->proto.tcp.last_index = TCP_NONE_SET;
1139 
1140         pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1141                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1142                  sender->td_end, sender->td_maxend, sender->td_maxwin,
1143                  sender->td_scale,
1144                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1145                  receiver->td_scale);
1146         return true;
1147 }
1148 
1149 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
1150 
1151 #include <linux/netfilter/nfnetlink.h>
1152 #include <linux/netfilter/nfnetlink_conntrack.h>
1153 
1154 static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
1155                          struct nf_conn *ct)
1156 {
1157         struct nlattr *nest_parms;
1158         struct nf_ct_tcp_flags tmp = {};
1159 
1160         spin_lock_bh(&ct->lock);
1161         nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP | NLA_F_NESTED);
1162         if (!nest_parms)
1163                 goto nla_put_failure;
1164 
1165         if (nla_put_u8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state) ||
1166             nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
1167                        ct->proto.tcp.seen[0].td_scale) ||
1168             nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
1169                        ct->proto.tcp.seen[1].td_scale))
1170                 goto nla_put_failure;
1171 
1172         tmp.flags = ct->proto.tcp.seen[0].flags;
1173         if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
1174                     sizeof(struct nf_ct_tcp_flags), &tmp))
1175                 goto nla_put_failure;
1176 
1177         tmp.flags = ct->proto.tcp.seen[1].flags;
1178         if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
1179                     sizeof(struct nf_ct_tcp_flags), &tmp))
1180                 goto nla_put_failure;
1181         spin_unlock_bh(&ct->lock);
1182 
1183         nla_nest_end(skb, nest_parms);
1184 
1185         return 0;
1186 
1187 nla_put_failure:
1188         spin_unlock_bh(&ct->lock);
1189         return -1;
1190 }
1191 
1192 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
1193         [CTA_PROTOINFO_TCP_STATE]           = { .type = NLA_U8 },
1194         [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
1195         [CTA_PROTOINFO_TCP_WSCALE_REPLY]    = { .type = NLA_U8 },
1196         [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
1197         [CTA_PROTOINFO_TCP_FLAGS_REPLY]     = { .len =  sizeof(struct nf_ct_tcp_flags) },
1198 };
1199 
1200 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
1201 {
1202         struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
1203         struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
1204         int err;
1205 
1206         /* updates could not contain anything about the private
1207          * protocol info, in that case skip the parsing */
1208         if (!pattr)
1209                 return 0;
1210 
1211         err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
1212         if (err < 0)
1213                 return err;
1214 
1215         if (tb[CTA_PROTOINFO_TCP_STATE] &&
1216             nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
1217                 return -EINVAL;
1218 
1219         spin_lock_bh(&ct->lock);
1220         if (tb[CTA_PROTOINFO_TCP_STATE])
1221                 ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
1222 
1223         if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
1224                 struct nf_ct_tcp_flags *attr =
1225                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
1226                 ct->proto.tcp.seen[0].flags &= ~attr->mask;
1227                 ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
1228         }
1229 
1230         if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
1231                 struct nf_ct_tcp_flags *attr =
1232                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
1233                 ct->proto.tcp.seen[1].flags &= ~attr->mask;
1234                 ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
1235         }
1236 
1237         if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
1238             tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
1239             ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
