net/netfilter/nf_conntrack_proto_tcp.c

   1 /* (C) 1999-2001 Paul `Rusty' Russell
   2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/types.h>
  10 #include <linux/timer.h>
  11 #include <linux/module.h>
  12 #include <linux/in.h>
  13 #include <linux/tcp.h>
  14 #include <linux/spinlock.h>
  15 #include <linux/skbuff.h>
  16 #include <linux/ipv6.h>
  17 #include <net/ip6_checksum.h>
  18 #include <asm/unaligned.h>
  19
  20 #include <net/tcp.h>
  21
  22 #include <linux/netfilter.h>
  23 #include <linux/netfilter_ipv4.h>
  24 #include <linux/netfilter_ipv6.h>
  25 #include <net/netfilter/nf_conntrack.h>
  26 #include <net/netfilter/nf_conntrack_l4proto.h>
  27 #include <net/netfilter/nf_conntrack_ecache.h>
  28 #include <net/netfilter/nf_log.h>
  29 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
  30 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
  31
  32 /* "Be conservative in what you do,
  33     be liberal in what you accept from others."
  34     If it's non-zero, we mark only out of window RST segments as INVALID. */
  35 static int nf_ct_tcp_be_liberal __read_mostly = 0;
  36
  37 /* If it is set to zero, we disable picking up already established
  38    connections. */
  39 static int nf_ct_tcp_loose __read_mostly = 1;
  40
  41 /* Max number of the retransmitted packets without receiving an (acceptable)
  42    ACK from the destination. If this number is reached, a shorter timer
  43    will be started. */
  44 static int nf_ct_tcp_max_retrans __read_mostly = 3;
  45
  46   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
  47      closely.  They're more complex. --RR */
  48
  49 static const char *const tcp_conntrack_names[] = {
  50         "NONE",
  51         "SYN_SENT",
  52         "SYN_RECV",
  53         "ESTABLISHED",
  54         "FIN_WAIT",
  55         "CLOSE_WAIT",
  56         "LAST_ACK",
  57         "TIME_WAIT",
  58         "CLOSE",
  59         "SYN_SENT2",
  60 };
  61
  62 #define SECS * HZ
  63 #define MINS * 60 SECS
  64 #define HOURS * 60 MINS
  65 #define DAYS * 24 HOURS
  66
  67 /* RFC1122 says the R2 limit should be at least 100 seconds.
  68    Linux uses 15 packets as limit, which corresponds
  69    to ~13-30min depending on RTO. */
  70 static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly    =   5 MINS;
  71 static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly =   5 MINS;
  72
  73 static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
  74         [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
  75         [TCP_CONNTRACK_SYN_RECV]        = 60 SECS,
  76         [TCP_CONNTRACK_ESTABLISHED]     = 5 DAYS,
  77         [TCP_CONNTRACK_FIN_WAIT]        = 2 MINS,
  78         [TCP_CONNTRACK_CLOSE_WAIT]      = 60 SECS,
  79         [TCP_CONNTRACK_LAST_ACK]        = 30 SECS,
  80         [TCP_CONNTRACK_TIME_WAIT]       = 2 MINS,
  81         [TCP_CONNTRACK_CLOSE]           = 10 SECS,
  82         [TCP_CONNTRACK_SYN_SENT2]       = 2 MINS,
  83 };
  84
  85 #define sNO TCP_CONNTRACK_NONE
  86 #define sSS TCP_CONNTRACK_SYN_SENT
  87 #define sSR TCP_CONNTRACK_SYN_RECV
  88 #define sES TCP_CONNTRACK_ESTABLISHED
  89 #define sFW TCP_CONNTRACK_FIN_WAIT
  90 #define sCW TCP_CONNTRACK_CLOSE_WAIT
  91 #define sLA TCP_CONNTRACK_LAST_ACK
  92 #define sTW TCP_CONNTRACK_TIME_WAIT
  93 #define sCL TCP_CONNTRACK_CLOSE
  94 #define sS2 TCP_CONNTRACK_SYN_SENT2
  95 #define sIV TCP_CONNTRACK_MAX
  96 #define sIG TCP_CONNTRACK_IGNORE
  97
  98 /* What TCP flags are set from RST/SYN/FIN/ACK. */
  99 enum tcp_bit_set {
 100         TCP_SYN_SET,
 101         TCP_SYNACK_SET,
 102         TCP_FIN_SET,
 103         TCP_ACK_SET,
 104         TCP_RST_SET,
 105         TCP_NONE_SET,
 106 };
 107
 108 /*
 109  * The TCP state transition table needs a few words...
 110  *
 111  * We are the man in the middle. All the packets go through us
 112  * but might get lost in transit to the destination.
 113  * It is assumed that the destinations can't receive segments
 114  * we haven't seen.
 115  *
 116  * The checked segment is in window, but our windows are *not*
 117  * equivalent with the ones of the sender/receiver. We always
 118  * try to guess the state of the current sender.
 119  *
 120  * The meaning of the states are:
 121  *
 122  * NONE:        initial state
 123  * SYN_SENT:    SYN-only packet seen
 124  * SYN_SENT2:   SYN-only packet seen from reply dir, simultaneous open
 125  * SYN_RECV:    SYN-ACK packet seen
 126  * ESTABLISHED: ACK packet seen
 127  * FIN_WAIT:    FIN packet seen
 128  * CLOSE_WAIT:  ACK seen (after FIN)
 129  * LAST_ACK:    FIN seen (after FIN)
 130  * TIME_WAIT:   last ACK seen
 131  * CLOSE:       closed connection (RST)
 132  *
 133  * Packets marked as IGNORED (sIG):
 134  *      if they may be either invalid or valid
 135  *      and the receiver may send back a connection
 136  *      closing RST or a SYN/ACK.
 137  *
 138  * Packets marked as INVALID (sIV):
 139  *      if we regard them as truly invalid packets
 140  */
 141 static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
 142         {
 143 /* ORIGINAL */
 144 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 145 /*syn*/    { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sS2 },
 146 /*
 147  *      sNO -> sSS      Initialize a new connection
 148  *      sSS -> sSS      Retransmitted SYN
 149  *      sS2 -> sS2      Late retransmitted SYN
 150  *      sSR -> sIG
 151  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
 152  *                      are errors. Receiver will reply with RST
 153  *                      and close the connection.
 154  *                      Or we are not in sync and hold a dead connection.
 155  *      sFW -> sIG
 156  *      sCW -> sIG
 157  *      sLA -> sIG
 158  *      sTW -> sSS      Reopened connection (RFC 1122).
 159  *      sCL -> sSS
 160  */
 161 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 162 /*synack*/ { sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
 163 /*
 164  *      sNO -> sIV      Too late and no reason to do anything
 165  *      sSS -> sIV      Client can't send SYN and then SYN/ACK
 166  *      sS2 -> sSR      SYN/ACK sent to SYN2 in simultaneous open
 167  *      sSR -> sIG
 168  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
 169  *                      are errors. Receiver will reply with RST
 170  *                      and close the connection.
 171  *                      Or we are not in sync and hold a dead connection.
 172  *      sFW -> sIG
 173  *      sCW -> sIG
 174  *      sLA -> sIG
 175  *      sTW -> sIG
 176  *      sCL -> sIG
 177  */
 178 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 179 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 180 /*
 181  *      sNO -> sIV      Too late and no reason to do anything...
 182  *      sSS -> sIV      Client migth not send FIN in this state:
 183  *                      we enforce waiting for a SYN/ACK reply first.
 184  *      sS2 -> sIV
 185  *      sSR -> sFW      Close started.
 186  *      sES -> sFW
 187  *      sFW -> sLA      FIN seen in both directions, waiting for
 188  *                      the last ACK.
 189  *                      Migth be a retransmitted FIN as well...
 190  *      sCW -> sLA
 191  *      sLA -> sLA      Retransmitted FIN. Remain in the same state.
 192  *      sTW -> sTW
 193  *      sCL -> sCL
 194  */
 195 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 196 /*ack*/    { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 197 /*
 198  *      sNO -> sES      Assumed.
 199  *      sSS -> sIV      ACK is invalid: we haven't seen a SYN/ACK yet.
 200  *      sS2 -> sIV
 201  *      sSR -> sES      Established state is reached.
 202  *      sES -> sES      :-)
 203  *      sFW -> sCW      Normal close request answered by ACK.
 204  *      sCW -> sCW
 205  *      sLA -> sTW      Last ACK detected.
 206  *      sTW -> sTW      Retransmitted last ACK. Remain in the same state.
 207  *      sCL -> sCL
 208  */
 209 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 210 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
 211 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 212         },
 213         {
 214 /* REPLY */
 215 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 216 /*syn*/    { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sS2 },
 217 /*
 218  *      sNO -> sIV      Never reached.
 219  *      sSS -> sS2      Simultaneous open
 220  *      sS2 -> sS2      Retransmitted simultaneous SYN
 221  *      sSR -> sIV      Invalid SYN packets sent by the server
 222  *      sES -> sIV
 223  *      sFW -> sIV
 224  *      sCW -> sIV
 225  *      sLA -> sIV
 226  *      sTW -> sIV      Reopened connection, but server may not do it.
 227  *      sCL -> sIV
 228  */
 229 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 230 /*synack*/ { sIV, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
 231 /*
 232  *      sSS -> sSR      Standard open.
 233  *      sS2 -> sSR      Simultaneous open
 234  *      sSR -> sIG      Retransmitted SYN/ACK, ignore it.
 235  *      sES -> sIG      Late retransmitted SYN/ACK?
 236  *      sFW -> sIG      Might be SYN/ACK answering ignored SYN
 237  *      sCW -> sIG
 238  *      sLA -> sIG
 239  *      sTW -> sIG
 240  *      sCL -> sIG
 241  */
 242 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 243 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 244 /*
 245  *      sSS -> sIV      Server might not send FIN in this state.
 246  *      sS2 -> sIV
 247  *      sSR -> sFW      Close started.
 248  *      sES -> sFW
 249  *      sFW -> sLA      FIN seen in both directions.
 250  *      sCW -> sLA
 251  *      sLA -> sLA      Retransmitted FIN.
 252  *      sTW -> sTW
 253  *      sCL -> sCL
 254  */
 255 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 256 /*ack*/    { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIG },
 257 /*
 258  *      sSS -> sIG      Might be a half-open connection.
 259  *      sS2 -> sIG
 260  *      sSR -> sSR      Might answer late resent SYN.
 261  *      sES -> sES      :-)
 262  *      sFW -> sCW      Normal close request answered by ACK.
 263  *      sCW -> sCW
 264  *      sLA -> sTW      Last ACK detected.
 265  *      sTW -> sTW      Retransmitted last ACK.
 266  *      sCL -> sCL
 267  */
 268 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
 269 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
 270 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 271         }
 272 };
 273
 274 static bool tcp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
 275                              struct nf_conntrack_tuple *tuple)
 276 {
 277         const struct tcphdr *hp;
 278         struct tcphdr _hdr;
 279
 280         /* Actually only need first 8 bytes. */
 281         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
 282         if (hp == NULL)
 283                 return false;
 284
 285         tuple->src.u.tcp.port = hp->source;
 286         tuple->dst.u.tcp.port = hp->dest;
 287
 288         return true;
 289 }
 290
 291 static bool tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
 292                              const struct nf_conntrack_tuple *orig)
 293 {
 294         tuple->src.u.tcp.port = orig->dst.u.tcp.port;
 295         tuple->dst.u.tcp.port = orig->src.u.tcp.port;
 296         return true;
 297 }
 298
 299 /* Print out the per-protocol part of the tuple. */
 300 static int tcp_print_tuple(struct seq_file *s,
 301                            const struct nf_conntrack_tuple *tuple)
 302 {
 303         return seq_printf(s, "sport=%hu dport=%hu ",
 304                           ntohs(tuple->src.u.tcp.port),
 305                           ntohs(tuple->dst.u.tcp.port));
 306 }
 307
 308 /* Print out the private part of the conntrack. */
 309 static int tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
 310 {
 311         enum tcp_conntrack state;
 312
 313         spin_lock_bh(&ct->lock);
 314         state = ct->proto.tcp.state;
 315         spin_unlock_bh(&ct->lock);
 316
 317         return seq_printf(s, "%s ", tcp_conntrack_names[state]);
 318 }
 319
 320 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
 321 {
 322         if (tcph->rst) return TCP_RST_SET;
 323         else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
 324         else if (tcph->fin) return TCP_FIN_SET;
 325         else if (tcph->ack) return TCP_ACK_SET;
 326         else return TCP_NONE_SET;
 327 }
 328
 329 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
 330    in IP Filter' by Guido van Rooij.
 331
 332    http://www.sane.nl/events/sane2000/papers.html
 333    http://www.darkart.com/mirrors/www.obfuscation.org/ipf/
 334
 335    The boundaries and the conditions are changed according to RFC793:
 336    the packet must intersect the window (i.e. segments may be
 337    after the right or before the left edge) and thus receivers may ACK
 338    segments after the right edge of the window.
 339
 340         td_maxend = max(sack + max(win,1)) seen in reply packets
 341         td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
 342         td_maxwin += seq + len - sender.td_maxend
 343                         if seq + len > sender.td_maxend
 344         td_end    = max(seq + len) seen in sent packets
 345
 346    I.   Upper bound for valid data:     seq <= sender.td_maxend
 347    II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
 348    III. Upper bound for valid (s)ack:   sack <= receiver.td_end
 349    IV.  Lower bound for valid (s)ack:   sack >= receiver.td_end - MAXACKWINDOW
 350
 351    where sack is the highest right edge of sack block found in the packet
 352    or ack in the case of packet without SACK option.
 353
 354    The upper bound limit for a valid (s)ack is not ignored -
 355    we doesn't have to deal with fragments.
 356 */
 357
 358 static inline __u32 segment_seq_plus_len(__u32 seq,
 359                                          size_t len,
 360                                          unsigned int dataoff,
 361                                          const struct tcphdr *tcph)
 362 {
 363         /* XXX Should I use payload length field in IP/IPv6 header ?
 364          * - YK */
 365         return (seq + len - dataoff - tcph->doff*4
 366                 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
 367 }
 368
 369 /* Fixme: what about big packets? */
 370 #define MAXACKWINCONST                  66000
 371 #define MAXACKWINDOW(sender)                                            \
 372         ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin     \
 373                                               : MAXACKWINCONST)
 374
 375 /*
 376  * Simplified tcp_parse_options routine from tcp_input.c
 377  */
 378 static void tcp_options(const struct sk_buff *skb,
 379                         unsigned int dataoff,
 380                         const struct tcphdr *tcph,
 381                         struct ip_ct_tcp_state *state)
 382 {
 383         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 384         const unsigned char *ptr;
 385         int length = (tcph->doff*4) - sizeof(struct tcphdr);
 386
 387         if (!length)
 388                 return;
 389
 390         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
 391                                  length, buff);
 392         BUG_ON(ptr == NULL);
 393
 394         state->td_scale =
 395         state->flags = 0;
 396
 397         while (length > 0) {
 398                 int opcode=*ptr++;
 399                 int opsize;
 400
 401                 switch (opcode) {
 402                 case TCPOPT_EOL:
 403                         return;
 404                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
 405                         length--;
 406                         continue;
 407                 default:
 408                         opsize=*ptr++;
 409                         if (opsize < 2) /* "silly options" */
 410                                 return;
 411                         if (opsize > length)
 412                                 return; /* don't parse partial options */
 413
 414                         if (opcode == TCPOPT_SACK_PERM
 415                             && opsize == TCPOLEN_SACK_PERM)
 416                                 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
 417                         else if (opcode == TCPOPT_WINDOW
 418                                  && opsize == TCPOLEN_WINDOW) {
 419                                 state->td_scale = *(u_int8_t *)ptr;
 420
 421                                 if (state->td_scale > 14) {
 422                                         /* See RFC1323 */
 423                                         state->td_scale = 14;
 424                                 }
 425                                 state->flags |=
 426                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
 427                         }
 428                         ptr += opsize - 2;
 429                         length -= opsize;
 430                 }
 431         }
 432 }
 433
 434 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
 435                      const struct tcphdr *tcph, __u32 *sack)
 436 {
 437         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 438         const unsigned char *ptr;
 439         int length = (tcph->doff*4) - sizeof(struct tcphdr);
 440         __u32 tmp;
 441
 442         if (!length)
 443                 return;
 444
 445         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
 446                                  length, buff);
 447         BUG_ON(ptr == NULL);
 448
 449         /* Fast path for timestamp-only option */
 450         if (length == TCPOLEN_TSTAMP_ALIGNED
 451             && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
 452                                        | (TCPOPT_NOP << 16)
 453                                        | (TCPOPT_TIMESTAMP << 8)
 454                                        | TCPOLEN_TIMESTAMP))
 455                 return;
 456
 457         while (length > 0) {
 458                 int opcode = *ptr++;
 459                 int opsize, i;
 460
 461                 switch (opcode) {
 462                 case TCPOPT_EOL:
 463                         return;
 464                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
 465                         length--;
 466                         continue;
 467                 default:
 468                         opsize = *ptr++;
 469                         if (opsize < 2) /* "silly options" */
 470                                 return;
 471                         if (opsize > length)
 472                                 return; /* don't parse partial options */
 473
 474                         if (opcode == TCPOPT_SACK
 475                             && opsize >= (TCPOLEN_SACK_BASE
 476                                           + TCPOLEN_SACK_PERBLOCK)
 477                             && !((opsize - TCPOLEN_SACK_BASE)
 478                                  % TCPOLEN_SACK_PERBLOCK)) {
 479                                 for (i = 0;
 480                                      i < (opsize - TCPOLEN_SACK_BASE);
 481                                      i += TCPOLEN_SACK_PERBLOCK) {
 482                                         tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
 483
 484                                         if (after(tmp, *sack))
 485                                                 *sack = tmp;
 486                                 }
 487                                 return;
 488                         }
 489                         ptr += opsize - 2;
 490                         length -= opsize;
 491                 }
 492         }
 493 }
 494
 495 #ifdef CONFIG_NF_NAT_NEEDED
 496 static inline s16 nat_offset(const struct nf_conn *ct,
 497                              enum ip_conntrack_dir dir,
 498                              u32 seq)
 499 {
 500         typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
 501
 502         return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
 503 }
 504 #define NAT_OFFSET(pf, ct, dir, seq) \
 505         (pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0)
 506 #else
 507 #define NAT_OFFSET(pf, ct, dir, seq)    0
 508 #endif
 509
 510 static bool tcp_in_window(const struct nf_conn *ct,
 511                           struct ip_ct_tcp *state,
 512                           enum ip_conntrack_dir dir,
 513                           unsigned int index,
 514                           const struct sk_buff *skb,
 515                           unsigned int dataoff,
 516                           const struct tcphdr *tcph,
 517                           u_int8_t pf)
 518 {
 519         struct net *net = nf_ct_net(ct);
 520         struct ip_ct_tcp_state *sender = &state->seen[dir];
 521         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
 522         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
 523         __u32 seq, ack, sack, end, win, swin;
 524         s16 receiver_offset;
 525         bool res;
 526
 527         /*
 528          * Get the required data from the packet.
 529          */
 530         seq = ntohl(tcph->seq);
 531         ack = sack = ntohl(tcph->ack_seq);
 532         win = ntohs(tcph->window);
 533         end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
 534
 535         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
 536                 tcp_sack(skb, dataoff, tcph, &sack);
 537
 538         /* Take into account NAT sequence number mangling */
 539         receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);
 540         ack -= receiver_offset;
 541         sack -= receiver_offset;
 542
 543         pr_debug("tcp_in_window: START\n");
 544         pr_debug("tcp_in_window: ");
 545         nf_ct_dump_tuple(tuple);
 546         pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
 547                  seq, ack, receiver_offset, sack, receiver_offset, win, end);
 548         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 549                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 550                  sender->td_end, sender->td_maxend, sender->td_maxwin,
 551                  sender->td_scale,
 552                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 553                  receiver->td_scale);
 554
 555         if (sender->td_maxwin == 0) {
 556                 /*
 557                  * Initialize sender data.
 558                  */
 559                 if (tcph->syn) {
 560                         /*
 561                          * SYN-ACK in reply to a SYN
 562                          * or SYN from reply direction in simultaneous open.
 563                          */
 564                         sender->td_end =
 565                         sender->td_maxend = end;
 566                         sender->td_maxwin = (win == 0 ? 1 : win);
 567
 568                         tcp_options(skb, dataoff, tcph, sender);
 569                         /*
 570                          * RFC 1323:
 571                          * Both sides must send the Window Scale option
 572                          * to enable window scaling in either direction.
 573                          */
 574                         if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
 575                               && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
 576                                 sender->td_scale =
 577                                 receiver->td_scale = 0;
 578                         if (!tcph->ack)
 579                                 /* Simultaneous open */
 580                                 return true;
 581                 } else {
 582                         /*
 583                          * We are in the middle of a connection,
 584                          * its history is lost for us.
 585                          * Let's try to use the data from the packet.
 586                          */
 587                         sender->td_end = end;
 588                         win <<= sender->td_scale;
 589                         sender->td_maxwin = (win == 0 ? 1 : win);
 590                         sender->td_maxend = end + sender->td_maxwin;
 591                         /*
 592                          * We haven't seen traffic in the other direction yet
 593                          * but we have to tweak window tracking to pass III
 594                          * and IV until that happens.
 595                          */
 596                         if (receiver->td_maxwin == 0)
 597                                 receiver->td_end = receiver->td_maxend = sack;
 598                 }
 599         } else if (((state->state == TCP_CONNTRACK_SYN_SENT
 600                      && dir == IP_CT_DIR_ORIGINAL)
 601                    || (state->state == TCP_CONNTRACK_SYN_RECV
 602                      && dir == IP_CT_DIR_REPLY))
 603                    && after(end, sender->td_end)) {
 604                 /*
 605                  * RFC 793: "if a TCP is reinitialized ... then it need
 606                  * not wait at all; it must only be sure to use sequence
 607                  * numbers larger than those recently used."
 608                  */
 609                 sender->td_end =
 610                 sender->td_maxend = end;
 611                 sender->td_maxwin = (win == 0 ? 1 : win);
 612
 613                 tcp_options(skb, dataoff, tcph, sender);
 614         }
 615
 616         if (!(tcph->ack)) {
 617                 /*
 618                  * If there is no ACK, just pretend it was set and OK.
 619                  */
 620                 ack = sack = receiver->td_end;
 621         } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
 622                     (TCP_FLAG_ACK|TCP_FLAG_RST))
 623                    && (ack == 0)) {
 624                 /*
 625                  * Broken TCP stacks, that set ACK in RST packets as well
 626                  * with zero ack value.
 627                  */
 628                 ack = sack = receiver->td_end;
 629         }
 630
 631         if (seq == end
 632             && (!tcph->rst
 633                 || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
 634                 /*
 635                  * Packets contains no data: we assume it is valid
 636                  * and check the ack value only.
 637                  * However RST segments are always validated by their
 638                  * SEQ number, except when seq == 0 (reset sent answering
 639                  * SYN.
 640                  */
 641                 seq = end = sender->td_end;
 642
 643         pr_debug("tcp_in_window: ");
 644         nf_ct_dump_tuple(tuple);
 645         pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
 646                  seq, ack, receiver_offset, sack, receiver_offset, win, end);
 647         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 648                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 649                  sender->td_end, sender->td_maxend, sender->td_maxwin,
 650                  sender->td_scale,
 651                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 652                  receiver->td_scale);
 653
 654         pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
 655                  before(seq, sender->td_maxend + 1),
 656                  after(end, sender->td_end - receiver->td_maxwin - 1),
 657                  before(sack, receiver->td_end + 1),
 658                  after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
 659
 660         if (before(seq, sender->td_maxend + 1) &&
 661             after(end, sender->td_end - receiver->td_maxwin - 1) &&
 662             before(sack, receiver->td_end + 1) &&
 663             after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
 664                 /*
 665                  * Take into account window scaling (RFC 1323).
 666                  */
 667                 if (!tcph->syn)
 668                         win <<= sender->td_scale;
 669
 670                 /*
 671                  * Update sender data.
 672                  */
 673                 swin = win + (sack - ack);
 674                 if (sender->td_maxwin < swin)
 675                         sender->td_maxwin = swin;
 676                 if (after(end, sender->td_end)) {
 677                         sender->td_end = end;
 678                         sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 679                 }
 680                 if (tcph->ack) {
 681                         if (!(sender->flags & IP_CT_TCP_FLAG_MAXACK_SET)) {
 682                                 sender->td_maxack = ack;
 683                                 sender->flags |= IP_CT_TCP_FLAG_MAXACK_SET;
 684                         } else if (after(ack, sender->td_maxack))
 685                                 sender->td_maxack = ack;
 686                 }
 687
 688                 /*
 689                  * Update receiver data.
 690                  */
 691                 if (receiver->td_maxwin != 0 && after(end, sender->td_maxend))
 692                         receiver->td_maxwin += end - sender->td_maxend;
 693                 if (after(sack + win, receiver->td_maxend - 1)) {
 694                         receiver->td_maxend = sack + win;
 695                         if (win == 0)
 696                                 receiver->td_maxend++;
 697                 }
 698                 if (ack == receiver->td_end)
 699                         receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 700
 701                 /*
 702                  * Check retransmissions.
 703                  */
 704                 if (index == TCP_ACK_SET) {
 705                         if (state->last_dir == dir
 706                             && state->last_seq == seq
 707                             && state->last_ack == ack
 708                             && state->last_end == end
 709                             && state->last_win == win)
 710                                 state->retrans++;
 711                         else {
 712                                 state->last_dir = dir;
 713                                 state->last_seq = seq;
 714                                 state->last_ack = ack;
 715                                 state->last_end = end;
 716                                 state->last_win = win;
 717                                 state->retrans = 0;
 718                         }
 719                 }
 720                 res = true;
 721         } else {
 722                 res = false;
 723                 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
 724                     nf_ct_tcp_be_liberal)
 725                         res = true;
 726                 if (!res && LOG_INVALID(net, IPPROTO_TCP))
 727                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 728                         "nf_ct_tcp: %s ",
 729                         before(seq, sender->td_maxend + 1) ?
 730                         after(end, sender->td_end - receiver->td_maxwin - 1) ?
 731                         before(sack, receiver->td_end + 1) ?
 732                         after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
 733                         : "ACK is under the lower bound (possible overly delayed ACK)"
 734                         : "ACK is over the upper bound (ACKed data not seen yet)"
 735                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
 736                         : "SEQ is over the upper bound (over the window of the receiver)");
 737         }
 738
 739         pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
 740                  "receiver end=%u maxend=%u maxwin=%u\n",
 741                  res, sender->td_end, sender->td_maxend, sender->td_maxwin,
 742                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
 743
 744         return res;
 745 }
 746
 747 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
 748 static const u8 tcp_valid_flags[(TCPHDR_FIN|TCPHDR_SYN|TCPHDR_RST|TCPHDR_ACK|
 749                                  TCPHDR_URG) + 1] =
 750 {
 751         [TCPHDR_SYN]                            = 1,
 752         [TCPHDR_SYN|TCPHDR_URG]                 = 1,
 753         [TCPHDR_SYN|TCPHDR_ACK]                 = 1,
 754         [TCPHDR_RST]                            = 1,
 755         [TCPHDR_RST|TCPHDR_ACK]                 = 1,
 756         [TCPHDR_FIN|TCPHDR_ACK]                 = 1,
 757         [TCPHDR_FIN|TCPHDR_ACK|TCPHDR_URG]      = 1,
 758         [TCPHDR_ACK]                            = 1,
 759         [TCPHDR_ACK|TCPHDR_URG]                 = 1,
 760 };
 761
 762 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
 763 static int tcp_error(struct net *net, struct nf_conn *tmpl,
 764                      struct sk_buff *skb,
 765                      unsigned int dataoff,
 766                      enum ip_conntrack_info *ctinfo,
 767                      u_int8_t pf,
 768                      unsigned int hooknum)
 769 {
 770         const struct tcphdr *th;
 771         struct tcphdr _tcph;
 772         unsigned int tcplen = skb->len - dataoff;
 773         u_int8_t tcpflags;
 774
 775         /* Smaller that minimal TCP header? */
 776         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
 777         if (th == NULL) {
 778                 if (LOG_INVALID(net, IPPROTO_TCP))
 779                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 780                                 "nf_ct_tcp: short packet ");
 781                 return -NF_ACCEPT;
 782         }
 783
 784         /* Not whole TCP header or malformed packet */
 785         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
 786                 if (LOG_INVALID(net, IPPROTO_TCP))
 787                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 788                                 "nf_ct_tcp: truncated/malformed packet ");
 789                 return -NF_ACCEPT;
 790         }
 791
 792         /* Checksum invalid? Ignore.
 793          * We skip checking packets on the outgoing path
 794          * because the checksum is assumed to be correct.
 795          */
 796         /* FIXME: Source route IP option packets --RR */
 797         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
 798             nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
 799                 if (LOG_INVALID(net, IPPROTO_TCP))
 800                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 801                                   "nf_ct_tcp: bad TCP checksum ");
 802                 return -NF_ACCEPT;
 803         }
 804
 805         /* Check TCP flags. */
 806         tcpflags = (tcp_flag_byte(th) & ~(TCPHDR_ECE|TCPHDR_CWR|TCPHDR_PSH));
 807         if (!tcp_valid_flags[tcpflags]) {
 808                 if (LOG_INVALID(net, IPPROTO_TCP))
 809                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 810                                   "nf_ct_tcp: invalid TCP flag combination ");
 811                 return -NF_ACCEPT;
 812         }
 813
 814         return NF_ACCEPT;
 815 }
 816
 817 /* Returns verdict for packet, or -1 for invalid. */
 818 static int tcp_packet(struct nf_conn *ct,
 819                       const struct sk_buff *skb,
 820                       unsigned int dataoff,
 821                       enum ip_conntrack_info ctinfo,
 822                       u_int8_t pf,
 823                       unsigned int hooknum)
 824 {
 825         struct net *net = nf_ct_net(ct);
 826         struct nf_conntrack_tuple *tuple;
 827         enum tcp_conntrack new_state, old_state;
 828         enum ip_conntrack_dir dir;
 829         const struct tcphdr *th;
 830         struct tcphdr _tcph;
 831         unsigned long timeout;
 832         unsigned int index;
 833
 834         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
 835         BUG_ON(th == NULL);
 836
 837         spin_lock_bh(&ct->lock);
 838         old_state = ct->proto.tcp.state;
 839         dir = CTINFO2DIR(ctinfo);
 840         index = get_conntrack_index(th);
 841         new_state = tcp_conntracks[dir][index][old_state];
 842         tuple = &ct->tuplehash[dir].tuple;
 843
 844         switch (new_state) {
 845         case TCP_CONNTRACK_SYN_SENT:
 846                 if (old_state < TCP_CONNTRACK_TIME_WAIT)
 847                         break;
 848                 /* RFC 1122: "When a connection is closed actively,
 849                  * it MUST linger in TIME-WAIT state for a time 2xMSL
 850                  * (Maximum Segment Lifetime). However, it MAY accept
 851                  * a new SYN from the remote TCP to reopen the connection
 852                  * directly from TIME-WAIT state, if..."
 853                  * We ignore the conditions because we are in the
 854                  * TIME-WAIT state anyway.
 855                  *
 856                  * Handle aborted connections: we and the server
 857                  * think there is an existing connection but the client
 858                  * aborts it and starts a new one.
 859                  */
 860                 if (((ct->proto.tcp.seen[dir].flags
 861                       | ct->proto.tcp.seen[!dir].flags)
 862                      & IP_CT_TCP_FLAG_CLOSE_INIT)
 863                     || (ct->proto.tcp.last_dir == dir
 864                         && ct->proto.tcp.last_index == TCP_RST_SET)) {
 865                         /* Attempt to reopen a closed/aborted connection.
 866                          * Delete this connection and look up again. */
 867                         spin_unlock_bh(&ct->lock);
 868
 869                         /* Only repeat if we can actually remove the timer.
 870                          * Destruction may already be in progress in process
 871                          * context and we must give it a chance to terminate.
 872                          */
 873                         if (nf_ct_kill(ct))
 874                                 return -NF_REPEAT;
 875                         return NF_DROP;
 876                 }
 877                 /* Fall through */
 878         case TCP_CONNTRACK_IGNORE:
 879                 /* Ignored packets:
 880                  *
 881                  * Our connection entry may be out of sync, so ignore
 882                  * packets which may signal the real connection between
 883                  * the client and the server.
 884                  *
 885                  * a) SYN in ORIGINAL
 886                  * b) SYN/ACK in REPLY
 887                  * c) ACK in reply direction after initial SYN in original.
 888                  *
 889                  * If the ignored packet is invalid, the receiver will send
 890                  * a RST we'll catch below.
 891                  */
 892                 if (index == TCP_SYNACK_SET
 893                     && ct->proto.tcp.last_index == TCP_SYN_SET
 894                     && ct->proto.tcp.last_dir != dir
 895                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
 896                         /* b) This SYN/ACK acknowledges a SYN that we earlier
 897                          * ignored as invalid. This means that the client and
 898                          * the server are both in sync, while the firewall is
 899                          * not. We get in sync from the previously annotated
 900                          * values.
 901                          */
 902                         old_state = TCP_CONNTRACK_SYN_SENT;
 903                         new_state = TCP_CONNTRACK_SYN_RECV;
 904                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_end =
 905                                 ct->proto.tcp.last_end;
 906                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxend =
 907                                 ct->proto.tcp.last_end;
 908                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxwin =
 909                                 ct->proto.tcp.last_win == 0 ?
 910                                         1 : ct->proto.tcp.last_win;
 911                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_scale =
 912                                 ct->proto.tcp.last_wscale;
 913                         ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
 914                                 ct->proto.tcp.last_flags;
 915                         memset(&ct->proto.tcp.seen[dir], 0,
 916                                sizeof(struct ip_ct_tcp_state));
 917                         break;
 918                 }
 919                 ct->proto.tcp.last_index = index;
 920                 ct->proto.tcp.last_dir = dir;
 921                 ct->proto.tcp.last_seq = ntohl(th->seq);
 922                 ct->proto.tcp.last_end =
 923                     segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
 924                 ct->proto.tcp.last_win = ntohs(th->window);
 925
 926                 /* a) This is a SYN in ORIGINAL. The client and the server
 927                  * may be in sync but we are not. In that case, we annotate
 928                  * the TCP options and let the packet go through. If it is a
 929                  * valid SYN packet, the server will reply with a SYN/ACK, and
 930                  * then we'll get in sync. Otherwise, the server ignores it. */
 931                 if (index == TCP_SYN_SET && dir == IP_CT_DIR_ORIGINAL) {
 932                         struct ip_ct_tcp_state seen = {};
 933
 934                         ct->proto.tcp.last_flags =
 935                         ct->proto.tcp.last_wscale = 0;
 936                         tcp_options(skb, dataoff, th, &seen);
 937                         if (seen.flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
 938                                 ct->proto.tcp.last_flags |=
 939                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
 940                                 ct->proto.tcp.last_wscale = seen.td_scale;
 941                         }
 942                         if (seen.flags & IP_CT_TCP_FLAG_SACK_PERM) {
 943                                 ct->proto.tcp.last_flags |=
 944                                         IP_CT_TCP_FLAG_SACK_PERM;
 945                         }
 946                 }
 947                 spin_unlock_bh(&ct->lock);
 948                 if (LOG_INVALID(net, IPPROTO_TCP))
 949                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 950                                   "nf_ct_tcp: invalid packet ignored ");
 951                 return NF_ACCEPT;
 952         case TCP_CONNTRACK_MAX:
 953                 /* Invalid packet */
 954                 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
 955                          dir, get_conntrack_index(th), old_state);
 956                 spin_unlock_bh(&ct->lock);
 957                 if (LOG_INVALID(net, IPPROTO_TCP))
 958                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 959                                   "nf_ct_tcp: invalid state ");
 960                 return -NF_ACCEPT;
 961         case TCP_CONNTRACK_CLOSE:
 962                 if (index == TCP_RST_SET
 963                     && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
 964                     && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) {
 965                         /* Invalid RST  */
 966                         spin_unlock_bh(&ct->lock);
 967                         if (LOG_INVALID(net, IPPROTO_TCP))
 968                                 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 969                                           "nf_ct_tcp: invalid RST ");
 970                         return -NF_ACCEPT;
 971                 }
 972                 if (index == TCP_RST_SET
 973                     && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
 974                          && ct->proto.tcp.last_index == TCP_SYN_SET)
 975                         || (!test_bit(IPS_ASSURED_BIT, &ct->status)
 976                             && ct->proto.tcp.last_index == TCP_ACK_SET))
 977                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
 978                         /* RST sent to invalid SYN or ACK we had let through
 979                          * at a) and c) above:
 980                          *
 981                          * a) SYN was in window then
 982                          * c) we hold a half-open connection.
 983                          *
 984                          * Delete our connection entry.
 985                          * We skip window checking, because packet might ACK
 986                          * segments we ignored. */
 987                         goto in_window;
 988                 }
 989                 /* Just fall through */
 990         default:
 991                 /* Keep compilers happy. */
 992                 break;
 993         }
 994
 995         if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
 996                            skb, dataoff, th, pf)) {
 997                 spin_unlock_bh(&ct->lock);
 998                 return -NF_ACCEPT;
 999         }
1000      in_window:
1001         /* From now on we have got in-window packets */
1002         ct->proto.tcp.last_index = index;
1003         ct->proto.tcp.last_dir = dir;
1004
1005         pr_debug("tcp_conntracks: ");
1006         nf_ct_dump_tuple(tuple);
1007         pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
1008                  (th->syn ? 1 : 0), (th->ack ? 1 : 0),
1009                  (th->fin ? 1 : 0), (th->rst ? 1 : 0),
1010                  old_state, new_state);
1011
1012         ct->proto.tcp.state = new_state;
1013         if (old_state != new_state
1014             && new_state == TCP_CONNTRACK_FIN_WAIT)
1015                 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
1016
1017         if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
1018             tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
1019                 timeout = nf_ct_tcp_timeout_max_retrans;
1020         else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
1021                  IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
1022                  tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
1023                 timeout = nf_ct_tcp_timeout_unacknowledged;
1024         else
1025                 timeout = tcp_timeouts[new_state];
1026         spin_unlock_bh(&ct->lock);
1027
1028         if (new_state != old_state)
1029                 nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
1030
1031         if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
1032                 /* If only reply is a RST, we can consider ourselves not to
1033                    have an established connection: this is a fairly common
1034                    problem case, so we can delete the conntrack
1035                    immediately.  --RR */
1036                 if (th->rst) {
1037                         nf_ct_kill_acct(ct, ctinfo, skb);
1038                         return NF_ACCEPT;
1039                 }
1040         } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
1041                    && (old_state == TCP_CONNTRACK_SYN_RECV
1042                        || old_state == TCP_CONNTRACK_ESTABLISHED)
1043                    && new_state == TCP_CONNTRACK_ESTABLISHED) {
1044                 /* Set ASSURED if we see see valid ack in ESTABLISHED
1045                    after SYN_RECV or a valid answer for a picked up
1046                    connection. */
1047                 set_bit(IPS_ASSURED_BIT, &ct->status);
1048                 nf_conntrack_event_cache(IPCT_ASSURED, ct);
1049         }
1050         nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
1051
1052         return NF_ACCEPT;
1053 }
1054
1055 /* Called when a new connection for this protocol found. */
1056 static bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
1057                     unsigned int dataoff)
1058 {
1059         enum tcp_conntrack new_state;
1060         const struct tcphdr *th;
1061         struct tcphdr _tcph;
1062         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
1063         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
1064
1065         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1066         BUG_ON(th == NULL);
1067
1068         /* Don't need lock here: this conntrack not in circulation yet */
1069         new_state = tcp_conntracks[0][get_conntrack_index(th)][TCP_CONNTRACK_NONE];
1070
1071         /* Invalid: delete conntrack */
1072         if (new_state >= TCP_CONNTRACK_MAX) {
1073                 pr_debug("nf_ct_tcp: invalid new deleting.\n");
1074                 return false;
1075         }
1076
1077         if (new_state == TCP_CONNTRACK_SYN_SENT) {
1078                 memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp));
1079                 /* SYN packet */
1080                 ct->proto.tcp.seen[0].td_end =
1081                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1082                                              dataoff, th);
1083                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1084                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1085                         ct->proto.tcp.seen[0].td_maxwin = 1;
1086                 ct->proto.tcp.seen[0].td_maxend =
1087                         ct->proto.tcp.seen[0].td_end;
1088
1089                 tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
1090         } else if (nf_ct_tcp_loose == 0) {
1091                 /* Don't try to pick up connections. */
1092                 return false;
1093         } else {
1094                 memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp));
1095                 /*
1096                  * We are in the middle of a connection,
1097                  * its history is lost for us.
1098                  * Let's try to use the data from the packet.
1099                  */
1100                 ct->proto.tcp.seen[0].td_end =
1101                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1102                                              dataoff, th);
1103                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1104                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1105                         ct->proto.tcp.seen[0].td_maxwin = 1;
1106                 ct->proto.tcp.seen[0].td_maxend =
1107                         ct->proto.tcp.seen[0].td_end +
1108                         ct->proto.tcp.seen[0].td_maxwin;
1109
1110                 /* We assume SACK and liberal window checking to handle
1111                  * window scaling */
1112                 ct->proto.tcp.seen[0].flags =
1113                 ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1114                                               IP_CT_TCP_FLAG_BE_LIBERAL;
1115         }
1116
1117         /* tcp_packet will set them */
1118         ct->proto.tcp.last_index = TCP_NONE_SET;
1119
1120         pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1121                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1122                  sender->td_end, sender->td_maxend, sender->td_maxwin,
1123                  sender->td_scale,
1124                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1125                  receiver->td_scale);
1126         return true;
1127 }
1128
1129 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1130
1131 #include <linux/netfilter/nfnetlink.h>
1132 #include <linux/netfilter/nfnetlink_conntrack.h>
1133
1134 static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
1135                          struct nf_conn *ct)
1136 {
1137         struct nlattr *nest_parms;
1138         struct nf_ct_tcp_flags tmp = {};
1139
1140         spin_lock_bh(&ct->lock);
1141         nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP | NLA_F_NESTED);
1142         if (!nest_parms)
1143                 goto nla_put_failure;
1144
1145         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state);
1146
1147         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
1148                    ct->proto.tcp.seen[0].td_scale);
1149
1150         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
1151                    ct->proto.tcp.seen[1].td_scale);
1152
1153         tmp.flags = ct->proto.tcp.seen[0].flags;
1154         NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
1155                 sizeof(struct nf_ct_tcp_flags), &tmp);
1156
1157         tmp.flags = ct->proto.tcp.seen[1].flags;
1158         NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
1159                 sizeof(struct nf_ct_tcp_flags), &tmp);
1160         spin_unlock_bh(&ct->lock);
1161
1162         nla_nest_end(skb, nest_parms);
1163
1164         return 0;
1165
1166 nla_put_failure:
1167         spin_unlock_bh(&ct->lock);
1168         return -1;
1169 }
1170
1171 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
1172         [CTA_PROTOINFO_TCP_STATE]           = { .type = NLA_U8 },
1173         [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
1174         [CTA_PROTOINFO_TCP_WSCALE_REPLY]    = { .type = NLA_U8 },
1175         [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
1176         [CTA_PROTOINFO_TCP_FLAGS_REPLY]     = { .len =  sizeof(struct nf_ct_tcp_flags) },
1177 };
1178
1179 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
1180 {
1181         struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
1182         struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
1183         int err;
1184
1185         /* updates could not contain anything about the private
1186          * protocol info, in that case skip the parsing */
1187         if (!pattr)
1188                 return 0;
1189
1190         err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
1191         if (err < 0)
1192                 return err;
1193
1194         if (tb[CTA_PROTOINFO_TCP_STATE] &&
1195             nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
1196                 return -EINVAL;
1197
1198         spin_lock_bh(&ct->lock);
1199         if (tb[CTA_PROTOINFO_TCP_STATE])
1200                 ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
1201
1202         if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
1203                 struct nf_ct_tcp_flags *attr =
1204                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
1205                 ct->proto.tcp.seen[0].flags &= ~attr->mask;
1206                 ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
1207         }
1208
1209         if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
1210                 struct nf_ct_tcp_flags *attr =
1211                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
1212                 ct->proto.tcp.seen[1].flags &= ~attr->mask;
1213                 ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
1214         }
1215
1216         if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
1217             tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
1218             ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
1219             ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1220                 ct->proto.tcp.seen[0].td_scale =
1221                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
1222                 ct->proto.tcp.seen[1].td_scale =
1223                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
1224         }
1225         spin_unlock_bh(&ct->lock);
1226
1227         return 0;
1228 }
1229
1230 static int tcp_nlattr_size(void)
1231 {
1232         return nla_total_size(0)           /* CTA_PROTOINFO_TCP */
1233                 + nla_policy_len(tcp_nla_policy, CTA_PROTOINFO_TCP_MAX + 1);
1234 }
1235
1236 static int tcp_nlattr_tuple_size(void)
1237 {
1238         return nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
1239 }
1240 #endif
1241
1242 #ifdef CONFIG_SYSCTL
1243 static unsigned int tcp_sysctl_table_users;
1244 static struct ctl_table_header *tcp_sysctl_header;
1245 static struct ctl_table tcp_sysctl_table[] = {
1246         {
1247                 .procname       = "nf_conntrack_tcp_timeout_syn_sent",
1248                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1249                 .maxlen         = sizeof(unsigned int),
1250                 .mode           = 0644,
1251                 .proc_handler   = proc_dointvec_jiffies,
1252         },
1253         {
1254                 .procname       = "nf_conntrack_tcp_timeout_syn_recv",
1255                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1256                 .maxlen         = sizeof(unsigned int),
1257                 .mode           = 0644,
1258                 .proc_handler   = proc_dointvec_jiffies,
1259         },
1260         {
1261                 .procname       = "nf_conntrack_tcp_timeout_established",
1262                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1263                 .maxlen         = sizeof(unsigned int),
1264                 .mode           = 0644,
1265                 .proc_handler   = proc_dointvec_jiffies,
1266         },
1267         {
1268                 .procname       = "nf_conntrack_tcp_timeout_fin_wait",
1269                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1270                 .maxlen         = sizeof(unsigned int),
1271                 .mode           = 0644,
1272                 .proc_handler   = proc_dointvec_jiffies,
1273         },
1274         {
1275                 .procname       = "nf_conntrack_tcp_timeout_close_wait",
1276                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1277                 .maxlen         = sizeof(unsigned int),
1278                 .mode           = 0644,
1279                 .proc_handler   = proc_dointvec_jiffies,
1280         },
1281         {
1282                 .procname       = "nf_conntrack_tcp_timeout_last_ack",
1283                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1284                 .maxlen         = sizeof(unsigned int),
1285                 .mode           = 0644,
1286                 .proc_handler   = proc_dointvec_jiffies,
1287         },
1288         {
1289                 .procname       = "nf_conntrack_tcp_timeout_time_wait",
1290                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1291                 .maxlen         = sizeof(unsigned int),
1292                 .mode           = 0644,
1293                 .proc_handler   = proc_dointvec_jiffies,
1294         },
1295         {
1296                 .procname       = "nf_conntrack_tcp_timeout_close",
1297                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1298                 .maxlen         = sizeof(unsigned int),
1299                 .mode           = 0644,
1300                 .proc_handler   = proc_dointvec_jiffies,
1301         },
1302         {
1303                 .procname       = "nf_conntrack_tcp_timeout_max_retrans",
1304                 .data           = &nf_ct_tcp_timeout_max_retrans,
1305                 .maxlen         = sizeof(unsigned int),
1306                 .mode           = 0644,
1307                 .proc_handler   = proc_dointvec_jiffies,
1308         },
1309         {
1310                 .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
1311                 .data           = &nf_ct_tcp_timeout_unacknowledged,
1312                 .maxlen         = sizeof(unsigned int),
1313                 .mode           = 0644,
1314                 .proc_handler   = proc_dointvec_jiffies,
1315         },
1316         {
1317                 .procname       = "nf_conntrack_tcp_loose",
1318                 .data           = &nf_ct_tcp_loose,
1319                 .maxlen         = sizeof(unsigned int),
1320                 .mode           = 0644,
1321                 .proc_handler   = proc_dointvec,
1322         },
1323         {
1324                 .procname       = "nf_conntrack_tcp_be_liberal",
1325                 .data           = &nf_ct_tcp_be_liberal,
1326                 .maxlen         = sizeof(unsigned int),
1327                 .mode           = 0644,
1328                 .proc_handler   = proc_dointvec,
1329         },
1330         {
1331                 .procname       = "nf_conntrack_tcp_max_retrans",
1332                 .data           = &nf_ct_tcp_max_retrans,
1333                 .maxlen         = sizeof(unsigned int),
1334                 .mode           = 0644,
1335                 .proc_handler   = proc_dointvec,
1336         },
1337         { }
1338 };
1339
1340 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1341 static struct ctl_table tcp_compat_sysctl_table[] = {
1342         {
1343                 .procname       = "ip_conntrack_tcp_timeout_syn_sent",
1344                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1345                 .maxlen         = sizeof(unsigned int),
1346                 .mode           = 0644,
1347                 .proc_handler   = proc_dointvec_jiffies,
1348         },
1349         {
1350                 .procname       = "ip_conntrack_tcp_timeout_syn_sent2",
1351                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT2],
1352                 .maxlen         = sizeof(unsigned int),
1353                 .mode           = 0644,
1354                 .proc_handler   = proc_dointvec_jiffies,
1355         },
1356         {
1357                 .procname       = "ip_conntrack_tcp_timeout_syn_recv",
1358                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1359                 .maxlen         = sizeof(unsigned int),
1360                 .mode           = 0644,
1361                 .proc_handler   = proc_dointvec_jiffies,
1362         },
1363         {
1364                 .procname       = "ip_conntrack_tcp_timeout_established",
1365                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1366                 .maxlen         = sizeof(unsigned int),
1367                 .mode           = 0644,
1368                 .proc_handler   = proc_dointvec_jiffies,
1369         },
1370         {
1371                 .procname       = "ip_conntrack_tcp_timeout_fin_wait",
1372                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1373                 .maxlen         = sizeof(unsigned int),
1374                 .mode           = 0644,
1375                 .proc_handler   = proc_dointvec_jiffies,
1376         },
1377         {
1378                 .procname       = "ip_conntrack_tcp_timeout_close_wait",
1379                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1380                 .maxlen         = sizeof(unsigned int),
1381                 .mode           = 0644,
1382                 .proc_handler   = proc_dointvec_jiffies,
1383         },
1384         {
1385                 .procname       = "ip_conntrack_tcp_timeout_last_ack",
1386                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1387                 .maxlen         = sizeof(unsigned int),
1388                 .mode           = 0644,
1389                 .proc_handler   = proc_dointvec_jiffies,
1390         },
1391         {
1392                 .procname       = "ip_conntrack_tcp_timeout_time_wait",
1393                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1394                 .maxlen         = sizeof(unsigned int),
1395                 .mode           = 0644,
1396                 .proc_handler   = proc_dointvec_jiffies,
1397         },
1398         {
1399                 .procname       = "ip_conntrack_tcp_timeout_close",
1400                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1401                 .maxlen         = sizeof(unsigned int),
1402                 .mode           = 0644,
1403                 .proc_handler   = proc_dointvec_jiffies,
1404         },
1405         {
1406                 .procname       = "ip_conntrack_tcp_timeout_max_retrans",
1407                 .data           = &nf_ct_tcp_timeout_max_retrans,
1408                 .maxlen         = sizeof(unsigned int),
1409                 .mode           = 0644,
1410                 .proc_handler   = proc_dointvec_jiffies,
1411         },
1412         {
1413                 .procname       = "ip_conntrack_tcp_loose",
1414                 .data           = &nf_ct_tcp_loose,
1415                 .maxlen         = sizeof(unsigned int),
1416                 .mode           = 0644,
1417                 .proc_handler   = proc_dointvec,
1418         },
1419         {
1420                 .procname       = "ip_conntrack_tcp_be_liberal",
1421                 .data           = &nf_ct_tcp_be_liberal,
1422                 .maxlen         = sizeof(unsigned int),
1423                 .mode           = 0644,
1424                 .proc_handler   = proc_dointvec,
1425         },
1426         {
1427                 .procname       = "ip_conntrack_tcp_max_retrans",
1428                 .data           = &nf_ct_tcp_max_retrans,
1429                 .maxlen         = sizeof(unsigned int),
1430                 .mode           = 0644,
1431                 .proc_handler   = proc_dointvec,
1432         },
1433         { }
1434 };
1435 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
1436 #endif /* CONFIG_SYSCTL */
1437
1438 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
1439 {
1440         .l3proto                = PF_INET,
1441         .l4proto                = IPPROTO_TCP,
1442         .name                   = "tcp",
1443         .pkt_to_tuple           = tcp_pkt_to_tuple,
1444         .invert_tuple           = tcp_invert_tuple,
1445         .print_tuple            = tcp_print_tuple,
1446         .print_conntrack        = tcp_print_conntrack,
1447         .packet                 = tcp_packet,
1448         .new                    = tcp_new,
1449         .error                  = tcp_error,
1450 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1451         .to_nlattr              = tcp_to_nlattr,
1452         .nlattr_size            = tcp_nlattr_size,
1453         .from_nlattr            = nlattr_to_tcp,
1454         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1455         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1456         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1457         .nla_policy             = nf_ct_port_nla_policy,
1458 #endif
1459 #ifdef CONFIG_SYSCTL
1460         .ctl_table_users        = &tcp_sysctl_table_users,
1461         .ctl_table_header       = &tcp_sysctl_header,
1462         .ctl_table              = tcp_sysctl_table,
1463 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1464         .ctl_compat_table       = tcp_compat_sysctl_table,
1465 #endif
1466 #endif
1467 };
1468 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
1469
1470 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
1471 {
1472         .l3proto                = PF_INET6,
1473         .l4proto                = IPPROTO_TCP,
1474         .name                   = "tcp",
1475         .pkt_to_tuple           = tcp_pkt_to_tuple,
1476         .invert_tuple           = tcp_invert_tuple,
1477         .print_tuple            = tcp_print_tuple,
1478         .print_conntrack        = tcp_print_conntrack,
1479         .packet                 = tcp_packet,
1480         .new                    = tcp_new,
1481         .error                  = tcp_error,
1482 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1483         .to_nlattr              = tcp_to_nlattr,
1484         .nlattr_size            = tcp_nlattr_size,
1485         .from_nlattr            = nlattr_to_tcp,
1486         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1487         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1488         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1489         .nla_policy             = nf_ct_port_nla_policy,
1490 #endif
1491 #ifdef CONFIG_SYSCTL
1492         .ctl_table_users        = &tcp_sysctl_table_users,
1493         .ctl_table_header       = &tcp_sysctl_header,
1494         .ctl_table              = tcp_sysctl_table,
1495 #endif
1496 };
1497 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);