~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_conntrack_proto_tcp.c

Version: ~ [ linux-5.15-rc1 ] ~ [ linux-5.14.5 ] ~ [ linux-5.13.18 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.66 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.147 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.206 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.246 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.282 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.283 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* (C) 1999-2001 Paul `Rusty' Russell
  2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  3  * (C) 2002-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  4  * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
  5  *
  6  * This program is free software; you can redistribute it and/or modify
  7  * it under the terms of the GNU General Public License version 2 as
  8  * published by the Free Software Foundation.
  9  */
 10 
 11 #include <linux/types.h>
 12 #include <linux/timer.h>
 13 #include <linux/module.h>
 14 #include <linux/in.h>
 15 #include <linux/tcp.h>
 16 #include <linux/spinlock.h>
 17 #include <linux/skbuff.h>
 18 #include <linux/ipv6.h>
 19 #include <net/ip6_checksum.h>
 20 #include <asm/unaligned.h>
 21 
 22 #include <net/tcp.h>
 23 
 24 #include <linux/netfilter.h>
 25 #include <linux/netfilter_ipv4.h>
 26 #include <linux/netfilter_ipv6.h>
 27 #include <net/netfilter/nf_conntrack.h>
 28 #include <net/netfilter/nf_conntrack_l4proto.h>
 29 #include <net/netfilter/nf_conntrack_ecache.h>
 30 #include <net/netfilter/nf_conntrack_seqadj.h>
 31 #include <net/netfilter/nf_conntrack_synproxy.h>
 32 #include <net/netfilter/nf_log.h>
 33 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 34 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 35 
 36 /* "Be conservative in what you do,
 37     be liberal in what you accept from others."
 38     If it's non-zero, we mark only out of window RST segments as INVALID. */
 39 static int nf_ct_tcp_be_liberal __read_mostly = 0;
 40 
 41 /* If it is set to zero, we disable picking up already established
 42    connections. */
 43 static int nf_ct_tcp_loose __read_mostly = 1;
 44 
 45 /* Max number of the retransmitted packets without receiving an (acceptable)
 46    ACK from the destination. If this number is reached, a shorter timer
 47    will be started. */
 48 static int nf_ct_tcp_max_retrans __read_mostly = 3;
 49 
 50   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
 51      closely.  They're more complex. --RR */
 52 
 53 static const char *const tcp_conntrack_names[] = {
 54         "NONE",
 55         "SYN_SENT",
 56         "SYN_RECV",
 57         "ESTABLISHED",
 58         "FIN_WAIT",
 59         "CLOSE_WAIT",
 60         "LAST_ACK",
 61         "TIME_WAIT",
 62         "CLOSE",
 63         "SYN_SENT2",
 64 };
 65 
 66 #define SECS * HZ
 67 #define MINS * 60 SECS
 68 #define HOURS * 60 MINS
 69 #define DAYS * 24 HOURS
 70 
 71 static unsigned int tcp_timeouts[TCP_CONNTRACK_TIMEOUT_MAX] __read_mostly = {
 72         [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
 73         [TCP_CONNTRACK_SYN_RECV]        = 60 SECS,
 74         [TCP_CONNTRACK_ESTABLISHED]     = 5 DAYS,
 75         [TCP_CONNTRACK_FIN_WAIT]        = 2 MINS,
 76         [TCP_CONNTRACK_CLOSE_WAIT]      = 60 SECS,
 77         [TCP_CONNTRACK_LAST_ACK]        = 30 SECS,
 78         [TCP_CONNTRACK_TIME_WAIT]       = 2 MINS,
 79         [TCP_CONNTRACK_CLOSE]           = 10 SECS,
 80         [TCP_CONNTRACK_SYN_SENT2]       = 2 MINS,
 81 /* RFC1122 says the R2 limit should be at least 100 seconds.
 82    Linux uses 15 packets as limit, which corresponds
 83    to ~13-30min depending on RTO. */
 84         [TCP_CONNTRACK_RETRANS]         = 5 MINS,
 85         [TCP_CONNTRACK_UNACK]           = 5 MINS,
 86 };
 87 
 88 #define sNO TCP_CONNTRACK_NONE
 89 #define sSS TCP_CONNTRACK_SYN_SENT
 90 #define sSR TCP_CONNTRACK_SYN_RECV
 91 #define sES TCP_CONNTRACK_ESTABLISHED
 92 #define sFW TCP_CONNTRACK_FIN_WAIT
 93 #define sCW TCP_CONNTRACK_CLOSE_WAIT
 94 #define sLA TCP_CONNTRACK_LAST_ACK
 95 #define sTW TCP_CONNTRACK_TIME_WAIT
 96 #define sCL TCP_CONNTRACK_CLOSE
 97 #define sS2 TCP_CONNTRACK_SYN_SENT2
 98 #define sIV TCP_CONNTRACK_MAX
 99 #define sIG TCP_CONNTRACK_IGNORE
100 
101 /* What TCP flags are set from RST/SYN/FIN/ACK. */
102 enum tcp_bit_set {
103         TCP_SYN_SET,
104         TCP_SYNACK_SET,
105         TCP_FIN_SET,
106         TCP_ACK_SET,
107         TCP_RST_SET,
108         TCP_NONE_SET,
109 };
110 
111 /*
112  * The TCP state transition table needs a few words...
113  *
114  * We are the man in the middle. All the packets go through us
115  * but might get lost in transit to the destination.
116  * It is assumed that the destinations can't receive segments
117  * we haven't seen.
118  *
119  * The checked segment is in window, but our windows are *not*
120  * equivalent with the ones of the sender/receiver. We always
121  * try to guess the state of the current sender.
122  *
123  * The meaning of the states are:
124  *
125  * NONE:        initial state
126  * SYN_SENT:    SYN-only packet seen
127  * SYN_SENT2:   SYN-only packet seen from reply dir, simultaneous open
128  * SYN_RECV:    SYN-ACK packet seen
129  * ESTABLISHED: ACK packet seen
130  * FIN_WAIT:    FIN packet seen
131  * CLOSE_WAIT:  ACK seen (after FIN)
132  * LAST_ACK:    FIN seen (after FIN)
133  * TIME_WAIT:   last ACK seen
134  * CLOSE:       closed connection (RST)
135  *
136  * Packets marked as IGNORED (sIG):
137  *      if they may be either invalid or valid
138  *      and the receiver may send back a connection
139  *      closing RST or a SYN/ACK.
140  *
141  * Packets marked as INVALID (sIV):
142  *      if we regard them as truly invalid packets
143  */
144 static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
145         {
146 /* ORIGINAL */
147 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
148 /*syn*/    { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sS2 },
149 /*
150  *      sNO -> sSS      Initialize a new connection
151  *      sSS -> sSS      Retransmitted SYN
152  *      sS2 -> sS2      Late retransmitted SYN
153  *      sSR -> sIG
154  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
155  *                      are errors. Receiver will reply with RST
156  *                      and close the connection.
157  *                      Or we are not in sync and hold a dead connection.
158  *      sFW -> sIG
159  *      sCW -> sIG
160  *      sLA -> sIG
161  *      sTW -> sSS      Reopened connection (RFC 1122).
162  *      sCL -> sSS
163  */
164 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
165 /*synack*/ { sIV, sIV, sSR, sIV, sIV, sIV, sIV, sIV, sIV, sSR },
166 /*
167  *      sNO -> sIV      Too late and no reason to do anything
168  *      sSS -> sIV      Client can't send SYN and then SYN/ACK
169  *      sS2 -> sSR      SYN/ACK sent to SYN2 in simultaneous open
170  *      sSR -> sSR      Late retransmitted SYN/ACK in simultaneous open
171  *      sES -> sIV      Invalid SYN/ACK packets sent by the client
172  *      sFW -> sIV
173  *      sCW -> sIV
174  *      sLA -> sIV
175  *      sTW -> sIV
176  *      sCL -> sIV
177  */
178 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
179 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
180 /*
181  *      sNO -> sIV      Too late and no reason to do anything...
182  *      sSS -> sIV      Client migth not send FIN in this state:
183  *                      we enforce waiting for a SYN/ACK reply first.
184  *      sS2 -> sIV
185  *      sSR -> sFW      Close started.
186  *      sES -> sFW
187  *      sFW -> sLA      FIN seen in both directions, waiting for
188  *                      the last ACK.
189  *                      Migth be a retransmitted FIN as well...
190  *      sCW -> sLA
191  *      sLA -> sLA      Retransmitted FIN. Remain in the same state.
192  *      sTW -> sTW
193  *      sCL -> sCL
194  */
195 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
196 /*ack*/    { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
197 /*
198  *      sNO -> sES      Assumed.
199  *      sSS -> sIV      ACK is invalid: we haven't seen a SYN/ACK yet.
200  *      sS2 -> sIV
201  *      sSR -> sES      Established state is reached.
202  *      sES -> sES      :-)
203  *      sFW -> sCW      Normal close request answered by ACK.
204  *      sCW -> sCW
205  *      sLA -> sTW      Last ACK detected (RFC5961 challenged)
206  *      sTW -> sTW      Retransmitted last ACK. Remain in the same state.
207  *      sCL -> sCL
208  */
209 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
210 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
211 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
212         },
213         {
214 /* REPLY */
215 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
216 /*syn*/    { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sSS, sIV, sS2 },
217 /*
218  *      sNO -> sIV      Never reached.
219  *      sSS -> sS2      Simultaneous open
220  *      sS2 -> sS2      Retransmitted simultaneous SYN
221  *      sSR -> sIV      Invalid SYN packets sent by the server
222  *      sES -> sIV
223  *      sFW -> sIV
224  *      sCW -> sIV
225  *      sLA -> sIV
226  *      sTW -> sSS      Reopened connection, but server may have switched role
227  *      sCL -> sIV
228  */
229 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
230 /*synack*/ { sIV, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
231 /*
232  *      sSS -> sSR      Standard open.
233  *      sS2 -> sSR      Simultaneous open
234  *      sSR -> sIG      Retransmitted SYN/ACK, ignore it.
235  *      sES -> sIG      Late retransmitted SYN/ACK?
236  *      sFW -> sIG      Might be SYN/ACK answering ignored SYN
237  *      sCW -> sIG
238  *      sLA -> sIG
239  *      sTW -> sIG
240  *      sCL -> sIG
241  */
242 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
243 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
244 /*
245  *      sSS -> sIV      Server might not send FIN in this state.
246  *      sS2 -> sIV
247  *      sSR -> sFW      Close started.
248  *      sES -> sFW
249  *      sFW -> sLA      FIN seen in both directions.
250  *      sCW -> sLA
251  *      sLA -> sLA      Retransmitted FIN.
252  *      sTW -> sTW
253  *      sCL -> sCL
254  */
255 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
256 /*ack*/    { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIG },
257 /*
258  *      sSS -> sIG      Might be a half-open connection.
259  *      sS2 -> sIG
260  *      sSR -> sSR      Might answer late resent SYN.
261  *      sES -> sES      :-)
262  *      sFW -> sCW      Normal close request answered by ACK.
263  *      sCW -> sCW
264  *      sLA -> sTW      Last ACK detected (RFC5961 challenged)
265  *      sTW -> sTW      Retransmitted last ACK.
266  *      sCL -> sCL
267  */
268 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
269 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
270 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
271         }
272 };
273 
274 static inline struct nf_tcp_net *tcp_pernet(struct net *net)
275 {
276         return &net->ct.nf_ct_proto.tcp;
277 }
278 
279 static bool tcp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
280                              struct net *net, struct nf_conntrack_tuple *tuple)
281 {
282         const struct tcphdr *hp;
283         struct tcphdr _hdr;
284 
285         /* Actually only need first 8 bytes. */
286         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
287         if (hp == NULL)
288                 return false;
289 
290         tuple->src.u.tcp.port = hp->source;
291         tuple->dst.u.tcp.port = hp->dest;
292 
293         return true;
294 }
295 
296 static bool tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
297                              const struct nf_conntrack_tuple *orig)
298 {
299         tuple->src.u.tcp.port = orig->dst.u.tcp.port;
300         tuple->dst.u.tcp.port = orig->src.u.tcp.port;
301         return true;
302 }
303 
304 /* Print out the per-protocol part of the tuple. */
305 static void tcp_print_tuple(struct seq_file *s,
306                             const struct nf_conntrack_tuple *tuple)
307 {
308         seq_printf(s, "sport=%hu dport=%hu ",
309                    ntohs(tuple->src.u.tcp.port),
310                    ntohs(tuple->dst.u.tcp.port));
311 }
312 
313 /* Print out the private part of the conntrack. */
314 static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
315 {
316         enum tcp_conntrack state;
317 
318         spin_lock_bh(&ct->lock);
319         state = ct->proto.tcp.state;
320         spin_unlock_bh(&ct->lock);
321 
322         seq_printf(s, "%s ", tcp_conntrack_names[state]);
323 }
324 
325 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
326 {
327         if (tcph->rst) return TCP_RST_SET;
328         else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
329         else if (tcph->fin) return TCP_FIN_SET;
330         else if (tcph->ack) return TCP_ACK_SET;
331         else return TCP_NONE_SET;
332 }
333 
334 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
335    in IP Filter' by Guido van Rooij.
336 
337    http://www.sane.nl/events/sane2000/papers.html
338    http://www.darkart.com/mirrors/www.obfuscation.org/ipf/
339 
340    The boundaries and the conditions are changed according to RFC793:
341    the packet must intersect the window (i.e. segments may be
342    after the right or before the left edge) and thus receivers may ACK
343    segments after the right edge of the window.
344 
345         td_maxend = max(sack + max(win,1)) seen in reply packets
346         td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
347         td_maxwin += seq + len - sender.td_maxend
348                         if seq + len > sender.td_maxend
349         td_end    = max(seq + len) seen in sent packets
350 
351    I.   Upper bound for valid data:     seq <= sender.td_maxend
352    II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
353    III. Upper bound for valid (s)ack:   sack <= receiver.td_end
354    IV.  Lower bound for valid (s)ack:   sack >= receiver.td_end - MAXACKWINDOW
355 
356    where sack is the highest right edge of sack block found in the packet
357    or ack in the case of packet without SACK option.
358 
359    The upper bound limit for a valid (s)ack is not ignored -
360    we doesn't have to deal with fragments.
361 */
362 
363 static inline __u32 segment_seq_plus_len(__u32 seq,
364                                          size_t len,
365                                          unsigned int dataoff,
366                                          const struct tcphdr *tcph)
367 {
368         /* XXX Should I use payload length field in IP/IPv6 header ?
369          * - YK */
370         return (seq + len - dataoff - tcph->doff*4
371                 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
372 }
373 
374 /* Fixme: what about big packets? */
375 #define MAXACKWINCONST                  66000
376 #define MAXACKWINDOW(sender)                                            \
377         ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin     \
378                                               : MAXACKWINCONST)
379 
380 /*
381  * Simplified tcp_parse_options routine from tcp_input.c
382  */
383 static void tcp_options(const struct sk_buff *skb,
384                         unsigned int dataoff,
385                         const struct tcphdr *tcph,
386                         struct ip_ct_tcp_state *state)
387 {
388         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
389         const unsigned char *ptr;
390         int length = (tcph->doff*4) - sizeof(struct tcphdr);
391 
392         if (!length)
393                 return;
394 
395         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
396                                  length, buff);
397         BUG_ON(ptr == NULL);
398 
399         state->td_scale =
400         state->flags = 0;
401 
402         while (length > 0) {
403                 int opcode=*ptr++;
404                 int opsize;
405 
406                 switch (opcode) {
407                 case TCPOPT_EOL:
408                         return;
409                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
410                         length--;
411                         continue;
412                 default:
413                         if (length < 2)
414                                 return;
415                         opsize=*ptr++;
416                         if (opsize < 2) /* "silly options" */
417                                 return;
418                         if (opsize > length)
419                                 return; /* don't parse partial options */
420 
421                         if (opcode == TCPOPT_SACK_PERM
422                             && opsize == TCPOLEN_SACK_PERM)
423                                 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
424                         else if (opcode == TCPOPT_WINDOW
425                                  && opsize == TCPOLEN_WINDOW) {
426                                 state->td_scale = *(u_int8_t *)ptr;
427 
428                                 if (state->td_scale > 14) {
429                                         /* See RFC1323 */
430                                         state->td_scale = 14;
431                                 }
432                                 state->flags |=
433                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
434                         }
435                         ptr += opsize - 2;
436                         length -= opsize;
437                 }
438         }
439 }
440 
441 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
442                      const struct tcphdr *tcph, __u32 *sack)
443 {
444         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
445         const unsigned char *ptr;
446         int length = (tcph->doff*4) - sizeof(struct tcphdr);
447         __u32 tmp;
448 
449         if (!length)
450                 return;
451 
452         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
453                                  length, buff);
454         BUG_ON(ptr == NULL);
455 
456         /* Fast path for timestamp-only option */
457         if (length == TCPOLEN_TSTAMP_ALIGNED
458             && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
459                                        | (TCPOPT_NOP << 16)
460                                        | (TCPOPT_TIMESTAMP << 8)
461                                        | TCPOLEN_TIMESTAMP))
462                 return;
463 
464         while (length > 0) {
465                 int opcode = *ptr++;
466                 int opsize, i;
467 
468                 switch (opcode) {
469                 case TCPOPT_EOL:
470                         return;
471                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
472                         length--;
473                         continue;
474                 default:
475                         if (length < 2)
476                                 return;
477                         opsize = *ptr++;
478                         if (opsize < 2) /* "silly options" */
479                                 return;
480                         if (opsize > length)
481                                 return; /* don't parse partial options */
482 
483                         if (opcode == TCPOPT_SACK
484                             && opsize >= (TCPOLEN_SACK_BASE
485                                           + TCPOLEN_SACK_PERBLOCK)
486                             && !((opsize - TCPOLEN_SACK_BASE)
487                                  % TCPOLEN_SACK_PERBLOCK)) {
488                                 for (i = 0;
489                                      i < (opsize - TCPOLEN_SACK_BASE);
490                                      i += TCPOLEN_SACK_PERBLOCK) {
491                                         tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
492 
493                                         if (after(tmp, *sack))
494                                                 *sack = tmp;
495                                 }
496                                 return;
497                         }
498                         ptr += opsize - 2;
499                         length -= opsize;
500                 }
501         }
502 }
503 
504 static bool tcp_in_window(const struct nf_conn *ct,
505                           struct ip_ct_tcp *state,
506                           enum ip_conntrack_dir dir,
507                           unsigned int index,
508                           const struct sk_buff *skb,
509                           unsigned int dataoff,
510                           const struct tcphdr *tcph,
511                           u_int8_t pf)
512 {
513         struct net *net = nf_ct_net(ct);
514         struct nf_tcp_net *tn = tcp_pernet(net);
515         struct ip_ct_tcp_state *sender = &state->seen[dir];
516         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
517         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
518         __u32 seq, ack, sack, end, win, swin;
519         s32 receiver_offset;
520         bool res, in_recv_win;
521 
522         /*
523          * Get the required data from the packet.