1240             ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1241                 ct->proto.tcp.seen[0].td_scale =
1242                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
1243                 ct->proto.tcp.seen[1].td_scale =
1244                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
1245         }
1246         spin_unlock_bh(&ct->lock);
1247 
1248         return 0;
1249 }
1250 
1251 static int tcp_nlattr_size(void)
1252 {
1253         return nla_total_size(0)           /* CTA_PROTOINFO_TCP */
1254                 + nla_policy_len(tcp_nla_policy, CTA_PROTOINFO_TCP_MAX + 1);
1255 }
1256 
1257 static int tcp_nlattr_tuple_size(void)
1258 {
1259         return nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
1260 }
1261 #endif
1262 
1263 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
1264 
1265 #include <linux/netfilter/nfnetlink.h>
1266 #include <linux/netfilter/nfnetlink_cttimeout.h>
1267 
1268 static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[],
1269                                      struct net *net, void *data)
1270 {
1271         unsigned int *timeouts = data;
1272         struct nf_tcp_net *tn = tcp_pernet(net);
1273         int i;
1274 
1275         /* set default TCP timeouts. */
1276         for (i=0; i<TCP_CONNTRACK_TIMEOUT_MAX; i++)
1277                 timeouts[i] = tn->timeouts[i];
1278 
1279         if (tb[CTA_TIMEOUT_TCP_SYN_SENT]) {
1280                 timeouts[TCP_CONNTRACK_SYN_SENT] =
1281                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT]))*HZ;
1282         }
1283         if (tb[CTA_TIMEOUT_TCP_SYN_RECV]) {
1284                 timeouts[TCP_CONNTRACK_SYN_RECV] =
1285                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_RECV]))*HZ;
1286         }
1287         if (tb[CTA_TIMEOUT_TCP_ESTABLISHED]) {
1288                 timeouts[TCP_CONNTRACK_ESTABLISHED] =
1289                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_ESTABLISHED]))*HZ;
1290         }
1291         if (tb[CTA_TIMEOUT_TCP_FIN_WAIT]) {
1292                 timeouts[TCP_CONNTRACK_FIN_WAIT] =
1293                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_FIN_WAIT]))*HZ;
1294         }
1295         if (tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]) {
1296                 timeouts[TCP_CONNTRACK_CLOSE_WAIT] =
1297                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]))*HZ;
1298         }
1299         if (tb[CTA_TIMEOUT_TCP_LAST_ACK]) {
1300                 timeouts[TCP_CONNTRACK_LAST_ACK] =
1301                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_LAST_ACK]))*HZ;
1302         }
1303         if (tb[CTA_TIMEOUT_TCP_TIME_WAIT]) {
1304                 timeouts[TCP_CONNTRACK_TIME_WAIT] =
1305                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_TIME_WAIT]))*HZ;
1306         }
1307         if (tb[CTA_TIMEOUT_TCP_CLOSE]) {
1308                 timeouts[TCP_CONNTRACK_CLOSE] =
1309                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE]))*HZ;
1310         }
1311         if (tb[CTA_TIMEOUT_TCP_SYN_SENT2]) {
1312                 timeouts[TCP_CONNTRACK_SYN_SENT2] =
1313                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT2]))*HZ;
1314         }
1315         if (tb[CTA_TIMEOUT_TCP_RETRANS]) {
1316                 timeouts[TCP_CONNTRACK_RETRANS] =
1317                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_RETRANS]))*HZ;
1318         }
1319         if (tb[CTA_TIMEOUT_TCP_UNACK]) {
1320                 timeouts[TCP_CONNTRACK_UNACK] =
1321                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_UNACK]))*HZ;
1322         }
1323         return 0;
1324 }
1325 
1326 static int
1327 tcp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
1328 {
1329         const unsigned int *timeouts = data;
1330 
1331         if (nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT,
1332                         htonl(timeouts[TCP_CONNTRACK_SYN_SENT] / HZ)) ||
1333             nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_RECV,
1334                          htonl(timeouts[TCP_CONNTRACK_SYN_RECV] / HZ)) ||
1335             nla_put_be32(skb, CTA_TIMEOUT_TCP_ESTABLISHED,
1336                          htonl(timeouts[TCP_CONNTRACK_ESTABLISHED] / HZ)) ||
1337             nla_put_be32(skb, CTA_TIMEOUT_TCP_FIN_WAIT,
1338                          htonl(timeouts[TCP_CONNTRACK_FIN_WAIT] / HZ)) ||
