121760d6cc50cd2ccd4568591168988606ab15d3
[linux-3.10.git] / net / ipv4 / netfilter / ip_conntrack_proto_tcp.c
1 /* (C) 1999-2001 Paul `Rusty' Russell
2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  *
8  * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>:
9  *      - Real stateful connection tracking
10  *      - Modified state transitions table
11  *      - Window scaling support added
12  *      - SACK support added
13  *
14  * Willy Tarreau:
15  *      - State table bugfixes
16  *      - More robust state changes
17  *      - Tuning timer parameters
18  *
19  * version 2.2
20  */
21
22 #include <linux/config.h>
23 #include <linux/types.h>
24 #include <linux/sched.h>
25 #include <linux/timer.h>
26 #include <linux/netfilter.h>
27 #include <linux/module.h>
28 #include <linux/in.h>
29 #include <linux/ip.h>
30 #include <linux/tcp.h>
31 #include <linux/spinlock.h>
32
33 #include <net/tcp.h>
34
35 #include <linux/netfilter.h>
36 #include <linux/netfilter_ipv4.h>
37 #include <linux/netfilter_ipv4/ip_conntrack.h>
38 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
39
40 #if 0
41 #define DEBUGP printk
42 #define DEBUGP_VARS
43 #else
44 #define DEBUGP(format, args...)
45 #endif
46
47 /* Protects conntrack->proto.tcp */
48 static DEFINE_RWLOCK(tcp_lock);
49
50 /* "Be conservative in what you do, 
51     be liberal in what you accept from others." 
52     If it's non-zero, we mark only out of window RST segments as INVALID. */
53 int ip_ct_tcp_be_liberal = 0;
54
55 /* When connection is picked up from the middle, how many packets are required
56    to pass in each direction when we assume we are in sync - if any side uses
57    window scaling, we lost the game. 
58    If it is set to zero, we disable picking up already established 
59    connections. */
60 int ip_ct_tcp_loose = 3;
61
62 /* Max number of the retransmitted packets without receiving an (acceptable) 
63    ACK from the destination. If this number is reached, a shorter timer 
64    will be started. */
65 int ip_ct_tcp_max_retrans = 3;
66
67   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
68      closely.  They're more complex. --RR */
69
70 static const char *tcp_conntrack_names[] = {
71         "NONE",
72         "SYN_SENT",
73         "SYN_RECV",
74         "ESTABLISHED",
75         "FIN_WAIT",
76         "CLOSE_WAIT",
77         "LAST_ACK",
78         "TIME_WAIT",
79         "CLOSE",
80         "LISTEN"
81 };
82   
83 #define SECS * HZ
84 #define MINS * 60 SECS
85 #define HOURS * 60 MINS
86 #define DAYS * 24 HOURS
87
88 unsigned long ip_ct_tcp_timeout_syn_sent =      2 MINS;
89 unsigned long ip_ct_tcp_timeout_syn_recv =     60 SECS;
90 unsigned long ip_ct_tcp_timeout_established =   5 DAYS;
91 unsigned long ip_ct_tcp_timeout_fin_wait =      2 MINS;
92 unsigned long ip_ct_tcp_timeout_close_wait =   60 SECS;
93 unsigned long ip_ct_tcp_timeout_last_ack =     30 SECS;
94 unsigned long ip_ct_tcp_timeout_time_wait =     2 MINS;
95 unsigned long ip_ct_tcp_timeout_close =        10 SECS;
96
97 /* RFC1122 says the R2 limit should be at least 100 seconds.
98    Linux uses 15 packets as limit, which corresponds 
99    to ~13-30min depending on RTO. */
100 unsigned long ip_ct_tcp_timeout_max_retrans =     5 MINS;
101  
102 static unsigned long * tcp_timeouts[]
103 = { NULL,                              /*      TCP_CONNTRACK_NONE */
104     &ip_ct_tcp_timeout_syn_sent,       /*      TCP_CONNTRACK_SYN_SENT, */
105     &ip_ct_tcp_timeout_syn_recv,       /*      TCP_CONNTRACK_SYN_RECV, */
106     &ip_ct_tcp_timeout_established,    /*      TCP_CONNTRACK_ESTABLISHED,      */
107     &ip_ct_tcp_timeout_fin_wait,       /*      TCP_CONNTRACK_FIN_WAIT, */
108     &ip_ct_tcp_timeout_close_wait,     /*      TCP_CONNTRACK_CLOSE_WAIT,       */
109     &ip_ct_tcp_timeout_last_ack,       /*      TCP_CONNTRACK_LAST_ACK, */
110     &ip_ct_tcp_timeout_time_wait,      /*      TCP_CONNTRACK_TIME_WAIT,        */
111     &ip_ct_tcp_timeout_close,          /*      TCP_CONNTRACK_CLOSE,    */
112     NULL,                              /*      TCP_CONNTRACK_LISTEN */
113  };
114  
115 #define sNO TCP_CONNTRACK_NONE
116 #define sSS TCP_CONNTRACK_SYN_SENT
117 #define sSR TCP_CONNTRACK_SYN_RECV
118 #define sES TCP_CONNTRACK_ESTABLISHED
119 #define sFW TCP_CONNTRACK_FIN_WAIT
120 #define sCW TCP_CONNTRACK_CLOSE_WAIT
121 #define sLA TCP_CONNTRACK_LAST_ACK
122 #define sTW TCP_CONNTRACK_TIME_WAIT
123 #define sCL TCP_CONNTRACK_CLOSE
124 #define sLI TCP_CONNTRACK_LISTEN
125 #define sIV TCP_CONNTRACK_MAX
126 #define sIG TCP_CONNTRACK_IGNORE
127
128 /* What TCP flags are set from RST/SYN/FIN/ACK. */
129 enum tcp_bit_set {
130         TCP_SYN_SET,
131         TCP_SYNACK_SET,
132         TCP_FIN_SET,
133         TCP_ACK_SET,
134         TCP_RST_SET,
135         TCP_NONE_SET,
136 };
137   
138 /*
139  * The TCP state transition table needs a few words...
140  *
141  * We are the man in the middle. All the packets go through us
142  * but might get lost in transit to the destination.
143  * It is assumed that the destinations can't receive segments 
144  * we haven't seen.
145  *
146  * The checked segment is in window, but our windows are *not*
147  * equivalent with the ones of the sender/receiver. We always
148  * try to guess the state of the current sender.
149  *
150  * The meaning of the states are:
151  *
152  * NONE:        initial state
153  * SYN_SENT:    SYN-only packet seen 
154  * SYN_RECV:    SYN-ACK packet seen
155  * ESTABLISHED: ACK packet seen
156  * FIN_WAIT:    FIN packet seen
157  * CLOSE_WAIT:  ACK seen (after FIN) 
158  * LAST_ACK:    FIN seen (after FIN)
159  * TIME_WAIT:   last ACK seen
160  * CLOSE:       closed connection
161  *
162  * LISTEN state is not used.
163  *
164  * Packets marked as IGNORED (sIG):
165  *      if they may be either invalid or valid 
166  *      and the receiver may send back a connection 
167  *      closing RST or a SYN/ACK.
168  *
169  * Packets marked as INVALID (sIV):
170  *      if they are invalid
171  *      or we do not support the request (simultaneous open)
172  */
173 static enum tcp_conntrack tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
174         {
175 /* ORIGINAL */
176 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
177 /*syn*/    { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sIV },
178 /*
179  *      sNO -> sSS      Initialize a new connection
180  *      sSS -> sSS      Retransmitted SYN
181  *      sSR -> sIG      Late retransmitted SYN?
182  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
183  *                      are errors. Receiver will reply with RST 
184  *                      and close the connection.
185  *                      Or we are not in sync and hold a dead connection.
186  *      sFW -> sIG
187  *      sCW -> sIG
188  *      sLA -> sIG
189  *      sTW -> sSS      Reopened connection (RFC 1122).
190  *      sCL -> sSS
191  */
192 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
193 /*synack*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
194 /*
195  * A SYN/ACK from the client is always invalid:
196  *      - either it tries to set up a simultaneous open, which is 
197  *        not supported;
198  *      - or the firewall has just been inserted between the two hosts
199  *        during the session set-up. The SYN will be retransmitted 
200  *        by the true client (or it'll time out).
201  */
202 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
203 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
204 /*
205  *      sNO -> sIV      Too late and no reason to do anything...
206  *      sSS -> sIV      Client migth not send FIN in this state:
207  *                      we enforce waiting for a SYN/ACK reply first.
208  *      sSR -> sFW      Close started.
209  *      sES -> sFW      
210  *      sFW -> sLA      FIN seen in both directions, waiting for
211  *                      the last ACK. 
212  *                      Migth be a retransmitted FIN as well...
213  *      sCW -> sLA
214  *      sLA -> sLA      Retransmitted FIN. Remain in the same state.
215  *      sTW -> sTW
216  *      sCL -> sCL
217  */
218 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
219 /*ack*/    { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
220 /*
221  *      sNO -> sES      Assumed.
222  *      sSS -> sIV      ACK is invalid: we haven't seen a SYN/ACK yet.
223  *      sSR -> sES      Established state is reached.
224  *      sES -> sES      :-)
225  *      sFW -> sCW      Normal close request answered by ACK.
226  *      sCW -> sCW
227  *      sLA -> sTW      Last ACK detected.
228  *      sTW -> sTW      Retransmitted last ACK. Remain in the same state.
229  *      sCL -> sCL
230  */
231 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
232 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
233 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
234         },
235         {
236 /* REPLY */
237 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
238 /*syn*/    { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
239 /*
240  *      sNO -> sIV      Never reached.
241  *      sSS -> sIV      Simultaneous open, not supported
242  *      sSR -> sIV      Simultaneous open, not supported.
243  *      sES -> sIV      Server may not initiate a connection.
244  *      sFW -> sIV
245  *      sCW -> sIV
246  *      sLA -> sIV
247  *      sTW -> sIV      Reopened connection, but server may not do it.
248  *      sCL -> sIV
249  */
250 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
251 /*synack*/ { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIV },
252 /*
253  *      sSS -> sSR      Standard open.
254  *      sSR -> sSR      Retransmitted SYN/ACK.
255  *      sES -> sIG      Late retransmitted SYN/ACK?
256  *      sFW -> sIG      Might be SYN/ACK answering ignored SYN
257  *      sCW -> sIG
258  *      sLA -> sIG
259  *      sTW -> sIG
260  *      sCL -> sIG
261  */
262 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
263 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
264 /*
265  *      sSS -> sIV      Server might not send FIN in this state.
266  *      sSR -> sFW      Close started.
267  *      sES -> sFW
268  *      sFW -> sLA      FIN seen in both directions.
269  *      sCW -> sLA
270  *      sLA -> sLA      Retransmitted FIN.
271  *      sTW -> sTW
272  *      sCL -> sCL
273  */
274 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
275 /*ack*/    { sIV, sIV, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
276 /*
277  *      sSS -> sIV      Might be a half-open connection.
278  *      sSR -> sSR      Might answer late resent SYN.
279  *      sES -> sES      :-)
280  *      sFW -> sCW      Normal close request answered by ACK.
281  *      sCW -> sCW
282  *      sLA -> sTW      Last ACK detected.
283  *      sTW -> sTW      Retransmitted last ACK.
284  *      sCL -> sCL
285  */
286 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
287 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
288 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
289         }
290 };
291
292 static int tcp_pkt_to_tuple(const struct sk_buff *skb,
293                             unsigned int dataoff,
294                             struct ip_conntrack_tuple *tuple)
295 {
296         struct tcphdr _hdr, *hp;
297
298         /* Actually only need first 8 bytes. */
299         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
300         if (hp == NULL)
301                 return 0;
302
303         tuple->src.u.tcp.port = hp->source;
304         tuple->dst.u.tcp.port = hp->dest;
305
306         return 1;
307 }
308
309 static int tcp_invert_tuple(struct ip_conntrack_tuple *tuple,
310                             const struct ip_conntrack_tuple *orig)
311 {
312         tuple->src.u.tcp.port = orig->dst.u.tcp.port;
313         tuple->dst.u.tcp.port = orig->src.u.tcp.port;
314         return 1;
315 }
316
317 /* Print out the per-protocol part of the tuple. */
318 static int tcp_print_tuple(struct seq_file *s,
319                            const struct ip_conntrack_tuple *tuple)
320 {
321         return seq_printf(s, "sport=%hu dport=%hu ",
322                           ntohs(tuple->src.u.tcp.port),
323                           ntohs(tuple->dst.u.tcp.port));
324 }
325
326 /* Print out the private part of the conntrack. */
327 static int tcp_print_conntrack(struct seq_file *s,
328                                const struct ip_conntrack *conntrack)
329 {
330         enum tcp_conntrack state;
331
332         read_lock_bh(&tcp_lock);
333         state = conntrack->proto.tcp.state;
334         read_unlock_bh(&tcp_lock);
335
336         return seq_printf(s, "%s ", tcp_conntrack_names[state]);
337 }
338
339 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
340     defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
341 static int tcp_to_nfattr(struct sk_buff *skb, struct nfattr *nfa,
342                          const struct ip_conntrack *ct)
343 {
344         read_lock_bh(&tcp_lock);
345         NFA_PUT(skb, CTA_PROTOINFO_TCP_STATE, sizeof(u_int8_t),
346                 &ct->proto.tcp.state);
347         read_unlock_bh(&tcp_lock);
348
349         return 0;
350
351 nfattr_failure:
352         read_unlock_bh(&tcp_lock);
353         return -1;
354 }
355 #endif
356
357 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
358 {
359         if (tcph->rst) return TCP_RST_SET;
360         else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
361         else if (tcph->fin) return TCP_FIN_SET;
362         else if (tcph->ack) return TCP_ACK_SET;
363         else return TCP_NONE_SET;
364 }
365
366 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
367    in IP Filter' by Guido van Rooij.
368    
369    http://www.nluug.nl/events/sane2000/papers.html
370    http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
371    
372    The boundaries and the conditions are changed according to RFC793:
373    the packet must intersect the window (i.e. segments may be
374    after the right or before the left edge) and thus receivers may ACK
375    segments after the right edge of the window.
376
377         td_maxend = max(sack + max(win,1)) seen in reply packets
378         td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
379         td_maxwin += seq + len - sender.td_maxend
380                         if seq + len > sender.td_maxend
381         td_end    = max(seq + len) seen in sent packets
382    
383    I.   Upper bound for valid data:     seq <= sender.td_maxend
384    II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
385    III. Upper bound for valid ack:      sack <= receiver.td_end
386    IV.  Lower bound for valid ack:      ack >= receiver.td_end - MAXACKWINDOW
387         
388    where sack is the highest right edge of sack block found in the packet.
389         
390    The upper bound limit for a valid ack is not ignored - 
391    we doesn't have to deal with fragments. 
392 */
393
394 static inline __u32 segment_seq_plus_len(__u32 seq,
395                                          size_t len,
396                                          struct iphdr *iph,
397                                          struct tcphdr *tcph)
398 {
399         return (seq + len - (iph->ihl + tcph->doff)*4
400                 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
401 }
402   
403 /* Fixme: what about big packets? */
404 #define MAXACKWINCONST                  66000
405 #define MAXACKWINDOW(sender)                                            \
406         ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin     \
407                                               : MAXACKWINCONST)
408   
409 /*
410  * Simplified tcp_parse_options routine from tcp_input.c
411  */
412 static void tcp_options(const struct sk_buff *skb,
413                         struct iphdr *iph,
414                         struct tcphdr *tcph, 
415                         struct ip_ct_tcp_state *state)
416 {
417         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
418         unsigned char *ptr;
419         int length = (tcph->doff*4) - sizeof(struct tcphdr);
420         
421         if (!length)
422                 return;
423
424         ptr = skb_header_pointer(skb,
425                                  (iph->ihl * 4) + sizeof(struct tcphdr),
426                                  length, buff);
427         BUG_ON(ptr == NULL);
428
429         state->td_scale = 
430         state->flags = 0;
431         
432         while (length > 0) {
433                 int opcode=*ptr++;
434                 int opsize;
435                 
436                 switch (opcode) {
437                 case TCPOPT_EOL:
438                         return;
439                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
440                         length--;
441                         continue;
442                 default:
443                         opsize=*ptr++;
444                         if (opsize < 2) /* "silly options" */
445                                 return;
446                         if (opsize > length)
447                                 break;  /* don't parse partial options */
448
449                         if (opcode == TCPOPT_SACK_PERM 
450                             && opsize == TCPOLEN_SACK_PERM)
451                                 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
452                         else if (opcode == TCPOPT_WINDOW
453                                  && opsize == TCPOLEN_WINDOW) {
454                                 state->td_scale = *(u_int8_t *)ptr;
455                                 
456                                 if (state->td_scale > 14) {
457                                         /* See RFC1323 */
458                                         state->td_scale = 14;
459                                 }
460                                 state->flags |=
461                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
462                         }
463                         ptr += opsize - 2;
464                         length -= opsize;
465                 }
466         }
467 }
468
469 static void tcp_sack(const struct sk_buff *skb,
470                      struct iphdr *iph,
471                      struct tcphdr *tcph,
472                      __u32 *sack)
473 {
474         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
475         unsigned char *ptr;
476         int length = (tcph->doff*4) - sizeof(struct tcphdr);
477         __u32 tmp;
478
479         if (!length)
480                 return;
481
482         ptr = skb_header_pointer(skb,
483                                  (iph->ihl * 4) + sizeof(struct tcphdr),
484                                  length, buff);
485         BUG_ON(ptr == NULL);
486
487         /* Fast path for timestamp-only option */
488         if (length == TCPOLEN_TSTAMP_ALIGNED*4
489             && *(__u32 *)ptr ==
490                 __constant_ntohl((TCPOPT_NOP << 24) 
491                                  | (TCPOPT_NOP << 16)
492                                  | (TCPOPT_TIMESTAMP << 8)
493                                  | TCPOLEN_TIMESTAMP))
494                 return;
495                 
496         while (length > 0) {
497                 int opcode=*ptr++;
498                 int opsize, i;
499                 
500                 switch (opcode) {
501                 case TCPOPT_EOL:
502                         return;
503                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
504                         length--;
505                         continue;
506                 default:
507                         opsize=*ptr++;
508                         if (opsize < 2) /* "silly options" */
509                                 return;
510                         if (opsize > length)
511                                 break;  /* don't parse partial options */
512
513                         if (opcode == TCPOPT_SACK 
514                             && opsize >= (TCPOLEN_SACK_BASE 
515                                           + TCPOLEN_SACK_PERBLOCK)
516                             && !((opsize - TCPOLEN_SACK_BASE) 
517                                  % TCPOLEN_SACK_PERBLOCK)) {
518                                 for (i = 0;
519                                      i < (opsize - TCPOLEN_SACK_BASE);
520                                      i += TCPOLEN_SACK_PERBLOCK) {
521                                         tmp = ntohl(*((u_int32_t *)(ptr+i)+1));
522                                         
523                                         if (after(tmp, *sack))
524                                                 *sack = tmp;
525                                 }
526                                 return;
527                         }
528                         ptr += opsize - 2;
529                         length -= opsize;
530                 }
531         }
532 }
533
534 static int tcp_in_window(struct ip_ct_tcp *state, 
535                          enum ip_conntrack_dir dir,
536                          unsigned int index,
537                          const struct sk_buff *skb,
538                          struct iphdr *iph,
539                          struct tcphdr *tcph)
540 {
541         struct ip_ct_tcp_state *sender = &state->seen[dir];
542         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
543         __u32 seq, ack, sack, end, win, swin;
544         int res;
545         
546         /*
547          * Get the required data from the packet.
548          */
549         seq = ntohl(tcph->seq);
550         ack = sack = ntohl(tcph->ack_seq);
551         win = ntohs(tcph->window);
552         end = segment_seq_plus_len(seq, skb->len, iph, tcph);
553         
554         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
555                 tcp_sack(skb, iph, tcph, &sack);
556                 
557         DEBUGP("tcp_in_window: START\n");
558         DEBUGP("tcp_in_window: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
559                "seq=%u ack=%u sack=%u win=%u end=%u\n",
560                 NIPQUAD(iph->saddr), ntohs(tcph->source), 
561                 NIPQUAD(iph->daddr), ntohs(tcph->dest),
562                 seq, ack, sack, win, end);
563         DEBUGP("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
564                "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
565                 sender->td_end, sender->td_maxend, sender->td_maxwin,
566                 sender->td_scale, 
567                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin, 
568                 receiver->td_scale);
569                 
570         if (sender->td_end == 0) {
571                 /*
572                  * Initialize sender data.
573                  */
574                 if (tcph->syn && tcph->ack) {
575                         /*
576                          * Outgoing SYN-ACK in reply to a SYN.
577                          */
578                         sender->td_end = 
579                         sender->td_maxend = end;
580                         sender->td_maxwin = (win == 0 ? 1 : win);
581
582                         tcp_options(skb, iph, tcph, sender);
583                         /* 
584                          * RFC 1323:
585                          * Both sides must send the Window Scale option
586                          * to enable window scaling in either direction.
587                          */
588                         if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
589                               && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
590                                 sender->td_scale = 
591                                 receiver->td_scale = 0;
592                 } else {
593                         /*
594                          * We are in the middle of a connection,
595                          * its history is lost for us.
596                          * Let's try to use the data from the packet.
597                          */
598                         sender->td_end = end;
599                         sender->td_maxwin = (win == 0 ? 1 : win);
600                         sender->td_maxend = end + sender->td_maxwin;
601                 }
602         } else if (((state->state == TCP_CONNTRACK_SYN_SENT
603                      && dir == IP_CT_DIR_ORIGINAL)
604                     || (state->state == TCP_CONNTRACK_SYN_RECV
605                         && dir == IP_CT_DIR_REPLY))
606                     && after(end, sender->td_end)) {
607                 /*
608                  * RFC 793: "if a TCP is reinitialized ... then it need
609                  * not wait at all; it must only be sure to use sequence 
610                  * numbers larger than those recently used."
611                  */
612                 sender->td_end =
613                 sender->td_maxend = end;
614                 sender->td_maxwin = (win == 0 ? 1 : win);
615
616                 tcp_options(skb, iph, tcph, sender);
617         }
618         
619         if (!(tcph->ack)) {
620                 /*
621                  * If there is no ACK, just pretend it was set and OK.
622                  */
623                 ack = sack = receiver->td_end;
624         } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) == 
625                     (TCP_FLAG_ACK|TCP_FLAG_RST)) 
626                    && (ack == 0)) {
627                 /*
628                  * Broken TCP stacks, that set ACK in RST packets as well
629                  * with zero ack value.
630                  */
631                 ack = sack = receiver->td_end;
632         }
633
634         if (seq == end
635             && (!tcph->rst 
636                 || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
637                 /*
638                  * Packets contains no data: we assume it is valid
639                  * and check the ack value only.
640                  * However RST segments are always validated by their
641                  * SEQ number, except when seq == 0 (reset sent answering
642                  * SYN.
643                  */
644                 seq = end = sender->td_end;
645                 
646         DEBUGP("tcp_in_window: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
647                "seq=%u ack=%u sack =%u win=%u end=%u\n",
648                 NIPQUAD(iph->saddr), ntohs(tcph->source),
649                 NIPQUAD(iph->daddr), ntohs(tcph->dest),
650                 seq, ack, sack, win, end);
651         DEBUGP("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
652                "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
653                 sender->td_end, sender->td_maxend, sender->td_maxwin,
654                 sender->td_scale, 
655                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
656                 receiver->td_scale);
657         
658         DEBUGP("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
659                 before(seq, sender->td_maxend + 1),
660                 after(end, sender->td_end - receiver->td_maxwin - 1),
661                 before(sack, receiver->td_end + 1),
662                 after(ack, receiver->td_end - MAXACKWINDOW(sender)));
663         
664         if (sender->loose || receiver->loose ||
665             (before(seq, sender->td_maxend + 1) &&
666              after(end, sender->td_end - receiver->td_maxwin - 1) &&
667              before(sack, receiver->td_end + 1) &&
668              after(ack, receiver->td_end - MAXACKWINDOW(sender)))) {
669                 /*
670                  * Take into account window scaling (RFC 1323).
671                  */
672                 if (!tcph->syn)
673                         win <<= sender->td_scale;
674                 
675                 /*
676                  * Update sender data.
677                  */
678                 swin = win + (sack - ack);
679                 if (sender->td_maxwin < swin)
680                         sender->td_maxwin = swin;
681                 if (after(end, sender->td_end))
682                         sender->td_end = end;
683                 /*
684                  * Update receiver data.
685                  */
686                 if (after(end, sender->td_maxend))
687                         receiver->td_maxwin += end - sender->td_maxend;
688                 if (after(sack + win, receiver->td_maxend - 1)) {
689                         receiver->td_maxend = sack + win;
690                         if (win == 0)
691                                 receiver->td_maxend++;
692                 }
693
694                 /* 
695                  * Check retransmissions.
696                  */
697                 if (index == TCP_ACK_SET) {
698                         if (state->last_dir == dir
699                             && state->last_seq == seq
700                             && state->last_ack == ack
701                             && state->last_end == end)
702                                 state->retrans++;
703                         else {
704                                 state->last_dir = dir;
705                                 state->last_seq = seq;
706                                 state->last_ack = ack;
707                                 state->last_end = end;
708                                 state->retrans = 0;
709                         }
710                 }
711                 /*
712                  * Close the window of disabled window tracking :-)
713                  */
714                 if (sender->loose)
715                         sender->loose--;
716                 
717                 res = 1;
718         } else {
719                 if (LOG_INVALID(IPPROTO_TCP))
720                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
721                         "ip_ct_tcp: %s ",
722                         before(seq, sender->td_maxend + 1) ?
723                         after(end, sender->td_end - receiver->td_maxwin - 1) ?
724                         before(sack, receiver->td_end + 1) ?
725                         after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
726                         : "ACK is under the lower bound (possible overly delayed ACK)"
727                         : "ACK is over the upper bound (ACKed data not seen yet)"
728                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
729                         : "SEQ is over the upper bound (over the window of the receiver)");
730
731                 res = ip_ct_tcp_be_liberal;
732         }
733   
734         DEBUGP("tcp_in_window: res=%i sender end=%u maxend=%u maxwin=%u "
735                "receiver end=%u maxend=%u maxwin=%u\n",
736                 res, sender->td_end, sender->td_maxend, sender->td_maxwin, 
737                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
738
739         return res;
740 }
741
742 #ifdef CONFIG_IP_NF_NAT_NEEDED
743 /* Update sender->td_end after NAT successfully mangled the packet */
744 void ip_conntrack_tcp_update(struct sk_buff *skb,
745                              struct ip_conntrack *conntrack, 
746                              enum ip_conntrack_dir dir)
747 {
748         struct iphdr *iph = skb->nh.iph;
749         struct tcphdr *tcph = (void *)skb->nh.iph + skb->nh.iph->ihl*4;
750         __u32 end;
751 #ifdef DEBUGP_VARS
752         struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[dir];
753         struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[!dir];
754 #endif
755
756         end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, iph, tcph);
757         
758         write_lock_bh(&tcp_lock);
759         /*
760          * We have to worry for the ack in the reply packet only...
761          */
762         if (after(end, conntrack->proto.tcp.seen[dir].td_end))
763                 conntrack->proto.tcp.seen[dir].td_end = end;
764         conntrack->proto.tcp.last_end = end;
765         write_unlock_bh(&tcp_lock);
766         DEBUGP("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
767                "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
768                 sender->td_end, sender->td_maxend, sender->td_maxwin,
769                 sender->td_scale, 
770                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
771                 receiver->td_scale);
772 }
773  
774 #endif
775
776 #define TH_FIN  0x01
777 #define TH_SYN  0x02
778 #define TH_RST  0x04
779 #define TH_PUSH 0x08
780 #define TH_ACK  0x10
781 #define TH_URG  0x20
782 #define TH_ECE  0x40
783 #define TH_CWR  0x80
784
785 /* table of valid flag combinations - ECE and CWR are always valid */
786 static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
787 {
788         [TH_SYN]                        = 1,
789         [TH_SYN|TH_ACK]                 = 1,
790         [TH_SYN|TH_ACK|TH_PUSH]         = 1,
791         [TH_RST]                        = 1,
792         [TH_RST|TH_ACK]                 = 1,
793         [TH_RST|TH_ACK|TH_PUSH]         = 1,
794         [TH_FIN|TH_ACK]                 = 1,
795         [TH_ACK]                        = 1,
796         [TH_ACK|TH_PUSH]                = 1,
797         [TH_ACK|TH_URG]                 = 1,
798         [TH_ACK|TH_URG|TH_PUSH]         = 1,
799         [TH_FIN|TH_ACK|TH_PUSH]         = 1,
800         [TH_FIN|TH_ACK|TH_URG]          = 1,
801         [TH_FIN|TH_ACK|TH_URG|TH_PUSH]  = 1,
802 };
803
804 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
805 static int tcp_error(struct sk_buff *skb,
806                      enum ip_conntrack_info *ctinfo,
807                      unsigned int hooknum)
808 {
809         struct iphdr *iph = skb->nh.iph;
810         struct tcphdr _tcph, *th;
811         unsigned int tcplen = skb->len - iph->ihl * 4;
812         u_int8_t tcpflags;
813
814         /* Smaller that minimal TCP header? */
815         th = skb_header_pointer(skb, iph->ihl * 4,
816                                 sizeof(_tcph), &_tcph);
817         if (th == NULL) {
818                 if (LOG_INVALID(IPPROTO_TCP))
819                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
820                                 "ip_ct_tcp: short packet ");
821                 return -NF_ACCEPT;
822         }
823   
824         /* Not whole TCP header or malformed packet */
825         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
826                 if (LOG_INVALID(IPPROTO_TCP))
827                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
828                                 "ip_ct_tcp: truncated/malformed packet ");
829                 return -NF_ACCEPT;
830         }
831   
832         /* Checksum invalid? Ignore.
833          * We skip checking packets on the outgoing path
834          * because the semantic of CHECKSUM_HW is different there 
835          * and moreover root might send raw packets.
836          */
837         /* FIXME: Source route IP option packets --RR */
838         if (hooknum == NF_IP_PRE_ROUTING
839             && skb->ip_summed != CHECKSUM_UNNECESSARY
840             && csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
841                                  skb->ip_summed == CHECKSUM_HW ? skb->csum
842                                  : skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
843                 if (LOG_INVALID(IPPROTO_TCP))
844                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
845                                   "ip_ct_tcp: bad TCP checksum ");
846                 return -NF_ACCEPT;
847         }
848
849         /* Check TCP flags. */
850         tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR));
851         if (!tcp_valid_flags[tcpflags]) {
852                 if (LOG_INVALID(IPPROTO_TCP))
853                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
854                                   "ip_ct_tcp: invalid TCP flag combination ");
855                 return -NF_ACCEPT;
856         }
857
858         return NF_ACCEPT;
859 }
860
861 /* Returns verdict for packet, or -1 for invalid. */
862 static int tcp_packet(struct ip_conntrack *conntrack,
863                       const struct sk_buff *skb,
864                       enum ip_conntrack_info ctinfo)
865 {
866         enum tcp_conntrack new_state, old_state;
867         enum ip_conntrack_dir dir;
868         struct iphdr *iph = skb->nh.iph;
869         struct tcphdr *th, _tcph;
870         unsigned long timeout;
871         unsigned int index;
872         
873         th = skb_header_pointer(skb, iph->ihl * 4,
874                                 sizeof(_tcph), &_tcph);
875         BUG_ON(th == NULL);
876         
877         write_lock_bh(&tcp_lock);
878         old_state = conntrack->proto.tcp.state;
879         dir = CTINFO2DIR(ctinfo);
880         index = get_conntrack_index(th);
881         new_state = tcp_conntracks[dir][index][old_state];
882
883         switch (new_state) {
884         case TCP_CONNTRACK_IGNORE:
885                 /* Either SYN in ORIGINAL
886                  * or SYN/ACK in REPLY. */
887                 if (index == TCP_SYNACK_SET
888                     && conntrack->proto.tcp.last_index == TCP_SYN_SET
889                     && conntrack->proto.tcp.last_dir != dir
890                     && ntohl(th->ack_seq) ==
891                              conntrack->proto.tcp.last_end) {
892                         /* This SYN/ACK acknowledges a SYN that we earlier 
893                          * ignored as invalid. This means that the client and
894                          * the server are both in sync, while the firewall is
895                          * not. We kill this session and block the SYN/ACK so
896                          * that the client cannot but retransmit its SYN and 
897                          * thus initiate a clean new session.
898                          */
899                         write_unlock_bh(&tcp_lock);
900                         if (LOG_INVALID(IPPROTO_TCP))
901                                 nf_log_packet(PF_INET, 0, skb, NULL, NULL,
902                                               NULL, "ip_ct_tcp: "
903                                               "killing out of sync session ");
904                         if (del_timer(&conntrack->timeout))
905                                 conntrack->timeout.function((unsigned long)
906                                                             conntrack);
907                         return -NF_DROP;
908                 }
909                 conntrack->proto.tcp.last_index = index;
910                 conntrack->proto.tcp.last_dir = dir;
911                 conntrack->proto.tcp.last_seq = ntohl(th->seq);
912                 conntrack->proto.tcp.last_end = 
913                     segment_seq_plus_len(ntohl(th->seq), skb->len, iph, th);
914                 
915                 write_unlock_bh(&tcp_lock);
916                 if (LOG_INVALID(IPPROTO_TCP))
917                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
918                                   "ip_ct_tcp: invalid packet ignored ");
919                 return NF_ACCEPT;
920         case TCP_CONNTRACK_MAX:
921                 /* Invalid packet */
922                 DEBUGP("ip_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
923                        dir, get_conntrack_index(th),
924                        old_state);
925                 write_unlock_bh(&tcp_lock);
926                 if (LOG_INVALID(IPPROTO_TCP))
927                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
928                                   "ip_ct_tcp: invalid state ");
929                 return -NF_ACCEPT;
930         case TCP_CONNTRACK_SYN_SENT:
931                 if (old_state < TCP_CONNTRACK_TIME_WAIT)
932                         break;
933                 if ((conntrack->proto.tcp.seen[dir].flags &
934                          IP_CT_TCP_FLAG_CLOSE_INIT)
935                     || after(ntohl(th->seq),
936                              conntrack->proto.tcp.seen[dir].td_end)) {  
937                         /* Attempt to reopen a closed connection.
938                         * Delete this connection and look up again. */
939                         write_unlock_bh(&tcp_lock);
940                         if (del_timer(&conntrack->timeout))
941                                 conntrack->timeout.function((unsigned long)
942                                                             conntrack);
943                         return -NF_REPEAT;
944                 } else {
945                         write_unlock_bh(&tcp_lock);
946                         if (LOG_INVALID(IPPROTO_TCP))
947                                 nf_log_packet(PF_INET, 0, skb, NULL, NULL,
948                                               NULL, "ip_ct_tcp: invalid SYN");
949                         return -NF_ACCEPT;
950                 }
951         case TCP_CONNTRACK_CLOSE:
952                 if (index == TCP_RST_SET
953                     && test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
954                     && conntrack->proto.tcp.last_index == TCP_SYN_SET
955                     && ntohl(th->ack_seq) == conntrack->proto.tcp.last_end) {
956                         /* RST sent to invalid SYN we had let trough
957                          * SYN was in window then, tear down connection.
958                          * We skip window checking, because packet might ACK
959                          * segments we ignored in the SYN. */
960                         goto in_window;
961                 }
962                 /* Just fall trough */
963         default:
964                 /* Keep compilers happy. */
965                 break;
966         }
967
968         if (!tcp_in_window(&conntrack->proto.tcp, dir, index, 
969                            skb, iph, th)) {
970                 write_unlock_bh(&tcp_lock);
971                 return -NF_ACCEPT;
972         }
973     in_window:
974         /* From now on we have got in-window packets */ 
975         conntrack->proto.tcp.last_index = index;
976
977         DEBUGP("tcp_conntracks: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
978                "syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
979                 NIPQUAD(iph->saddr), ntohs(th->source),
980                 NIPQUAD(iph->daddr), ntohs(th->dest),
981                 (th->syn ? 1 : 0), (th->ack ? 1 : 0),
982                 (th->fin ? 1 : 0), (th->rst ? 1 : 0),
983                 old_state, new_state);
984
985         conntrack->proto.tcp.state = new_state;
986         if (old_state != new_state 
987             && (new_state == TCP_CONNTRACK_FIN_WAIT
988                 || new_state == TCP_CONNTRACK_CLOSE))
989                 conntrack->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
990         timeout = conntrack->proto.tcp.retrans >= ip_ct_tcp_max_retrans
991                   && *tcp_timeouts[new_state] > ip_ct_tcp_timeout_max_retrans
992                   ? ip_ct_tcp_timeout_max_retrans : *tcp_timeouts[new_state];
993         write_unlock_bh(&tcp_lock);
994
995         ip_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
996         if (new_state != old_state)
997                 ip_conntrack_event_cache(IPCT_PROTOINFO, skb);
998
999         if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
1000                 /* If only reply is a RST, we can consider ourselves not to
1001                    have an established connection: this is a fairly common
1002                    problem case, so we can delete the conntrack
1003                    immediately.  --RR */
1004                 if (th->rst) {
1005                         if (del_timer(&conntrack->timeout))
1006                                 conntrack->timeout.function((unsigned long)
1007                                                             conntrack);
1008                         return NF_ACCEPT;
1009                 }
1010         } else if (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
1011                    && (old_state == TCP_CONNTRACK_SYN_RECV
1012                        || old_state == TCP_CONNTRACK_ESTABLISHED)
1013                    && new_state == TCP_CONNTRACK_ESTABLISHED) {
1014                 /* Set ASSURED if we see see valid ack in ESTABLISHED 
1015                    after SYN_RECV or a valid answer for a picked up 
1016                    connection. */
1017                 set_bit(IPS_ASSURED_BIT, &conntrack->status);
1018                 ip_conntrack_event_cache(IPCT_STATUS, skb);
1019         }
1020         ip_ct_refresh_acct(conntrack, ctinfo, skb, timeout);
1021
1022         return NF_ACCEPT;
1023 }
1024  
1025 /* Called when a new connection for this protocol found. */
1026 static int tcp_new(struct ip_conntrack *conntrack,
1027                    const struct sk_buff *skb)
1028 {
1029         enum tcp_conntrack new_state;
1030         struct iphdr *iph = skb->nh.iph;
1031         struct tcphdr *th, _tcph;
1032 #ifdef DEBUGP_VARS
1033         struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[0];
1034         struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[1];
1035 #endif
1036
1037         th = skb_header_pointer(skb, iph->ihl * 4,
1038                                 sizeof(_tcph), &_tcph);
1039         BUG_ON(th == NULL);
1040         
1041         /* Don't need lock here: this conntrack not in circulation yet */
1042         new_state
1043                 = tcp_conntracks[0][get_conntrack_index(th)]
1044                 [TCP_CONNTRACK_NONE];
1045
1046         /* Invalid: delete conntrack */
1047         if (new_state >= TCP_CONNTRACK_MAX) {
1048                 DEBUGP("ip_ct_tcp: invalid new deleting.\n");
1049                 return 0;
1050         }
1051
1052         if (new_state == TCP_CONNTRACK_SYN_SENT) {
1053                 /* SYN packet */
1054                 conntrack->proto.tcp.seen[0].td_end =
1055                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1056                                              iph, th);
1057                 conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1058                 if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
1059                         conntrack->proto.tcp.seen[0].td_maxwin = 1;
1060                 conntrack->proto.tcp.seen[0].td_maxend =
1061                         conntrack->proto.tcp.seen[0].td_end;
1062
1063                 tcp_options(skb, iph, th, &conntrack->proto.tcp.seen[0]);
1064                 conntrack->proto.tcp.seen[1].flags = 0;
1065                 conntrack->proto.tcp.seen[0].loose = 
1066                 conntrack->proto.tcp.seen[1].loose = 0;
1067         } else if (ip_ct_tcp_loose == 0) {
1068                 /* Don't try to pick up connections. */
1069                 return 0;
1070         } else {
1071                 /*
1072                  * We are in the middle of a connection,
1073                  * its history is lost for us.
1074                  * Let's try to use the data from the packet.
1075                  */
1076                 conntrack->proto.tcp.seen[0].td_end =
1077                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1078                                              iph, th);
1079                 conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1080                 if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
1081                         conntrack->proto.tcp.seen[0].td_maxwin = 1;
1082                 conntrack->proto.tcp.seen[0].td_maxend =
1083                         conntrack->proto.tcp.seen[0].td_end + 
1084                         conntrack->proto.tcp.seen[0].td_maxwin;
1085                 conntrack->proto.tcp.seen[0].td_scale = 0;
1086
1087                 /* We assume SACK. Should we assume window scaling too? */
1088                 conntrack->proto.tcp.seen[0].flags =
1089                 conntrack->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM;
1090                 conntrack->proto.tcp.seen[0].loose = 
1091                 conntrack->proto.tcp.seen[1].loose = ip_ct_tcp_loose;
1092         }
1093     
1094         conntrack->proto.tcp.seen[1].td_end = 0;
1095         conntrack->proto.tcp.seen[1].td_maxend = 0;
1096         conntrack->proto.tcp.seen[1].td_maxwin = 1;
1097         conntrack->proto.tcp.seen[1].td_scale = 0;      
1098
1099         /* tcp_packet will set them */
1100         conntrack->proto.tcp.state = TCP_CONNTRACK_NONE;
1101         conntrack->proto.tcp.last_index = TCP_NONE_SET;
1102          
1103         DEBUGP("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1104                "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1105                 sender->td_end, sender->td_maxend, sender->td_maxwin,
1106                 sender->td_scale, 
1107                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1108                 receiver->td_scale);
1109         return 1;
1110 }
1111   
1112 struct ip_conntrack_protocol ip_conntrack_protocol_tcp =
1113 {
1114         .proto                  = IPPROTO_TCP,
1115         .name                   = "tcp",
1116         .pkt_to_tuple           = tcp_pkt_to_tuple,
1117         .invert_tuple           = tcp_invert_tuple,
1118         .print_tuple            = tcp_print_tuple,
1119         .print_conntrack        = tcp_print_conntrack,
1120         .packet                 = tcp_packet,
1121         .new                    = tcp_new,
1122         .error                  = tcp_error,
1123 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
1124     defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
1125         .to_nfattr              = tcp_to_nfattr,
1126         .tuple_to_nfattr        = ip_ct_port_tuple_to_nfattr,
1127         .nfattr_to_tuple        = ip_ct_port_nfattr_to_tuple,
1128 #endif
1129 };