524          */
525         seq = ntohl(tcph->seq);
526         ack = sack = ntohl(tcph->ack_seq);
527         win = ntohs(tcph->window);
528         end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
529 
530         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
531                 tcp_sack(skb, dataoff, tcph, &sack);
532 
533         /* Take into account NAT sequence number mangling */
534         receiver_offset = nf_ct_seq_offset(ct, !dir, ack - 1);
535         ack -= receiver_offset;
536         sack -= receiver_offset;
537 
538         pr_debug("tcp_in_window: START\n");
539         pr_debug("tcp_in_window: ");
540         nf_ct_dump_tuple(tuple);
541         pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
542                  seq, ack, receiver_offset, sack, receiver_offset, win, end);
543         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
544                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
545                  sender->td_end, sender->td_maxend, sender->td_maxwin,
546                  sender->td_scale,
547                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
548                  receiver->td_scale);
549 
550         if (sender->td_maxwin == 0) {
551                 /*
552                  * Initialize sender data.
553                  */
554                 if (tcph->syn) {
555                         /*
556                          * SYN-ACK in reply to a SYN
557                          * or SYN from reply direction in simultaneous open.
558                          */
559                         sender->td_end =
560                         sender->td_maxend = end;
561                         sender->td_maxwin = (win == 0 ? 1 : win);
562 
563                         tcp_options(skb, dataoff, tcph, sender);
564                         /*
565                          * RFC 1323:
566                          * Both sides must send the Window Scale option
567                          * to enable window scaling in either direction.
568                          */
569                         if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
570                               && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
571                                 sender->td_scale =
572                                 receiver->td_scale = 0;
573                         if (!tcph->ack)
574                                 /* Simultaneous open */
575                                 return true;
576                 } else {
577                         /*
578                          * We are in the middle of a connection,
579                          * its history is lost for us.
580                          * Let's try to use the data from the packet.
581                          */
582                         sender->td_end = end;
583                         swin = win << sender->td_scale;
584                         sender->td_maxwin = (swin == 0 ? 1 : swin);
585                         sender->td_maxend = end + sender->td_maxwin;
586                         /*
587                          * We haven't seen traffic in the other direction yet
588                          * but we have to tweak window tracking to pass III
589                          * and IV until that happens.
590                          */
591                         if (receiver->td_maxwin == 0)
592                                 receiver->td_end = receiver->td_maxend = sack;
593                 }
594         } else if (((state->state == TCP_CONNTRACK_SYN_SENT
595                      && dir == IP_CT_DIR_ORIGINAL)
596                    || (state->state == TCP_CONNTRACK_SYN_RECV
597                      && dir == IP_CT_DIR_REPLY))
598                    && after(end, sender->td_end)) {
599                 /*
600                  * RFC 793: "if a TCP is reinitialized ... then it need
601                  * not wait at all; it must only be sure to use sequence
602                  * numbers larger than those recently used."
603                  */
604                 sender->td_end =
605                 sender->td_maxend = end;
606                 sender->td_maxwin = (win == 0 ? 1 : win);
607 
608                 tcp_options(skb, dataoff, tcph, sender);
609         }
610 
611         if (!(tcph->ack)) {
612                 /*
613                  * If there is no ACK, just pretend it was set and OK.
614                  */
615                 ack = sack = receiver->td_end;
616         } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
617                     (TCP_FLAG_ACK|TCP_FLAG_RST))
618                    && (ack == 0)) {
619                 /*
620                  * Broken TCP stacks, that set ACK in RST packets as well
621                  * with zero ack value.
622                  */
623                 ack = sack = receiver->td_end;
624         }
625 
626         if (tcph->rst && seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)
627                 /*
628                  * RST sent answering SYN.
629                  */
630                 seq = end = sender->td_end;
631 
632         pr_debug("tcp_in_window: ");
633         nf_ct_dump_tuple(tuple);
634         pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
635                  seq, ack, receiver_offset, sack, receiver_offset, win, end);
636         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
637                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
638                  sender->td_end, sender->td_maxend, sender->td_maxwin,
639                  sender->td_scale,
640                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
641                  receiver->td_scale);
642 
643         /* Is the ending sequence in the receive window (if available)? */
644         in_recv_win = !receiver->td_maxwin ||
645                       after(end, sender->td_end - receiver->td_maxwin - 1);
646 
647         pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
648                  before(seq, sender->td_maxend + 1),
649                  (in_recv_win ? 1 : 0),
650                  before(sack, receiver->td_end + 1),
651                  after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
652 
653         if (before(seq, sender->td_maxend + 1) &&
654             in_recv_win &&
655             before(sack, receiver->td_end + 1) &&
656             after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
657                 /*
658                  * Take into account window scaling (RFC 1323).
659                  */
660                 if (!tcph->syn)
661                         win <<= sender->td_scale;
662 
663                 /*
664                  * Update sender data.
665                  */
666                 swin = win + (sack - ack);
667                 if (sender->td_maxwin < swin)
668                         sender->td_maxwin = swin;
669                 if (after(end, sender->td_end)) {
670                         sender->td_end = end;
671                         sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
672                 }
673                 if (tcph->ack) {
674                         if (!(sender->flags & IP_CT_TCP_FLAG_MAXACK_SET)) {
675                                 sender->td_maxack = ack;
676                                 sender->flags |= IP_CT_TCP_FLAG_MAXACK_SET;
677                         } else if (after(ack, sender->td_maxack))
678                                 sender->td_maxack = ack;
679                 }
680 
681                 /*
682                  * Update receiver data.
683                  */
684                 if (receiver->td_maxwin != 0 && after(end, sender->td_maxend))
685                         receiver->td_maxwin += end - sender->td_maxend;
686                 if (after(sack + win, receiver->td_maxend - 1)) {
687                         receiver->td_maxend = sack + win;
688                         if (win == 0)
689                                 receiver->td_maxend++;
690                 }
691                 if (ack == receiver->td_end)
692                         receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
693 
694                 /*
695                  * Check retransmissions.
696                  */
697                 if (index == TCP_ACK_SET) {
698                         if (state->last_dir == dir
699                             && state->last_seq == seq
700                             && state->last_ack == ack
701                             && state->last_end == end
702                             && state->last_win == win)
703                                 state->retrans++;
704                         else {
705                                 state->last_dir = dir;
706                                 state->last_seq = seq;
707                                 state->last_ack = ack;
708                                 state->last_end = end;
709                                 state->last_win = win;
710                                 state->retrans = 0;
711                         }
712                 }
713                 res = true;
714         } else {
715                 res = false;
716                 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
717                     tn->tcp_be_liberal)
718                         res = true;
719                 if (!res && LOG_INVALID(net, IPPROTO_TCP))
720                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
721                         "nf_ct_tcp: %s ",
722                         before(seq, sender->td_maxend + 1) ?
723                         in_recv_win ?
724                         before(sack, receiver->td_end + 1) ?