1339             nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE_WAIT,
1340                          htonl(timeouts[TCP_CONNTRACK_CLOSE_WAIT] / HZ)) ||
1341             nla_put_be32(skb, CTA_TIMEOUT_TCP_LAST_ACK,
1342                          htonl(timeouts[TCP_CONNTRACK_LAST_ACK] / HZ)) ||
1343             nla_put_be32(skb, CTA_TIMEOUT_TCP_TIME_WAIT,
1344                          htonl(timeouts[TCP_CONNTRACK_TIME_WAIT] / HZ)) ||
1345             nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE,
1346                          htonl(timeouts[TCP_CONNTRACK_CLOSE] / HZ)) ||
1347             nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT2,
1348                          htonl(timeouts[TCP_CONNTRACK_SYN_SENT2] / HZ)) ||
1349             nla_put_be32(skb, CTA_TIMEOUT_TCP_RETRANS,
1350                          htonl(timeouts[TCP_CONNTRACK_RETRANS] / HZ)) ||
1351             nla_put_be32(skb, CTA_TIMEOUT_TCP_UNACK,
1352                          htonl(timeouts[TCP_CONNTRACK_UNACK] / HZ)))
1353                 goto nla_put_failure;
1354         return 0;
1355 
1356 nla_put_failure:
1357         return -ENOSPC;
1358 }
1359 
1360 static const struct nla_policy tcp_timeout_nla_policy[CTA_TIMEOUT_TCP_MAX+1] = {
1361         [CTA_TIMEOUT_TCP_SYN_SENT]      = { .type = NLA_U32 },
1362         [CTA_TIMEOUT_TCP_SYN_RECV]      = { .type = NLA_U32 },
1363         [CTA_TIMEOUT_TCP_ESTABLISHED]   = { .type = NLA_U32 },
1364         [CTA_TIMEOUT_TCP_FIN_WAIT]      = { .type = NLA_U32 },
1365         [CTA_TIMEOUT_TCP_CLOSE_WAIT]    = { .type = NLA_U32 },
1366         [CTA_TIMEOUT_TCP_LAST_ACK]      = { .type = NLA_U32 },
1367         [CTA_TIMEOUT_TCP_TIME_WAIT]     = { .type = NLA_U32 },
1368         [CTA_TIMEOUT_TCP_CLOSE]         = { .type = NLA_U32 },
1369         [CTA_TIMEOUT_TCP_SYN_SENT2]     = { .type = NLA_U32 },
1370         [CTA_TIMEOUT_TCP_RETRANS]       = { .type = NLA_U32 },
1371         [CTA_TIMEOUT_TCP_UNACK]         = { .type = NLA_U32 },
1372 };
1373 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
1374 
1375 #ifdef CONFIG_SYSCTL
1376 static struct ctl_table tcp_sysctl_table[] = {
1377         {
1378                 .procname       = "nf_conntrack_tcp_timeout_syn_sent",
1379                 .maxlen         = sizeof(unsigned int),
1380                 .mode           = 0644,
1381                 .proc_handler   = proc_dointvec_jiffies,
1382         },
1383         {
1384                 .procname       = "nf_conntrack_tcp_timeout_syn_recv",
1385                 .maxlen         = sizeof(unsigned int),
1386                 .mode           = 0644,
1387                 .proc_handler   = proc_dointvec_jiffies,
1388         },
1389         {
1390                 .procname       = "nf_conntrack_tcp_timeout_established",
1391                 .maxlen         = sizeof(unsigned int),
1392                 .mode           = 0644,
1393                 .proc_handler   = proc_dointvec_jiffies,
1394         },
1395         {
1396                 .procname       = "nf_conntrack_tcp_timeout_fin_wait",
1397                 .maxlen         = sizeof(unsigned int),
1398                 .mode           = 0644,
1399                 .proc_handler   = proc_dointvec_jiffies,
1400         },
1401         {
1402                 .procname       = "nf_conntrack_tcp_timeout_close_wait",
1403                 .maxlen         = sizeof(unsigned int),
1404                 .mode           = 0644,
1405                 .proc_handler   = proc_dointvec_jiffies,
1406         },
1407         {
1408                 .procname       = "nf_conntrack_tcp_timeout_last_ack",
1409                 .maxlen         = sizeof(unsigned int),
1410                 .mode           = 0644,
1411                 .proc_handler   = proc_dointvec_jiffies,
1412         },
1413         {
1414                 .procname       = "nf_conntrack_tcp_timeout_time_wait",
1415                 .maxlen         = sizeof(unsigned int),
1416                 .mode           = 0644,
1417                 .proc_handler   = proc_dointvec_jiffies,
1418         },
1419         {
1420                 .procname       = "nf_conntrack_tcp_timeout_close",
1421                 .maxlen         = sizeof(unsigned int),
1422                 .mode           = 0644,
1423                 .proc_handler   = proc_dointvec_jiffies,
1424         },
1425         {
1426                 .procname       = "nf_conntrack_tcp_timeout_max_retrans",
1427                 .maxlen         = sizeof(unsigned int),
1428                 .mode           = 0644,
1429                 .proc_handler   = proc_dointvec_jiffies,
1430         },
1431         {
1432                 .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
1433                 .maxlen         = sizeof(unsigned int),
1434                 .mode           = 0644,
1435                 .proc_handler   = proc_dointvec_jiffies,
1436         },
1437         {
1438                 .procname       = "nf_conntrack_tcp_loose",
1439                 .maxlen         = sizeof(unsigned int),
1440                 .mode           = 0644,
1441                 .proc_handler   = proc_dointvec,
1442         },
1443         {
1444                 .procname       = "nf_conntrack_tcp_be_liberal",
1445                 .maxlen         = sizeof(unsigned int),
1446                 .mode           = 0644,
1447                 .proc_handler   = proc_dointvec,
1448         },
1449         {
1450                 .procname       = "nf_conntrack_tcp_max_retrans",
1451                 .maxlen         = sizeof(unsigned int),
1452                 .mode           = 0644,
1453                 .proc_handler   = proc_dointvec,
1454         },
1455         { }
1456 };
1457 
1458 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1459 static struct ctl_table tcp_compat_sysctl_table[] = {
1460         {
1461                 .procname       = "ip_conntrack_tcp_timeout_syn_sent",
1462                 .maxlen         = sizeof(unsigned int),
1463                 .mode           = 0644,
1464                 .proc_handler   = proc_dointvec_jiffies,
1465         },
1466         {
1467                 .procname       = "ip_conntrack_tcp_timeout_syn_sent2",
1468                 .maxlen         = sizeof(unsigned int),
1469                 .mode           = 0644,
1470                 .proc_handler   = proc_dointvec_jiffies,
1471         },
1472         {
1473                 .procname       = "ip_conntrack_tcp_timeout_syn_recv",
1474                 .maxlen         = sizeof(unsigned int),
1475                 .mode           = 0644,
1476                 .proc_handler   = proc_dointvec_jiffies,
1477         },
1478         {
1479                 .procname       = "ip_conntrack_tcp_timeout_established",
1480                 .maxlen         = sizeof(unsigned int),
1481                 .mode           = 0644,
1482                 .proc_handler   = proc_dointvec_jiffies,
1483         },
1484         {
1485                 .procname       = "ip_conntrack_tcp_timeout_fin_wait",
1486                 .maxlen         = sizeof(unsigned int),
1487                 .mode           = 0644,
1488                 .proc_handler   = proc_dointvec_jiffies,
1489         },
1490         {
1491                 .procname       = "ip_conntrack_tcp_timeout_close_wait",
1492                 .maxlen         = sizeof(unsigned int),
1493                 .mode           = 0644,
1494                 .proc_handler   = proc_dointvec_jiffies,
1495         },
1496         {
1497                 .procname       = "ip_conntrack_tcp_timeout_last_ack",
1498                 .maxlen         = sizeof(unsigned int),
1499                 .mode           = 0644,
1500                 .proc_handler   = proc_dointvec_jiffies,
1501         },
1502         {
1503                 .procname       = "ip_conntrack_tcp_timeout_time_wait",
1504                 .maxlen         = sizeof(unsigned int),
1505                 .mode           = 0644,
1506                 .proc_handler   = proc_dointvec_jiffies,
1507         },
1508         {
1509                 .procname       = "ip_conntrack_tcp_timeout_close",
1510                 .maxlen         = sizeof(unsigned int),
1511                 .mode           = 0644,
1512                 .proc_handler   = proc_dointvec_jiffies,
1513         },
1514         {
1515                 .procname       = "ip_conntrack_tcp_timeout_max_retrans",
1516                 .maxlen         = sizeof(unsigned int),
1517                 .mode           = 0644,
1518                 .proc_handler   = proc_dointvec_jiffies,
1519         },
1520         {
1521                 .procname       = "ip_conntrack_tcp_loose",
1522                 .maxlen         = sizeof(unsigned int),
1523                 .mode           = 0644,
1524                 .proc_handler   = proc_dointvec,
1525         },
1526         {
1527                 .procname       = "ip_conntrack_tcp_be_liberal",
1528                 .maxlen         = sizeof(unsigned int),
1529                 .mode           = 0644,
1530                 .proc_handler   = proc_dointvec,
1531         },
1532         {
1533                 .procname       = "ip_conntrack_tcp_max_retrans",
1534                 .maxlen         = sizeof(unsigned int),
1535                 .mode           = 0644,
1536                 .proc_handler   = proc_dointvec,
1537         },
1538         { }
1539 };
1540 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
1541 #endif /* CONFIG_SYSCTL */
1542 
1543 static int tcp_kmemdup_sysctl_table(struct nf_proto_net *pn,
1544                                     struct nf_tcp_net *tn)
1545 {
1546 #ifdef CONFIG_SYSCTL
1547         if (pn->ctl_table)
1548                 return 0;
1549 
1550         pn->ctl_table = kmemdup(tcp_sysctl_table,
1551                                 sizeof(tcp_sysctl_table),
1552                                 GFP_KERNEL);
1553         if (!pn->ctl_table)
1554                 return -ENOMEM;
1555 
1556         pn->ctl_table[0].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT];
1557         pn->ctl_table[1].data = &tn->timeouts[TCP_CONNTRACK_SYN_RECV];
1558         pn->ctl_table[2].data = &tn->timeouts[TCP_CONNTRACK_ESTABLISHED];
1559         pn->ctl_table[3].data = &tn->timeouts[TCP_CONNTRACK_FIN_WAIT];
1560         pn->ctl_table[4].data = &tn->timeouts[TCP_CONNTRACK_CLOSE_WAIT];
1561         pn->ctl_table[5].data = &tn->timeouts[TCP_CONNTRACK_LAST_ACK];
1562         pn->ctl_table[6].data = &tn->timeouts[TCP_CONNTRACK_TIME_WAIT];
1563         pn->ctl_table[7].data = &tn->timeouts[TCP_CONNTRACK_CLOSE];
1564         pn->ctl_table[8].data = &tn->timeouts[TCP_CONNTRACK_RETRANS];
1565         pn->ctl_table[9].data = &tn->timeouts[TCP_CONNTRACK_UNACK];
1566         pn->ctl_table[10].data = &tn->tcp_loose;
1567         pn->ctl_table[11].data = &tn->tcp_be_liberal;
1568         pn->ctl_table[12].data = &tn->tcp_max_retrans;
1569 #endif
1570         return 0;
1571 }
1572 
1573 static int tcp_kmemdup_compat_sysctl_table(struct nf_proto_net *pn,
1574                                            struct nf_tcp_net *tn)
1575 {
1576 #ifdef CONFIG_SYSCTL
1577 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1578         pn->ctl_compat_table = kmemdup(tcp_compat_sysctl_table,
1579                                        sizeof(tcp_compat_sysctl_table),
1580                                        GFP_KERNEL);
1581         if (!pn->ctl_compat_table)
1582                 return -ENOMEM;
1583 
1584         pn->ctl_compat_table[0].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT];
1585         pn->ctl_compat_table[1].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT2];
1586         pn->ctl_compat_table[2].data = &tn->timeouts[TCP_CONNTRACK_SYN_RECV];
1587         pn->ctl_compat_table[3].data = &tn->timeouts[TCP_CONNTRACK_ESTABLISHED];
1588         pn->ctl_compat_table[4].data = &tn->timeouts[TCP_CONNTRACK_FIN_WAIT];
1589         pn->ctl_compat_table[5].data = &tn->timeouts[TCP_CONNTRACK_CLOSE_WAIT];
1590         pn->ctl_compat_table[6].data = &tn->timeouts[TCP_CONNTRACK_LAST_ACK];
1591         pn->ctl_compat_table[7].data = &tn->timeouts[TCP_CONNTRACK_TIME_WAIT];
1592         pn->ctl_compat_table[8].data = &tn->timeouts[TCP_CONNTRACK_CLOSE];
1593         pn->ctl_compat_table[9].data = &tn->timeouts[TCP_CONNTRACK_RETRANS];
1594         pn->ctl_compat_table[10].data = &tn->tcp_loose;
1595         pn->ctl_compat_table[11].data = &tn->tcp_be_liberal;
1596         pn->ctl_compat_table[12].data = &tn->tcp_max_retrans;
1597 #endif
1598 #endif
1599         return 0;
1600 }
1601 
1602 static int tcp_init_net(struct net *net, u_int16_t proto)
1603 {
1604         int ret;
1605         struct nf_tcp_net *tn = tcp_pernet(net);
1606         struct nf_proto_net *pn = &tn->pn;
1607 
1608         if (!pn->users) {
1609                 int i;
1610 
1611                 for (i = 0; i < TCP_CONNTRACK_TIMEOUT_MAX; i++)
1612                         tn->timeouts[i] = tcp_timeouts[i];
1613 
1614                 tn->tcp_loose = nf_ct_tcp_loose;
1615                 tn->tcp_be_liberal = nf_ct_tcp_be_liberal;
1616                 tn->tcp_max_retrans = nf_ct_tcp_max_retrans;
1617         }
1618 
1619         if (proto == AF_INET) {
1620                 ret = tcp_kmemdup_compat_sysctl_table(pn, tn);
1621                 if (ret < 0)
1622                         return ret;
1623 
1624                 ret = tcp_kmemdup_sysctl_table(pn, tn);
1625                 if (ret < 0)
1626                         nf_ct_kfree_compat_sysctl_table(pn);
1627         } else
1628                 ret = tcp_kmemdup_sysctl_table(pn, tn);
1629 
1630         return ret;
1631 }
1632 
1633 static struct nf_proto_net *tcp_get_net_proto(struct net *net)
1634 {
1635         return &net->ct.nf_ct_proto.tcp.pn;
1636 }
1637 
1638 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
1639 {
1640         .l3proto                = PF_INET,
1641         .l4proto                = IPPROTO_TCP,
1642         .name                   = "tcp",
1643         .pkt_to_tuple           = tcp_pkt_to_tuple,
1644         .invert_tuple           = tcp_invert_tuple,
1645         .print_tuple            = tcp_print_tuple,
1646         .print_conntrack        = tcp_print_conntrack,
1647         .packet                 = tcp_packet,
1648         .get_timeouts           = tcp_get_timeouts,
1649         .new                    = tcp_new,
1650         .error                  = tcp_error,
1651 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
1652         .to_nlattr              = tcp_to_nlattr,
1653         .nlattr_size            = tcp_nlattr_size,
1654         .from_nlattr            = nlattr_to_tcp,
1655         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1656         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1657         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1658         .nla_policy             = nf_ct_port_nla_policy,
1659 #endif
1660 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
1661         .ctnl_timeout           = {
1662                 .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
1663                 .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
1664                 .nlattr_max     = CTA_TIMEOUT_TCP_MAX,
1665                 .obj_size       = sizeof(unsigned int) *
1666                                         TCP_CONNTRACK_TIMEOUT_MAX,
1667                 .nla_policy     = tcp_timeout_nla_policy,
1668         },
1669 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
1670         .init_net               = tcp_init_net,
1671         .get_net_proto          = tcp_get_net_proto,
1672 };
1673 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
1674 
1675 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
1676 {
1677         .l3proto                = PF_INET6,
1678         .l4proto                = IPPROTO_TCP,
1679         .name                   = "tcp",
1680         .pkt_to_tuple           = tcp_pkt_to_tuple,
1681         .invert_tuple           = tcp_invert_tuple,
1682         .print_tuple            = tcp_print_tuple,
1683         .print_conntrack        = tcp_print_conntrack,
1684         .packet                 = tcp_packet,
1685         .get_timeouts           = tcp_get_timeouts,
1686         .new                    = tcp_new,
1687         .error                  = tcp_error,
1688 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
1689         .to_nlattr              = tcp_to_nlattr,
1690         .nlattr_size            = tcp_nlattr_size,
1691         .from_nlattr            = nlattr_to_tcp,
1692         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1693         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1694         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1695         .nla_policy             = nf_ct_port_nla_policy,
1696 #endif
1697 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
1698         .ctnl_timeout           = {
1699                 .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
1700                 .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
1701                 .nlattr_max     = CTA_TIMEOUT_TCP_MAX,
1702                 .obj_size       = sizeof(unsigned int) *
1703                                         TCP_CONNTRACK_TIMEOUT_MAX,
1704                 .nla_policy     = tcp_timeout_nla_policy,
1705         },
1706 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
1707         .init_net               = tcp_init_net,
1708         .get_net_proto          = tcp_get_net_proto,
1709 };
1710 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);
1711 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp