Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
[linux-2.6.git] / net / netfilter / nf_conntrack_proto_tcp.c
1 /* (C) 1999-2001 Paul `Rusty' Russell
2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  */
8
9 #include <linux/types.h>
10 #include <linux/timer.h>
11 #include <linux/module.h>
12 #include <linux/in.h>
13 #include <linux/tcp.h>
14 #include <linux/spinlock.h>
15 #include <linux/skbuff.h>
16 #include <linux/ipv6.h>
17 #include <net/ip6_checksum.h>
18
19 #include <net/tcp.h>
20
21 #include <linux/netfilter.h>
22 #include <linux/netfilter_ipv4.h>
23 #include <linux/netfilter_ipv6.h>
24 #include <net/netfilter/nf_conntrack.h>
25 #include <net/netfilter/nf_conntrack_l4proto.h>
26 #include <net/netfilter/nf_conntrack_ecache.h>
27 #include <net/netfilter/nf_log.h>
28
29 /* Protects ct->proto.tcp */
30 static DEFINE_RWLOCK(tcp_lock);
31
32 /* "Be conservative in what you do,
33     be liberal in what you accept from others."
34     If it's non-zero, we mark only out of window RST segments as INVALID. */
35 static int nf_ct_tcp_be_liberal __read_mostly = 0;
36
37 /* If it is set to zero, we disable picking up already established
38    connections. */
39 static int nf_ct_tcp_loose __read_mostly = 1;
40
41 /* Max number of the retransmitted packets without receiving an (acceptable)
42    ACK from the destination. If this number is reached, a shorter timer
43    will be started. */
44 static int nf_ct_tcp_max_retrans __read_mostly = 3;
45
46   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
47      closely.  They're more complex. --RR */
48
49 static const char *const tcp_conntrack_names[] = {
50         "NONE",
51         "SYN_SENT",
52         "SYN_RECV",
53         "ESTABLISHED",
54         "FIN_WAIT",
55         "CLOSE_WAIT",
56         "LAST_ACK",
57         "TIME_WAIT",
58         "CLOSE",
59         "LISTEN"
60 };
61
62 #define SECS * HZ
63 #define MINS * 60 SECS
64 #define HOURS * 60 MINS
65 #define DAYS * 24 HOURS
66
67 /* RFC1122 says the R2 limit should be at least 100 seconds.
68    Linux uses 15 packets as limit, which corresponds
69    to ~13-30min depending on RTO. */
70 static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly =   5 MINS;
71
72 static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
73         [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
74         [TCP_CONNTRACK_SYN_RECV]        = 60 SECS,
75         [TCP_CONNTRACK_ESTABLISHED]     = 5 DAYS,
76         [TCP_CONNTRACK_FIN_WAIT]        = 2 MINS,
77         [TCP_CONNTRACK_CLOSE_WAIT]      = 60 SECS,
78         [TCP_CONNTRACK_LAST_ACK]        = 30 SECS,
79         [TCP_CONNTRACK_TIME_WAIT]       = 2 MINS,
80         [TCP_CONNTRACK_CLOSE]           = 10 SECS,
81 };
82
83 #define sNO TCP_CONNTRACK_NONE
84 #define sSS TCP_CONNTRACK_SYN_SENT
85 #define sSR TCP_CONNTRACK_SYN_RECV
86 #define sES TCP_CONNTRACK_ESTABLISHED
87 #define sFW TCP_CONNTRACK_FIN_WAIT
88 #define sCW TCP_CONNTRACK_CLOSE_WAIT
89 #define sLA TCP_CONNTRACK_LAST_ACK
90 #define sTW TCP_CONNTRACK_TIME_WAIT
91 #define sCL TCP_CONNTRACK_CLOSE
92 #define sLI TCP_CONNTRACK_LISTEN
93 #define sIV TCP_CONNTRACK_MAX
94 #define sIG TCP_CONNTRACK_IGNORE
95
96 /* What TCP flags are set from RST/SYN/FIN/ACK. */
97 enum tcp_bit_set {
98         TCP_SYN_SET,
99         TCP_SYNACK_SET,
100         TCP_FIN_SET,
101         TCP_ACK_SET,
102         TCP_RST_SET,
103         TCP_NONE_SET,
104 };
105
106 /*
107  * The TCP state transition table needs a few words...
108  *
109  * We are the man in the middle. All the packets go through us
110  * but might get lost in transit to the destination.
111  * It is assumed that the destinations can't receive segments
112  * we haven't seen.
113  *
114  * The checked segment is in window, but our windows are *not*
115  * equivalent with the ones of the sender/receiver. We always
116  * try to guess the state of the current sender.
117  *
118  * The meaning of the states are:
119  *
120  * NONE:        initial state
121  * SYN_SENT:    SYN-only packet seen
122  * SYN_RECV:    SYN-ACK packet seen
123  * ESTABLISHED: ACK packet seen
124  * FIN_WAIT:    FIN packet seen
125  * CLOSE_WAIT:  ACK seen (after FIN)
126  * LAST_ACK:    FIN seen (after FIN)
127  * TIME_WAIT:   last ACK seen
128  * CLOSE:       closed connection (RST)
129  *
130  * LISTEN state is not used.
131  *
132  * Packets marked as IGNORED (sIG):
133  *      if they may be either invalid or valid
134  *      and the receiver may send back a connection
135  *      closing RST or a SYN/ACK.
136  *
137  * Packets marked as INVALID (sIV):
138  *      if they are invalid
139  *      or we do not support the request (simultaneous open)
140  */
141 static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
142         {
143 /* ORIGINAL */
144 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
145 /*syn*/    { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sIV },
146 /*
147  *      sNO -> sSS      Initialize a new connection
148  *      sSS -> sSS      Retransmitted SYN
149  *      sSR -> sIG      Late retransmitted SYN?
150  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
151  *                      are errors. Receiver will reply with RST
152  *                      and close the connection.
153  *                      Or we are not in sync and hold a dead connection.
154  *      sFW -> sIG
155  *      sCW -> sIG
156  *      sLA -> sIG
157  *      sTW -> sSS      Reopened connection (RFC 1122).
158  *      sCL -> sSS
159  */
160 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
161 /*synack*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
162 /*
163  * A SYN/ACK from the client is always invalid:
164  *      - either it tries to set up a simultaneous open, which is
165  *        not supported;
166  *      - or the firewall has just been inserted between the two hosts
167  *        during the session set-up. The SYN will be retransmitted
168  *        by the true client (or it'll time out).
169  */
170 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
171 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
172 /*
173  *      sNO -> sIV      Too late and no reason to do anything...
174  *      sSS -> sIV      Client migth not send FIN in this state:
175  *                      we enforce waiting for a SYN/ACK reply first.
176  *      sSR -> sFW      Close started.
177  *      sES -> sFW
178  *      sFW -> sLA      FIN seen in both directions, waiting for
179  *                      the last ACK.
180  *                      Migth be a retransmitted FIN as well...
181  *      sCW -> sLA
182  *      sLA -> sLA      Retransmitted FIN. Remain in the same state.
183  *      sTW -> sTW
184  *      sCL -> sCL
185  */
186 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
187 /*ack*/    { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
188 /*
189  *      sNO -> sES      Assumed.
190  *      sSS -> sIV      ACK is invalid: we haven't seen a SYN/ACK yet.
191  *      sSR -> sES      Established state is reached.
192  *      sES -> sES      :-)
193  *      sFW -> sCW      Normal close request answered by ACK.
194  *      sCW -> sCW
195  *      sLA -> sTW      Last ACK detected.
196  *      sTW -> sTW      Retransmitted last ACK. Remain in the same state.
197  *      sCL -> sCL
198  */
199 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
200 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
201 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
202         },
203         {
204 /* REPLY */
205 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
206 /*syn*/    { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
207 /*
208  *      sNO -> sIV      Never reached.
209  *      sSS -> sIV      Simultaneous open, not supported
210  *      sSR -> sIV      Simultaneous open, not supported.
211  *      sES -> sIV      Server may not initiate a connection.
212  *      sFW -> sIV
213  *      sCW -> sIV
214  *      sLA -> sIV
215  *      sTW -> sIV      Reopened connection, but server may not do it.
216  *      sCL -> sIV
217  */
218 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
219 /*synack*/ { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIV },
220 /*
221  *      sSS -> sSR      Standard open.
222  *      sSR -> sSR      Retransmitted SYN/ACK.
223  *      sES -> sIG      Late retransmitted SYN/ACK?
224  *      sFW -> sIG      Might be SYN/ACK answering ignored SYN
225  *      sCW -> sIG
226  *      sLA -> sIG
227  *      sTW -> sIG
228  *      sCL -> sIG
229  */
230 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
231 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
232 /*
233  *      sSS -> sIV      Server might not send FIN in this state.
234  *      sSR -> sFW      Close started.
235  *      sES -> sFW
236  *      sFW -> sLA      FIN seen in both directions.
237  *      sCW -> sLA
238  *      sLA -> sLA      Retransmitted FIN.
239  *      sTW -> sTW
240  *      sCL -> sCL
241  */
242 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
243 /*ack*/    { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
244 /*
245  *      sSS -> sIG      Might be a half-open connection.
246  *      sSR -> sSR      Might answer late resent SYN.
247  *      sES -> sES      :-)
248  *      sFW -> sCW      Normal close request answered by ACK.
249  *      sCW -> sCW
250  *      sLA -> sTW      Last ACK detected.
251  *      sTW -> sTW      Retransmitted last ACK.
252  *      sCL -> sCL
253  */
254 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
255 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
256 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
257         }
258 };
259
260 static int tcp_pkt_to_tuple(const struct sk_buff *skb,
261                             unsigned int dataoff,
262                             struct nf_conntrack_tuple *tuple)
263 {
264         const struct tcphdr *hp;
265         struct tcphdr _hdr;
266
267         /* Actually only need first 8 bytes. */
268         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
269         if (hp == NULL)
270                 return 0;
271
272         tuple->src.u.tcp.port = hp->source;
273         tuple->dst.u.tcp.port = hp->dest;
274
275         return 1;
276 }
277
278 static int tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
279                             const struct nf_conntrack_tuple *orig)
280 {
281         tuple->src.u.tcp.port = orig->dst.u.tcp.port;
282         tuple->dst.u.tcp.port = orig->src.u.tcp.port;
283         return 1;
284 }
285
286 /* Print out the per-protocol part of the tuple. */
287 static int tcp_print_tuple(struct seq_file *s,
288                            const struct nf_conntrack_tuple *tuple)
289 {
290         return seq_printf(s, "sport=%hu dport=%hu ",
291                           ntohs(tuple->src.u.tcp.port),
292                           ntohs(tuple->dst.u.tcp.port));
293 }
294
295 /* Print out the private part of the conntrack. */
296 static int tcp_print_conntrack(struct seq_file *s, const struct nf_conn *ct)
297 {
298         enum tcp_conntrack state;
299
300         read_lock_bh(&tcp_lock);
301         state = ct->proto.tcp.state;
302         read_unlock_bh(&tcp_lock);
303
304         return seq_printf(s, "%s ", tcp_conntrack_names[state]);
305 }
306
307 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
308 {
309         if (tcph->rst) return TCP_RST_SET;
310         else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
311         else if (tcph->fin) return TCP_FIN_SET;
312         else if (tcph->ack) return TCP_ACK_SET;
313         else return TCP_NONE_SET;
314 }
315
316 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
317    in IP Filter' by Guido van Rooij.
318
319    http://www.nluug.nl/events/sane2000/papers.html
320    http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
321
322    The boundaries and the conditions are changed according to RFC793:
323    the packet must intersect the window (i.e. segments may be
324    after the right or before the left edge) and thus receivers may ACK
325    segments after the right edge of the window.
326
327         td_maxend = max(sack + max(win,1)) seen in reply packets
328         td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
329         td_maxwin += seq + len - sender.td_maxend
330                         if seq + len > sender.td_maxend
331         td_end    = max(seq + len) seen in sent packets
332
333    I.   Upper bound for valid data:     seq <= sender.td_maxend
334    II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
335    III. Upper bound for valid ack:      sack <= receiver.td_end
336    IV.  Lower bound for valid ack:      ack >= receiver.td_end - MAXACKWINDOW
337
338    where sack is the highest right edge of sack block found in the packet.
339
340    The upper bound limit for a valid ack is not ignored -
341    we doesn't have to deal with fragments.
342 */
343
344 static inline __u32 segment_seq_plus_len(__u32 seq,
345                                          size_t len,
346                                          unsigned int dataoff,
347                                          const struct tcphdr *tcph)
348 {
349         /* XXX Should I use payload length field in IP/IPv6 header ?
350          * - YK */
351         return (seq + len - dataoff - tcph->doff*4
352                 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
353 }
354
355 /* Fixme: what about big packets? */
356 #define MAXACKWINCONST                  66000
357 #define MAXACKWINDOW(sender)                                            \
358         ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin     \
359                                               : MAXACKWINCONST)
360
361 /*
362  * Simplified tcp_parse_options routine from tcp_input.c
363  */
364 static void tcp_options(const struct sk_buff *skb,
365                         unsigned int dataoff,
366                         const struct tcphdr *tcph,
367                         struct ip_ct_tcp_state *state)
368 {
369         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
370         const unsigned char *ptr;
371         int length = (tcph->doff*4) - sizeof(struct tcphdr);
372
373         if (!length)
374                 return;
375
376         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
377                                  length, buff);
378         BUG_ON(ptr == NULL);
379
380         state->td_scale =
381         state->flags = 0;
382
383         while (length > 0) {
384                 int opcode=*ptr++;
385                 int opsize;
386
387                 switch (opcode) {
388                 case TCPOPT_EOL:
389                         return;
390                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
391                         length--;
392                         continue;
393                 default:
394                         opsize=*ptr++;
395                         if (opsize < 2) /* "silly options" */
396                                 return;
397                         if (opsize > length)
398                                 break;  /* don't parse partial options */
399
400                         if (opcode == TCPOPT_SACK_PERM
401                             && opsize == TCPOLEN_SACK_PERM)
402                                 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
403                         else if (opcode == TCPOPT_WINDOW
404                                  && opsize == TCPOLEN_WINDOW) {
405                                 state->td_scale = *(u_int8_t *)ptr;
406
407                                 if (state->td_scale > 14) {
408                                         /* See RFC1323 */
409                                         state->td_scale = 14;
410                                 }
411                                 state->flags |=
412                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
413                         }
414                         ptr += opsize - 2;
415                         length -= opsize;
416                 }
417         }
418 }
419
420 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
421                      const struct tcphdr *tcph, __u32 *sack)
422 {
423         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
424         const unsigned char *ptr;
425         int length = (tcph->doff*4) - sizeof(struct tcphdr);
426         __u32 tmp;
427
428         if (!length)
429                 return;
430
431         ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
432                                  length, buff);
433         BUG_ON(ptr == NULL);
434
435         /* Fast path for timestamp-only option */
436         if (length == TCPOLEN_TSTAMP_ALIGNED*4
437             && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
438                                        | (TCPOPT_NOP << 16)
439                                        | (TCPOPT_TIMESTAMP << 8)
440                                        | TCPOLEN_TIMESTAMP))
441                 return;
442
443         while (length > 0) {
444                 int opcode = *ptr++;
445                 int opsize, i;
446
447                 switch (opcode) {
448                 case TCPOPT_EOL:
449                         return;
450                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
451                         length--;
452                         continue;
453                 default:
454                         opsize = *ptr++;
455                         if (opsize < 2) /* "silly options" */
456                                 return;
457                         if (opsize > length)
458                                 break;  /* don't parse partial options */
459
460                         if (opcode == TCPOPT_SACK
461                             && opsize >= (TCPOLEN_SACK_BASE
462                                           + TCPOLEN_SACK_PERBLOCK)
463                             && !((opsize - TCPOLEN_SACK_BASE)
464                                  % TCPOLEN_SACK_PERBLOCK)) {
465                                 for (i = 0;
466                                      i < (opsize - TCPOLEN_SACK_BASE);
467                                      i += TCPOLEN_SACK_PERBLOCK) {
468                                         tmp = ntohl(*((__be32 *)(ptr+i)+1));
469
470                                         if (after(tmp, *sack))
471                                                 *sack = tmp;
472                                 }
473                                 return;
474                         }
475                         ptr += opsize - 2;
476                         length -= opsize;
477                 }
478         }
479 }
480
481 static int tcp_in_window(const struct nf_conn *ct,
482                          struct ip_ct_tcp *state,
483                          enum ip_conntrack_dir dir,
484                          unsigned int index,
485                          const struct sk_buff *skb,
486                          unsigned int dataoff,
487                          const struct tcphdr *tcph,
488                          int pf)
489 {
490         struct ip_ct_tcp_state *sender = &state->seen[dir];
491         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
492         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
493         __u32 seq, ack, sack, end, win, swin;
494         int res;
495
496         /*
497          * Get the required data from the packet.
498          */
499         seq = ntohl(tcph->seq);
500         ack = sack = ntohl(tcph->ack_seq);
501         win = ntohs(tcph->window);
502         end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
503
504         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
505                 tcp_sack(skb, dataoff, tcph, &sack);
506
507         pr_debug("tcp_in_window: START\n");
508         pr_debug("tcp_in_window: ");
509         NF_CT_DUMP_TUPLE(tuple);
510         pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
511                  seq, ack, sack, win, end);
512         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
513                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
514                  sender->td_end, sender->td_maxend, sender->td_maxwin,
515                  sender->td_scale,
516                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
517                  receiver->td_scale);
518
519         if (sender->td_end == 0) {
520                 /*
521                  * Initialize sender data.
522                  */
523                 if (tcph->syn && tcph->ack) {
524                         /*
525                          * Outgoing SYN-ACK in reply to a SYN.
526                          */
527                         sender->td_end =
528                         sender->td_maxend = end;
529                         sender->td_maxwin = (win == 0 ? 1 : win);
530
531                         tcp_options(skb, dataoff, tcph, sender);
532                         /*
533                          * RFC 1323:
534                          * Both sides must send the Window Scale option
535                          * to enable window scaling in either direction.
536                          */
537                         if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
538                               && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
539                                 sender->td_scale =
540                                 receiver->td_scale = 0;
541                 } else {
542                         /*
543                          * We are in the middle of a connection,
544                          * its history is lost for us.
545                          * Let's try to use the data from the packet.
546                          */
547                         sender->td_end = end;
548                         sender->td_maxwin = (win == 0 ? 1 : win);
549                         sender->td_maxend = end + sender->td_maxwin;
550                 }
551         } else if (((state->state == TCP_CONNTRACK_SYN_SENT
552                      && dir == IP_CT_DIR_ORIGINAL)
553                    || (state->state == TCP_CONNTRACK_SYN_RECV
554                      && dir == IP_CT_DIR_REPLY))
555                    && after(end, sender->td_end)) {
556                 /*
557                  * RFC 793: "if a TCP is reinitialized ... then it need
558                  * not wait at all; it must only be sure to use sequence
559                  * numbers larger than those recently used."
560                  */
561                 sender->td_end =
562                 sender->td_maxend = end;
563                 sender->td_maxwin = (win == 0 ? 1 : win);
564
565                 tcp_options(skb, dataoff, tcph, sender);
566         }
567
568         if (!(tcph->ack)) {
569                 /*
570                  * If there is no ACK, just pretend it was set and OK.
571                  */
572                 ack = sack = receiver->td_end;
573         } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
574                     (TCP_FLAG_ACK|TCP_FLAG_RST))
575                    && (ack == 0)) {
576                 /*
577                  * Broken TCP stacks, that set ACK in RST packets as well
578                  * with zero ack value.
579                  */
580                 ack = sack = receiver->td_end;
581         }
582
583         if (seq == end
584             && (!tcph->rst
585                 || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
586                 /*
587                  * Packets contains no data: we assume it is valid
588                  * and check the ack value only.
589                  * However RST segments are always validated by their
590                  * SEQ number, except when seq == 0 (reset sent answering
591                  * SYN.
592                  */
593                 seq = end = sender->td_end;
594
595         pr_debug("tcp_in_window: ");
596         NF_CT_DUMP_TUPLE(tuple);
597         pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
598                  seq, ack, sack, win, end);
599         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
600                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
601                  sender->td_end, sender->td_maxend, sender->td_maxwin,
602                  sender->td_scale,
603                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
604                  receiver->td_scale);
605
606         pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
607                  before(seq, sender->td_maxend + 1),
608                  after(end, sender->td_end - receiver->td_maxwin - 1),
609                  before(sack, receiver->td_end + 1),
610                  after(ack, receiver->td_end - MAXACKWINDOW(sender)));
611
612         if (before(seq, sender->td_maxend + 1) &&
613             after(end, sender->td_end - receiver->td_maxwin - 1) &&
614             before(sack, receiver->td_end + 1) &&
615             after(ack, receiver->td_end - MAXACKWINDOW(sender))) {
616                 /*
617                  * Take into account window scaling (RFC 1323).
618                  */
619                 if (!tcph->syn)
620                         win <<= sender->td_scale;
621
622                 /*
623                  * Update sender data.
624                  */
625                 swin = win + (sack - ack);
626                 if (sender->td_maxwin < swin)
627                         sender->td_maxwin = swin;
628                 if (after(end, sender->td_end))
629                         sender->td_end = end;
630                 /*
631                  * Update receiver data.
632                  */
633                 if (after(end, sender->td_maxend))
634                         receiver->td_maxwin += end - sender->td_maxend;
635                 if (after(sack + win, receiver->td_maxend - 1)) {
636                         receiver->td_maxend = sack + win;
637                         if (win == 0)
638                                 receiver->td_maxend++;
639                 }
640
641                 /*
642                  * Check retransmissions.
643                  */
644                 if (index == TCP_ACK_SET) {
645                         if (state->last_dir == dir
646                             && state->last_seq == seq
647                             && state->last_ack == ack
648                             && state->last_end == end
649                             && state->last_win == win)
650                                 state->retrans++;
651                         else {
652                                 state->last_dir = dir;
653                                 state->last_seq = seq;
654                                 state->last_ack = ack;
655                                 state->last_end = end;
656                                 state->last_win = win;
657                                 state->retrans = 0;
658                         }
659                 }
660                 res = 1;
661         } else {
662                 res = 0;
663                 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
664                     nf_ct_tcp_be_liberal)
665                         res = 1;
666                 if (!res && LOG_INVALID(IPPROTO_TCP))
667                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
668                         "nf_ct_tcp: %s ",
669                         before(seq, sender->td_maxend + 1) ?
670                         after(end, sender->td_end - receiver->td_maxwin - 1) ?
671                         before(sack, receiver->td_end + 1) ?
672                         after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
673                         : "ACK is under the lower bound (possible overly delayed ACK)"
674                         : "ACK is over the upper bound (ACKed data not seen yet)"
675                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
676                         : "SEQ is over the upper bound (over the window of the receiver)");
677         }
678
679         pr_debug("tcp_in_window: res=%i sender end=%u maxend=%u maxwin=%u "
680                  "receiver end=%u maxend=%u maxwin=%u\n",
681                  res, sender->td_end, sender->td_maxend, sender->td_maxwin,
682                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
683
684         return res;
685 }
686
687 #ifdef CONFIG_NF_NAT_NEEDED
688 /* Update sender->td_end after NAT successfully mangled the packet */
689 /* Caller must linearize skb at tcp header. */
690 void nf_conntrack_tcp_update(const struct sk_buff *skb,
691                              unsigned int dataoff,
692                              struct nf_conn *ct,
693                              int dir)
694 {
695         const struct tcphdr *tcph = (const void *)skb->data + dataoff;
696         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
697         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
698         __u32 end;
699
700         end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
701
702         write_lock_bh(&tcp_lock);
703         /*
704          * We have to worry for the ack in the reply packet only...
705          */
706         if (after(end, ct->proto.tcp.seen[dir].td_end))
707                 ct->proto.tcp.seen[dir].td_end = end;
708         ct->proto.tcp.last_end = end;
709         write_unlock_bh(&tcp_lock);
710         pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
711                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
712                  sender->td_end, sender->td_maxend, sender->td_maxwin,
713                  sender->td_scale,
714                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
715                  receiver->td_scale);
716 }
717 EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
718 #endif
719
720 #define TH_FIN  0x01
721 #define TH_SYN  0x02
722 #define TH_RST  0x04
723 #define TH_PUSH 0x08
724 #define TH_ACK  0x10
725 #define TH_URG  0x20
726 #define TH_ECE  0x40
727 #define TH_CWR  0x80
728
729 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
730 static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
731 {
732         [TH_SYN]                        = 1,
733         [TH_SYN|TH_URG]                 = 1,
734         [TH_SYN|TH_ACK]                 = 1,
735         [TH_RST]                        = 1,
736         [TH_RST|TH_ACK]                 = 1,
737         [TH_FIN|TH_ACK]                 = 1,
738         [TH_FIN|TH_ACK|TH_URG]          = 1,
739         [TH_ACK]                        = 1,
740         [TH_ACK|TH_URG]                 = 1,
741 };
742
743 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
744 static int tcp_error(struct sk_buff *skb,
745                      unsigned int dataoff,
746                      enum ip_conntrack_info *ctinfo,
747                      int pf,
748                      unsigned int hooknum)
749 {
750         const struct tcphdr *th;
751         struct tcphdr _tcph;
752         unsigned int tcplen = skb->len - dataoff;
753         u_int8_t tcpflags;
754
755         /* Smaller that minimal TCP header? */
756         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
757         if (th == NULL) {
758                 if (LOG_INVALID(IPPROTO_TCP))
759                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
760                                 "nf_ct_tcp: short packet ");
761                 return -NF_ACCEPT;
762         }
763
764         /* Not whole TCP header or malformed packet */
765         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
766                 if (LOG_INVALID(IPPROTO_TCP))
767                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
768                                 "nf_ct_tcp: truncated/malformed packet ");
769                 return -NF_ACCEPT;
770         }
771
772         /* Checksum invalid? Ignore.
773          * We skip checking packets on the outgoing path
774          * because the checksum is assumed to be correct.
775          */
776         /* FIXME: Source route IP option packets --RR */
777         if (nf_conntrack_checksum && hooknum == NF_INET_PRE_ROUTING &&
778             nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
779                 if (LOG_INVALID(IPPROTO_TCP))
780                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
781                                   "nf_ct_tcp: bad TCP checksum ");
782                 return -NF_ACCEPT;
783         }
784
785         /* Check TCP flags. */
786         tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR|TH_PUSH));
787         if (!tcp_valid_flags[tcpflags]) {
788                 if (LOG_INVALID(IPPROTO_TCP))
789                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
790                                   "nf_ct_tcp: invalid TCP flag combination ");
791                 return -NF_ACCEPT;
792         }
793
794         return NF_ACCEPT;
795 }
796
797 /* Returns verdict for packet, or -1 for invalid. */
798 static int tcp_packet(struct nf_conn *ct,
799                       const struct sk_buff *skb,
800                       unsigned int dataoff,
801                       enum ip_conntrack_info ctinfo,
802                       int pf,
803                       unsigned int hooknum)
804 {
805         struct nf_conntrack_tuple *tuple;
806         enum tcp_conntrack new_state, old_state;
807         enum ip_conntrack_dir dir;
808         const struct tcphdr *th;
809         struct tcphdr _tcph;
810         unsigned long timeout;
811         unsigned int index;
812
813         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
814         BUG_ON(th == NULL);
815
816         write_lock_bh(&tcp_lock);
817         old_state = ct->proto.tcp.state;
818         dir = CTINFO2DIR(ctinfo);
819         index = get_conntrack_index(th);
820         new_state = tcp_conntracks[dir][index][old_state];
821         tuple = &ct->tuplehash[dir].tuple;
822
823         switch (new_state) {
824         case TCP_CONNTRACK_SYN_SENT:
825                 if (old_state < TCP_CONNTRACK_TIME_WAIT)
826                         break;
827                 /* RFC 1122: "When a connection is closed actively,
828                  * it MUST linger in TIME-WAIT state for a time 2xMSL
829                  * (Maximum Segment Lifetime). However, it MAY accept
830                  * a new SYN from the remote TCP to reopen the connection
831                  * directly from TIME-WAIT state, if..."
832                  * We ignore the conditions because we are in the
833                  * TIME-WAIT state anyway.
834                  *
835                  * Handle aborted connections: we and the server
836                  * think there is an existing connection but the client
837                  * aborts it and starts a new one.
838                  */
839                 if (((ct->proto.tcp.seen[dir].flags
840                       | ct->proto.tcp.seen[!dir].flags)
841                      & IP_CT_TCP_FLAG_CLOSE_INIT)
842                     || (ct->proto.tcp.last_dir == dir
843                         && ct->proto.tcp.last_index == TCP_RST_SET)) {
844                         /* Attempt to reopen a closed/aborted connection.
845                          * Delete this connection and look up again. */
846                         write_unlock_bh(&tcp_lock);
847                         if (del_timer(&ct->timeout))
848                                 ct->timeout.function((unsigned long)ct);
849                         return -NF_REPEAT;
850                 }
851                 /* Fall through */
852         case TCP_CONNTRACK_IGNORE:
853                 /* Ignored packets:
854                  *
855                  * Our connection entry may be out of sync, so ignore
856                  * packets which may signal the real connection between
857                  * the client and the server.
858                  *
859                  * a) SYN in ORIGINAL
860                  * b) SYN/ACK in REPLY
861                  * c) ACK in reply direction after initial SYN in original.
862                  *
863                  * If the ignored packet is invalid, the receiver will send
864                  * a RST we'll catch below.
865                  */
866                 if (index == TCP_SYNACK_SET
867                     && ct->proto.tcp.last_index == TCP_SYN_SET
868                     && ct->proto.tcp.last_dir != dir
869                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
870                         /* b) This SYN/ACK acknowledges a SYN that we earlier
871                          * ignored as invalid. This means that the client and
872                          * the server are both in sync, while the firewall is
873                          * not. We kill this session and block the SYN/ACK so
874                          * that the client cannot but retransmit its SYN and
875                          * thus initiate a clean new session.
876                          */
877                         write_unlock_bh(&tcp_lock);
878                         if (LOG_INVALID(IPPROTO_TCP))
879                                 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
880                                           "nf_ct_tcp: killing out of sync session ");
881                         if (del_timer(&ct->timeout))
882                                 ct->timeout.function((unsigned long)ct);
883                         return -NF_DROP;
884                 }
885                 ct->proto.tcp.last_index = index;
886                 ct->proto.tcp.last_dir = dir;
887                 ct->proto.tcp.last_seq = ntohl(th->seq);
888                 ct->proto.tcp.last_end =
889                     segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
890
891                 write_unlock_bh(&tcp_lock);
892                 if (LOG_INVALID(IPPROTO_TCP))
893                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
894                                   "nf_ct_tcp: invalid packet ignored ");
895                 return NF_ACCEPT;
896         case TCP_CONNTRACK_MAX:
897                 /* Invalid packet */
898                 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
899                          dir, get_conntrack_index(th), old_state);
900                 write_unlock_bh(&tcp_lock);
901                 if (LOG_INVALID(IPPROTO_TCP))
902                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
903                                   "nf_ct_tcp: invalid state ");
904                 return -NF_ACCEPT;
905         case TCP_CONNTRACK_CLOSE:
906                 if (index == TCP_RST_SET
907                     && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
908                          && ct->proto.tcp.last_index == TCP_SYN_SET)
909                         || (!test_bit(IPS_ASSURED_BIT, &ct->status)
910                             && ct->proto.tcp.last_index == TCP_ACK_SET))
911                     && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
912                         /* RST sent to invalid SYN or ACK we had let through
913                          * at a) and c) above:
914                          *
915                          * a) SYN was in window then
916                          * c) we hold a half-open connection.
917                          *
918                          * Delete our connection entry.
919                          * We skip window checking, because packet might ACK
920                          * segments we ignored. */
921                         goto in_window;
922                 }
923                 /* Just fall through */
924         default:
925                 /* Keep compilers happy. */
926                 break;
927         }
928
929         if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
930                            skb, dataoff, th, pf)) {
931                 write_unlock_bh(&tcp_lock);
932                 return -NF_ACCEPT;
933         }
934      in_window:
935         /* From now on we have got in-window packets */
936         ct->proto.tcp.last_index = index;
937         ct->proto.tcp.last_dir = dir;
938
939         pr_debug("tcp_conntracks: ");
940         NF_CT_DUMP_TUPLE(tuple);
941         pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
942                  (th->syn ? 1 : 0), (th->ack ? 1 : 0),
943                  (th->fin ? 1 : 0), (th->rst ? 1 : 0),
944                  old_state, new_state);
945
946         ct->proto.tcp.state = new_state;
947         if (old_state != new_state
948             && new_state == TCP_CONNTRACK_CLOSE)
949                 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
950         timeout = ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans
951                   && tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans
952                   ? nf_ct_tcp_timeout_max_retrans : tcp_timeouts[new_state];
953         write_unlock_bh(&tcp_lock);
954
955         nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
956         if (new_state != old_state)
957                 nf_conntrack_event_cache(IPCT_PROTOINFO, skb);
958
959         if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
960                 /* If only reply is a RST, we can consider ourselves not to
961                    have an established connection: this is a fairly common
962                    problem case, so we can delete the conntrack
963                    immediately.  --RR */
964                 if (th->rst) {
965                         if (del_timer(&ct->timeout))
966                                 ct->timeout.function((unsigned long)ct);
967                         return NF_ACCEPT;
968                 }
969         } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
970                    && (old_state == TCP_CONNTRACK_SYN_RECV
971                        || old_state == TCP_CONNTRACK_ESTABLISHED)
972                    && new_state == TCP_CONNTRACK_ESTABLISHED) {
973                 /* Set ASSURED if we see see valid ack in ESTABLISHED
974                    after SYN_RECV or a valid answer for a picked up
975                    connection. */
976                 set_bit(IPS_ASSURED_BIT, &ct->status);
977                 nf_conntrack_event_cache(IPCT_STATUS, skb);
978         }
979         nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
980
981         return NF_ACCEPT;
982 }
983
984 /* Called when a new connection for this protocol found. */
985 static int tcp_new(struct nf_conn *ct,
986                    const struct sk_buff *skb,
987                    unsigned int dataoff)
988 {
989         enum tcp_conntrack new_state;
990         const struct tcphdr *th;
991         struct tcphdr _tcph;
992         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
993         const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
994
995         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
996         BUG_ON(th == NULL);
997
998         /* Don't need lock here: this conntrack not in circulation yet */
999         new_state
1000                 = tcp_conntracks[0][get_conntrack_index(th)]
1001                 [TCP_CONNTRACK_NONE];
1002
1003         /* Invalid: delete conntrack */
1004         if (new_state >= TCP_CONNTRACK_MAX) {
1005                 pr_debug("nf_ct_tcp: invalid new deleting.\n");
1006                 return 0;
1007         }
1008
1009         if (new_state == TCP_CONNTRACK_SYN_SENT) {
1010                 /* SYN packet */
1011                 ct->proto.tcp.seen[0].td_end =
1012                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1013                                              dataoff, th);
1014                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1015                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1016                         ct->proto.tcp.seen[0].td_maxwin = 1;
1017                 ct->proto.tcp.seen[0].td_maxend =
1018                         ct->proto.tcp.seen[0].td_end;
1019
1020                 tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
1021                 ct->proto.tcp.seen[1].flags = 0;
1022         } else if (nf_ct_tcp_loose == 0) {
1023                 /* Don't try to pick up connections. */
1024                 return 0;
1025         } else {
1026                 /*
1027                  * We are in the middle of a connection,
1028                  * its history is lost for us.
1029                  * Let's try to use the data from the packet.
1030                  */
1031                 ct->proto.tcp.seen[0].td_end =
1032                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1033                                              dataoff, th);
1034                 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1035                 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1036                         ct->proto.tcp.seen[0].td_maxwin = 1;
1037                 ct->proto.tcp.seen[0].td_maxend =
1038                         ct->proto.tcp.seen[0].td_end +
1039                         ct->proto.tcp.seen[0].td_maxwin;
1040                 ct->proto.tcp.seen[0].td_scale = 0;
1041
1042                 /* We assume SACK and liberal window checking to handle
1043                  * window scaling */
1044                 ct->proto.tcp.seen[0].flags =
1045                 ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1046                                               IP_CT_TCP_FLAG_BE_LIBERAL;
1047         }
1048
1049         ct->proto.tcp.seen[1].td_end = 0;
1050         ct->proto.tcp.seen[1].td_maxend = 0;
1051         ct->proto.tcp.seen[1].td_maxwin = 1;
1052         ct->proto.tcp.seen[1].td_scale = 0;
1053
1054         /* tcp_packet will set them */
1055         ct->proto.tcp.state = TCP_CONNTRACK_NONE;
1056         ct->proto.tcp.last_index = TCP_NONE_SET;
1057
1058         pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1059                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1060                  sender->td_end, sender->td_maxend, sender->td_maxwin,
1061                  sender->td_scale,
1062                  receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1063                  receiver->td_scale);
1064         return 1;
1065 }
1066
1067 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1068
1069 #include <linux/netfilter/nfnetlink.h>
1070 #include <linux/netfilter/nfnetlink_conntrack.h>
1071
1072 static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
1073                          const struct nf_conn *ct)
1074 {
1075         struct nlattr *nest_parms;
1076         struct nf_ct_tcp_flags tmp = {};
1077
1078         read_lock_bh(&tcp_lock);
1079         nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP | NLA_F_NESTED);
1080         if (!nest_parms)
1081                 goto nla_put_failure;
1082
1083         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state);
1084
1085         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
1086                    ct->proto.tcp.seen[0].td_scale);
1087
1088         NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
1089                    ct->proto.tcp.seen[1].td_scale);
1090
1091         tmp.flags = ct->proto.tcp.seen[0].flags;
1092         NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
1093                 sizeof(struct nf_ct_tcp_flags), &tmp);
1094
1095         tmp.flags = ct->proto.tcp.seen[1].flags;
1096         NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
1097                 sizeof(struct nf_ct_tcp_flags), &tmp);
1098         read_unlock_bh(&tcp_lock);
1099
1100         nla_nest_end(skb, nest_parms);
1101
1102         return 0;
1103
1104 nla_put_failure:
1105         read_unlock_bh(&tcp_lock);
1106         return -1;
1107 }
1108
1109 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
1110         [CTA_PROTOINFO_TCP_STATE]           = { .type = NLA_U8 },
1111         [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
1112         [CTA_PROTOINFO_TCP_WSCALE_REPLY]    = { .type = NLA_U8 },
1113         [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
1114         [CTA_PROTOINFO_TCP_FLAGS_REPLY]     = { .len =  sizeof(struct nf_ct_tcp_flags) },
1115 };
1116
1117 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
1118 {
1119         struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
1120         struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
1121         int err;
1122
1123         /* updates could not contain anything about the private
1124          * protocol info, in that case skip the parsing */
1125         if (!pattr)
1126                 return 0;
1127
1128         err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
1129         if (err < 0)
1130                 return err;
1131
1132         if (!tb[CTA_PROTOINFO_TCP_STATE])
1133                 return -EINVAL;
1134
1135         write_lock_bh(&tcp_lock);
1136         ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
1137
1138         if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
1139                 struct nf_ct_tcp_flags *attr =
1140                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
1141                 ct->proto.tcp.seen[0].flags &= ~attr->mask;
1142                 ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
1143         }
1144
1145         if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
1146                 struct nf_ct_tcp_flags *attr =
1147                         nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
1148                 ct->proto.tcp.seen[1].flags &= ~attr->mask;
1149                 ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
1150         }
1151
1152         if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
1153             tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
1154             ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
1155             ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1156                 ct->proto.tcp.seen[0].td_scale =
1157                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
1158                 ct->proto.tcp.seen[1].td_scale =
1159                         nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
1160         }
1161         write_unlock_bh(&tcp_lock);
1162
1163         return 0;
1164 }
1165 #endif
1166
1167 #ifdef CONFIG_SYSCTL
1168 static unsigned int tcp_sysctl_table_users;
1169 static struct ctl_table_header *tcp_sysctl_header;
1170 static struct ctl_table tcp_sysctl_table[] = {
1171         {
1172                 .procname       = "nf_conntrack_tcp_timeout_syn_sent",
1173                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1174                 .maxlen         = sizeof(unsigned int),
1175                 .mode           = 0644,
1176                 .proc_handler   = &proc_dointvec_jiffies,
1177         },
1178         {
1179                 .procname       = "nf_conntrack_tcp_timeout_syn_recv",
1180                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1181                 .maxlen         = sizeof(unsigned int),
1182                 .mode           = 0644,
1183                 .proc_handler   = &proc_dointvec_jiffies,
1184         },
1185         {
1186                 .procname       = "nf_conntrack_tcp_timeout_established",
1187                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1188                 .maxlen         = sizeof(unsigned int),
1189                 .mode           = 0644,
1190                 .proc_handler   = &proc_dointvec_jiffies,
1191         },
1192         {
1193                 .procname       = "nf_conntrack_tcp_timeout_fin_wait",
1194                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1195                 .maxlen         = sizeof(unsigned int),
1196                 .mode           = 0644,
1197                 .proc_handler   = &proc_dointvec_jiffies,
1198         },
1199         {
1200                 .procname       = "nf_conntrack_tcp_timeout_close_wait",
1201                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1202                 .maxlen         = sizeof(unsigned int),
1203                 .mode           = 0644,
1204                 .proc_handler   = &proc_dointvec_jiffies,
1205         },
1206         {
1207                 .procname       = "nf_conntrack_tcp_timeout_last_ack",
1208                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1209                 .maxlen         = sizeof(unsigned int),
1210                 .mode           = 0644,
1211                 .proc_handler   = &proc_dointvec_jiffies,
1212         },
1213         {
1214                 .procname       = "nf_conntrack_tcp_timeout_time_wait",
1215                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1216                 .maxlen         = sizeof(unsigned int),
1217                 .mode           = 0644,
1218                 .proc_handler   = &proc_dointvec_jiffies,
1219         },
1220         {
1221                 .procname       = "nf_conntrack_tcp_timeout_close",
1222                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1223                 .maxlen         = sizeof(unsigned int),
1224                 .mode           = 0644,
1225                 .proc_handler   = &proc_dointvec_jiffies,
1226         },
1227         {
1228                 .procname       = "nf_conntrack_tcp_timeout_max_retrans",
1229                 .data           = &nf_ct_tcp_timeout_max_retrans,
1230                 .maxlen         = sizeof(unsigned int),
1231                 .mode           = 0644,
1232                 .proc_handler   = &proc_dointvec_jiffies,
1233         },
1234         {
1235                 .ctl_name       = NET_NF_CONNTRACK_TCP_LOOSE,
1236                 .procname       = "nf_conntrack_tcp_loose",
1237                 .data           = &nf_ct_tcp_loose,
1238                 .maxlen         = sizeof(unsigned int),
1239                 .mode           = 0644,
1240                 .proc_handler   = &proc_dointvec,
1241         },
1242         {
1243                 .ctl_name       = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
1244                 .procname       = "nf_conntrack_tcp_be_liberal",
1245                 .data           = &nf_ct_tcp_be_liberal,
1246                 .maxlen         = sizeof(unsigned int),
1247                 .mode           = 0644,
1248                 .proc_handler   = &proc_dointvec,
1249         },
1250         {
1251                 .ctl_name       = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
1252                 .procname       = "nf_conntrack_tcp_max_retrans",
1253                 .data           = &nf_ct_tcp_max_retrans,
1254                 .maxlen         = sizeof(unsigned int),
1255                 .mode           = 0644,
1256                 .proc_handler   = &proc_dointvec,
1257         },
1258         {
1259                 .ctl_name       = 0
1260         }
1261 };
1262
1263 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1264 static struct ctl_table tcp_compat_sysctl_table[] = {
1265         {
1266                 .procname       = "ip_conntrack_tcp_timeout_syn_sent",
1267                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1268                 .maxlen         = sizeof(unsigned int),
1269                 .mode           = 0644,
1270                 .proc_handler   = &proc_dointvec_jiffies,
1271         },
1272         {
1273                 .procname       = "ip_conntrack_tcp_timeout_syn_recv",
1274                 .data           = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1275                 .maxlen         = sizeof(unsigned int),
1276                 .mode           = 0644,
1277                 .proc_handler   = &proc_dointvec_jiffies,
1278         },
1279         {
1280                 .procname       = "ip_conntrack_tcp_timeout_established",
1281                 .data           = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1282                 .maxlen         = sizeof(unsigned int),
1283                 .mode           = 0644,
1284                 .proc_handler   = &proc_dointvec_jiffies,
1285         },
1286         {
1287                 .procname       = "ip_conntrack_tcp_timeout_fin_wait",
1288                 .data           = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1289                 .maxlen         = sizeof(unsigned int),
1290                 .mode           = 0644,
1291                 .proc_handler   = &proc_dointvec_jiffies,
1292         },
1293         {
1294                 .procname       = "ip_conntrack_tcp_timeout_close_wait",
1295                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1296                 .maxlen         = sizeof(unsigned int),
1297                 .mode           = 0644,
1298                 .proc_handler   = &proc_dointvec_jiffies,
1299         },
1300         {
1301                 .procname       = "ip_conntrack_tcp_timeout_last_ack",
1302                 .data           = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1303                 .maxlen         = sizeof(unsigned int),
1304                 .mode           = 0644,
1305                 .proc_handler   = &proc_dointvec_jiffies,
1306         },
1307         {
1308                 .procname       = "ip_conntrack_tcp_timeout_time_wait",
1309                 .data           = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1310                 .maxlen         = sizeof(unsigned int),
1311                 .mode           = 0644,
1312                 .proc_handler   = &proc_dointvec_jiffies,
1313         },
1314         {
1315                 .procname       = "ip_conntrack_tcp_timeout_close",
1316                 .data           = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1317                 .maxlen         = sizeof(unsigned int),
1318                 .mode           = 0644,
1319                 .proc_handler   = &proc_dointvec_jiffies,
1320         },
1321         {
1322                 .procname       = "ip_conntrack_tcp_timeout_max_retrans",
1323                 .data           = &nf_ct_tcp_timeout_max_retrans,
1324                 .maxlen         = sizeof(unsigned int),
1325                 .mode           = 0644,
1326                 .proc_handler   = &proc_dointvec_jiffies,
1327         },
1328         {
1329                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
1330                 .procname       = "ip_conntrack_tcp_loose",
1331                 .data           = &nf_ct_tcp_loose,
1332                 .maxlen         = sizeof(unsigned int),
1333                 .mode           = 0644,
1334                 .proc_handler   = &proc_dointvec,
1335         },
1336         {
1337                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
1338                 .procname       = "ip_conntrack_tcp_be_liberal",
1339                 .data           = &nf_ct_tcp_be_liberal,
1340                 .maxlen         = sizeof(unsigned int),
1341                 .mode           = 0644,
1342                 .proc_handler   = &proc_dointvec,
1343         },
1344         {
1345                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
1346                 .procname       = "ip_conntrack_tcp_max_retrans",
1347                 .data           = &nf_ct_tcp_max_retrans,
1348                 .maxlen         = sizeof(unsigned int),
1349                 .mode           = 0644,
1350                 .proc_handler   = &proc_dointvec,
1351         },
1352         {
1353                 .ctl_name       = 0
1354         }
1355 };
1356 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
1357 #endif /* CONFIG_SYSCTL */
1358
1359 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
1360 {
1361         .l3proto                = PF_INET,
1362         .l4proto                = IPPROTO_TCP,
1363         .name                   = "tcp",
1364         .pkt_to_tuple           = tcp_pkt_to_tuple,
1365         .invert_tuple           = tcp_invert_tuple,
1366         .print_tuple            = tcp_print_tuple,
1367         .print_conntrack        = tcp_print_conntrack,
1368         .packet                 = tcp_packet,
1369         .new                    = tcp_new,
1370         .error                  = tcp_error,
1371 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1372         .to_nlattr              = tcp_to_nlattr,
1373         .from_nlattr            = nlattr_to_tcp,
1374         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1375         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1376         .nla_policy             = nf_ct_port_nla_policy,
1377 #endif
1378 #ifdef CONFIG_SYSCTL
1379         .ctl_table_users        = &tcp_sysctl_table_users,
1380         .ctl_table_header       = &tcp_sysctl_header,
1381         .ctl_table              = tcp_sysctl_table,
1382 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1383         .ctl_compat_table       = tcp_compat_sysctl_table,
1384 #endif
1385 #endif
1386 };
1387 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
1388
1389 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
1390 {
1391         .l3proto                = PF_INET6,
1392         .l4proto                = IPPROTO_TCP,
1393         .name                   = "tcp",
1394         .pkt_to_tuple           = tcp_pkt_to_tuple,
1395         .invert_tuple           = tcp_invert_tuple,
1396         .print_tuple            = tcp_print_tuple,
1397         .print_conntrack        = tcp_print_conntrack,
1398         .packet                 = tcp_packet,
1399         .new                    = tcp_new,
1400         .error                  = tcp_error,
1401 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1402         .to_nlattr              = tcp_to_nlattr,
1403         .from_nlattr            = nlattr_to_tcp,
1404         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
1405         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
1406         .nla_policy             = nf_ct_port_nla_policy,
1407 #endif
1408 #ifdef CONFIG_SYSCTL
1409         .ctl_table_users        = &tcp_sysctl_table_users,
1410         .ctl_table_header       = &tcp_sysctl_header,
1411         .ctl_table              = tcp_sysctl_table,
1412 #endif
1413 };
1414 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);