netfilter: xt_limit: fix invalid return code in limit_mt_check()
[linux-2.6.git] / net / netfilter / nf_conntrack_proto_tcp.c
1 /* (C) 1999-2001 Paul `Rusty' Russell
2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  */
8
9 #include <linux/types.h>
10 #include <linux/timer.h>
11 #include <linux/module.h>
12 #include <linux/in.h>
13 #include <linux/tcp.h>
14 #include <linux/spinlock.h>
15 #include <linux/skbuff.h>
16 #include <linux/ipv6.h>
17 #include <net/ip6_checksum.h>
18 #include <asm/unaligned.h>
19
20 #include <net/tcp.h>
21
22 #include <linux/netfilter.h>
23 #include <linux/netfilter_ipv4.h>
24 #include <linux/netfilter_ipv6.h>
25 #include <net/netfilter/nf_conntrack.h>
26 #include <net/netfilter/nf_conntrack_l4proto.h>
27 #include <net/netfilter/nf_conntrack_ecache.h>
28 #include <net/netfilter/nf_log.h>
29 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
30 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
31
32 /* "Be conservative in what you do,
33     be liberal in what you accept from others."
34     If it's non-zero, we mark only out of window RST segments as INVALID. */
35 static int nf_ct_tcp_be_liberal __read_mostly = 0;
36
37 /* If it is set to zero, we disable picking up already established
38    connections. */
39 static int nf_ct_tcp_loose __read_mostly = 1;
40
41 /* Max number of the retransmitted packets without receiving an (acceptable)
42    ACK from the destination. If this number is reached, a shorter timer
43    will be started. */
44 static int nf_ct_tcp_max_retrans __read_mostly = 3;
45
46   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
47      closely.  They're more complex. --RR */
48
49 static const char *const tcp_conntrack_names[] = {
50         "NONE",
51         "SYN_SENT",
52         "SYN_RECV",
53         "ESTABLISHED",
54         "FIN_WAIT",
55         "CLOSE_WAIT",
56         "LAST_ACK",
57         "TIME_WAIT",
58         "CLOSE",
59         "SYN_SENT2",
60 };
61
62 #define SECS * HZ
63 #define MINS * 60 SECS
64 #define HOURS * 60 MINS
65 #define DAYS * 24 HOURS
66
67 /* RFC1122 says the R2 limit should be at least 100 seconds.
68    Linux uses 15 packets as limit, which corresponds
69    to ~13-30min depending on RTO. */
70 static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly    =   5 MINS;
71 static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly =   5 MINS;
72
73 static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
74         [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
75         [TCP_CONNTRACK_SYN_RECV]        = 60 SECS,
76         [TCP_CONNTRACK_ESTABLISHED]     = 5 DAYS,
77         [TCP_CONNTRACK_FIN_WAIT]        = 2 MINS,
78         [TCP_CONNTRACK_CLOSE_WAIT]      = 60 SECS,
79         [TCP_CONNTRACK_LAST_ACK]        = 30 SECS,
80         [TCP_CONNTRACK_TIME_WAIT]       = 2 MINS,
81         [TCP_CONNTRACK_CLOSE]           = 10 SECS,
82         [TCP_CONNTRACK_SYN_SENT2]       = 2 MINS,
83 };
84
85 #define sNO TCP_CONNTRACK_NONE
86 #define sSS TCP_CONNTRACK_SYN_SENT
87 #define sSR TCP_CONNTRACK_SYN_RECV
88 #define sES TCP_CONNTRACK_ESTABLISHED
89 #define sFW TCP_CONNTRACK_FIN_WAIT
90 #define sCW TCP_CONNTRACK_CLOSE_WAIT
91 #define sLA TCP_CONNTRACK_LAST_ACK
92 #define sTW TCP_CONNTRACK_TIME_WAIT
93 #define sCL TCP_CONNTRACK_CLOSE
94 #define sS2 TCP_CONNTRACK_SYN_SENT2
95 #define sIV TCP_CONNTRACK_MAX
96 #define sIG TCP_CONNTRACK_IGNORE
97
98 /* What TCP flags are set from RST/SYN/FIN/ACK. */
99 enum tcp_bit_set {
100         TCP_SYN_SET,
101         TCP_SYNACK_SET,
102         TCP_FIN_SET,
103         TCP_ACK_SET,
104         TCP_RST_SET,
105         TCP_NONE_SET,
106 };
107
108 /*
109  * The TCP state transition table needs a few words...
110  *
111  * We are the man in the middle. All the packets go through us
112  * but might get lost in transit to the destination.
113  * It is assumed that the destinations can't receive segments
114  * we haven't seen.
115  *
116  * The checked segment is in window, but our windows are *not*
117  * equivalent with the ones of the sender/receiver. We always
118  * try to guess the state of the current sender.
119  *
120  * The meaning of the states are:
121  *
122  * NONE:        initial state
123  * SYN_SENT:    SYN-only packet seen
124  * SYN_SENT2:   SYN-only packet seen from reply dir, simultaneous open
125  * SYN_RECV:    SYN-ACK packet seen
126  * ESTABLISHED: ACK packet seen
127  * FIN_WAIT:    FIN packet seen
128  * CLOSE_WAIT:  ACK seen (after FIN)
129  * LAST_ACK:    FIN seen (after FIN)
130  * TIME_WAIT:   last ACK seen
131  * CLOSE:       closed connection (RST)
132  *
133  * Packets marked as IGNORED (sIG):
134  *      if they may be either invalid or valid
135  *      and the receiver may send back a connection
136  *      closing RST or a SYN/ACK.
137  *
138  * Packets marked as INVALID (sIV):
139  *      if we regard them as truly invalid packets
140  */
141 static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
142         {
143 /* ORIGINAL */
144 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
145 /*syn*/    { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sS2 },
146 /*
147  *      sNO -> sSS      Initialize a new connection
148  *      sSS -> sSS      Retransmitted SYN
149  *      sS2 -> sS2      Late retransmitted SYN
150  *      sSR -> sIG
151  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
152  *                      are errors. Receiver will reply with RST
153  *                      and close the connection.
154  *                      Or we are not in sync and hold a dead connection.
155  *      sFW -> sIG
156  *      sCW -> sIG
157  *      sLA -> sIG
158  *      sTW -> sSS      Reopened connection (RFC 1122).
159  *      sCL -> sSS
160  */
161 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
162 /*synack*/ { sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
163 /*
164  *      sNO -> sIV      Too late and no reason to do anything
165  *      sSS -> sIV      Client can't send SYN and then SYN/ACK
166  *      sS2 -> sSR      SYN/ACK sent to SYN2 in simultaneous open
167  *      sSR -> sIG
168  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
169  *                      are errors. Receiver will reply with RST
170  *                      and close the connection.
171  *                      Or we are not in sync and hold a dead connection.
172  *      sFW -> sIG
173  *      sCW -> sIG
174  *      sLA -> sIG
175  *      sTW -> sIG
176  *      sCL -> sIG
177  */
178 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
179 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
180 /*
181  *      sNO -> sIV      Too late and no reason to do anything...
182  *      sSS -> sIV      Client migth not send FIN in this state:
183  *                      we enforce waiting for a SYN/ACK reply first.
184  *      sS2 -> sIV
185  *      sSR -> sFW      Close started.
186  *      sES -> sFW
187  *      sFW -> sLA      FIN seen in both directions, waiting for
188  *                      the last ACK.
189  *                      Migth be a retransmitted FIN as well...
190  *      sCW -> sLA
191  *      sLA -> sLA      Retransmitted FIN. Remain in the same state.
192  *      sTW -> sTW
193  *      sCL -> sCL
194  */
195 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
196 /*ack*/    { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
197 /*
198  *      sNO -> sES      Assumed.
199  *      sSS -> sIV      ACK is invalid: we haven't seen a SYN/ACK yet.
200  *      sS2 -> sIV
201  *      sSR -> sES      Established state is reached.
202  *      sES -> sES      :-)
203  *      sFW -> sCW      Normal close request answered by ACK.
204  *      sCW -> sCW
205  *      sLA -> sTW      Last ACK detected.
206  *      sTW -> sTW      Retransmitted last ACK. Remain in the same state.
207  *      sCL -> sCL
208  */
209 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
210 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
211 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
212         },
213         {
214 /* REPLY */
215 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
216 /*syn*/    { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sS2 },
217 /*
218  *      sNO -> sIV      Never reached.
219  *      sSS -> sS2      Simultaneous open
220  *      sS2 -> sS2      Retransmitted simultaneous SYN
221  *      sSR -> sIV      Invalid SYN packets sent by the server
222  *      sES -> sIV
223  *      sFW -> sIV
224  *      sCW -> sIV
225  *      sLA -> sIV
226  *      sTW -> sIV      Reopened connection, but server may not do it.
227  *      sCL -> sIV
228  */
229 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
230 /*synack*/ { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
231 /*
232  *      sSS -> sSR      Standard open.
233  *      sS2 -> sSR      Simultaneous open
234  *      sSR -> sSR      Retransmitted SYN/ACK.
235  *      sES -> sIG      Late retransmitted SYN/ACK?
236  *      sFW -> sIG      Might be SYN/ACK answering ignored SYN
237  *      sCW -> sIG
238  *      sLA -> sIG
239  *      sTW -> sIG
240  *      sCL -> sIG
241  */
242 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
243 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
244 /*
245  *      sSS -> sIV      Server might not send FIN in this state.
246  *      sS2 -> sIV
247  *      sSR -> sFW      Close started.
248  *      sES -> sFW
249  *      sFW -> sLA      FIN seen in both directions.
250  *      sCW -> sLA
251  *      sLA -> sLA      Retransmitted FIN.
252  *      sTW -> sTW
253  *      sCL -> sCL
254  */
255 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
256 /*ack*/    { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIG },
257 /*
258  *      sSS -> sIG      Might be a half-open connection.
259  *      sS2 -> sIG
260  *      sSR -> sSR      Might answer late resent SYN.
261  *      sES -> sES      :-)
262  *      sFW -> sCW      Normal close request answered by ACK.
263  *      sCW -> sCW
264  *      sLA -> sTW      Last ACK detected.
265  *      sTW -> sTW      Retransmitted last ACK.
266  *      sCL -> sCL
267  */
268 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
269 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
270 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
271         }
272 };
273
274 static bool tcp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
275                              struct nf_conntrack_tuple *tuple)
276 {
277         const struct tcphdr *hp;
278         struct tcphdr _hdr;
279
280         /* Actually only need first 8 bytes. */
281         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
282         if (hp == NULL)
283                 return false;
284
285         tuple->src.u.tcp.port = hp->source;
286         tuple->dst.u.tcp.port = hp->dest;
287
288         return true;
289 }
290
291 static bool tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
292                              const struct nf_conntrack_tuple *orig)
293 {
294         tuple->src.u.tcp.port = orig->dst.u.tcp.port;
295         tuple->dst.u.tcp.port = orig->src.u.tcp.port;
296         return true;
297 }
298
299 /* Print out the per-protocol part of the tuple. */
300 static int tcp_print_tuple(struct seq_file *s,
301                            const struct nf_conntrack_tuple *tuple)
302 {
303         return seq_printf(s, "sport=%hu dport=%hu ",
304                           ntohs(tuple->src.u.tcp.port),
305                           ntohs(tuple->dst.u.tcp.port));
306 }
307
308 /* Print out the private part of the conntrack. */
309 static int tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
310 {
311         enum tcp_conntrack state;
312
313         spin_lock_bh(&ct->lock);
314         state = ct->proto.tcp.state;
315         spin_unlock_bh(&ct->lock);
316
317         return seq_printf(s, "%s ", tcp_conntrack_names[state]);
318 }
319
320 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
321 {
322         if (tcph->rst) return TCP_RST_SET;
323         else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
324         else if (tcph->fin) return TCP_FIN_SET;
325         else if (tcph->ack) return TCP_ACK_SET;
326         else return TCP_NONE_SET;
327 }
328
329 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
330    in IP Filter' by Guido van Rooij.
331
332    http://www.nluug.nl/events/sane2000/papers.html
333    http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
334
335    The boundaries and the conditions are changed according to RFC793:
336    the packet must intersect the window (i.e. segments may be
337    after the right or before the left edge) and thus receivers may ACK
338    segments after the right edge of the window.
339
340         td_maxend = max(sack + max(win,1)) seen in reply packets
341         td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
342         td_maxwin += seq + len - sender.td_maxend
343                         if seq + len > sender.td_maxend
344         td_end    = max(seq + len) seen in sent packets
345
346    I.   Upper bound for valid data:     seq <= sender.td_maxend
347    II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
348    III. Upper bound for valid (s)ack:   sack <= receiver.td_end
349    IV.  Lower bound for valid (s)ack:   sack >= receiver.td_end - MAXACKWINDOW
350
351    where sack is the highest right edge of sack block found in the packet
352    or ack in the case of packet without SACK option.
353
354    The upper bound limit for a valid (s)ack is not ignored -
355    we doesn't have to deal with fragments.
356 */
357
358 static inline __u32 segment_seq_plus_len(__u32 seq,
359                                          size_t len,
360                                          unsigned int dataoff,
361                                          const struct tcphdr *tcph)
362 {
363         /* XXX Should I use payload length field in IP/IPv6 header ?
364          * - YK */
365         return (seq + len - dataoff - tcph->doff*4
366                 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
367 }
368
369 /* Fixme: what about big packets? */
370 #define MAXACKWINCONST                  66000
371 #define MAXACKWINDOW(sender)                                            \
372         ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin     \
373                                               : MAXACKWINCONST)
374
375 /*
376  * Simplified tcp_parse_options routine from tcp_input.c
377  */
378 static void tcp_options(const struct sk_buff *skb,
379                         unsigned int dataoff,
380                         const struct tcphdr *tcph,
381                         struct ip_ct_tcp_state *state)
382 {
383         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
384         const unsigned char *ptr;
385         int length = (tcph->doff*4) - sizeof(struct tcphdr);
386
387         if (!length)
388                 return;
389
390         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
391                                  length, buff);
392         BUG_ON(ptr == NULL);
393
394         state->td_scale =
395         state->flags = 0;
396
397         while (length > 0) {
398                 int opcode=*ptr++;
399                 int opsize;
400
401                 switch (opcode) {
402                 case TCPOPT_EOL:
403                         return;
404                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
405                         length--;
406                         continue;
407                 default:
408                         opsize=*ptr++;
409                         if (opsize < 2) /* "silly options" */
410                                 return;
411                         if (opsize > length)
412                                 break;  /* don't parse partial options */
413
414                         if (opcode == TCPOPT_SACK_PERM
415                             && opsize == TCPOLEN_SACK_PERM)
416                                 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
417                         else if (opcode == TCPOPT_WINDOW
418                                  && opsize == TCPOLEN_WINDOW) {
419                                 state->td_scale = *(u_int8_t *)ptr;
420
421                                 if (state->td_scale > 14) {
422                                         /* See RFC1323 */
423                                         state->td_scale = 14;
424                                 }
425                                 state->flags |=
426                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
427                         }
428                         ptr += opsize - 2;
429                         length -= opsize;
430                 }
431         }
432 }
433
434 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
435                      const struct tcphdr *tcph, __u32 *sack)
436 {
437         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
438         const unsigned char *ptr;
439         int length = (tcph->doff*4) - sizeof(struct tcphdr);
440         __u32 tmp;
441
442         if (!length)
443                 return;
444
445         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
446                                  length, buff);
447         BUG_ON(ptr == NULL);
448
449         /* Fast path for timestamp-only option */
450         if (length == TCPOLEN_TSTAMP_ALIGNED*4
451             && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
452                                        | (TCPOPT_NOP << 16)
453                                        | (TCPOPT_TIMESTAMP << 8)
454                                        | TCPOLEN_TIMESTAMP))
455                 return;
456
457         while (length > 0) {
458                 int opcode = *ptr++;
459                 int opsize, i;
460
461                 switch (opcode) {
462                 case TCPOPT_EOL:
463                         return;
464                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
465                         length--;
466                         continue;
467                 default:
468                         opsize = *ptr++;
469                         if (opsize < 2) /* "silly options" */
470                                 return;
471                         if (opsize > length)
472                                 break;  /* don't parse partial options */
473
474                         if (opcode == TCPOPT_SACK
475                             && opsize >= (TCPOLEN_SACK_BASE
476                                           + TCPOLEN_SACK_PERBLOCK)
477                             && !((opsize - TCPOLEN_SACK_BASE)
478                                  % TCPOLEN_SACK_PERBLOCK)) {
479                                 for (i = 0;
480                                      i < (opsize - TCPOLEN_SACK_BASE);
481                                      i += TCPOLEN_SACK_PERBLOCK) {
482                                         tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
483
484                                         if (after(tmp, *sack))
485                                                 *sack = tmp;
486                                 }
487                                 return;
488                         }
489                         ptr += opsize - 2;
490                         length -= opsize;
491                 }
492         }
493 }
494
495 #ifdef CONFIG_NF_NAT_NEEDED
496 static inline s16 nat_offset(const struct nf_conn *ct,
497                              enum ip_conntrack_dir dir,
498                              u32 seq)
499 {
500         typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
501
502         return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
503 }
504 #define NAT_OFFSET(pf, ct, dir, seq) \
505         (pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0)
506 #else
507 #define NAT_OFFSET(pf, ct, dir, seq)    0
508 #endif
509
510 static bool tcp_in_window(const struct nf_conn *ct,
511                           struct ip_ct_tcp *state,
512                           enum ip_conntrack_dir dir,
513                           unsigned int index,
514                           const struct sk_buff *skb,
515                           unsigned int dataoff,
516                           const struct tcphdr *tcph,
517                           u_int8_t pf)
518 {
519         struct net *net = nf_ct_net(ct);
520         struct ip_ct_tcp_state *sender = &state->seen[dir];
521         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
522         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
523         __u32 seq, ack, sack, end, win, swin;
524         s16 receiver_offset;
525         bool res;
526
527         /*
528          * Get the required data from the packet.
529          */
530         seq = ntohl(tcph->seq);
531         ack = sack = ntohl(tcph->ack_seq);
532         win = ntohs(tcph->window);
533         end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
534
535         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
536                 tcp_sack(skb, dataoff, tcph, &sack);
537
538         /* Take into account NAT sequence number mangling */
539         receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);
540         ack -= receiver_offset;
541         sack -= receiver_offset;
542
543         pr_debug("tcp_in_window: START\n");
544         pr_debug("tcp_in_window: ");
545         nf_ct_dump_tuple(tuple);
546         pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
547                  seq, ack, receiver_offset, sack, receiver_offset, win, end);
548         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
549                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
550                  sender->td_end, sender->td_maxend, sender->td_maxwin,
551                  sender->td_scale,
552                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
553                  receiver->td_scale);
554
555         if (sender->td_maxwin == 0) {
556                 /*
557                  * Initialize sender data.
558                  */
559                 if (tcph->syn) {
560                         /*
561                          * SYN-ACK in reply to a SYN
562                          * or SYN from reply direction in simultaneous open.
563                          */
564                         sender->td_end =
565                         sender->td_maxend = end;
566                         sender->td_maxwin = (win == 0 ? 1 : win);
567
568                         tcp_options(skb, dataoff, tcph, sender);
569                         /*
570                          * RFC 1323:
571                          * Both sides must send the Window Scale option
572                          * to enable window scaling in either direction.
573                          */
574                         if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
575                               && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
576                                 sender->td_scale =
577                                 receiver->td_scale = 0;
578                         if (!tcph->ack)
579                                 /* Simultaneous open */
580                                 return true;
581                 } else {
582                         /*
583                          * We are in the middle of a connection,
584                          * its history is lost for us.
585                          * Let's try to use the data from the packet.
586                          */
587                         sender->td_end = end;
588                         sender->td_maxwin = (win == 0 ? 1 : win);
589                         sender->td_maxend = end + sender->td_maxwin;
590                 }
591         } else if (((state->state == TCP_CONNTRACK_SYN_SENT
592                      && dir == IP_CT_DIR_ORIGINAL)
593                    || (state->state == TCP_CONNTRACK_SYN_RECV
594                      && dir == IP_CT_DIR_REPLY))
595                    && after(end, sender->td_end)) {
596                 /*
597                  * RFC 793: "if a TCP is reinitialized ... then it need
598                  * not wait at all; it must only be sure to use sequence
599                  * numbers larger than those recently used."
600                  */
601                 sender->td_end =
602                 sender->td_maxend = end;
603                 sender->td_maxwin = (win == 0 ? 1 : win);
604
605                 tcp_options(skb, dataoff, tcph, sender);
606         }
607
608         if (!(tcph->ack)) {
609                 /*
610                  * If there is no ACK, just pretend it was set and OK.
611                  */
612                 ack = sack = receiver->td_end;
613         } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
614                     (TCP_FLAG_ACK|TCP_FLAG_RST))
615                    && (ack == 0)) {
616                 /*
617                  * Broken TCP stacks, that set ACK in RST packets as well
618                  * with zero ack value.
619                  */
620                 ack = sack = receiver->td_end;
621         }
622
623         if (seq == end
624             && (!tcph->rst
625                 || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
626                 /*
627                  * Packets contains no data: we assume it is valid
628                  * and check the ack value only.
629                  * However RST segments are always validated by their
630                  * SEQ number, except when seq == 0 (reset sent answering
631                  * SYN.
632                  */
633                 seq = end = sender->td_end;
634
635         pr_debug("tcp_in_window: ");
636         nf_ct_dump_tuple(tuple);
637         pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
638                  seq, ack, receiver_offset, sack, receiver_offset, win, end);
639         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
640                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
641                  sender->td_end, sender->td_maxend, sender->td_maxwin,
642                  sender->td_scale,
643                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
644                  receiver->td_scale);
645
646         pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
647                  before(seq, sender->td_maxend + 1),
648                  after(end, sender->td_end - receiver->td_maxwin - 1),
649                  before(sack, receiver->td_end + 1),
650                  after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
651
652         if (before(seq, sender->td_maxend + 1) &&
653             after(end, sender->td_end - receiver->td_maxwin - 1) &&
654             before(sack, receiver->td_end + 1) &&
655             after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
656                 /*
657                  * Take into account window scaling (RFC 1323).
658                  */
659                 if (!tcph->syn)
660                         win <<= sender->td_scale;
661
662                 /*
663                  * Update sender data.
664                  */
665                 swin = win + (sack - ack);
666                 if (sender->td_maxwin < swin)
667                         sender->td_maxwin = swin;
668                 if (after(end, sender->td_end)) {
669                         sender->td_end = end;
670                         sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
671                 }
672                 if (tcph->ack) {
673                         if (!(sender->flags & IP_CT_TCP_FLAG_MAXACK_SET)) {
674                                 sender->td_maxack = ack;
675                                 sender->flags |= IP_CT_TCP_FLAG_MAXACK_SET;
676                         } else if (after(ack, sender->td_maxack))
677                                 sender->td_maxack = ack;
678                 }
679
680                 /*
681                  * Update receiver data.
682                  */
683                 if (after(end, sender->td_maxend))
684                         receiver->td_maxwin += end - sender->td_maxend;
685                 if (after(sack + win, receiver->td_maxend - 1)) {
686                         receiver->td_maxend = sack + win;
687                         if (win == 0)
688                                 receiver->td_maxend++;
689                 }
690                 if (ack == receiver->td_end)
691                         receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
692
693                 /*
694                  * Check retransmissions.
695                  */
696                 if (index == TCP_ACK_SET) {
697                         if (state->last_dir == dir
698                             && state->last_seq == seq
699                             && state->last_ack == ack
700                             && state->last_end == end
701                             && state->last_win == win)
702                                 state->retrans++;
703                         else {
704                                 state->last_dir = dir;
705                                 state->last_seq = seq;
706                                 state->last_ack = ack;
707                                 state->last_end = end;
708                                 state->last_win = win;
709                                 state->retrans = 0;
710                         }
711                 }
712                 res = true;
713         } else {
714                 res = false;
715                 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
716                     nf_ct_tcp_be_liberal)
717                         res = true;
718                 if (!res && LOG_INVALID(net, IPPROTO_TCP))
719                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
720                         "nf_ct_tcp: %s ",
721                         before(seq, sender->td_maxend + 1) ?
722                         after(end, sender->td_end - receiver->td_maxwin - 1) ?
723                         before(sack, receiver->td_end + 1) ?
724                         after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
725                         : "ACK is under the lower bound (possible overly delayed ACK)"
726                         : "ACK is over the upper bound (ACKed data not seen yet)"
727                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
728                         : "SEQ is over the upper bound (over the window of the receiver)");
729         }
730
731         pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
732                  "receiver end=%u maxend=%u maxwin=%u\n",
733                  res, sender->td_end, sender->td_maxend, sender->td_maxwin,
734                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
735
736         return res;
737 }
738
739 #define TH_FIN  0x01
740 #define TH_SYN  0x02
741 #define TH_RST  0x04
742 #define TH_PUSH 0x08
743 #define TH_ACK  0x10
744 #define TH_URG  0x20
745 #define TH_ECE  0x40
746 #define TH_CWR  0x80
747
748 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
749 static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
750 {
751         [TH_SYN]                        = 1,
752         [TH_SYN|TH_URG]                 = 1,
753         [TH_SYN|TH_ACK]                 = 1,
754         [TH_RST]                        = 1,
755         [TH_RST|TH_ACK]                 = 1,
756         [TH_FIN|TH_ACK]                 = 1,
757         [TH_FIN|TH_ACK|TH_URG]          = 1,
758         [TH_ACK]                        = 1,
759         [TH_ACK|TH_URG]                 = 1,
760 };
761
762 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
763 static int tcp_error(struct net *net,
764                      struct sk_buff *skb,
765                      unsigned int dataoff,
766                      enum ip_conntrack_info *ctinfo,
767                      u_int8_t pf,
768                      unsigned int hooknum)
769 {
770         const struct tcphdr *th;
771         struct tcphdr _tcph;
772         unsigned int tcplen = skb->len - dataoff;
773         u_int8_t tcpflags;
774
775         /* Smaller that minimal TCP header? */
776         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
777         if (th == NULL) {
778                 if (LOG_INVALID(net, IPPROTO_TCP))
779                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
780                                 "nf_ct_tcp: short packet ");
781                 return -NF_ACCEPT;
782         }
783
784         /* Not whole TCP header or malformed packet */
785         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
786                 if (LOG_INVALID(net, IPPROTO_TCP))
787                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
788                                 "nf_ct_tcp: truncated/malformed packet ");
789                 return -NF_ACCEPT;
790         }
791
792         /* Checksum invalid? Ignore.
793          * We skip checking packets on the outgoing path
794          * because the checksum is assumed to be correct.
795          */
796         /* FIXME: Source route IP option packets --RR */
797         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
798             nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
799                 if (LOG_INVALID(net, IPPROTO_TCP))
800                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
801                                   "nf_ct_tcp: bad TCP checksum ");
802                 return -NF_ACCEPT;
803         }
804
805         /* Check TCP flags. */
806         tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR|TH_PUSH));
807         if (!tcp_valid_flags[tcpflags]) {
808                 if (LOG_INVALID(net, IPPROTO_TCP))
809                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
810                                   "nf_ct_tcp: invalid TCP flag combination ");
811                 return -NF_ACCEPT;
812         }
813
814         return NF_ACCEPT;
815 }
816
817 /* Returns verdict for packet, or -1 for invalid. */
818 static int tcp_packet(struct nf_conn *ct,
819                       const struct sk_buff *skb,
820                       unsigned int dataoff,
821                       enum ip_conntrack_info ctinfo,
822                       u_int8_t pf,
823                       unsigned int hooknum)
824 {
825         struct net *net = nf_ct_net(ct);
826         struct nf_conntrack_tuple *tuple;
827         enum tcp_conntrack new_state, old_state;
828         enum ip_conntrack_dir dir;
829         const struct tcphdr *th;
830         struct tcphdr _tcph;
831         unsigned long timeout;
832         unsigned int index;
833
834         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
835         BUG_ON(th == NULL);
836
837         spin_lock_bh(&ct->lock);
838         old_state = ct->proto.tcp.state;
839         dir = CTINFO2DIR(ctinfo);
840         index = get_conntrack_index(th);
841         new_state = tcp_conntracks[dir][index][old_state];
842         tuple = &ct->tuplehash[dir].tuple;
843
844         switch (new_state) {
845         case TCP_CONNTRACK_SYN_SENT:
846                 if (old_state < TCP_CONNTRACK_TIME_WAIT)
847                         break;
848                 /* RFC 1122: "When a connection is closed actively,
849                  * it MUST linger in TIME-WAIT state for a time 2xMSL
850                  * (Maximum Segment Lifetime). However, it MAY accept
851                  * a new SYN from the remote TCP to reopen the connection
852                  * directly from TIME-WAIT state, if..."
853                  * We ignore the conditions because we are in the
854                  * TIME-WAIT state anyway.
855                  *
856                  * Handle aborted connections: we and the server
857                  * think there is an existing connection but the client
858                  * aborts it and starts a new one.
859                  */
860                 if (((ct->proto.tcp.seen[dir].flags
861                       | ct->proto.tcp.seen[!dir].flags)
862                      & IP_CT_TCP_FLAG_CLOSE_INIT)
863                     || (ct->proto.tcp.last_dir == dir
864                         && ct->proto.tcp.last_index == TCP_RST_SET)) {
865                         /* Attempt to reopen a closed/aborted connection.
866                          * Delete this connection and look up again. */
867                         spin_unlock_bh(&ct->lock);
868
869                         /* Only repeat if we can actually remove the timer.
870                          * Destruction may already be in progress in process
871                          * context and we must give it a chance to terminate.
872                          */
873                         if (nf_ct_kill(ct))
874                                 return -NF_REPEAT;
875                         return NF_DROP;
876                 }
877                 /* Fall through */
878         case TCP_CONNTRACK_IGNORE:
879                 /* Ignored packets:
880                  *
881                  * Our connection entry may be out of sync, so ignore
882                  * packets which may signal the real connection between
883                  * the client and the server.
884                  *
885                  * a) SYN in ORIGINAL
886                  * b) SYN/ACK in REPLY
887                  * c) ACK in reply direction after initial SYN in original.
888                  *
889                  * If the ignored packet is invalid, the receiver will send
890                  * a RST we'll catch below.
891                  */
892                 if (index == TCP_SYNACK_SET
893                     && ct->proto.tcp.last_index == TCP_SYN_SET
894                     && ct->proto.tcp.last_dir != dir
895                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
896                         /* b) This SYN/ACK acknowledges a SYN that we earlier
897                          * ignored as invalid. This means that the client and
898                          * the server are both in sync, while the firewall is
899                          * not. We kill this session and block the SYN/ACK so
900                          * that the client cannot but retransmit its SYN and
901                          * thus initiate a clean new session.
902                          */
903                         spin_unlock_bh(&ct->lock);
904                         if (LOG_INVALID(net, IPPROTO_TCP))
905                                 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
906                                           "nf_ct_tcp: killing out of sync session ");
907                         nf_ct_kill(ct);
908                         return NF_DROP;
909                 }
910                 ct->proto.tcp.last_index = index;
911                 ct->proto.tcp.last_dir = dir;
912                 ct->proto.tcp.last_seq = ntohl(th->seq);
913                 ct->proto.tcp.last_end =
914                     segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
915
916                 spin_unlock_bh(&ct->lock);
917                 if (LOG_INVALID(net, IPPROTO_TCP))
918                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
919                                   "nf_ct_tcp: invalid packet ignored ");
920                 return NF_ACCEPT;
921         case TCP_CONNTRACK_MAX:
922                 /* Invalid packet */
923                 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
924                          dir, get_conntrack_index(th), old_state);
925                 spin_unlock_bh(&ct->lock);
926                 if (LOG_INVALID(net, IPPROTO_TCP))
927                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
928                                   "nf_ct_tcp: invalid state ");
929                 return -NF_ACCEPT;
930         case TCP_CONNTRACK_CLOSE:
931                 if (index == TCP_RST_SET
932                     && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
933                     && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) {
934                         /* Invalid RST  */
935                         spin_unlock_bh(&ct->lock);
936                         if (LOG_INVALID(net, IPPROTO_TCP))
937                                 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
938                                           "nf_ct_tcp: invalid RST ");
939                         return -NF_ACCEPT;
940                 }
941                 if (index == TCP_RST_SET
942                     && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
943                          && ct->proto.tcp.last_index == TCP_SYN_SET)
944                         || (!test_bit(IPS_ASSURED_BIT, &ct->status)
945                             && ct->proto.tcp.last_index == TCP_ACK_SET))
946                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
947                         /* RST sent to invalid SYN or ACK we had let through
948                          * at a) and c) above:
949                          *
950                          * a) SYN was in window then
951                          * c) we hold a half-open connection.
952                          *
953                          * Delete our connection entry.
954                          * We skip window checking, because packet might ACK
955                          * segments we ignored. */
956                         goto in_window;
957                 }
958                 /* Just fall through */
959         default:
960                 /* Keep compilers happy. */
961                 break;
962         }
963
964         if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
965                            skb, dataoff, th, pf)) {
966                 spin_unlock_bh(&ct->lock);
967                 return -NF_ACCEPT;
968         }
969      in_window:
970         /* From now on we have got in-window packets */
971         ct->proto.tcp.last_index = index;
972         ct->proto.tcp.last_dir = dir;
973
974         pr_debug("tcp_conntracks: ");
975         nf_ct_dump_tuple(tuple);
976         pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
977                  (th->syn ? 1 : 0), (th->ack ? 1 : 0),
978                  (th->fin ? 1 : 0), (th->rst ? 1 : 0),
979                  old_state, new_state);
980
981         ct->proto.tcp.state = new_state;
982         if (old_state != new_state
983             && new_state == TCP_CONNTRACK_FIN_WAIT)
984                 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
985
986         if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
987             tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
988                 timeout = nf_ct_tcp_timeout_max_retrans;
989         else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
990                  IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
991                  tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
992                 timeout = nf_ct_tcp_timeout_unacknowledged;
993         else
994                 timeout = tcp_timeouts[new_state];
995         spin_unlock_bh(&ct->lock);
996
997         if (new_state != old_state)
998                 nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
999
1000         if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
1001                 /* If only reply is a RST, we can consider ourselves not to
1002                    have an established connection: this is a fairly common
1003                    problem case, so we can delete the conntrack
1004                    immediately.  --RR */
1005                 if (th->rst) {
1006                         nf_ct_kill_acct(ct, ctinfo, skb);
1007                         return NF_ACCEPT;
1008                 }
1009         } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
1010                    && (old_state == TCP_CONNTRACK_SYN_RECV
1011                        || old_state == TCP_CONNTRACK_ESTABLISHED)
1012                    && new_state == TCP_CONNTRACK_ESTABLISHED) {
1013                 /* Set ASSURED if we see see valid ack in ESTABLISHED
1014                    after SYN_RECV or a valid answer for a picked up
1015                    connection. */
1016                 set_bit(IPS_ASSURED_BIT, &ct->status);
1017                 nf_conntrack_event_cache(IPCT_STATUS, ct);
1018         }
1019         nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
1020
1021         return NF_ACCEPT;
1022 }
1023
1024 /* Called when a new connection for this protocol found. */
1025 static bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
1026                     unsigned int dataoff)
1027 {
1028         enum tcp_conntrack new_state;
1029         const struct tcphdr *th;
1030         struct tcphdr _tcph;
1031         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
1032         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
1033
1034         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1035         BUG_ON(th == NULL);
1036
1037         /* Don't need lock here: this conntrack not in circulation yet */
1038         new_state
1039                 = tcp_conntracks[0][get_conntrack_index(th)]
1040                 [TCP_CONNTRACK_NONE];
1041
1042         /* Invalid: delete conntrack */
1043         if (new_state >= TCP_CONNTRACK_MAX) {
1044                 pr_debug("nf_ct_tcp: invalid new deleting.\n");
1045                 return false;
1046         }
1047
1048         if (new_state == TCP_CONNTRACK_SYN_SENT) {
1049                 /* SYN packet */
1050                 ct->proto.tcp.seen[0].td_end =
1051                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1052                                              dataoff, th);
1053                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1054                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1055                         ct->proto.tcp.seen[0].td_maxwin = 1;
1056                 ct->proto.tcp.seen[0].td_maxend =
1057                         ct->proto.tcp.seen[0].td_end;
1058
1059                 tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
1060                 ct->proto.tcp.seen[1].flags = 0;
1061         } else if (nf_ct_tcp_loose == 0) {
1062                 /* Don't try to pick up connections. */
1063                 return false;
1064         } else {
1065                 /*
1066                  * We are in the middle of a connection,
1067                  * its history is lost for us.
1068                  * Let's try to use the data from the packet.
1069                  */
1070                 ct->proto.tcp.seen[0].td_end =
1071                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1072                                              dataoff, th);
1073                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1074                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1075                         ct->proto.tcp.seen[0].td_maxwin = 1;
1076                 ct->proto.tcp.seen[0].td_maxend =
1077                         ct->proto.tcp.seen[0].td_end +
1078                         ct->proto.tcp.seen[0].td_maxwin;
1079                 ct->proto.tcp.seen[0].td_scale = 0;
1080
1081                 /* We assume SACK and liberal window checking to handle
1082                  * window scaling */
1083                 ct->proto.tcp.seen[0].flags =
1084                 ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1085                                               IP_CT_TCP_FLAG_BE_LIBERAL;
1086         }
1087
1088         ct->proto.tcp.seen[1].td_end = 0;
1089         ct->proto.tcp.seen[1].td_maxend = 0;
1090         ct->proto.tcp.seen[1].td_maxwin = 0;
1091         ct->proto.tcp.seen[1].td_scale = 0;
1092
1093         /* tcp_packet will set them */
1094         ct->proto.tcp.state = TCP_CONNTRACK_NONE;
1095         ct->proto.tcp.last_index = TCP_NONE_SET;
1096
1097         pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1098                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1099                  sender->td_end, sender->td_maxend, sender->td_maxwin,
1100                  sender->td_scale,
1101                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1102                  receiver->td_scale);
1103         return true;
1104 }
1105
1106 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1107
1108 #include <linux/netfilter/nfnetlink.h>
1109 #include <linux/netfilter/nfnetlink_conntrack.h>
1110
1111 static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
1112                          struct nf_conn *ct)
1113 {
1114         struct nlattr *nest_parms;
1115         struct nf_ct_tcp_flags tmp = {};
1116
1117         spin_lock_bh(&ct->lock);
1118         nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP | NLA_F_NESTED);
1119         if (!nest_parms)
1120                 goto nla_put_failure;
1121
1122         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state);
1123
1124         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
1125                    ct->proto.tcp.seen[0].td_scale);
1126
1127         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
1128                    ct->proto.tcp.seen[1].td_scale);
1129
1130         tmp.flags = ct->proto.tcp.seen[0].flags;
1131         NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
1132                 sizeof(struct nf_ct_tcp_flags), &tmp);
1133
1134         tmp.flags = ct->proto.tcp.seen[1].flags;
1135         NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
1136                 sizeof(struct nf_ct_tcp_flags), &tmp);
1137         spin_unlock_bh(&ct->lock);
1138
1139         nla_nest_end(skb, nest_parms);
1140
1141         return 0;
1142
1143 nla_put_failure:
1144         spin_unlock_bh(&ct->lock);
1145         return -1;
1146 }
1147
1148 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
1149         [CTA_PROTOINFO_TCP_STATE]           = { .type = NLA_U8 },
1150         [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
1151         [CTA_PROTOINFO_TCP_WSCALE_REPLY]    = { .type = NLA_U8 },
1152         [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
1153         [CTA_PROTOINFO_TCP_FLAGS_REPLY]     = { .len =  sizeof(struct nf_ct_tcp_flags) },
1154 };
1155
1156 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
1157 {
1158         struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
1159         struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
1160         int err;
1161
1162         /* updates could not contain anything about the private
1163          * protocol info, in that case skip the parsing */
1164         if (!pattr)
1165                 return 0;
1166
1167         err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
1168         if (err < 0)
1169                 return err;
1170
1171         if (tb[CTA_PROTOINFO_TCP_STATE] &&
1172             nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
1173                 return -EINVAL;
1174
1175         spin_lock_bh(&ct->lock);
1176         if (tb[CTA_PROTOINFO_TCP_STATE])
1177                 ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
1178
1179         if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
1180                 struct nf_ct_tcp_flags *attr =
1181                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
1182                 ct->proto.tcp.seen[0].flags &= ~attr->mask;
1183                 ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
1184         }
1185
1186         if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
1187                 struct nf_ct_tcp_flags *attr =
1188                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
1189                 ct->proto.tcp.seen[1].flags &= ~attr->mask;
1190                 ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
1191         }
1192
1193         if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
1194             tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
1195             ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
1196             ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1197                 ct->proto.tcp.seen[0].td_scale =
1198                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
1199                 ct->proto.tcp.seen[1].td_scale =
1200                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
1201         }
1202         spin_unlock_bh(&ct->lock);
1203
1204         return 0;
1205 }
1206
1207 static int tcp_nlattr_size(void)
1208 {
1209         return nla_total_size(0)           /* CTA_PROTOINFO_TCP */
1210                 + nla_policy_len(tcp_nla_policy, CTA_PROTOINFO_TCP_MAX + 1);
1211 }
1212
1213 static int tcp_nlattr_tuple_size(void)
1214 {
1215         return nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
1216 }
1217 #endif
1218
1219 #ifdef CONFIG_SYSCTL
1220 static unsigned int tcp_sysctl_table_users;
1221 static struct ctl_table_header *tcp_sysctl_header;
1222 static struct ctl_table tcp_sysctl_table[] = {
1223         {
1224                 .procname       = "nf_conntrack_tcp_timeout_syn_sent",
1225                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1226                 .maxlen         = sizeof(unsigned int),
1227                 .mode           = 0644,
1228                 .proc_handler   = proc_dointvec_jiffies,
1229         },
1230         {
1231                 .procname       = "nf_conntrack_tcp_timeout_syn_recv",
1232                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1233                 .maxlen         = sizeof(unsigned int),
1234                 .mode           = 0644,
1235                 .proc_handler   = proc_dointvec_jiffies,
1236         },
1237         {
1238                 .procname       = "nf_conntrack_tcp_timeout_established",
1239                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1240                 .maxlen         = sizeof(unsigned int),
1241                 .mode           = 0644,
1242                 .proc_handler   = proc_dointvec_jiffies,
1243         },
1244         {
1245                 .procname       = "nf_conntrack_tcp_timeout_fin_wait",
1246                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1247                 .maxlen         = sizeof(unsigned int),
1248                 .mode           = 0644,
1249                 .proc_handler   = proc_dointvec_jiffies,
1250         },
1251         {
1252                 .procname       = "nf_conntrack_tcp_timeout_close_wait",
1253                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1254                 .maxlen         = sizeof(unsigned int),
1255                 .mode           = 0644,
1256                 .proc_handler   = proc_dointvec_jiffies,
1257         },
1258         {
1259                 .procname       = "nf_conntrack_tcp_timeout_last_ack",
1260                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1261                 .maxlen         = sizeof(unsigned int),
1262                 .mode           = 0644,
1263                 .proc_handler   = proc_dointvec_jiffies,
1264         },
1265         {
1266                 .procname       = "nf_conntrack_tcp_timeout_time_wait",
1267                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1268                 .maxlen         = sizeof(unsigned int),
1269                 .mode           = 0644,
1270                 .proc_handler   = proc_dointvec_jiffies,
1271         },
1272         {
1273                 .procname       = "nf_conntrack_tcp_timeout_close",
1274                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1275                 .maxlen         = sizeof(unsigned int),
1276                 .mode           = 0644,
1277                 .proc_handler   = proc_dointvec_jiffies,
1278         },
1279         {
1280                 .procname       = "nf_conntrack_tcp_timeout_max_retrans",
1281                 .data           = &nf_ct_tcp_timeout_max_retrans,
1282                 .maxlen         = sizeof(unsigned int),
1283                 .mode           = 0644,
1284                 .proc_handler   = proc_dointvec_jiffies,
1285         },
1286         {
1287                 .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
1288                 .data           = &nf_ct_tcp_timeout_unacknowledged,
1289                 .maxlen         = sizeof(unsigned int),
1290                 .mode           = 0644,
1291                 .proc_handler   = proc_dointvec_jiffies,
1292         },
1293         {
1294                 .ctl_name       = NET_NF_CONNTRACK_TCP_LOOSE,
1295                 .procname       = "nf_conntrack_tcp_loose",
1296                 .data           = &nf_ct_tcp_loose,
1297                 .maxlen         = sizeof(unsigned int),
1298                 .mode           = 0644,
1299                 .proc_handler   = proc_dointvec,
1300         },
1301         {
1302                 .ctl_name       = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
1303                 .procname       = "nf_conntrack_tcp_be_liberal",
1304                 .data           = &nf_ct_tcp_be_liberal,
1305                 .maxlen         = sizeof(unsigned int),
1306                 .mode           = 0644,
1307                 .proc_handler   = proc_dointvec,
1308         },
1309         {
1310                 .ctl_name       = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
1311                 .procname       = "nf_conntrack_tcp_max_retrans",
1312                 .data           = &nf_ct_tcp_max_retrans,
1313                 .maxlen         = sizeof(unsigned int),
1314                 .mode           = 0644,
1315                 .proc_handler   = proc_dointvec,
1316         },
1317         {
1318                 .ctl_name       = 0
1319         }
1320 };
1321
1322 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1323 static struct ctl_table tcp_compat_sysctl_table[] = {
1324         {
1325                 .procname       = "ip_conntrack_tcp_timeout_syn_sent",
1326                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1327                 .maxlen         = sizeof(unsigned int),
1328                 .mode           = 0644,
1329                 .proc_handler   = proc_dointvec_jiffies,
1330         },
1331         {
1332                 .procname       = "ip_conntrack_tcp_timeout_syn_sent2",
1333                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT2],
1334                 .maxlen         = sizeof(unsigned int),
1335                 .mode           = 0644,
1336                 .proc_handler   = proc_dointvec_jiffies,
1337         },
1338         {
1339                 .procname       = "ip_conntrack_tcp_timeout_syn_recv",
1340                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1341                 .maxlen         = sizeof(unsigned int),
1342                 .mode           = 0644,
1343                 .proc_handler   = proc_dointvec_jiffies,
1344         },
1345         {
1346                 .procname       = "ip_conntrack_tcp_timeout_established",
1347                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1348                 .maxlen         = sizeof(unsigned int),
1349                 .mode           = 0644,
1350                 .proc_handler   = proc_dointvec_jiffies,
1351         },
1352         {
1353                 .procname       = "ip_conntrack_tcp_timeout_fin_wait",
1354                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1355                 .maxlen         = sizeof(unsigned int),
1356                 .mode           = 0644,
1357                 .proc_handler   = proc_dointvec_jiffies,
1358         },
1359         {
1360                 .procname       = "ip_conntrack_tcp_timeout_close_wait",
1361                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1362                 .maxlen         = sizeof(unsigned int),
1363                 .mode           = 0644,
1364                 .proc_handler   = proc_dointvec_jiffies,
1365         },
1366         {
1367                 .procname       = "ip_conntrack_tcp_timeout_last_ack",
1368                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1369                 .maxlen         = sizeof(unsigned int),
1370                 .mode           = 0644,
1371                 .proc_handler   = proc_dointvec_jiffies,
1372         },
1373         {
1374                 .procname       = "ip_conntrack_tcp_timeout_time_wait",
1375                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1376                 .maxlen         = sizeof(unsigned int),
1377                 .mode           = 0644,
1378                 .proc_handler   = proc_dointvec_jiffies,
1379         },
1380         {
1381                 .procname       = "ip_conntrack_tcp_timeout_close",
1382                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1383                 .maxlen         = sizeof(unsigned int),
1384                 .mode           = 0644,
1385                 .proc_handler   = proc_dointvec_jiffies,
1386         },
1387         {
1388                 .procname       = "ip_conntrack_tcp_timeout_max_retrans",
1389                 .data           = &nf_ct_tcp_timeout_max_retrans,
1390                 .maxlen         = sizeof(unsigned int),
1391                 .mode           = 0644,
1392                 .proc_handler   = proc_dointvec_jiffies,
1393         },
1394         {
1395                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
1396                 .procname       = "ip_conntrack_tcp_loose",
1397                 .data           = &nf_ct_tcp_loose,
1398                 .maxlen         = sizeof(unsigned int),
1399                 .mode           = 0644,
1400                 .proc_handler   = proc_dointvec,
1401         },
1402         {
1403                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
1404                 .procname       = "ip_conntrack_tcp_be_liberal",
1405                 .data           = &nf_ct_tcp_be_liberal,
1406                 .maxlen         = sizeof(unsigned int),
1407                 .mode           = 0644,
1408                 .proc_handler   = proc_dointvec,
1409         },
1410         {
1411                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
1412                 .procname       = "ip_conntrack_tcp_max_retrans",
1413                 .data           = &nf_ct_tcp_max_retrans,
1414                 .maxlen         = sizeof(unsigned int),
1415                 .mode           = 0644,
1416                 .proc_handler   = proc_dointvec,
1417         },
1418         {
1419                 .ctl_name       = 0
1420         }
1421 };
1422 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
1423 #endif /* CONFIG_SYSCTL */
1424
1425 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
1426 {
1427         .l3proto                = PF_INET,
1428         .l4proto                = IPPROTO_TCP,
1429         .name                   = "tcp",
1430         .pkt_to_tuple           = tcp_pkt_to_tuple,
1431         .invert_tuple           = tcp_invert_tuple,
1432         .print_tuple            = tcp_print_tuple,
1433         .print_conntrack        = tcp_print_conntrack,
1434         .packet                 = tcp_packet,
1435         .new                    = tcp_new,
1436         .error                  = tcp_error,
1437 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1438         .to_nlattr              = tcp_to_nlattr,
1439         .nlattr_size            = tcp_nlattr_size,
1440         .from_nlattr            = nlattr_to_tcp,
1441         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1442         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1443         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1444         .nla_policy             = nf_ct_port_nla_policy,
1445 #endif
1446 #ifdef CONFIG_SYSCTL
1447         .ctl_table_users        = &tcp_sysctl_table_users,
1448         .ctl_table_header       = &tcp_sysctl_header,
1449         .ctl_table              = tcp_sysctl_table,
1450 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1451         .ctl_compat_table       = tcp_compat_sysctl_table,
1452 #endif
1453 #endif
1454 };
1455 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
1456
1457 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
1458 {
1459         .l3proto                = PF_INET6,
1460         .l4proto                = IPPROTO_TCP,
1461         .name                   = "tcp",
1462         .pkt_to_tuple           = tcp_pkt_to_tuple,
1463         .invert_tuple           = tcp_invert_tuple,
1464         .print_tuple            = tcp_print_tuple,
1465         .print_conntrack        = tcp_print_conntrack,
1466         .packet                 = tcp_packet,
1467         .new                    = tcp_new,
1468         .error                  = tcp_error,
1469 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1470         .to_nlattr              = tcp_to_nlattr,
1471         .nlattr_size            = tcp_nlattr_size,
1472         .from_nlattr            = nlattr_to_tcp,
1473         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1474         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1475         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
1476         .nla_policy             = nf_ct_port_nla_policy,
1477 #endif
1478 #ifdef CONFIG_SYSCTL
1479         .ctl_table_users        = &tcp_sysctl_table_users,
1480         .ctl_table_header       = &tcp_sysctl_header,
1481         .ctl_table              = tcp_sysctl_table,
1482 #endif
1483 };
1484 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);