725                         after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
726                         : "ACK is under the lower bound (possible overly delayed ACK)"
727                         : "ACK is over the upper bound (ACKed data not seen yet)"
728                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
729                         : "SEQ is over the upper bound (over the window of the receiver)");
730         }
731 
732         pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
733                  "receiver end=%u maxend=%u maxwin=%u\n",
734                  res, sender->td_end, sender->td_maxend, sender->td_maxwin,
735                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
736 
737         return res;
738 }
739 
740 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
741 static const u8 tcp_valid_flags[(TCPHDR_FIN|TCPHDR_SYN|TCPHDR_RST|TCPHDR_ACK|
742                                  TCPHDR_URG) + 1] =
743 {
744         [TCPHDR_SYN]                            = 1,
745         [TCPHDR_SYN|TCPHDR_URG]                 = 1,
746         [TCPHDR_SYN|TCPHDR_ACK]                 = 1,
747         [TCPHDR_RST]                            = 1,
748         [TCPHDR_RST|TCPHDR_ACK]                 = 1,
749         [TCPHDR_FIN|TCPHDR_ACK]                 = 1,
750         [TCPHDR_FIN|TCPHDR_ACK|TCPHDR_URG]      = 1,
751         [TCPHDR_ACK]                            = 1,
752         [TCPHDR_ACK|TCPHDR_URG]                 = 1,
753 };
754 
755 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
756 static int tcp_error(struct net *net, struct nf_conn *tmpl,
757                      struct sk_buff *skb,
758                      unsigned int dataoff,
759                      enum ip_conntrack_info *ctinfo,
760                      u_int8_t pf,
761                      unsigned int hooknum)
762 {
763         const struct tcphdr *th;
764         struct tcphdr _tcph;
765         unsigned int tcplen = skb->len - dataoff;
766         u_int8_t tcpflags;
767 
768         /* Smaller that minimal TCP header? */
769         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
770         if (th == NULL) {
771                 if (LOG_INVALID(net, IPPROTO_TCP))
772                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
773                                 "nf_ct_tcp: short packet ");
774                 return -NF_ACCEPT;
775         }
776 
777         /* Not whole TCP header or malformed packet */
778         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
779                 if (LOG_INVALID(net, IPPROTO_TCP))
780                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
781                                 "nf_ct_tcp: truncated/malformed packet ");
782                 return -NF_ACCEPT;
783         }
784 
785         /* Checksum invalid? Ignore.
786          * We skip checking packets on the outgoing path
787          * because the checksum is assumed to be correct.
788          */
789         /* FIXME: Source route IP option packets --RR */
790         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
791             nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
792                 if (LOG_INVALID(net, IPPROTO_TCP))
793                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
794                                   "nf_ct_tcp: bad TCP checksum ");
795                 return -NF_ACCEPT;
796         }
797 
798         /* Check TCP flags. */
799         tcpflags = (tcp_flag_byte(th) & ~(TCPHDR_ECE|TCPHDR_CWR|TCPHDR_PSH));
800         if (!tcp_valid_flags[tcpflags]) {
801                 if (LOG_INVALID(net, IPPROTO_TCP))
802                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
803                                   "nf_ct_tcp: invalid TCP flag combination ");
804                 return -NF_ACCEPT;
805         }
806 
807         return NF_ACCEPT;
808 }
809 
810 static unsigned int *tcp_get_timeouts(struct net *net)
811 {
812         return tcp_pernet(net)->timeouts;
813 }
814 
815 /* Returns verdict for packet, or -1 for invalid. */
816 static int tcp_packet(struct nf_conn *ct,
817                       const struct sk_buff *skb,
818                       unsigned int dataoff,
819                       enum ip_conntrack_info ctinfo,
820                       u_int8_t pf,
821                       unsigned int hooknum,
822                       unsigned int *timeouts)
823 {
824         struct net *net = nf_ct_net(ct);
825         struct nf_tcp_net *tn = tcp_pernet(net);
826         struct nf_conntrack_tuple *tuple;
827         enum tcp_conntrack new_state, old_state;
828         enum ip_conntrack_dir dir;
829         const struct tcphdr *th;
830         struct tcphdr _tcph;
831         unsigned long timeout;
832         unsigned int index;
833 
834         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
835         BUG_ON(th == NULL);
836 
837         spin_lock_bh(&ct->lock);
838         old_state = ct->proto.tcp.state;
839         dir = CTINFO2DIR(ctinfo);
840         index = get_conntrack_index(th);
841         new_state = tcp_conntracks[dir][index][old_state];
842         tuple = &ct->tuplehash[dir].tuple;
843 
844         switch (new_state) {
845         case TCP_CONNTRACK_SYN_SENT:
846                 if (old_state < TCP_CONNTRACK_TIME_WAIT)
847                         break;
848                 /* RFC 1122: "When a connection is closed actively,
849                  * it MUST linger in TIME-WAIT state for a time 2xMSL
850                  * (Maximum Segment Lifetime). However, it MAY accept
851                  * a new SYN from the remote TCP to reopen the connection
852                  * directly from TIME-WAIT state, if..."
853                  * We ignore the conditions because we are in the
854                  * TIME-WAIT state anyway.
855                  *
856                  * Handle aborted connections: we and the server
857                  * think there is an existing connection but the client
858                  * aborts it and starts a new one.
859                  */
860                 if (((ct->proto.tcp.seen[dir].flags
861                       | ct->proto.tcp.seen[!dir].flags)
862                      & IP_CT_TCP_FLAG_CLOSE_INIT)
863                     || (ct->proto.tcp.last_dir == dir
864                         && ct->proto.tcp.last_index == TCP_RST_SET)) {
865                         /* Attempt to reopen a closed/aborted connection.
866                          * Delete this connection and look up again. */
867                         spin_unlock_bh(&ct->lock);
868 
869                         /* Only repeat if we can actually remove the timer.
870                          * Destruction may already be in progress in process
871                          * context and we must give it a chance to terminate.
872                          */
873                         if (nf_ct_kill(ct))
874                                 return -NF_REPEAT;
875                         return NF_DROP;
876                 }
877                 /* Fall through */
878         case TCP_CONNTRACK_IGNORE:
879                 /* Ignored packets:
880                  *
881                  * Our connection entry may be out of sync, so ignore
882                  * packets which may signal the real connection between
883                  * the client and the server.
884                  *
885                  * a) SYN in ORIGINAL
886                  * b) SYN/ACK in REPLY
887                  * c) ACK in reply direction after initial SYN in original.
888                  *
889                  * If the ignored packet is invalid, the receiver will send
890                  * a RST we'll catch below.
891                  */
892                 if (index == TCP_SYNACK_SET
893                     && ct->proto.tcp.last_index == TCP_SYN_SET
894                     && ct->proto.tcp.last_dir != dir
895                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
896                         /* b) This SYN/ACK acknowledges a SYN that we earlier
897                          * ignored as invalid. This means that the client and
898                          * the server are both in sync, while the firewall is
899                          * not. We get in sync from the previously annotated
900                          * values.
901                          */
902                         old_state = TCP_CONNTRACK_SYN_SENT;
903                         new_state = TCP_CONNTRACK_SYN_RECV;
904                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_end =
905                                 ct->proto.tcp.last_end;
906                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxend =
907                                 ct->proto.tcp.last_end;
908                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxwin =
909                                 ct->proto.tcp.last_win == 0 ?
910                                         1 : ct->proto.tcp.last_win;
911                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_scale =
912                                 ct->proto.tcp.last_wscale;
913                         ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
914                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
915                                 ct->proto.tcp.last_flags;
916                         memset(&ct->proto.tcp.seen[dir], 0,
917                                sizeof(struct ip_ct_tcp_state));
918                         break;
919                 }
920                 ct->proto.tcp.last_index = index;
921                 ct->proto.tcp.last_dir = dir;
922                 ct->proto.tcp.last_seq = ntohl(th->seq);
923                 ct->proto.tcp.last_end =
924                     segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
925                 ct->proto.tcp.last_win = ntohs(th->window);
926 
927                 /* a) This is a SYN in ORIGINAL. The client and the server
928                  * may be in sync but we are not. In that case, we annotate
929                  * the TCP options and let the packet go through. If it is a
930                  * valid SYN packet, the server will reply with a SYN/ACK, and
931                  * then we'll get in sync. Otherwise, the server potentially
932                  * responds with a challenge ACK if implementing RFC5961.
933                  */
934                 if (index == TCP_SYN_SET && dir == IP_CT_DIR_ORIGINAL) {
935                         struct ip_ct_tcp_state seen = {};
936 
937                         ct->proto.tcp.last_flags =
938                         ct->proto.tcp.last_wscale = 0;
939                         tcp_options(skb, dataoff, th, &seen);
940                         if (seen.flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
941                                 ct->proto.tcp.last_flags |=
942                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
943                                 ct->proto.tcp.last_wscale = seen.td_scale;
944                         }
945                         if (seen.flags & IP_CT_TCP_FLAG_SACK_PERM) {
946                                 ct->proto.tcp.last_flags |=
947                                         IP_CT_TCP_FLAG_SACK_PERM;
948                         }
949                         /* Mark the potential for RFC5961 challenge ACK,
950                          * this pose a special problem for LAST_ACK state
951                          * as ACK is intrepretated as ACKing last FIN.
952                          */
953                         if (old_state == TCP_CONNTRACK_LAST_ACK)
954                                 ct->proto.tcp.last_flags |=
955                                         IP_CT_EXP_CHALLENGE_ACK;
956                 }
957                 spin_unlock_bh(&ct->lock);
958                 if (LOG_INVALID(net, IPPROTO_TCP))
959                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
960                                   "nf_ct_tcp: invalid packet ignored in "
961                                   "state %s ", tcp_conntrack_names[old_state]);
962                 return NF_ACCEPT;
963         case TCP_CONNTRACK_MAX:
964                 /* Special case for SYN proxy: when the SYN to the server or
965                  * the SYN/ACK from the server is lost, the client may transmit
966                  * a keep-alive packet while in SYN_SENT state. This needs to
967                  * be associated with the original conntrack entry in order to
968                  * generate a new SYN with the correct sequence number.
969                  */
970                 if (nfct_synproxy(ct) && old_state == TCP_CONNTRACK_SYN_SENT &&
971                     index == TCP_ACK_SET && dir == IP_CT_DIR_ORIGINAL &&
972                     ct->proto.tcp.last_dir == IP_CT_DIR_ORIGINAL &&
973                     ct->proto.tcp.seen[dir].td_end - 1 == ntohl(th->seq)) {
974                         pr_debug("nf_ct_tcp: SYN proxy client keep alive\n");
975                         spin_unlock_bh(&ct->lock);
976                         return NF_ACCEPT;
977                 }
978 
979                 /* Invalid packet */
980                 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
981                          dir, get_conntrack_index(th), old_state);
982                 spin_unlock_bh(&ct->lock);
983                 if (LOG_INVALID(net, IPPROTO_TCP))
984                         nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
985                                   "nf_ct_tcp: invalid state ");
986                 return -NF_ACCEPT;
987         case TCP_CONNTRACK_TIME_WAIT:
988                 /* RFC5961 compliance cause stack to send "challenge-ACK"
989                  * e.g. in response to spurious SYNs.  Conntrack MUST
990                  * not believe this ACK is acking last FIN.
991                  */
992                 if (old_state == TCP_CONNTRACK_LAST_ACK &&
993                     index == TCP_ACK_SET &&
994                     ct->proto.tcp.last_dir != dir &&
995                     ct->proto.tcp.last_index == TCP_SYN_SET &&
996                     (ct->proto.tcp.last_flags & IP_CT_EXP_CHALLENGE_ACK)) {
997                         /* Detected RFC5961 challenge ACK */
998                         ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
999                         spin_unlock_bh(&ct->lock);
1000                         if (LOG_INVALID(net, IPPROTO_TCP))
1001                                 nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
1002                                       "nf_ct_tcp: challenge-ACK ignored ");
1003                         return NF_ACCEPT; /* Don't change state */
1004                 }
1005                 break;
1006         case TCP_CONNTRACK_CLOSE:
1007                 if (index == TCP_RST_SET
1008                     && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
1009                     && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) {
1010                         /* Invalid RST  */
1011                         spin_unlock_bh(&ct->lock);
1012                         if (LOG_INVALID(net, IPPROTO_TCP))
1013                                 nf_log_packet(net, pf, 0, skb, NULL, NULL,
1014                                               NULL, "nf_ct_tcp: invalid RST ");
1015                         return -NF_ACCEPT;
1016                 }
1017                 if (index == TCP_RST_SET
1018                     && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
1019                          && ct->proto.tcp.last_index == TCP_SYN_SET)
1020                         || (!test_bit(IPS_ASSURED_BIT, &ct->status)
1021                             && ct->proto.tcp.last_index == TCP_ACK_SET))
1022                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
1023                         /* RST sent to invalid SYN or ACK we had let through
1024                          * at a) and c) above:
1025                          *
1026                          * a) SYN was in window then
1027                          * c) we hold a half-open connection.
1028                          *
1029                          * Delete our connection entry.
1030                          * We skip window checking, because packet might ACK
1031                          * segments we ignored. */
1032                         goto in_window;
1033                 }
1034                 /* Just fall through */
1035         default:
1036                 /* Keep compilers happy. */
1037                 break;
1038         }
1039 
1040         if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
1041                            skb, dataoff, th, pf)) {
1042                 spin_unlock_bh(&ct->lock);
1043                 return -NF_ACCEPT;
1044         }
1045      in_window:
1046         /* From now on we have got in-window packets */
1047         ct->proto.tcp.last_index = index;
1048         ct->proto.tcp.last_dir = dir;
1049 
1050         pr_debug("tcp_conntracks: ");
1051         nf_ct_dump_tuple(tuple);
1052         pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
1053                  (th->syn ? 1 : 0), (th->ack ? 1 : 0),
1054                  (th->fin ? 1 : 0), (th->rst ? 1 : 0),
1055                  old_state, new_state);
1056 
1057         ct->proto.tcp.state = new_state;
1058         if (old_state != new_state
1059             && new_state == TCP_CONNTRACK_FIN_WAIT)
1060                 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
1061 
1062         if (ct->proto.tcp.retrans >= tn->tcp_max_retrans &&
1063             timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
1064                 timeout = timeouts[TCP_CONNTRACK_RETRANS];
1065         else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
1066                  IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
1067                  timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
1068                 timeout = timeouts[TCP_CONNTRACK_UNACK];
1069         else
1070                 timeout = timeouts[new_state];
1071         spin_unlock_bh(&ct->lock);
1072 
1073         if (new_state != old_state)
1074                 nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
1075 
1076         if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
1077                 /* If only reply is a RST, we can consider ourselves not to
1078                    have an established connection: this is a fairly common
1079                    problem case, so we can delete the conntrack
1080                    immediately.  --RR */
1081                 if (th->rst) {
1082                         nf_ct_kill_acct(ct, ctinfo, skb);
1083                         return NF_ACCEPT;
1084                 }
1085                 /* ESTABLISHED without SEEN_REPLY, i.e. mid-connection
1086                  * pickup with loose=1. Avoid large ESTABLISHED timeout.
1087                  */
1088                 if (new_state == TCP_CONNTRACK_ESTABLISHED &&
1089                     timeout > timeouts[TCP_CONNTRACK_UNACK])
1090                         timeout = timeouts[TCP_CONNTRACK_UNACK];
1091         } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
1092                    && (old_state == TCP_CONNTRACK_SYN_RECV
1093                        || old_state == TCP_CONNTRACK_ESTABLISHED)
1094                    && new_state == TCP_CONNTRACK_ESTABLISHED) {
1095                 /* Set ASSURED if we see see valid ack in ESTABLISHED
1096                    after SYN_RECV or a valid answer for a picked up
1097                    connection. */
1098                 set_bit(IPS_ASSURED_BIT, &ct->status);
1099                 nf_conntrack_event_cache(IPCT_ASSURED, ct);
1100         }
1101         nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
1102 
1103         return NF_ACCEPT;
1104 }
1105 
1106 /* Called when a new connection for this protocol found. */
1107 static bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
1108                     unsigned int dataoff, unsigned int *timeouts)
1109 {
1110         enum tcp_conntrack new_state;
1111         const struct tcphdr *th;
1112         struct tcphdr _tcph;
1113         struct net *net = nf_ct_net(ct);
1114         struct nf_tcp_net *tn = tcp_pernet(net);
1115         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
1116         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
1117 
1118         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1119         BUG_ON(th == NULL);
1120 
1121         /* Don't need lock here: this conntrack not in circulation yet */
1122         new_state = tcp_conntracks[0][get_conntrack_index(th)][TCP_CONNTRACK_NONE];
1123 
1124         /* Invalid: delete conntrack */
1125         if (new_state >= TCP_CONNTRACK_MAX) {
1126                 pr_debug("nf_ct_tcp: invalid new deleting.\n");
1127                 return false;
1128         }
1129 
1130         if (new_state == TCP_CONNTRACK_SYN_SENT) {
1131                 memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp));
1132                 /* SYN packet */
1133                 ct->proto.tcp.seen[0].td_end =
1134                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1135                                              dataoff, th);
1136                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1137                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1138                         ct->proto.tcp.seen[0].td_maxwin = 1;
1139                 ct->proto.tcp.seen[0].td_maxend =
1140                         ct->proto.tcp.seen[0].td_end;
1141 
1142                 tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
1143         } else if (tn->tcp_loose == 0) {
1144                 /* Don't try to pick up connections. */
1145                 return false;
1146         } else {
1147                 memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp));
1148                 /*
1149                  * We are in the middle of a connection,
1150                  * its history is lost for us.
1151                  * Let's try to use the data from the packet.
1152                  */
1153                 ct->proto.tcp.seen[0].td_end =
1154                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1155                                              dataoff, th);
1156                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1157                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1158                         ct->proto.tcp.seen[0].td_maxwin = 1;
1159                 ct->proto.tcp.seen[0].td_maxend =
1160                         ct->proto.tcp.seen[0].td_end +
1161                         ct->proto.tcp.seen[0].td_maxwin;
1162 
1163                 /* We assume SACK and liberal window checking to handle
1164                  * window scaling */
1165                 ct->proto.tcp.seen[0].flags =
1166                 ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1167                                               IP_CT_TCP_FLAG_BE_LIBERAL;
1168         }
1169 
1170         /* tcp_packet will set them */
1171         ct->proto.tcp.last_index = TCP_NONE_SET;
1172 
1173         pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1174                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1175                  sender->td_end, sender->td_maxend, sender->td_maxwin,
1176                  sender->td_scale,
1177                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1178                  receiver->td_scale);
1179         return true;
1180 }
1181 
1182 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
1183 
1184 #include <linux/netfilter/nfnetlink.h>
1185 #include <linux/netfilter/nfnetlink_conntrack.h>
1186 
1187 static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
1188                          struct nf_conn *ct)
1189 {
1190         struct nlattr *nest_parms;
1191         struct nf_ct_tcp_flags tmp = {};
1192 
1193         spin_lock_bh(&ct->lock);
1194         nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP | NLA_F_NESTED);
1195         if (!nest_parms)
1196                 goto nla_put_failure;
1197 
1198         if (nla_put_u8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state) ||
1199             nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
1200                        ct->proto.tcp.seen[0].td_scale) ||
1201             nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
1202                        ct->proto.tcp.seen[1].td_scale))
1203                 goto nla_put_failure;
1204 
1205         tmp.flags = ct->proto.tcp.seen[0].flags;
1206         if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
1207                     sizeof(struct nf_ct_tcp_flags), &tmp))
1208                 goto nla_put_failure;
1209 
1210         tmp.flags = ct->proto.tcp.seen[1].flags;
1211         if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
1212                     sizeof(struct nf_ct_tcp_flags), &tmp))
1213                 goto nla_put_failure;
1214         spin_unlock_bh(&ct->lock);
1215 
1216         nla_nest_end(skb, nest_parms);
1217 
1218         return 0;
1219 
1220 nla_put_failure:
1221         spin_unlock_bh(&ct->lock);
1222         return -1;
1223 }
1224 
1225 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
1226         [CTA_PROTOINFO_TCP_STATE]           = { .type = NLA_U8 },
1227         [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
1228         [CTA_PROTOINFO_TCP_WSCALE_REPLY]    = { .type = NLA_U8 },
1229         [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
1230         [CTA_PROTOINFO_TCP_FLAGS_REPLY]     = { .len =  sizeof(struct nf_ct_tcp_flags) },
1231 };
1232 
1233 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
1234 {
1235         struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
1236         struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
1237         int err;
1238 
1239         /* updates could not contain anything about the private
1240          * protocol info, in that case skip the parsing */
1241         if (!pattr)
1242                 return 0;
1243 
1244         err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
1245         if (err < 0)
1246                 return err;
1247 
1248         if (tb[CTA_PROTOINFO_TCP_STATE] &&
1249             nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
1250                 return -EINVAL;
1251 
1252         spin_lock_bh(&ct->lock);
1253         if (tb[CTA_PROTOINFO_TCP_STATE])
1254                 ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
1255 
1256         if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
1257                 struct nf_ct_tcp_flags *attr =
1258                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
1259                 ct->proto.tcp.seen[0].flags &= ~attr->mask;
1260                 ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
1261         }
1262 
1263         if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
1264                 struct nf_ct_tcp_flags *attr =
1265                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
1266                 ct->proto.tcp.seen[1].flags &= ~attr->mask;
1267                 ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
1268         }
1269 
1270         if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
1271             tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
1272             ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
1273             ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1274                 ct->proto.tcp.seen[0].td_scale =
1275                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
1276                 ct->proto.tcp.seen[1].td_scale =
1277                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
1278         }
1279         spin_unlock_bh(&ct->lock);
1280 
1281         return 0;
1282 }
1283 
1284 static int tcp_nlattr_size(void)
1285 {
1286         return nla_total_size(0)           /* CTA_PROTOINFO_TCP */
1287                 + nla_policy_len(tcp_nla_policy, CTA_PROTOINFO_TCP_MAX + 1);
1288 }
1289 
1290 static int tcp_nlattr_tuple_size(void)
1291 {
1292         return nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
1293 }
1294 #endif
1295 
1296 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
1297 
1298 #include <linux/netfilter/nfnetlink.h>
1299 #include <linux/netfilter/nfnetlink_cttimeout.h>
1300 
1301 static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[],
1302                                      struct net *net, void *data)
1303 {
1304         unsigned int *timeouts = data;
1305         struct nf_tcp_net *tn = tcp_pernet(net);
1306         int i;
1307 
1308         /* set default TCP timeouts. */
1309         for (i=0; i<TCP_CONNTRACK_TIMEOUT_MAX; i++)
1310                 timeouts[i] = tn->timeouts[i];
1311 
1312         if (tb[CTA_TIMEOUT_TCP_SYN_SENT]) {
1313                 timeouts[TCP_CONNTRACK_SYN_SENT] =
1314                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT]))*HZ;
1315         }
1316         if (tb[CTA_TIMEOUT_TCP_SYN_RECV]) {
1317                 timeouts[TCP_CONNTRACK_SYN_RECV] =
1318                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_RECV]))*HZ;
1319         }
1320         if (tb[CTA_TIMEOUT_TCP_ESTABLISHED]) {
1321                 timeouts[TCP_CONNTRACK_ESTABLISHED] =
1322                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_ESTABLISHED]))*HZ;
1323         }
1324         if (tb[CTA_TIMEOUT_TCP_FIN_WAIT]) {
1325                 timeouts[TCP_CONNTRACK_FIN_WAIT] =
1326                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_FIN_WAIT]))*HZ;
1327         }
1328         if (tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]) {
1329                 timeouts[TCP_CONNTRACK_CLOSE_WAIT] =
1330                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]))*HZ;
1331         }
1332         if (tb[CTA_TIMEOUT_TCP_LAST_ACK]) {
1333                 timeouts[TCP_CONNTRACK_LAST_ACK] =
1334                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_LAST_ACK]))*HZ;
1335         }
1336         if (tb[CTA_TIMEOUT_TCP_TIME_WAIT]) {
1337                 timeouts[TCP_CONNTRACK_TIME_WAIT] =
1338                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_TIME_WAIT]))*HZ;
1339         }
1340         if (tb[CTA_TIMEOUT_TCP_CLOSE]) {
1341                 timeouts[TCP_CONNTRACK_CLOSE] =
1342                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE]))*HZ;
1343         }
1344         if (tb[CTA_TIMEOUT_TCP_SYN_SENT2]) {
1345                 timeouts[TCP_CONNTRACK_SYN_SENT2] =
1346                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT2]))*HZ;
1347         }
1348         if (tb[CTA_TIMEOUT_TCP_RETRANS]) {
1349                 timeouts[TCP_CONNTRACK_RETRANS] =
1350                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_RETRANS]))*HZ;
1351         }
1352         if (tb[CTA_TIMEOUT_TCP_UNACK]) {
1353                 timeouts[TCP_CONNTRACK_UNACK] =
1354                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_UNACK]))*HZ;
1355         }
1356         return 0;
1357 }
1358 
1359 static int
1360 tcp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
1361 {
1362         const unsigned int *timeouts = data;
1363 
1364         if (nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT,
1365                         htonl(timeouts[TCP_CONNTRACK_SYN_SENT] / HZ)) ||
1366             nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_RECV,
1367                          htonl(timeouts[TCP_CONNTRACK_SYN_RECV] / HZ)) ||
1368             nla_put_be32(skb, CTA_TIMEOUT_TCP_ESTABLISHED,
1369                          htonl(timeouts[TCP_CONNTRACK_ESTABLISHED] / HZ)) ||
1370             nla_put_be32(skb, CTA_TIMEOUT_TCP_FIN_WAIT,
1371                          htonl(timeouts[TCP_CONNTRACK_FIN_WAIT] / HZ)) ||
1372             nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE_WAIT,
1373                          htonl(timeouts[TCP_CONNTRACK_CLOSE_WAIT] / HZ)) ||
1374             nla_put_be32(skb, CTA_TIMEOUT_TCP_LAST_ACK,
1375                          htonl(timeouts[TCP_CONNTRACK_LAST_ACK] / HZ)) ||
1376             nla_put_be32(skb, CTA_TIMEOUT_TCP_TIME_WAIT,
1377                          htonl(timeouts[TCP_CONNTRACK_TIME_WAIT] / HZ)) ||
1378             nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE,
1379                          htonl(timeouts[TCP_CONNTRACK_CLOSE] / HZ)) ||
1380             nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT2,
1381                          htonl(timeouts[TCP_CONNTRACK_SYN_SENT2] / HZ)) ||
1382             nla_put_be32(skb, CTA_TIMEOUT_TCP_RETRANS,
1383                          htonl(timeouts[TCP_CONNTRACK_RETRANS] / HZ)) ||
1384             nla_put_be32(skb, CTA_TIMEOUT_TCP_UNACK,
1385                          htonl(timeouts[TCP_CONNTRACK_UNACK] / HZ)))
1386                 goto nla_put_failure;
1387         return 0;
1388 
1389 nla_put_failure:
1390         return -ENOSPC;
1391 }
1392 
1393 static const struct nla_policy tcp_timeout_nla_policy[CTA_TIMEOUT_TCP_MAX+1] = {
1394         [CTA_TIMEOUT_TCP_SYN_SENT]      = { .type = NLA_U32 },
1395         [CTA_TIMEOUT_TCP_SYN_RECV]      = { .type = NLA_U32 },
1396         [CTA_TIMEOUT_TCP_ESTABLISHED]   = { .type = NLA_U32 },
1397         [CTA_TIMEOUT_TCP_FIN_WAIT]      = { .type = NLA_U32 },
1398         [CTA_TIMEOUT_TCP_CLOSE_WAIT]    = { .type = NLA_U32 },
1399         [CTA_TIMEOUT_TCP_LAST_ACK]      = { .type = NLA_U32 },
1400         [CTA_TIMEOUT_TCP_TIME_WAIT]     = { .type = NLA_U32 },
1401         [CTA_TIMEOUT_TCP_CLOSE]         = { .type = NLA_U32 },
1402         [CTA_TIMEOUT_TCP_SYN_SENT2]     = { .type = NLA_U32 },
1403         [CTA_TIMEOUT_TCP_RETRANS]       = { .type = NLA_U32 },
1404         [CTA_TIMEOUT_TCP_UNACK]         = { .type = NLA_U32 },
1405 };
1406 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
1407 
1408 #ifdef CONFIG_SYSCTL
1409 static struct ctl_table tcp_sysctl_table[] = {
1410         {
1411                 .procname       = "nf_conntrack_tcp_timeout_syn_sent",
1412                 .maxlen         = sizeof(unsigned int),
1413                 .mode           = 0644,
1414                 .proc_handler   = proc_dointvec_jiffies,
1415         },
1416         {
1417                 .procname       = "nf_conntrack_tcp_timeout_syn_recv",
1418                 .maxlen         = sizeof(unsigned int),
1419                 .mode           = 0644,
1420                 .proc_handler   = proc_dointvec_jiffies,
1421         },
1422         {
1423                 .procname       = "nf_conntrack_tcp_timeout_established",
1424                 .maxlen         = sizeof(unsigned int),
1425                 .mode           = 0644,
1426                 .proc_handler   = proc_dointvec_jiffies,
1427         },
1428         {
1429                 .procname       = "nf_conntrack_tcp_timeout_fin_wait",
1430                 .maxlen         = sizeof(unsigned int),
1431                 .mode           = 0644,
1432                 .proc_handler   = proc_dointvec_jiffies,
1433         },
1434         {
1435                 .procname       = "nf_conntrack_tcp_timeout_close_wait",
1436                 .maxlen         = sizeof(unsigned int),
1437                 .mode           = 0644,
1438                 .proc_handler   = proc_dointvec_jiffies,
1439         },
1440         {
1441                 .procname       = "nf_conntrack_tcp_timeout_last_ack",
1442                 .maxlen         = sizeof(unsigned int),
1443                 .mode           = 0644,
1444                 .proc_handler   = proc_dointvec_jiffies,
1445         },
1446         {
1447                 .procname       = "nf_conntrack_tcp_timeout_time_wait",
1448                 .maxlen         = sizeof(unsigned int),
1449                 .mode           = 0644,
1450                 .proc_handler   = proc_dointvec_jiffies,
1451         },
1452         {
1453                 .procname       = "nf_conntrack_tcp_timeout_close",
1454                 .maxlen         = sizeof(unsigned int),
1455                 .mode           = 0644,
1456                 .proc_handler   = proc_dointvec_jiffies,
1457         },
1458         {
1459                 .procname       = "nf_conntrack_tcp_timeout_max_retrans",
1460                 .maxlen         = sizeof(unsigned int),
1461                 .mode           = 0644,
1462                 .proc_handler   = proc_dointvec_jiffies,
1463         },
1464         {
1465                 .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
1466                 .maxlen         = sizeof(unsigned int),
1467                 .mode           = 0644,
1468                 .proc_handler   = proc_dointvec_jiffies,
1469         },
1470         {
1471                 .procname       = "nf_conntrack_tcp_loose",
1472                 .maxlen         = sizeof(unsigned int),
1473                 .mode           = 0644,
1474                 .proc_handler   = proc_dointvec,
1475         },
1476         {
1477                 .procname       = "nf_conntrack_tcp_be_liberal",
1478                 .maxlen         = sizeof(unsigned int),
1479                 .mode           = 0644,
1480                 .proc_handler   = proc_dointvec,
1481         },
1482         {
1483                 .procname       = "nf_conntrack_tcp_max_retrans",
1484                 .maxlen         = sizeof(unsigned int),
1485                 .mode           = 0644,
1486                 .proc_handler   = proc_dointvec,
1487         },
1488         { }
1489 };
1490 
1491 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1492 static struct ctl_table tcp_compat_sysctl_table[] = {
1493         {
1494                 .procname       = "ip_conntrack_tcp_timeout_syn_sent",
1495                 .maxlen         = sizeof(unsigned int),
1496                 .mode           = 0644,
1497                 .proc_handler   = proc_dointvec_jiffies,
1498         },
1499         {
1500                 .procname       = "ip_conntrack_tcp_timeout_syn_sent2",
1501                 .maxlen         = sizeof(unsigned int),
1502                 .mode           = 0644,
1503                 .proc_handler   = proc_dointvec_jiffies,
1504         },
1505         {
1506                 .procname       = "ip_conntrack_tcp_timeout_syn_recv",
1507                 .maxlen         = sizeof(unsigned int),
1508                 .mode           = 0644,
1509                 .proc_handler   = proc_dointvec_jiffies,
1510         },
1511         {
1512                 .procname       = "ip_conntrack_tcp_timeout_established",
1513                 .maxlen         = sizeof(unsigned int),
1514                 .mode           = 0644,
1515                 .proc_handler   = proc_dointvec_jiffies,
1516         },
1517         {
1518                 .procname       = "ip_conntrack_tcp_timeout_fin_wait",
1519                 .maxlen         = sizeof(unsigned int),
1520                 .mode           = 0644,
1521                 .proc_handler   = proc_dointvec_jiffies,
1522         },
1523         {
1524                 .procname       = "ip_conntrack_tcp_timeout_close_wait",
1525                 .maxlen         = sizeof(unsigned int),
1526                 .mode           = 0644,
1527                 .proc_handler   = proc_dointvec_jiffies,
1528         },
1529         {
1530                 .procname       = "ip_conntrack_tcp_timeout_last_ack",
1531                 .maxlen         = sizeof(unsigned int),
1532                 .mode           = 0644,
1533                 .proc_handler   = proc_dointvec_jiffies,
1534         },
1535         {
1536                 .procname       = "ip_conntrack_tcp_timeout_time_wait",
1537                 .maxlen         = sizeof(unsigned int),
1538                 .mode           = 0644,
1539                 .proc_handler   = proc_dointvec_jiffies,
1540         },
1541         {
1542                 .procname       = "ip_conntrack_tcp_timeout_close",
1543                 .maxlen         = sizeof(unsigned int),
1544                 .mode           = 0644,
1545                 .proc_handler   = proc_dointvec_jiffies,
1546         },
1547         {
1548                 .procname       = "ip_conntrack_tcp_timeout_max_retrans",
1549                 .maxlen         = sizeof(unsigned int),
1550                 .mode           = 0644,
1551                 .proc_handler   = proc_dointvec_jiffies,
1552         },
1553         {
1554                 .procname       = "ip_conntrack_tcp_loose",
1555                 .maxlen         = sizeof(unsigned int),
1556                 .mode           = 0644,
1557                 .proc_handler   = proc_dointvec,
1558         },
1559         {
1560                 .procname       = "ip_conntrack_tcp_be_liberal",
1561                 .maxlen         = sizeof(unsigned int),
1562                 .mode           = 0644,
1563                 .proc_handler   = proc_dointvec,
1564         },
1565         {
1566                 .procname       = "ip_conntrack_tcp_max_retrans",
1567                 .maxlen         = sizeof(unsigned int),
1568                 .mode           = 0644,
1569                 .proc_handler   = proc_dointvec,
1570         },
1571         { }
1572 };
1573 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
1574 #endif /* CONFIG_SYSCTL */
1575 
1576 static int tcp_kmemdup_sysctl_table(struct nf_proto_net *pn,
1577                                     struct nf_tcp_net *tn)
1578 {
1579 #ifdef CONFIG_SYSCTL
1580         if (pn->ctl_table)
1581                 return 0;
1582 
1583         pn->ctl_table = kmemdup(tcp_sysctl_table,
1584                                 sizeof(tcp_sysctl_table),
1585                                 GFP_KERNEL);
1586         if (!pn->ctl_table)
1587                 return -ENOMEM;
1588 
1589         pn->ctl_table[0].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT];
1590         pn->ctl_table[1].data = &tn->timeouts[TCP_CONNTRACK_SYN_RECV];
1591         pn->ctl_table[2].data = &tn->timeouts[TCP_CONNTRACK_ESTABLISHED];
1592         pn->ctl_table[3].data = &tn->timeouts[TCP_CONNTRACK_FIN_WAIT];
1593         pn->ctl_table[4].data = &tn->timeouts[TCP_CONNTRACK_CLOSE_WAIT];
1594         pn->ctl_table[5].data = &tn->timeouts[TCP_CONNTRACK_LAST_ACK];
1595         pn->ctl_table[6].data = &tn->timeouts[TCP_CONNTRACK_TIME_WAIT];
1596         pn->ctl_table[7].data = &tn->timeouts[TCP_CONNTRACK_CLOSE];
1597         pn->ctl_table[8].data = &tn->timeouts[TCP_CONNTRACK_RETRANS];
1598         pn->ctl_table[9].data = &tn->timeouts[TCP_CONNTRACK_UNACK];
1599         pn->ctl_table[10].data = &tn->tcp_loose;
1600         pn->ctl_table[11].data = &tn->tcp_be_liberal;
1601         pn->ctl_table[12].data = &tn->tcp_max_retrans;
1602 #endif
1603         return 0;
1604 }
1605 
1606 static int tcp_kmemdup_compat_sysctl_table(struct nf_proto_net *pn,
1607                                            struct nf_tcp_net *tn)
1608 {
1609 #ifdef CONFIG_SYSCTL
1610 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1611         pn->ctl_compat_table = kmemdup(tcp_compat_sysctl_table,
1612                                        sizeof(tcp_compat_sysctl_table),
1613                                        GFP_KERNEL);
1614         if (!pn->ctl_compat_table)
1615                 return -ENOMEM;
1616 
1617         pn->ctl_compat_table[0].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT];
1618         pn->ctl_compat_table[1].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT2];
1619         pn->ctl_compat_table[2].data = &tn->timeouts[TCP_CONNTRACK_SYN_RECV];
1620         pn->ctl_compat_table[3].data = &tn->timeouts[TCP_CONNTRACK_ESTABLISHED];
1621         pn->ctl_compat_table[4].data = &tn->timeouts[TCP_CONNTRACK_FIN_WAIT];
1622         pn->ctl_compat_table[5].data = &tn->timeouts[TCP_CONNTRACK_CLOSE_WAIT];
1623         pn->ctl_compat_table[6].data = &tn->timeouts[TCP_CONNTRACK_LAST_ACK];
1624         pn->ctl_compat_table[7].data = &tn->timeouts[TCP_CONNTRACK_TIME_WAIT];
1625         pn->ctl_compat_table[8].data = &tn->timeouts[TCP_CONNTRACK_CLOSE];
1626         pn->ctl_compat_table[9].data = &tn->timeouts[TCP_CONNTRACK_RETRANS];
1627         pn->ctl_compat_table[10].data = &tn->tcp_loose;
1628         pn->ctl_compat_table[11].data = &tn->tcp_be_liberal;
1629         pn->ctl_compat_table[12].data = &tn->tcp_max_retrans;
1630 #endif
1631 #endif
1632         return 0;
1633 }
1634 
1635 static int tcp_init_net(struct net *net, u_int16_t proto)
1636 {
1637         int ret;
1638         struct nf_tcp_net *tn = tcp_pernet(net);
1639         struct nf_proto_net *pn = &tn->pn;
1640 
1641         if (!pn->users) {
1642                 int i;
1643 
1644                 for (i = 0; i < TCP_CONNTRACK_TIMEOUT_MAX; i++)
1645                         tn->timeouts[i] = tcp_timeouts[i];
1646 
1647                 tn->tcp_loose = nf_ct_tcp_loose;
1648                 tn->tcp_be_liberal = nf_ct_tcp_be_liberal;
1649                 tn->tcp_max_retrans = nf_ct_tcp_max_retrans;
1650         }
1651 
1652         if (proto == AF_INET) {
1653                 ret = tcp_kmemdup_compat_sysctl_table(pn, tn);
1654                 if (ret < 0)
1655                         return ret;
1656 
1657                 ret = tcp_kmemdup_sysctl_table(pn, tn);
1658                 if (ret < 0)
1659                         nf_ct_kfree_compat_sysctl_table(pn);
1660         } else
1661                 ret = tcp_kmemdup_sysctl_table(pn, tn);
1662 
1663         return ret;
1664 }
1665 
1666 static struct nf_proto_net *tcp_get_net_proto(struct net *net)
1667 {
1668         return &net->ct.nf_ct_proto.tcp.pn;
1669 }
1670 
1671 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
1672 {
1673         .l3proto                = PF_INET,
1674         .l4proto                = IPPROTO_TCP,
1675         .name                   = "tcp",
1676         .pkt_to_tuple           = tcp_pkt_to_tuple,
1677         .invert_tuple           = tcp_invert_tuple,
1678         .print_tuple            = tcp_print_tuple,
1679         .print_conntrack        = tcp_print_conntrack,
1680         .packet                 = tcp_packet,
1681         .get_timeouts           = tcp_get_timeouts,
1682         .new                    = tcp_new,
1683         .error                  = tcp_error,
1684 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
1685         .to_nlattr              = tcp_to_nlattr,
1686         .nlattr_size            = tcp_nlattr_size,
1687         .from_nlattr            = nlattr_to_tcp,
1688         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1689         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1690         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1691         .nla_policy             = nf_ct_port_nla_policy,
1692 #endif
1693 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
1694         .ctnl_timeout           = {
1695                 .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
1696                 .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
1697                 .nlattr_max     = CTA_TIMEOUT_TCP_MAX,
1698                 .obj_size       = sizeof(unsigned int) *
1699                                         TCP_CONNTRACK_TIMEOUT_MAX,
1700                 .nla_policy     = tcp_timeout_nla_policy,
1701         },
1702 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
1703         .init_net               = tcp_init_net,
1704         .get_net_proto          = tcp_get_net_proto,
1705 };
1706 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
1707 
1708 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
1709 {
1710         .l3proto                = PF_INET6,
1711         .l4proto                = IPPROTO_TCP,
1712         .name                   = "tcp",
1713         .pkt_to_tuple           = tcp_pkt_to_tuple,
1714         .invert_tuple           = tcp_invert_tuple,
1715         .print_tuple            = tcp_print_tuple,
1716         .print_conntrack        = tcp_print_conntrack,
1717         .packet                 = tcp_packet,
1718         .get_timeouts           = tcp_get_timeouts,
1719         .new                    = tcp_new,
1720         .error                  = tcp_error,
1721 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
1722         .to_nlattr              = tcp_to_nlattr,
1723         .nlattr_size            = tcp_nlattr_size,
1724         .from_nlattr            = nlattr_to_tcp,
1725         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1726         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1727         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1728         .nla_policy             = nf_ct_port_nla_policy,
1729 #endif
1730 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
1731         .ctnl_timeout           = {
1732                 .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
1733                 .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
1734                 .nlattr_max     = CTA_TIMEOUT_TCP_MAX,
1735                 .obj_size       = sizeof(unsigned int) *
1736                                         TCP_CONNTRACK_TIMEOUT_MAX,
1737                 .nla_policy     = tcp_timeout_nla_policy,
1738         },
1739 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
1740         .init_net               = tcp_init_net,
1741         .get_net_proto          = tcp_get_net_proto,
1742 };
1743 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);
1744 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp