projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[NETFILTER]: Fix whitespace errors
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / netfilter / nf_conntrack_proto_tcp.c
CommitLineData
9fb9cbb1
YK		 1/* (C) 1999-2001 Paul `Rusty' Russell
2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>:
9 * - Real stateful connection tracking
10 * - Modified state transitions table
11 * - Window scaling support added
12 * - SACK support added
13 *
14 * Willy Tarreau:
15 * - State table bugfixes
16 * - More robust state changes
17 * - Tuning timer parameters
18 *
19 * 27 Oct 2004: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
20 * - genelized Layer 3 protocol part.
21 *
22 * Derived from net/ipv4/netfilter/ip_conntrack_proto_tcp.c
23 *
24 * version 2.2
25 */
26
9fb9cbb1
YK		 27#include <linux/types.h>
28#include <linux/sched.h>
29#include <linux/timer.h>
30#include <linux/netfilter.h>
31#include <linux/module.h>
32#include <linux/in.h>
33#include <linux/tcp.h>
34#include <linux/spinlock.h>
35#include <linux/skbuff.h>
36#include <linux/ipv6.h>
37#include <net/ip6_checksum.h>
38
39#include <net/tcp.h>
40
41#include <linux/netfilter.h>
42#include <linux/netfilter_ipv4.h>
43#include <linux/netfilter_ipv6.h>
44#include <net/netfilter/nf_conntrack.h>
605dcad6 45#include <net/netfilter/nf_conntrack_l4proto.h>
f6180121 46#include <net/netfilter/nf_conntrack_ecache.h>
9fb9cbb1
YK		 47
48#if 0
49#define DEBUGP printk
50#define DEBUGP_VARS
51#else
52#define DEBUGP(format, args...)
53#endif
54
55/* Protects conntrack->proto.tcp */
56static DEFINE_RWLOCK(tcp_lock);
57
601e68e1
YH		 58/* "Be conservative in what you do,
59 be liberal in what you accept from others."
9fb9cbb1 60 If it's non-zero, we mark only out of window RST segments as INVALID. */
94aec08e 61int nf_ct_tcp_be_liberal __read_mostly = 0;
9fb9cbb1 62
a09113c2 63/* If it is set to zero, we disable picking up already established
9fb9cbb1 64 connections. */
a09113c2 65int nf_ct_tcp_loose __read_mostly = 1;
9fb9cbb1 66
601e68e1
YH		 67/* Max number of the retransmitted packets without receiving an (acceptable)
68 ACK from the destination. If this number is reached, a shorter timer
9fb9cbb1 69 will be started. */
94aec08e 70int nf_ct_tcp_max_retrans __read_mostly = 3;
9fb9cbb1
YK		 71
72 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
73 closely. They're more complex. --RR */
74
75static const char *tcp_conntrack_names[] = {
76 "NONE",
77 "SYN_SENT",
78 "SYN_RECV",
79 "ESTABLISHED",
80 "FIN_WAIT",
81 "CLOSE_WAIT",
82 "LAST_ACK",
83 "TIME_WAIT",
84 "CLOSE",
85 "LISTEN"
86};
601e68e1 87
9fb9cbb1
YK		 88#define SECS * HZ
89#define MINS * 60 SECS
90#define HOURS * 60 MINS
91#define DAYS * 24 HOURS
92
933a41e7
PM		 93static unsigned int nf_ct_tcp_timeout_syn_sent __read_mostly = 2 MINS;
94static unsigned int nf_ct_tcp_timeout_syn_recv __read_mostly = 60 SECS;
95static unsigned int nf_ct_tcp_timeout_established __read_mostly = 5 DAYS;
96static unsigned int nf_ct_tcp_timeout_fin_wait __read_mostly = 2 MINS;
97static unsigned int nf_ct_tcp_timeout_close_wait __read_mostly = 60 SECS;
98static unsigned int nf_ct_tcp_timeout_last_ack __read_mostly = 30 SECS;
99static unsigned int nf_ct_tcp_timeout_time_wait __read_mostly = 2 MINS;
100static unsigned int nf_ct_tcp_timeout_close __read_mostly = 10 SECS;
9fb9cbb1
YK		 101
102/* RFC1122 says the R2 limit should be at least 100 seconds.
601e68e1 103 Linux uses 15 packets as limit, which corresponds
9fb9cbb1 104 to ~13-30min depending on RTO. */
933a41e7 105static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly = 5 MINS;
601e68e1 106
933a41e7
PM		 107static unsigned int * tcp_timeouts[] = {
108 NULL, /* TCP_CONNTRACK_NONE */
9fb9cbb1
YK		 109 &nf_ct_tcp_timeout_syn_sent, /* TCP_CONNTRACK_SYN_SENT, */
110 &nf_ct_tcp_timeout_syn_recv, /* TCP_CONNTRACK_SYN_RECV, */
111 &nf_ct_tcp_timeout_established, /* TCP_CONNTRACK_ESTABLISHED, */
112 &nf_ct_tcp_timeout_fin_wait, /* TCP_CONNTRACK_FIN_WAIT, */
113 &nf_ct_tcp_timeout_close_wait, /* TCP_CONNTRACK_CLOSE_WAIT, */
114 &nf_ct_tcp_timeout_last_ack, /* TCP_CONNTRACK_LAST_ACK, */
115 &nf_ct_tcp_timeout_time_wait, /* TCP_CONNTRACK_TIME_WAIT, */
116 &nf_ct_tcp_timeout_close, /* TCP_CONNTRACK_CLOSE, */
117 NULL, /* TCP_CONNTRACK_LISTEN */
118 };
601e68e1 119
9fb9cbb1
YK		 120#define sNO TCP_CONNTRACK_NONE
121#define sSS TCP_CONNTRACK_SYN_SENT
122#define sSR TCP_CONNTRACK_SYN_RECV
123#define sES TCP_CONNTRACK_ESTABLISHED
124#define sFW TCP_CONNTRACK_FIN_WAIT
125#define sCW TCP_CONNTRACK_CLOSE_WAIT
126#define sLA TCP_CONNTRACK_LAST_ACK
127#define sTW TCP_CONNTRACK_TIME_WAIT
128#define sCL TCP_CONNTRACK_CLOSE
129#define sLI TCP_CONNTRACK_LISTEN
130#define sIV TCP_CONNTRACK_MAX
131#define sIG TCP_CONNTRACK_IGNORE
132
133/* What TCP flags are set from RST/SYN/FIN/ACK. */
134enum tcp_bit_set {
135 TCP_SYN_SET,
136 TCP_SYNACK_SET,
137 TCP_FIN_SET,
138 TCP_ACK_SET,
139 TCP_RST_SET,
140 TCP_NONE_SET,
141};
601e68e1 142
9fb9cbb1
YK		 143/*
144 * The TCP state transition table needs a few words...
145 *
146 * We are the man in the middle. All the packets go through us
147 * but might get lost in transit to the destination.
601e68e1 148 * It is assumed that the destinations can't receive segments
9fb9cbb1
YK		 149 * we haven't seen.
150 *
151 * The checked segment is in window, but our windows are *not*
152 * equivalent with the ones of the sender/receiver. We always
153 * try to guess the state of the current sender.
154 *
155 * The meaning of the states are:
156 *
157 * NONE: initial state
601e68e1 158 * SYN_SENT: SYN-only packet seen
9fb9cbb1
YK		 159 * SYN_RECV: SYN-ACK packet seen
160 * ESTABLISHED: ACK packet seen
161 * FIN_WAIT: FIN packet seen
601e68e1 162 * CLOSE_WAIT: ACK seen (after FIN)
9fb9cbb1
YK		 163 * LAST_ACK: FIN seen (after FIN)
164 * TIME_WAIT: last ACK seen
165 * CLOSE: closed connection
166 *
167 * LISTEN state is not used.
168 *
169 * Packets marked as IGNORED (sIG):
601e68e1
YH		 170 * if they may be either invalid or valid
171 * and the receiver may send back a connection
9fb9cbb1
YK		 172 * closing RST or a SYN/ACK.
173 *
174 * Packets marked as INVALID (sIV):
175 * if they are invalid
176 * or we do not support the request (simultaneous open)
177 */
178static enum tcp_conntrack tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
179 {
180/* ORIGINAL */
181/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
182/*syn*/ { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sIV },
183/*
184 * sNO -> sSS Initialize a new connection
185 * sSS -> sSS Retransmitted SYN
186 * sSR -> sIG Late retransmitted SYN?
187 * sES -> sIG Error: SYNs in window outside the SYN_SENT state
601e68e1 188 * are errors. Receiver will reply with RST
9fb9cbb1
YK		 189 * and close the connection.
190 * Or we are not in sync and hold a dead connection.
191 * sFW -> sIG
192 * sCW -> sIG
193 * sLA -> sIG
194 * sTW -> sSS Reopened connection (RFC 1122).
195 * sCL -> sSS
196 */
197/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
198/*synack*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
199/*
200 * A SYN/ACK from the client is always invalid:
601e68e1 201 * - either it tries to set up a simultaneous open, which is
9fb9cbb1
YK		 202 * not supported;
203 * - or the firewall has just been inserted between the two hosts
601e68e1 204 * during the session set-up. The SYN will be retransmitted
9fb9cbb1
YK		 205 * by the true client (or it'll time out).
206 */
207/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
208/*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
209/*
210 * sNO -> sIV Too late and no reason to do anything...
211 * sSS -> sIV Client migth not send FIN in this state:
212 * we enforce waiting for a SYN/ACK reply first.
213 * sSR -> sFW Close started.
214 * sES -> sFW
215 * sFW -> sLA FIN seen in both directions, waiting for
601e68e1 216 * the last ACK.
9fb9cbb1
YK		 217 * Migth be a retransmitted FIN as well...
218 * sCW -> sLA
219 * sLA -> sLA Retransmitted FIN. Remain in the same state.
220 * sTW -> sTW
221 * sCL -> sCL
222 */
223/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
224/*ack*/ { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
225/*
226 * sNO -> sES Assumed.
227 * sSS -> sIV ACK is invalid: we haven't seen a SYN/ACK yet.
228 * sSR -> sES Established state is reached.
229 * sES -> sES :-)
230 * sFW -> sCW Normal close request answered by ACK.
231 * sCW -> sCW
232 * sLA -> sTW Last ACK detected.
233 * sTW -> sTW Retransmitted last ACK. Remain in the same state.
234 * sCL -> sCL
235 */
236/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
237/*rst*/ { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
238/*none*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
239 },
240 {
241/* REPLY */
242/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
243/*syn*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
244/*
245 * sNO -> sIV Never reached.
246 * sSS -> sIV Simultaneous open, not supported
247 * sSR -> sIV Simultaneous open, not supported.
248 * sES -> sIV Server may not initiate a connection.
249 * sFW -> sIV
250 * sCW -> sIV
251 * sLA -> sIV
252 * sTW -> sIV Reopened connection, but server may not do it.
253 * sCL -> sIV
254 */
255/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
256/*synack*/ { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIV },
257/*
258 * sSS -> sSR Standard open.
259 * sSR -> sSR Retransmitted SYN/ACK.
260 * sES -> sIG Late retransmitted SYN/ACK?
261 * sFW -> sIG Might be SYN/ACK answering ignored SYN
262 * sCW -> sIG
263 * sLA -> sIG
264 * sTW -> sIG
265 * sCL -> sIG
266 */
267/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
268/*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
269/*
270 * sSS -> sIV Server might not send FIN in this state.
271 * sSR -> sFW Close started.
272 * sES -> sFW
273 * sFW -> sLA FIN seen in both directions.
274 * sCW -> sLA
275 * sLA -> sLA Retransmitted FIN.
276 * sTW -> sTW
277 * sCL -> sCL
278 */
279/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
73f30602 280/*ack*/ { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
9fb9cbb1 281/*
73f30602 282 * sSS -> sIG Might be a half-open connection.
9fb9cbb1
YK		 283 * sSR -> sSR Might answer late resent SYN.
284 * sES -> sES :-)
285 * sFW -> sCW Normal close request answered by ACK.
286 * sCW -> sCW
287 * sLA -> sTW Last ACK detected.
288 * sTW -> sTW Retransmitted last ACK.
289 * sCL -> sCL
290 */
291/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
292/*rst*/ { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
293/*none*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
601e68e1 294 }
9fb9cbb1
YK		 295};
296
297static int tcp_pkt_to_tuple(const struct sk_buff *skb,
298 unsigned int dataoff,
299 struct nf_conntrack_tuple *tuple)
300{
301 struct tcphdr _hdr, *hp;
302
303 /* Actually only need first 8 bytes. */
304 hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
305 if (hp == NULL)
306 return 0;
307
308 tuple->src.u.tcp.port = hp->source;
309 tuple->dst.u.tcp.port = hp->dest;
310
311 return 1;
312}
313
314static int tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
315 const struct nf_conntrack_tuple *orig)
316{
317 tuple->src.u.tcp.port = orig->dst.u.tcp.port;
318 tuple->dst.u.tcp.port = orig->src.u.tcp.port;
319 return 1;
320}
321
322/* Print out the per-protocol part of the tuple. */
323static int tcp_print_tuple(struct seq_file *s,
324 const struct nf_conntrack_tuple *tuple)
325{
326 return seq_printf(s, "sport=%hu dport=%hu ",
327 ntohs(tuple->src.u.tcp.port),
328 ntohs(tuple->dst.u.tcp.port));
329}
330
331/* Print out the private part of the conntrack. */
332static int tcp_print_conntrack(struct seq_file *s,
333 const struct nf_conn *conntrack)
334{
335 enum tcp_conntrack state;
336
337 read_lock_bh(&tcp_lock);
338 state = conntrack->proto.tcp.state;
339 read_unlock_bh(&tcp_lock);
340
341 return seq_printf(s, "%s ", tcp_conntrack_names[state]);
342}
343
344static unsigned int get_conntrack_index(const struct tcphdr *tcph)
345{
346 if (tcph->rst) return TCP_RST_SET;
347 else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
348 else if (tcph->fin) return TCP_FIN_SET;
349 else if (tcph->ack) return TCP_ACK_SET;
350 else return TCP_NONE_SET;
351}
352
353/* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
354 in IP Filter' by Guido van Rooij.
601e68e1 355
9fb9cbb1
YK		 356 http://www.nluug.nl/events/sane2000/papers.html
357 http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
601e68e1 358
9fb9cbb1
YK		 359 The boundaries and the conditions are changed according to RFC793:
360 the packet must intersect the window (i.e. segments may be
361 after the right or before the left edge) and thus receivers may ACK
362 segments after the right edge of the window.
363
601e68e1 364 td_maxend = max(sack + max(win,1)) seen in reply packets
9fb9cbb1
YK		 365 td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
366 td_maxwin += seq + len - sender.td_maxend
367 if seq + len > sender.td_maxend
368 td_end = max(seq + len) seen in sent packets
601e68e1 369
9fb9cbb1
YK		 370 I. Upper bound for valid data: seq <= sender.td_maxend
371 II. Lower bound for valid data: seq + len >= sender.td_end - receiver.td_maxwin
372 III. Upper bound for valid ack: sack <= receiver.td_end
373 IV. Lower bound for valid ack: ack >= receiver.td_end - MAXACKWINDOW
374
375 where sack is the highest right edge of sack block found in the packet.
376
601e68e1
YH		 377 The upper bound limit for a valid ack is not ignored -
378 we doesn't have to deal with fragments.
9fb9cbb1
YK		 379*/
380
381static inline __u32 segment_seq_plus_len(__u32 seq,
382 size_t len,
383 unsigned int dataoff,
384 struct tcphdr *tcph)
385{
386 /* XXX Should I use payload length field in IP/IPv6 header ?
387 * - YK */
388 return (seq + len - dataoff - tcph->doff*4
389 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
390}
601e68e1 391
9fb9cbb1
YK		 392/* Fixme: what about big packets? */
393#define MAXACKWINCONST 66000
394#define MAXACKWINDOW(sender) \
395 ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin \
396 : MAXACKWINCONST)
601e68e1 397
9fb9cbb1
YK		 398/*
399 * Simplified tcp_parse_options routine from tcp_input.c
400 */
401static void tcp_options(const struct sk_buff *skb,
402 unsigned int dataoff,
601e68e1 403 struct tcphdr *tcph,
9fb9cbb1
YK		 404 struct ip_ct_tcp_state *state)
405{
406 unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
407 unsigned char *ptr;
408 int length = (tcph->doff*4) - sizeof(struct tcphdr);
409
410 if (!length)
411 return;
412
413 ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
414 length, buff);
415 BUG_ON(ptr == NULL);
416
601e68e1 417 state->td_scale =
9fb9cbb1
YK		 418 state->flags = 0;
419
420 while (length > 0) {
421 int opcode=*ptr++;
422 int opsize;
423
424 switch (opcode) {
425 case TCPOPT_EOL:
426 return;
427 case TCPOPT_NOP: /* Ref: RFC 793 section 3.1 */
428 length--;
429 continue;
430 default:
431 opsize=*ptr++;
432 if (opsize < 2) /* "silly options" */
433 return;
434 if (opsize > length)
435 break; /* don't parse partial options */
436
601e68e1 437 if (opcode == TCPOPT_SACK_PERM
9fb9cbb1
YK		 438 && opsize == TCPOLEN_SACK_PERM)
439 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
440 else if (opcode == TCPOPT_WINDOW
441 && opsize == TCPOLEN_WINDOW) {
442 state->td_scale = *(u_int8_t *)ptr;
443
444 if (state->td_scale > 14) {
445 /* See RFC1323 */
446 state->td_scale = 14;
447 }
448 state->flags |=
449 IP_CT_TCP_FLAG_WINDOW_SCALE;
450 }
451 ptr += opsize - 2;
452 length -= opsize;
453 }
454 }
455}
456
457static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
458 struct tcphdr *tcph, __u32 *sack)
459{
601e68e1 460 unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
9fb9cbb1
YK		 461 unsigned char *ptr;
462 int length = (tcph->doff*4) - sizeof(struct tcphdr);
463 __u32 tmp;
464
465 if (!length)
466 return;
467
468 ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
469 length, buff);
470 BUG_ON(ptr == NULL);
471
472 /* Fast path for timestamp-only option */
473 if (length == TCPOLEN_TSTAMP_ALIGNED*4
bff9a89b 474 && *(__be32 *)ptr ==
601e68e1
YH		 475 __constant_htonl((TCPOPT_NOP << 24)
476 | (TCPOPT_NOP << 16)
477 | (TCPOPT_TIMESTAMP << 8)
478 | TCPOLEN_TIMESTAMP))
9fb9cbb1
YK		 479 return;
480
481 while (length > 0) {
482 int opcode = *ptr++;
483 int opsize, i;
484
485 switch (opcode) {
486 case TCPOPT_EOL:
487 return;
488 case TCPOPT_NOP: /* Ref: RFC 793 section 3.1 */
489 length--;
490 continue;
491 default:
492 opsize = *ptr++;
493 if (opsize < 2) /* "silly options" */
494 return;
495 if (opsize > length)
496 break; /* don't parse partial options */
497
601e68e1
YH		 498 if (opcode == TCPOPT_SACK
499 && opsize >= (TCPOLEN_SACK_BASE
500 + TCPOLEN_SACK_PERBLOCK)
501 && !((opsize - TCPOLEN_SACK_BASE)
502 % TCPOLEN_SACK_PERBLOCK)) {
503 for (i = 0;
504 i < (opsize - TCPOLEN_SACK_BASE);
505 i += TCPOLEN_SACK_PERBLOCK) {
506 tmp = ntohl(*((__be32 *)(ptr+i)+1));
9fb9cbb1
YK		 507
508 if (after(tmp, *sack))
509 *sack = tmp;
510 }
511 return;
512 }
513 ptr += opsize - 2;
514 length -= opsize;
515 }
516 }
517}
518
601e68e1
YH		 519static int tcp_in_window(struct ip_ct_tcp *state,
520 enum ip_conntrack_dir dir,
521 unsigned int index,
522 const struct sk_buff *skb,
9fb9cbb1 523 unsigned int dataoff,
601e68e1 524 struct tcphdr *tcph,
9fb9cbb1
YK		 525 int pf)
526{
527 struct ip_ct_tcp_state *sender = &state->seen[dir];
528 struct ip_ct_tcp_state *receiver = &state->seen[!dir];
529 __u32 seq, ack, sack, end, win, swin;
530 int res;
531
532 /*
533 * Get the required data from the packet.
534 */
535 seq = ntohl(tcph->seq);
536 ack = sack = ntohl(tcph->ack_seq);
537 win = ntohs(tcph->window);
538 end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
539
540 if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
541 tcp_sack(skb, dataoff, tcph, &sack);
542
543 DEBUGP("tcp_in_window: START\n");
544 DEBUGP("tcp_in_window: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
545 "seq=%u ack=%u sack=%u win=%u end=%u\n",
601e68e1 546 NIPQUAD(iph->saddr), ntohs(tcph->source),
9fb9cbb1
YK		 547 NIPQUAD(iph->daddr), ntohs(tcph->dest),
548 seq, ack, sack, win, end);
549 DEBUGP("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
550 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
551 sender->td_end, sender->td_maxend, sender->td_maxwin,
601e68e1
YH		 552 sender->td_scale,
553 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
9fb9cbb1
YK		 554 receiver->td_scale);
555
556 if (sender->td_end == 0) {
557 /*
558 * Initialize sender data.
559 */
560 if (tcph->syn && tcph->ack) {
561 /*
562 * Outgoing SYN-ACK in reply to a SYN.
563 */
601e68e1 564 sender->td_end =
9fb9cbb1
YK		 565 sender->td_maxend = end;
566 sender->td_maxwin = (win == 0 ? 1 : win);
567
568 tcp_options(skb, dataoff, tcph, sender);
601e68e1 569 /*
9fb9cbb1
YK		 570 * RFC 1323:
571 * Both sides must send the Window Scale option
572 * to enable window scaling in either direction.
573 */
574 if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
575 && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
601e68e1 576 sender->td_scale =
9fb9cbb1
YK		 577 receiver->td_scale = 0;
578 } else {
579 /*
580 * We are in the middle of a connection,
581 * its history is lost for us.
582 * Let's try to use the data from the packet.
601e68e1 583 */
9fb9cbb1
YK		 584 sender->td_end = end;
585 sender->td_maxwin = (win == 0 ? 1 : win);
586 sender->td_maxend = end + sender->td_maxwin;
587 }
588 } else if (((state->state == TCP_CONNTRACK_SYN_SENT
589 && dir == IP_CT_DIR_ORIGINAL)
590 || (state->state == TCP_CONNTRACK_SYN_RECV
591 && dir == IP_CT_DIR_REPLY))
592 && after(end, sender->td_end)) {
593 /*
594 * RFC 793: "if a TCP is reinitialized ... then it need
601e68e1 595 * not wait at all; it must only be sure to use sequence
9fb9cbb1
YK		 596 * numbers larger than those recently used."
597 */
598 sender->td_end =
599 sender->td_maxend = end;
600 sender->td_maxwin = (win == 0 ? 1 : win);
601
602 tcp_options(skb, dataoff, tcph, sender);
603 }
604
605 if (!(tcph->ack)) {
606 /*
607 * If there is no ACK, just pretend it was set and OK.
608 */
609 ack = sack = receiver->td_end;
601e68e1
YH		 610 } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
611 (TCP_FLAG_ACK|TCP_FLAG_RST))
9fb9cbb1
YK		 612 && (ack == 0)) {
613 /*
614 * Broken TCP stacks, that set ACK in RST packets as well
615 * with zero ack value.
616 */
617 ack = sack = receiver->td_end;
618 }
619
620 if (seq == end
621 && (!tcph->rst
622 || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
623 /*
624 * Packets contains no data: we assume it is valid
625 * and check the ack value only.
626 * However RST segments are always validated by their
627 * SEQ number, except when seq == 0 (reset sent answering
628 * SYN.
629 */
630 seq = end = sender->td_end;
631
632 DEBUGP("tcp_in_window: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
633 "seq=%u ack=%u sack =%u win=%u end=%u\n",
634 NIPQUAD(iph->saddr), ntohs(tcph->source),
635 NIPQUAD(iph->daddr), ntohs(tcph->dest),
636 seq, ack, sack, win, end);
637 DEBUGP("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
638 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
639 sender->td_end, sender->td_maxend, sender->td_maxwin,
601e68e1 640 sender->td_scale,
9fb9cbb1
YK		 641 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
642 receiver->td_scale);
643
644 DEBUGP("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
645 before(seq, sender->td_maxend + 1),
646 after(end, sender->td_end - receiver->td_maxwin - 1),
601e68e1
YH		 647 before(sack, receiver->td_end + 1),
648 after(ack, receiver->td_end - MAXACKWINDOW(sender)));
9fb9cbb1 649
a09113c2
PM		 650 if (before(seq, sender->td_maxend + 1) &&
651 after(end, sender->td_end - receiver->td_maxwin - 1) &&
652 before(sack, receiver->td_end + 1) &&
653 after(ack, receiver->td_end - MAXACKWINDOW(sender))) {
601e68e1 654 /*
9fb9cbb1
YK		 655 * Take into account window scaling (RFC 1323).
656 */
657 if (!tcph->syn)
658 win <<= sender->td_scale;
659
660 /*
661 * Update sender data.
662 */
663 swin = win + (sack - ack);
664 if (sender->td_maxwin < swin)
665 sender->td_maxwin = swin;
666 if (after(end, sender->td_end))
667 sender->td_end = end;
668 /*
669 * Update receiver data.
670 */
671 if (after(end, sender->td_maxend))
672 receiver->td_maxwin += end - sender->td_maxend;
673 if (after(sack + win, receiver->td_maxend - 1)) {
674 receiver->td_maxend = sack + win;
675 if (win == 0)
676 receiver->td_maxend++;
677 }
678
601e68e1 679 /*
9fb9cbb1
YK		 680 * Check retransmissions.
681 */
682 if (index == TCP_ACK_SET) {
683 if (state->last_dir == dir
684 && state->last_seq == seq
685 && state->last_ack == ack
c1fe3ca5
GH		 686 && state->last_end == end
687 && state->last_win == win)
9fb9cbb1
YK		 688 state->retrans++;
689 else {
690 state->last_dir = dir;
691 state->last_seq = seq;
692 state->last_ack = ack;
693 state->last_end = end;
c1fe3ca5 694 state->last_win = win;
9fb9cbb1
YK		 695 state->retrans = 0;
696 }
697 }
9fb9cbb1
YK		 698 res = 1;
699 } else {
a09113c2
PM		 700 res = 0;
701 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
702 nf_ct_tcp_be_liberal)
703 res = 1;
704 if (!res && LOG_INVALID(IPPROTO_TCP))
9fb9cbb1
YK		 705 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
706 "nf_ct_tcp: %s ",
707 before(seq, sender->td_maxend + 1) ?
708 after(end, sender->td_end - receiver->td_maxwin - 1) ?
709 before(sack, receiver->td_end + 1) ?
710 after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
711 : "ACK is under the lower bound (possible overly delayed ACK)"
712 : "ACK is over the upper bound (ACKed data not seen yet)"
713 : "SEQ is under the lower bound (already ACKed data retransmitted)"
714 : "SEQ is over the upper bound (over the window of the receiver)");
601e68e1
YH		 715 }
716
9fb9cbb1
YK		 717 DEBUGP("tcp_in_window: res=%i sender end=%u maxend=%u maxwin=%u "
718 "receiver end=%u maxend=%u maxwin=%u\n",
601e68e1 719 res, sender->td_end, sender->td_maxend, sender->td_maxwin,
9fb9cbb1
YK		 720 receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
721
722 return res;
723}
724
5b1158e9 725#ifdef CONFIG_NF_NAT_NEEDED
9fb9cbb1
YK		 726/* Update sender->td_end after NAT successfully mangled the packet */
727/* Caller must linearize skb at tcp header. */
728void nf_conntrack_tcp_update(struct sk_buff *skb,
729 unsigned int dataoff,
601e68e1 730 struct nf_conn *conntrack,
9fb9cbb1
YK		 731 int dir)
732{
733 struct tcphdr *tcph = (void *)skb->data + dataoff;
734 __u32 end;
735#ifdef DEBUGP_VARS
736 struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[dir];
737 struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[!dir];
738#endif
739
740 end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
741
742 write_lock_bh(&tcp_lock);
743 /*
744 * We have to worry for the ack in the reply packet only...
745 */
746 if (after(end, conntrack->proto.tcp.seen[dir].td_end))
747 conntrack->proto.tcp.seen[dir].td_end = end;
748 conntrack->proto.tcp.last_end = end;
749 write_unlock_bh(&tcp_lock);
750 DEBUGP("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
751 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
752 sender->td_end, sender->td_maxend, sender->td_maxwin,
601e68e1 753 sender->td_scale,
9fb9cbb1
YK		 754 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
755 receiver->td_scale);
756}
13b18339 757EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
9fb9cbb1
YK		 758#endif
759
760#define TH_FIN 0x01
761#define TH_SYN 0x02
762#define TH_RST 0x04
763#define TH_PUSH 0x08
764#define TH_ACK 0x10
765#define TH_URG 0x20
766#define TH_ECE 0x40
767#define TH_CWR 0x80
768
769/* table of valid flag combinations - ECE and CWR are always valid */
770static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
771{
772 [TH_SYN] = 1,
773 [TH_SYN|TH_ACK] = 1,
a2d7222f 774 [TH_SYN|TH_PUSH] = 1,
9fb9cbb1
YK		 775 [TH_SYN|TH_ACK|TH_PUSH] = 1,
776 [TH_RST] = 1,
777 [TH_RST|TH_ACK] = 1,
778 [TH_RST|TH_ACK|TH_PUSH] = 1,
779 [TH_FIN|TH_ACK] = 1,
780 [TH_ACK] = 1,
781 [TH_ACK|TH_PUSH] = 1,
782 [TH_ACK|TH_URG] = 1,
783 [TH_ACK|TH_URG|TH_PUSH] = 1,
784 [TH_FIN|TH_ACK|TH_PUSH] = 1,
785 [TH_FIN|TH_ACK|TH_URG] = 1,
786 [TH_FIN|TH_ACK|TH_URG|TH_PUSH] = 1,
787};
788
789/* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c. */
790static int tcp_error(struct sk_buff *skb,
791 unsigned int dataoff,
792 enum ip_conntrack_info *ctinfo,
793 int pf,
96f6bf82 794 unsigned int hooknum)
9fb9cbb1
YK		 795{
796 struct tcphdr _tcph, *th;
797 unsigned int tcplen = skb->len - dataoff;
798 u_int8_t tcpflags;
799
800 /* Smaller that minimal TCP header? */
801 th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
802 if (th == NULL) {
803 if (LOG_INVALID(IPPROTO_TCP))
804 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
805 "nf_ct_tcp: short packet ");
806 return -NF_ACCEPT;
601e68e1
YH		 807 }
808
9fb9cbb1
YK		 809 /* Not whole TCP header or malformed packet */
810 if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
811 if (LOG_INVALID(IPPROTO_TCP))
812 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
813 "nf_ct_tcp: truncated/malformed packet ");
814 return -NF_ACCEPT;
815 }
601e68e1 816
9fb9cbb1
YK		 817 /* Checksum invalid? Ignore.
818 * We skip checking packets on the outgoing path
84fa7933 819 * because the checksum is assumed to be correct.
9fb9cbb1
YK		 820 */
821 /* FIXME: Source route IP option packets --RR */
39a27a35
PM		 822 if (nf_conntrack_checksum &&
823 ((pf == PF_INET && hooknum == NF_IP_PRE_ROUTING) ||
824 (pf == PF_INET6 && hooknum == NF_IP6_PRE_ROUTING)) &&
96f6bf82 825 nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
9fb9cbb1
YK		 826 if (LOG_INVALID(IPPROTO_TCP))
827 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
828 "nf_ct_tcp: bad TCP checksum ");
829 return -NF_ACCEPT;
830 }
831
832 /* Check TCP flags. */
833 tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR));
834 if (!tcp_valid_flags[tcpflags]) {
835 if (LOG_INVALID(IPPROTO_TCP))
836 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
837 "nf_ct_tcp: invalid TCP flag combination ");
838 return -NF_ACCEPT;
839 }
840
841 return NF_ACCEPT;
842}
843
9fb9cbb1
YK		 844/* Returns verdict for packet, or -1 for invalid. */
845static int tcp_packet(struct nf_conn *conntrack,
846 const struct sk_buff *skb,
847 unsigned int dataoff,
848 enum ip_conntrack_info ctinfo,
849 int pf,
850 unsigned int hooknum)
851{
852 enum tcp_conntrack new_state, old_state;
853 enum ip_conntrack_dir dir;
854 struct tcphdr *th, _tcph;
855 unsigned long timeout;
856 unsigned int index;
857
858 th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
859 BUG_ON(th == NULL);
860
861 write_lock_bh(&tcp_lock);
862 old_state = conntrack->proto.tcp.state;
863 dir = CTINFO2DIR(ctinfo);
864 index = get_conntrack_index(th);
865 new_state = tcp_conntracks[dir][index][old_state];
866
867 switch (new_state) {
868 case TCP_CONNTRACK_IGNORE:
73f30602
JK		 869 /* Ignored packets:
870 *
871 * a) SYN in ORIGINAL
872 * b) SYN/ACK in REPLY
601e68e1 873 * c) ACK in reply direction after initial SYN in original.
73f30602 874 */
9fb9cbb1
YK		 875 if (index == TCP_SYNACK_SET
876 && conntrack->proto.tcp.last_index == TCP_SYN_SET
877 && conntrack->proto.tcp.last_dir != dir
878 && ntohl(th->ack_seq) ==
601e68e1
YH		 879 conntrack->proto.tcp.last_end) {
880 /* This SYN/ACK acknowledges a SYN that we earlier
9fb9cbb1
YK		 881 * ignored as invalid. This means that the client and
882 * the server are both in sync, while the firewall is
883 * not. We kill this session and block the SYN/ACK so
601e68e1 884 * that the client cannot but retransmit its SYN and
9fb9cbb1
YK		 885 * thus initiate a clean new session.
886 */
601e68e1 887 write_unlock_bh(&tcp_lock);
9fb9cbb1
YK		 888 if (LOG_INVALID(IPPROTO_TCP))
889 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
890 "nf_ct_tcp: killing out of sync session ");
601e68e1
YH		 891 if (del_timer(&conntrack->timeout))
892 conntrack->timeout.function((unsigned long)
893 conntrack);
894 return -NF_DROP;
9fb9cbb1
YK		 895 }
896 conntrack->proto.tcp.last_index = index;
897 conntrack->proto.tcp.last_dir = dir;
898 conntrack->proto.tcp.last_seq = ntohl(th->seq);
899 conntrack->proto.tcp.last_end =
900 segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
901
902 write_unlock_bh(&tcp_lock);
903 if (LOG_INVALID(IPPROTO_TCP))
904 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
905 "nf_ct_tcp: invalid packed ignored ");
906 return NF_ACCEPT;
907 case TCP_CONNTRACK_MAX:
908 /* Invalid packet */
909 DEBUGP("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
910 dir, get_conntrack_index(th),
911 old_state);
912 write_unlock_bh(&tcp_lock);
913 if (LOG_INVALID(IPPROTO_TCP))
914 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
915 "nf_ct_tcp: invalid state ");
916 return -NF_ACCEPT;
917 case TCP_CONNTRACK_SYN_SENT:
918 if (old_state < TCP_CONNTRACK_TIME_WAIT)
919 break;
920 if ((conntrack->proto.tcp.seen[dir].flags &
921 IP_CT_TCP_FLAG_CLOSE_INIT)
922 || after(ntohl(th->seq),
923 conntrack->proto.tcp.seen[dir].td_end)) {
601e68e1
YH		 924 /* Attempt to reopen a closed connection.
925 * Delete this connection and look up again. */
926 write_unlock_bh(&tcp_lock);
927 if (del_timer(&conntrack->timeout))
928 conntrack->timeout.function((unsigned long)
929 conntrack);
930 return -NF_REPEAT;
3746a2b1
KK		 931 } else {
932 write_unlock_bh(&tcp_lock);
933 if (LOG_INVALID(IPPROTO_TCP))
934 nf_log_packet(pf, 0, skb, NULL, NULL,
935 NULL, "nf_ct_tcp: invalid SYN");
936 return -NF_ACCEPT;
9fb9cbb1
YK		 937 }
938 case TCP_CONNTRACK_CLOSE:
939 if (index == TCP_RST_SET
73f30602 940 && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
601e68e1
YH		 941 && conntrack->proto.tcp.last_index == TCP_SYN_SET)
942 || (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
943 && conntrack->proto.tcp.last_index == TCP_ACK_SET))
9fb9cbb1 944 && ntohl(th->ack_seq) == conntrack->proto.tcp.last_end) {
93b1fae4 945 /* RST sent to invalid SYN or ACK we had let through
73f30602
JK		 946 * at a) and c) above:
947 *
948 * a) SYN was in window then
949 * c) we hold a half-open connection.
950 *
951 * Delete our connection entry.
9fb9cbb1 952 * We skip window checking, because packet might ACK
73f30602 953 * segments we ignored. */
9fb9cbb1
YK		 954 goto in_window;
955 }
93b1fae4 956 /* Just fall through */
9fb9cbb1
YK		 957 default:
958 /* Keep compilers happy. */
959 break;
960 }
961
962 if (!tcp_in_window(&conntrack->proto.tcp, dir, index,
963 skb, dataoff, th, pf)) {
964 write_unlock_bh(&tcp_lock);
965 return -NF_ACCEPT;
966 }
967 in_window:
968 /* From now on we have got in-window packets */
969 conntrack->proto.tcp.last_index = index;
970
971 DEBUGP("tcp_conntracks: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
972 "syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
973 NIPQUAD(iph->saddr), ntohs(th->source),
974 NIPQUAD(iph->daddr), ntohs(th->dest),
975 (th->syn ? 1 : 0), (th->ack ? 1 : 0),
976 (th->fin ? 1 : 0), (th->rst ? 1 : 0),
977 old_state, new_state);
978
979 conntrack->proto.tcp.state = new_state;
980 if (old_state != new_state
981 && (new_state == TCP_CONNTRACK_FIN_WAIT
982 || new_state == TCP_CONNTRACK_CLOSE))
983 conntrack->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
984 timeout = conntrack->proto.tcp.retrans >= nf_ct_tcp_max_retrans
985 && *tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans
986 ? nf_ct_tcp_timeout_max_retrans : *tcp_timeouts[new_state];
987 write_unlock_bh(&tcp_lock);
988
989 nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
990 if (new_state != old_state)
991 nf_conntrack_event_cache(IPCT_PROTOINFO, skb);
992
993 if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
994 /* If only reply is a RST, we can consider ourselves not to
995 have an established connection: this is a fairly common
996 problem case, so we can delete the conntrack
997 immediately. --RR */
998 if (th->rst) {
999 if (del_timer(&conntrack->timeout))
1000 conntrack->timeout.function((unsigned long)
1001 conntrack);
1002 return NF_ACCEPT;
1003 }
1004 } else if (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
1005 && (old_state == TCP_CONNTRACK_SYN_RECV
1006 || old_state == TCP_CONNTRACK_ESTABLISHED)
1007 && new_state == TCP_CONNTRACK_ESTABLISHED) {
601e68e1
YH		 1008 /* Set ASSURED if we see see valid ack in ESTABLISHED
1009 after SYN_RECV or a valid answer for a picked up
9fb9cbb1
YK		 1010 connection. */
1011 set_bit(IPS_ASSURED_BIT, &conntrack->status);
1012 nf_conntrack_event_cache(IPCT_STATUS, skb);
1013 }
1014 nf_ct_refresh_acct(conntrack, ctinfo, skb, timeout);
1015
1016 return NF_ACCEPT;
1017}
601e68e1 1018
9fb9cbb1
YK		 1019/* Called when a new connection for this protocol found. */
1020static int tcp_new(struct nf_conn *conntrack,
1021 const struct sk_buff *skb,
1022 unsigned int dataoff)
1023{
1024 enum tcp_conntrack new_state;
1025 struct tcphdr *th, _tcph;
1026#ifdef DEBUGP_VARS
1027 struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[0];
1028 struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[1];
1029#endif
1030
1031 th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1032 BUG_ON(th == NULL);
1033
1034 /* Don't need lock here: this conntrack not in circulation yet */
1035 new_state
1036 = tcp_conntracks[0][get_conntrack_index(th)]
1037 [TCP_CONNTRACK_NONE];
1038
1039 /* Invalid: delete conntrack */
1040 if (new_state >= TCP_CONNTRACK_MAX) {
1041 DEBUGP("nf_ct_tcp: invalid new deleting.\n");
1042 return 0;
1043 }
1044
1045 if (new_state == TCP_CONNTRACK_SYN_SENT) {
1046 /* SYN packet */
1047 conntrack->proto.tcp.seen[0].td_end =
1048 segment_seq_plus_len(ntohl(th->seq), skb->len,
1049 dataoff, th);
1050 conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1051 if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
1052 conntrack->proto.tcp.seen[0].td_maxwin = 1;
1053 conntrack->proto.tcp.seen[0].td_maxend =
1054 conntrack->proto.tcp.seen[0].td_end;
1055
1056 tcp_options(skb, dataoff, th, &conntrack->proto.tcp.seen[0]);
1057 conntrack->proto.tcp.seen[1].flags = 0;
9fb9cbb1
YK		 1058 } else if (nf_ct_tcp_loose == 0) {
1059 /* Don't try to pick up connections. */
1060 return 0;
1061 } else {
1062 /*
1063 * We are in the middle of a connection,
1064 * its history is lost for us.
1065 * Let's try to use the data from the packet.
1066 */
1067 conntrack->proto.tcp.seen[0].td_end =
1068 segment_seq_plus_len(ntohl(th->seq), skb->len,
1069 dataoff, th);
1070 conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1071 if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
1072 conntrack->proto.tcp.seen[0].td_maxwin = 1;
1073 conntrack->proto.tcp.seen[0].td_maxend =
601e68e1 1074 conntrack->proto.tcp.seen[0].td_end +
9fb9cbb1
YK		 1075 conntrack->proto.tcp.seen[0].td_maxwin;
1076 conntrack->proto.tcp.seen[0].td_scale = 0;
1077
a09113c2
PM		 1078 /* We assume SACK and liberal window checking to handle
1079 * window scaling */
9fb9cbb1 1080 conntrack->proto.tcp.seen[0].flags =
a09113c2
PM		 1081 conntrack->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1082 IP_CT_TCP_FLAG_BE_LIBERAL;
9fb9cbb1 1083 }
601e68e1 1084
9fb9cbb1
YK		 1085 conntrack->proto.tcp.seen[1].td_end = 0;
1086 conntrack->proto.tcp.seen[1].td_maxend = 0;
1087 conntrack->proto.tcp.seen[1].td_maxwin = 1;
601e68e1 1088 conntrack->proto.tcp.seen[1].td_scale = 0;
9fb9cbb1
YK		 1089
1090 /* tcp_packet will set them */
1091 conntrack->proto.tcp.state = TCP_CONNTRACK_NONE;
1092 conntrack->proto.tcp.last_index = TCP_NONE_SET;
601e68e1 1093
9fb9cbb1
YK		 1094 DEBUGP("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1095 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1096 sender->td_end, sender->td_maxend, sender->td_maxwin,
601e68e1 1097 sender->td_scale,
9fb9cbb1
YK		 1098 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1099 receiver->td_scale);
1100 return 1;
1101}
c1d10adb
PNA		 1102
1103#if defined(CONFIG_NF_CT_NETLINK) || \
1104 defined(CONFIG_NF_CT_NETLINK_MODULE)
1105
1106#include <linux/netfilter/nfnetlink.h>
1107#include <linux/netfilter/nfnetlink_conntrack.h>
1108
1109static int tcp_to_nfattr(struct sk_buff *skb, struct nfattr *nfa,
1110 const struct nf_conn *ct)
1111{
1112 struct nfattr *nest_parms;
601e68e1 1113
c1d10adb
PNA		 1114 read_lock_bh(&tcp_lock);
1115 nest_parms = NFA_NEST(skb, CTA_PROTOINFO_TCP);
1116 NFA_PUT(skb, CTA_PROTOINFO_TCP_STATE, sizeof(u_int8_t),
1117 &ct->proto.tcp.state);
1118 read_unlock_bh(&tcp_lock);
1119
1120 NFA_NEST_END(skb, nest_parms);
1121
1122 return 0;
1123
1124nfattr_failure:
1125 read_unlock_bh(&tcp_lock);
1126 return -1;
1127}
1128
1129static const size_t cta_min_tcp[CTA_PROTOINFO_TCP_MAX] = {
1130 [CTA_PROTOINFO_TCP_STATE-1] = sizeof(u_int8_t),
1131};
1132
1133static int nfattr_to_tcp(struct nfattr *cda[], struct nf_conn *ct)
1134{
1135 struct nfattr *attr = cda[CTA_PROTOINFO_TCP-1];
1136 struct nfattr *tb[CTA_PROTOINFO_TCP_MAX];
1137
1138 /* updates could not contain anything about the private
1139 * protocol info, in that case skip the parsing */
1140 if (!attr)
1141 return 0;
1142
601e68e1 1143 nfattr_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, attr);
c1d10adb
PNA		 1144
1145 if (nfattr_bad_size(tb, CTA_PROTOINFO_TCP_MAX, cta_min_tcp))
1146 return -EINVAL;
1147
1148 if (!tb[CTA_PROTOINFO_TCP_STATE-1])
1149 return -EINVAL;
1150
1151 write_lock_bh(&tcp_lock);
601e68e1 1152 ct->proto.tcp.state =
c1d10adb
PNA		 1153 *(u_int8_t *)NFA_DATA(tb[CTA_PROTOINFO_TCP_STATE-1]);
1154 write_unlock_bh(&tcp_lock);
1155
1156 return 0;
1157}
1158#endif
933a41e7
PM		 1159
1160#ifdef CONFIG_SYSCTL
1161static unsigned int tcp_sysctl_table_users;
1162static struct ctl_table_header *tcp_sysctl_header;
1163static struct ctl_table tcp_sysctl_table[] = {
1164 {
1165 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_SYN_SENT,
1166 .procname = "nf_conntrack_tcp_timeout_syn_sent",
1167 .data = &nf_ct_tcp_timeout_syn_sent,
1168 .maxlen = sizeof(unsigned int),
1169 .mode = 0644,
1170 .proc_handler = &proc_dointvec_jiffies,
1171 },
1172 {
1173 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_SYN_RECV,
1174 .procname = "nf_conntrack_tcp_timeout_syn_recv",
1175 .data = &nf_ct_tcp_timeout_syn_recv,
1176 .maxlen = sizeof(unsigned int),
1177 .mode = 0644,
1178 .proc_handler = &proc_dointvec_jiffies,
1179 },
1180 {
1181 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_ESTABLISHED,
1182 .procname = "nf_conntrack_tcp_timeout_established",
1183 .data = &nf_ct_tcp_timeout_established,
1184 .maxlen = sizeof(unsigned int),
1185 .mode = 0644,
1186 .proc_handler = &proc_dointvec_jiffies,
1187 },
1188 {
1189 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_FIN_WAIT,
1190 .procname = "nf_conntrack_tcp_timeout_fin_wait",
1191 .data = &nf_ct_tcp_timeout_fin_wait,
1192 .maxlen = sizeof(unsigned int),
1193 .mode = 0644,
1194 .proc_handler = &proc_dointvec_jiffies,
1195 },
1196 {
1197 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_CLOSE_WAIT,
1198 .procname = "nf_conntrack_tcp_timeout_close_wait",
1199 .data = &nf_ct_tcp_timeout_close_wait,
1200 .maxlen = sizeof(unsigned int),
1201 .mode = 0644,
1202 .proc_handler = &proc_dointvec_jiffies,
1203 },
1204 {
1205 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_LAST_ACK,
1206 .procname = "nf_conntrack_tcp_timeout_last_ack",
1207 .data = &nf_ct_tcp_timeout_last_ack,
1208 .maxlen = sizeof(unsigned int),
1209 .mode = 0644,
1210 .proc_handler = &proc_dointvec_jiffies,
1211 },
1212 {
1213 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_TIME_WAIT,
1214 .procname = "nf_conntrack_tcp_timeout_time_wait",
1215 .data = &nf_ct_tcp_timeout_time_wait,
1216 .maxlen = sizeof(unsigned int),
1217 .mode = 0644,
1218 .proc_handler = &proc_dointvec_jiffies,
1219 },
1220 {
1221 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_CLOSE,
1222 .procname = "nf_conntrack_tcp_timeout_close",
1223 .data = &nf_ct_tcp_timeout_close,
1224 .maxlen = sizeof(unsigned int),
1225 .mode = 0644,
1226 .proc_handler = &proc_dointvec_jiffies,
1227 },
1228 {
1229 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_MAX_RETRANS,
1230 .procname = "nf_conntrack_tcp_timeout_max_retrans",
1231 .data = &nf_ct_tcp_timeout_max_retrans,
1232 .maxlen = sizeof(unsigned int),
1233 .mode = 0644,
1234 .proc_handler = &proc_dointvec_jiffies,
1235 },
1236 {
1237 .ctl_name = NET_NF_CONNTRACK_TCP_LOOSE,
1238 .procname = "nf_conntrack_tcp_loose",
1239 .data = &nf_ct_tcp_loose,
1240 .maxlen = sizeof(unsigned int),
1241 .mode = 0644,
1242 .proc_handler = &proc_dointvec,
1243 },
1244 {
1245 .ctl_name = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
1246 .procname = "nf_conntrack_tcp_be_liberal",
1247 .data = &nf_ct_tcp_be_liberal,
1248 .maxlen = sizeof(unsigned int),
1249 .mode = 0644,
1250 .proc_handler = &proc_dointvec,
1251 },
1252 {
1253 .ctl_name = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
1254 .procname = "nf_conntrack_tcp_max_retrans",
1255 .data = &nf_ct_tcp_max_retrans,
1256 .maxlen = sizeof(unsigned int),
1257 .mode = 0644,
1258 .proc_handler = &proc_dointvec,
1259 },
1260 {
1261 .ctl_name = 0
1262 }
1263};
a999e683
PM		 1264
1265#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1266static struct ctl_table tcp_compat_sysctl_table[] = {
1267 {
1268 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_SENT,
1269 .procname = "ip_conntrack_tcp_timeout_syn_sent",
1270 .data = &nf_ct_tcp_timeout_syn_sent,
1271 .maxlen = sizeof(unsigned int),
1272 .mode = 0644,
1273 .proc_handler = &proc_dointvec_jiffies,
1274 },
1275 {
1276 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_RECV,
1277 .procname = "ip_conntrack_tcp_timeout_syn_recv",
1278 .data = &nf_ct_tcp_timeout_syn_recv,
1279 .maxlen = sizeof(unsigned int),
1280 .mode = 0644,
1281 .proc_handler = &proc_dointvec_jiffies,
1282 },
1283 {
1284 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_ESTABLISHED,
1285 .procname = "ip_conntrack_tcp_timeout_established",
1286 .data = &nf_ct_tcp_timeout_established,
1287 .maxlen = sizeof(unsigned int),
1288 .mode = 0644,
1289 .proc_handler = &proc_dointvec_jiffies,
1290 },
1291 {
1292 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_FIN_WAIT,
1293 .procname = "ip_conntrack_tcp_timeout_fin_wait",
1294 .data = &nf_ct_tcp_timeout_fin_wait,
1295 .maxlen = sizeof(unsigned int),
1296 .mode = 0644,
1297 .proc_handler = &proc_dointvec_jiffies,
1298 },
1299 {
1300 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE_WAIT,
1301 .procname = "ip_conntrack_tcp_timeout_close_wait",
1302 .data = &nf_ct_tcp_timeout_close_wait,
1303 .maxlen = sizeof(unsigned int),
1304 .mode = 0644,
1305 .proc_handler = &proc_dointvec_jiffies,
1306 },
1307 {
1308 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_LAST_ACK,
1309 .procname = "ip_conntrack_tcp_timeout_last_ack",
1310 .data = &nf_ct_tcp_timeout_last_ack,
1311 .maxlen = sizeof(unsigned int),
1312 .mode = 0644,
1313 .proc_handler = &proc_dointvec_jiffies,
1314 },
1315 {
1316 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_TIME_WAIT,
1317 .procname = "ip_conntrack_tcp_timeout_time_wait",
1318 .data = &nf_ct_tcp_timeout_time_wait,
1319 .maxlen = sizeof(unsigned int),
1320 .mode = 0644,
1321 .proc_handler = &proc_dointvec_jiffies,
1322 },
1323 {
1324 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE,
1325 .procname = "ip_conntrack_tcp_timeout_close",
1326 .data = &nf_ct_tcp_timeout_close,
1327 .maxlen = sizeof(unsigned int),
1328 .mode = 0644,
1329 .proc_handler = &proc_dointvec_jiffies,
1330 },
1331 {
1332 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_MAX_RETRANS,
1333 .procname = "ip_conntrack_tcp_timeout_max_retrans",
1334 .data = &nf_ct_tcp_timeout_max_retrans,
1335 .maxlen = sizeof(unsigned int),
1336 .mode = 0644,
1337 .proc_handler = &proc_dointvec_jiffies,
1338 },
1339 {
1340 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
1341 .procname = "ip_conntrack_tcp_loose",
1342 .data = &nf_ct_tcp_loose,
1343 .maxlen = sizeof(unsigned int),
1344 .mode = 0644,
1345 .proc_handler = &proc_dointvec,
1346 },
1347 {
1348 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
1349 .procname = "ip_conntrack_tcp_be_liberal",
1350 .data = &nf_ct_tcp_be_liberal,
1351 .maxlen = sizeof(unsigned int),
1352 .mode = 0644,
1353 .proc_handler = &proc_dointvec,
1354 },
1355 {
1356 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
1357 .procname = "ip_conntrack_tcp_max_retrans",
1358 .data = &nf_ct_tcp_max_retrans,
1359 .maxlen = sizeof(unsigned int),
1360 .mode = 0644,
1361 .proc_handler = &proc_dointvec,
1362 },
1363 {
1364 .ctl_name = 0
1365 }
1366};
1367#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
933a41e7
PM		 1368#endif /* CONFIG_SYSCTL */
1369
605dcad6 1370struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 =
9fb9cbb1
YK		 1371{
1372 .l3proto = PF_INET,
605dcad6 1373 .l4proto = IPPROTO_TCP,
9fb9cbb1
YK		 1374 .name = "tcp",
1375 .pkt_to_tuple = tcp_pkt_to_tuple,
1376 .invert_tuple = tcp_invert_tuple,
1377 .print_tuple = tcp_print_tuple,
1378 .print_conntrack = tcp_print_conntrack,
1379 .packet = tcp_packet,
1380 .new = tcp_new,
96f6bf82 1381 .error = tcp_error,
c1d10adb
PNA		 1382#if defined(CONFIG_NF_CT_NETLINK) || \
1383 defined(CONFIG_NF_CT_NETLINK_MODULE)
1384 .to_nfattr = tcp_to_nfattr,
1385 .from_nfattr = nfattr_to_tcp,
1386 .tuple_to_nfattr = nf_ct_port_tuple_to_nfattr,
1387 .nfattr_to_tuple = nf_ct_port_nfattr_to_tuple,
1388#endif
933a41e7
PM		 1389#ifdef CONFIG_SYSCTL
1390 .ctl_table_users = &tcp_sysctl_table_users,
1391 .ctl_table_header = &tcp_sysctl_header,
1392 .ctl_table = tcp_sysctl_table,
a999e683
PM		 1393#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1394 .ctl_compat_table = tcp_compat_sysctl_table,
1395#endif
933a41e7 1396#endif
9fb9cbb1 1397};
13b18339 1398EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
9fb9cbb1 1399
605dcad6 1400struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 =
9fb9cbb1
YK		 1401{
1402 .l3proto = PF_INET6,
605dcad6 1403 .l4proto = IPPROTO_TCP,
9fb9cbb1
YK		 1404 .name = "tcp",
1405 .pkt_to_tuple = tcp_pkt_to_tuple,
1406 .invert_tuple = tcp_invert_tuple,
1407 .print_tuple = tcp_print_tuple,
1408 .print_conntrack = tcp_print_conntrack,
1409 .packet = tcp_packet,
1410 .new = tcp_new,
96f6bf82 1411 .error = tcp_error,
c1d10adb
PNA		 1412#if defined(CONFIG_NF_CT_NETLINK) || \
1413 defined(CONFIG_NF_CT_NETLINK_MODULE)
1414 .to_nfattr = tcp_to_nfattr,
1415 .from_nfattr = nfattr_to_tcp,
1416 .tuple_to_nfattr = nf_ct_port_tuple_to_nfattr,
1417 .nfattr_to_tuple = nf_ct_port_nfattr_to_tuple,
1418#endif
933a41e7
PM		 1419#ifdef CONFIG_SYSCTL
1420 .ctl_table_users = &tcp_sysctl_table_users,
1421 .ctl_table_header = &tcp_sysctl_header,
1422 .ctl_table = tcp_sysctl_table,
1423#endif
9fb9cbb1 1424};
13b18339 1425EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);
kernel source for telekom puls (alcatel/mediatek)