net/ipv4/netfilter/ip_conntrack_proto_tcp.c

   1 /* (C) 1999-2001 Paul `Rusty' Russell
   2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>:
   9  *      - Real stateful connection tracking
  10  *      - Modified state transitions table
  11  *      - Window scaling support added
  12  *      - SACK support added
  13  *
  14  * Willy Tarreau:
  15  *      - State table bugfixes
  16  *      - More robust state changes
  17  *      - Tuning timer parameters
  18  *
  19  * version 2.2
  20  */
  21
  22 #include <linux/config.h>
  23 #include <linux/types.h>
  24 #include <linux/sched.h>
  25 #include <linux/timer.h>
  26 #include <linux/netfilter.h>
  27 #include <linux/module.h>
  28 #include <linux/in.h>
  29 #include <linux/ip.h>
  30 #include <linux/tcp.h>
  31 #include <linux/spinlock.h>
  32
  33 #include <net/tcp.h>
  34
  35 #include <linux/netfilter.h>
  36 #include <linux/netfilter_ipv4.h>
  37 #include <linux/netfilter_ipv4/ip_conntrack.h>
  38 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
  39
  40 #if 0
  41 #define DEBUGP printk
  42 #define DEBUGP_VARS
  43 #else
  44 #define DEBUGP(format, args...)
  45 #endif
  46
  47 /* Protects conntrack->proto.tcp */
  48 static DEFINE_RWLOCK(tcp_lock);
  49
  50 /* "Be conservative in what you do,
  51     be liberal in what you accept from others."
  52     If it's non-zero, we mark only out of window RST segments as INVALID. */
  53 int ip_ct_tcp_be_liberal = 0;
  54
  55 /* When connection is picked up from the middle, how many packets are required
  56    to pass in each direction when we assume we are in sync - if any side uses
  57    window scaling, we lost the game.
  58    If it is set to zero, we disable picking up already established
  59    connections. */
  60 int ip_ct_tcp_loose = 3;
  61
  62 /* Max number of the retransmitted packets without receiving an (acceptable)
  63    ACK from the destination. If this number is reached, a shorter timer
  64    will be started. */
  65 int ip_ct_tcp_max_retrans = 3;
  66
  67   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
  68      closely.  They're more complex. --RR */
  69
  70 static const char *tcp_conntrack_names[] = {
  71         "NONE",
  72         "SYN_SENT",
  73         "SYN_RECV",
  74         "ESTABLISHED",
  75         "FIN_WAIT",
  76         "CLOSE_WAIT",
  77         "LAST_ACK",
  78         "TIME_WAIT",
  79         "CLOSE",
  80         "LISTEN"
  81 };
  82
  83 #define SECS * HZ
  84 #define MINS * 60 SECS
  85 #define HOURS * 60 MINS
  86 #define DAYS * 24 HOURS
  87
  88 unsigned long ip_ct_tcp_timeout_syn_sent =      2 MINS;
  89 unsigned long ip_ct_tcp_timeout_syn_recv =     60 SECS;
  90 unsigned long ip_ct_tcp_timeout_established =   5 DAYS;
  91 unsigned long ip_ct_tcp_timeout_fin_wait =      2 MINS;
  92 unsigned long ip_ct_tcp_timeout_close_wait =   60 SECS;
  93 unsigned long ip_ct_tcp_timeout_last_ack =     30 SECS;
  94 unsigned long ip_ct_tcp_timeout_time_wait =     2 MINS;
  95 unsigned long ip_ct_tcp_timeout_close =        10 SECS;
  96
  97 /* RFC1122 says the R2 limit should be at least 100 seconds.
  98    Linux uses 15 packets as limit, which corresponds
  99    to ~13-30min depending on RTO. */
 100 unsigned long ip_ct_tcp_timeout_max_retrans =     5 MINS;
 101
 102 static unsigned long * tcp_timeouts[]
 103 = { NULL,                              /*      TCP_CONNTRACK_NONE */
 104     &ip_ct_tcp_timeout_syn_sent,       /*      TCP_CONNTRACK_SYN_SENT, */
 105     &ip_ct_tcp_timeout_syn_recv,       /*      TCP_CONNTRACK_SYN_RECV, */
 106     &ip_ct_tcp_timeout_established,    /*      TCP_CONNTRACK_ESTABLISHED,      */
 107     &ip_ct_tcp_timeout_fin_wait,       /*      TCP_CONNTRACK_FIN_WAIT, */
 108     &ip_ct_tcp_timeout_close_wait,     /*      TCP_CONNTRACK_CLOSE_WAIT,       */
 109     &ip_ct_tcp_timeout_last_ack,       /*      TCP_CONNTRACK_LAST_ACK, */
 110     &ip_ct_tcp_timeout_time_wait,      /*      TCP_CONNTRACK_TIME_WAIT,        */
 111     &ip_ct_tcp_timeout_close,          /*      TCP_CONNTRACK_CLOSE,    */
 112     NULL,                              /*      TCP_CONNTRACK_LISTEN */
 113  };
 114
 115 #define sNO TCP_CONNTRACK_NONE
 116 #define sSS TCP_CONNTRACK_SYN_SENT
 117 #define sSR TCP_CONNTRACK_SYN_RECV
 118 #define sES TCP_CONNTRACK_ESTABLISHED
 119 #define sFW TCP_CONNTRACK_FIN_WAIT
 120 #define sCW TCP_CONNTRACK_CLOSE_WAIT
 121 #define sLA TCP_CONNTRACK_LAST_ACK
 122 #define sTW TCP_CONNTRACK_TIME_WAIT
 123 #define sCL TCP_CONNTRACK_CLOSE
 124 #define sLI TCP_CONNTRACK_LISTEN
 125 #define sIV TCP_CONNTRACK_MAX
 126 #define sIG TCP_CONNTRACK_IGNORE
 127
 128 /* What TCP flags are set from RST/SYN/FIN/ACK. */
 129 enum tcp_bit_set {
 130         TCP_SYN_SET,
 131         TCP_SYNACK_SET,
 132         TCP_FIN_SET,
 133         TCP_ACK_SET,
 134         TCP_RST_SET,
 135         TCP_NONE_SET,
 136 };
 137
 138 /*
 139  * The TCP state transition table needs a few words...
 140  *
 141  * We are the man in the middle. All the packets go through us
 142  * but might get lost in transit to the destination.
 143  * It is assumed that the destinations can't receive segments
 144  * we haven't seen.
 145  *
 146  * The checked segment is in window, but our windows are *not*
 147  * equivalent with the ones of the sender/receiver. We always
 148  * try to guess the state of the current sender.
 149  *
 150  * The meaning of the states are:
 151  *
 152  * NONE:        initial state
 153  * SYN_SENT:    SYN-only packet seen
 154  * SYN_RECV:    SYN-ACK packet seen
 155  * ESTABLISHED: ACK packet seen
 156  * FIN_WAIT:    FIN packet seen
 157  * CLOSE_WAIT:  ACK seen (after FIN)
 158  * LAST_ACK:    FIN seen (after FIN)
 159  * TIME_WAIT:   last ACK seen
 160  * CLOSE:       closed connection
 161  *
 162  * LISTEN state is not used.
 163  *
 164  * Packets marked as IGNORED (sIG):
 165  *      if they may be either invalid or valid
 166  *      and the receiver may send back a connection
 167  *      closing RST or a SYN/ACK.
 168  *
 169  * Packets marked as INVALID (sIV):
 170  *      if they are invalid
 171  *      or we do not support the request (simultaneous open)
 172  */
 173 static enum tcp_conntrack tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
 174         {
 175 /* ORIGINAL */
 176 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 177 /*syn*/    { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sIV },
 178 /*
 179  *      sNO -> sSS      Initialize a new connection
 180  *      sSS -> sSS      Retransmitted SYN
 181  *      sSR -> sIG      Late retransmitted SYN?
 182  *      sES -> sIG      Error: SYNs in window outside the SYN_SENT state
 183  *                      are errors. Receiver will reply with RST
 184  *                      and close the connection.
 185  *                      Or we are not in sync and hold a dead connection.
 186  *      sFW -> sIG
 187  *      sCW -> sIG
 188  *      sLA -> sIG
 189  *      sTW -> sSS      Reopened connection (RFC 1122).
 190  *      sCL -> sSS
 191  */
 192 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 193 /*synack*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
 194 /*
 195  * A SYN/ACK from the client is always invalid:
 196  *      - either it tries to set up a simultaneous open, which is
 197  *        not supported;
 198  *      - or the firewall has just been inserted between the two hosts
 199  *        during the session set-up. The SYN will be retransmitted
 200  *        by the true client (or it'll time out).
 201  */
 202 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 203 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 204 /*
 205  *      sNO -> sIV      Too late and no reason to do anything...
 206  *      sSS -> sIV      Client migth not send FIN in this state:
 207  *                      we enforce waiting for a SYN/ACK reply first.
 208  *      sSR -> sFW      Close started.
 209  *      sES -> sFW
 210  *      sFW -> sLA      FIN seen in both directions, waiting for
 211  *                      the last ACK.
 212  *                      Migth be a retransmitted FIN as well...
 213  *      sCW -> sLA
 214  *      sLA -> sLA      Retransmitted FIN. Remain in the same state.
 215  *      sTW -> sTW
 216  *      sCL -> sCL
 217  */
 218 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 219 /*ack*/    { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 220 /*
 221  *      sNO -> sES      Assumed.
 222  *      sSS -> sIV      ACK is invalid: we haven't seen a SYN/ACK yet.
 223  *      sSR -> sES      Established state is reached.
 224  *      sES -> sES      :-)
 225  *      sFW -> sCW      Normal close request answered by ACK.
 226  *      sCW -> sCW
 227  *      sLA -> sTW      Last ACK detected.
 228  *      sTW -> sTW      Retransmitted last ACK. Remain in the same state.
 229  *      sCL -> sCL
 230  */
 231 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 232 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
 233 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 234         },
 235         {
 236 /* REPLY */
 237 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 238 /*syn*/    { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
 239 /*
 240  *      sNO -> sIV      Never reached.
 241  *      sSS -> sIV      Simultaneous open, not supported
 242  *      sSR -> sIV      Simultaneous open, not supported.
 243  *      sES -> sIV      Server may not initiate a connection.
 244  *      sFW -> sIV
 245  *      sCW -> sIV
 246  *      sLA -> sIV
 247  *      sTW -> sIV      Reopened connection, but server may not do it.
 248  *      sCL -> sIV
 249  */
 250 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 251 /*synack*/ { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIV },
 252 /*
 253  *      sSS -> sSR      Standard open.
 254  *      sSR -> sSR      Retransmitted SYN/ACK.
 255  *      sES -> sIG      Late retransmitted SYN/ACK?
 256  *      sFW -> sIG      Might be SYN/ACK answering ignored SYN
 257  *      sCW -> sIG
 258  *      sLA -> sIG
 259  *      sTW -> sIG
 260  *      sCL -> sIG
 261  */
 262 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 263 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 264 /*
 265  *      sSS -> sIV      Server might not send FIN in this state.
 266  *      sSR -> sFW      Close started.
 267  *      sES -> sFW
 268  *      sFW -> sLA      FIN seen in both directions.
 269  *      sCW -> sLA
 270  *      sLA -> sLA      Retransmitted FIN.
 271  *      sTW -> sTW
 272  *      sCL -> sCL
 273  */
 274 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 275 /*ack*/    { sIV, sIV, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 276 /*
 277  *      sSS -> sIV      Might be a half-open connection.
 278  *      sSR -> sSR      Might answer late resent SYN.
 279  *      sES -> sES      :-)
 280  *      sFW -> sCW      Normal close request answered by ACK.
 281  *      sCW -> sCW
 282  *      sLA -> sTW      Last ACK detected.
 283  *      sTW -> sTW      Retransmitted last ACK.
 284  *      sCL -> sCL
 285  */
 286 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
 287 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
 288 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 289         }
 290 };
 291
 292 static int tcp_pkt_to_tuple(const struct sk_buff *skb,
 293                             unsigned int dataoff,
 294                             struct ip_conntrack_tuple *tuple)
 295 {
 296         struct tcphdr _hdr, *hp;
 297
 298         /* Actually only need first 8 bytes. */
 299         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
 300         if (hp == NULL)
 301                 return 0;
 302
 303         tuple->src.u.tcp.port = hp->source;
 304         tuple->dst.u.tcp.port = hp->dest;
 305
 306         return 1;
 307 }
 308
 309 static int tcp_invert_tuple(struct ip_conntrack_tuple *tuple,
 310                             const struct ip_conntrack_tuple *orig)
 311 {
 312         tuple->src.u.tcp.port = orig->dst.u.tcp.port;
 313         tuple->dst.u.tcp.port = orig->src.u.tcp.port;
 314         return 1;
 315 }
 316
 317 /* Print out the per-protocol part of the tuple. */
 318 static int tcp_print_tuple(struct seq_file *s,
 319                            const struct ip_conntrack_tuple *tuple)
 320 {
 321         return seq_printf(s, "sport=%hu dport=%hu ",
 322                           ntohs(tuple->src.u.tcp.port),
 323                           ntohs(tuple->dst.u.tcp.port));
 324 }
 325
 326 /* Print out the private part of the conntrack. */
 327 static int tcp_print_conntrack(struct seq_file *s,
 328                                const struct ip_conntrack *conntrack)
 329 {
 330         enum tcp_conntrack state;
 331
 332         read_lock_bh(&tcp_lock);
 333         state = conntrack->proto.tcp.state;
 334         read_unlock_bh(&tcp_lock);
 335
 336         return seq_printf(s, "%s ", tcp_conntrack_names[state]);
 337 }
 338
 339 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
 340     defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
 341 static int tcp_to_nfattr(struct sk_buff *skb, struct nfattr *nfa,
 342                          const struct ip_conntrack *ct)
 343 {
 344         read_lock_bh(&tcp_lock);
 345         NFA_PUT(skb, CTA_PROTOINFO_TCP_STATE, sizeof(u_int8_t),
 346                 &ct->proto.tcp.state);
 347         read_unlock_bh(&tcp_lock);
 348
 349         return 0;
 350
 351 nfattr_failure:
 352         read_unlock_bh(&tcp_lock);
 353         return -1;
 354 }
 355 #endif
 356
 357 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
 358 {
 359         if (tcph->rst) return TCP_RST_SET;
 360         else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
 361         else if (tcph->fin) return TCP_FIN_SET;
 362         else if (tcph->ack) return TCP_ACK_SET;
 363         else return TCP_NONE_SET;
 364 }
 365
 366 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
 367    in IP Filter' by Guido van Rooij.
 368
 369    http://www.nluug.nl/events/sane2000/papers.html
 370    http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
 371
 372    The boundaries and the conditions are changed according to RFC793:
 373    the packet must intersect the window (i.e. segments may be
 374    after the right or before the left edge) and thus receivers may ACK
 375    segments after the right edge of the window.
 376
 377         td_maxend = max(sack + max(win,1)) seen in reply packets
 378         td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
 379         td_maxwin += seq + len - sender.td_maxend
 380                         if seq + len > sender.td_maxend
 381         td_end    = max(seq + len) seen in sent packets
 382
 383    I.   Upper bound for valid data:     seq <= sender.td_maxend
 384    II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
 385    III. Upper bound for valid ack:      sack <= receiver.td_end
 386    IV.  Lower bound for valid ack:      ack >= receiver.td_end - MAXACKWINDOW
 387
 388    where sack is the highest right edge of sack block found in the packet.
 389
 390    The upper bound limit for a valid ack is not ignored -
 391    we doesn't have to deal with fragments.
 392 */
 393
 394 static inline __u32 segment_seq_plus_len(__u32 seq,
 395                                          size_t len,
 396                                          struct iphdr *iph,
 397                                          struct tcphdr *tcph)
 398 {
 399         return (seq + len - (iph->ihl + tcph->doff)*4
 400                 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
 401 }
 402
 403 /* Fixme: what about big packets? */
 404 #define MAXACKWINCONST                  66000
 405 #define MAXACKWINDOW(sender)                                            \
 406         ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin     \
 407                                               : MAXACKWINCONST)
 408
 409 /*
 410  * Simplified tcp_parse_options routine from tcp_input.c
 411  */
 412 static void tcp_options(const struct sk_buff *skb,
 413                         struct iphdr *iph,
 414                         struct tcphdr *tcph,
 415                         struct ip_ct_tcp_state *state)
 416 {
 417         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 418         unsigned char *ptr;
 419         int length = (tcph->doff*4) - sizeof(struct tcphdr);
 420
 421         if (!length)
 422                 return;
 423
 424         ptr = skb_header_pointer(skb,
 425                                  (iph->ihl * 4) + sizeof(struct tcphdr),
 426                                  length, buff);
 427         BUG_ON(ptr == NULL);
 428
 429         state->td_scale =
 430         state->flags = 0;
 431
 432         while (length > 0) {
 433                 int opcode=*ptr++;
 434                 int opsize;
 435
 436                 switch (opcode) {
 437                 case TCPOPT_EOL:
 438                         return;
 439                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
 440                         length--;
 441                         continue;
 442                 default:
 443                         opsize=*ptr++;
 444                         if (opsize < 2) /* "silly options" */
 445                                 return;
 446                         if (opsize > length)
 447                                 break;  /* don't parse partial options */
 448
 449                         if (opcode == TCPOPT_SACK_PERM
 450                             && opsize == TCPOLEN_SACK_PERM)
 451                                 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
 452                         else if (opcode == TCPOPT_WINDOW
 453                                  && opsize == TCPOLEN_WINDOW) {
 454                                 state->td_scale = *(u_int8_t *)ptr;
 455
 456                                 if (state->td_scale > 14) {
 457                                         /* See RFC1323 */
 458                                         state->td_scale = 14;
 459                                 }
 460                                 state->flags |=
 461                                         IP_CT_TCP_FLAG_WINDOW_SCALE;
 462                         }
 463                         ptr += opsize - 2;
 464                         length -= opsize;
 465                 }
 466         }
 467 }
 468
 469 static void tcp_sack(const struct sk_buff *skb,
 470                      struct iphdr *iph,
 471                      struct tcphdr *tcph,
 472                      __u32 *sack)
 473 {
 474         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 475         unsigned char *ptr;
 476         int length = (tcph->doff*4) - sizeof(struct tcphdr);
 477         __u32 tmp;
 478
 479         if (!length)
 480                 return;
 481
 482         ptr = skb_header_pointer(skb,
 483                                  (iph->ihl * 4) + sizeof(struct tcphdr),
 484                                  length, buff);
 485         BUG_ON(ptr == NULL);
 486
 487         /* Fast path for timestamp-only option */
 488         if (length == TCPOLEN_TSTAMP_ALIGNED*4
 489             && *(__u32 *)ptr ==
 490                 __constant_ntohl((TCPOPT_NOP << 24)
 491                                  | (TCPOPT_NOP << 16)
 492                                  | (TCPOPT_TIMESTAMP << 8)
 493                                  | TCPOLEN_TIMESTAMP))
 494                 return;
 495
 496         while (length > 0) {
 497                 int opcode=*ptr++;
 498                 int opsize, i;
 499
 500                 switch (opcode) {
 501                 case TCPOPT_EOL:
 502                         return;
 503                 case TCPOPT_NOP:        /* Ref: RFC 793 section 3.1 */
 504                         length--;
 505                         continue;
 506                 default:
 507                         opsize=*ptr++;
 508                         if (opsize < 2) /* "silly options" */
 509                                 return;
 510                         if (opsize > length)
 511                                 break;  /* don't parse partial options */
 512
 513                         if (opcode == TCPOPT_SACK
 514                             && opsize >= (TCPOLEN_SACK_BASE
 515                                           + TCPOLEN_SACK_PERBLOCK)
 516                             && !((opsize - TCPOLEN_SACK_BASE)
 517                                  % TCPOLEN_SACK_PERBLOCK)) {
 518                                 for (i = 0;
 519                                      i < (opsize - TCPOLEN_SACK_BASE);
 520                                      i += TCPOLEN_SACK_PERBLOCK) {
 521                                         tmp = ntohl(*((u_int32_t *)(ptr+i)+1));
 522
 523                                         if (after(tmp, *sack))
 524                                                 *sack = tmp;
 525                                 }
 526                                 return;
 527                         }
 528                         ptr += opsize - 2;
 529                         length -= opsize;
 530                 }
 531         }
 532 }
 533
 534 static int tcp_in_window(struct ip_ct_tcp *state,
 535                          enum ip_conntrack_dir dir,
 536                          unsigned int index,
 537                          const struct sk_buff *skb,
 538                          struct iphdr *iph,
 539                          struct tcphdr *tcph)
 540 {
 541         struct ip_ct_tcp_state *sender = &state->seen[dir];
 542         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
 543         __u32 seq, ack, sack, end, win, swin;
 544         int res;
 545
 546         /*
 547          * Get the required data from the packet.
 548          */
 549         seq = ntohl(tcph->seq);
 550         ack = sack = ntohl(tcph->ack_seq);
 551         win = ntohs(tcph->window);
 552         end = segment_seq_plus_len(seq, skb->len, iph, tcph);
 553
 554         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
 555                 tcp_sack(skb, iph, tcph, &sack);
 556
 557         DEBUGP("tcp_in_window: START\n");
 558         DEBUGP("tcp_in_window: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
 559                "seq=%u ack=%u sack=%u win=%u end=%u\n",
 560                 NIPQUAD(iph->saddr), ntohs(tcph->source),
 561                 NIPQUAD(iph->daddr), ntohs(tcph->dest),
 562                 seq, ack, sack, win, end);
 563         DEBUGP("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 564                "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 565                 sender->td_end, sender->td_maxend, sender->td_maxwin,
 566                 sender->td_scale,
 567                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 568                 receiver->td_scale);
 569
 570         if (sender->td_end == 0) {
 571                 /*
 572                  * Initialize sender data.
 573                  */
 574                 if (tcph->syn && tcph->ack) {
 575                         /*
 576                          * Outgoing SYN-ACK in reply to a SYN.
 577                          */
 578                         sender->td_end =
 579                         sender->td_maxend = end;
 580                         sender->td_maxwin = (win == 0 ? 1 : win);
 581
 582                         tcp_options(skb, iph, tcph, sender);
 583                         /*
 584                          * RFC 1323:
 585                          * Both sides must send the Window Scale option
 586                          * to enable window scaling in either direction.
 587                          */
 588                         if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
 589                               && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
 590                                 sender->td_scale =
 591                                 receiver->td_scale = 0;
 592                 } else {
 593                         /*
 594                          * We are in the middle of a connection,
 595                          * its history is lost for us.
 596                          * Let's try to use the data from the packet.
 597                          */
 598                         sender->td_end = end;
 599                         sender->td_maxwin = (win == 0 ? 1 : win);
 600                         sender->td_maxend = end + sender->td_maxwin;
 601                 }
 602         } else if (((state->state == TCP_CONNTRACK_SYN_SENT
 603                      && dir == IP_CT_DIR_ORIGINAL)
 604                     || (state->state == TCP_CONNTRACK_SYN_RECV
 605                         && dir == IP_CT_DIR_REPLY))
 606                     && after(end, sender->td_end)) {
 607                 /*
 608                  * RFC 793: "if a TCP is reinitialized ... then it need
 609                  * not wait at all; it must only be sure to use sequence
 610                  * numbers larger than those recently used."
 611                  */
 612                 sender->td_end =
 613                 sender->td_maxend = end;
 614                 sender->td_maxwin = (win == 0 ? 1 : win);
 615
 616                 tcp_options(skb, iph, tcph, sender);
 617         }
 618
 619         if (!(tcph->ack)) {
 620                 /*
 621                  * If there is no ACK, just pretend it was set and OK.
 622                  */
 623                 ack = sack = receiver->td_end;
 624         } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
 625                     (TCP_FLAG_ACK|TCP_FLAG_RST))
 626                    && (ack == 0)) {
 627                 /*
 628                  * Broken TCP stacks, that set ACK in RST packets as well
 629                  * with zero ack value.
 630                  */
 631                 ack = sack = receiver->td_end;
 632         }
 633
 634         if (seq == end
 635             && (!tcph->rst
 636                 || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
 637                 /*
 638                  * Packets contains no data: we assume it is valid
 639                  * and check the ack value only.
 640                  * However RST segments are always validated by their
 641                  * SEQ number, except when seq == 0 (reset sent answering
 642                  * SYN.
 643                  */
 644                 seq = end = sender->td_end;
 645
 646         DEBUGP("tcp_in_window: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
 647                "seq=%u ack=%u sack =%u win=%u end=%u\n",
 648                 NIPQUAD(iph->saddr), ntohs(tcph->source),
 649                 NIPQUAD(iph->daddr), ntohs(tcph->dest),
 650                 seq, ack, sack, win, end);
 651         DEBUGP("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 652                "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 653                 sender->td_end, sender->td_maxend, sender->td_maxwin,
 654                 sender->td_scale,
 655                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 656                 receiver->td_scale);
 657
 658         DEBUGP("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
 659                 before(seq, sender->td_maxend + 1),
 660                 after(end, sender->td_end - receiver->td_maxwin - 1),
 661                 before(sack, receiver->td_end + 1),
 662                 after(ack, receiver->td_end - MAXACKWINDOW(sender)));
 663
 664         if (sender->loose || receiver->loose ||
 665             (before(seq, sender->td_maxend + 1) &&
 666              after(end, sender->td_end - receiver->td_maxwin - 1) &&
 667              before(sack, receiver->td_end + 1) &&
 668              after(ack, receiver->td_end - MAXACKWINDOW(sender)))) {
 669                 /*
 670                  * Take into account window scaling (RFC 1323).
 671                  */
 672                 if (!tcph->syn)
 673                         win <<= sender->td_scale;
 674
 675                 /*
 676                  * Update sender data.
 677                  */
 678                 swin = win + (sack - ack);
 679                 if (sender->td_maxwin < swin)
 680                         sender->td_maxwin = swin;
 681                 if (after(end, sender->td_end))
 682                         sender->td_end = end;
 683                 /*
 684                  * Update receiver data.
 685                  */
 686                 if (after(end, sender->td_maxend))
 687                         receiver->td_maxwin += end - sender->td_maxend;
 688                 if (after(sack + win, receiver->td_maxend - 1)) {
 689                         receiver->td_maxend = sack + win;
 690                         if (win == 0)
 691                                 receiver->td_maxend++;
 692                 }
 693
 694                 /*
 695                  * Check retransmissions.
 696                  */
 697                 if (index == TCP_ACK_SET) {
 698                         if (state->last_dir == dir
 699                             && state->last_seq == seq
 700                             && state->last_ack == ack
 701                             && state->last_end == end)
 702                                 state->retrans++;
 703                         else {
 704                                 state->last_dir = dir;
 705                                 state->last_seq = seq;
 706                                 state->last_ack = ack;
 707                                 state->last_end = end;
 708                                 state->retrans = 0;
 709                         }
 710                 }
 711                 /*
 712                  * Close the window of disabled window tracking :-)
 713                  */
 714                 if (sender->loose)
 715                         sender->loose--;
 716
 717                 res = 1;
 718         } else {
 719                 if (LOG_INVALID(IPPROTO_TCP))
 720                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
 721                         "ip_ct_tcp: %s ",
 722                         before(seq, sender->td_maxend + 1) ?
 723                         after(end, sender->td_end - receiver->td_maxwin - 1) ?
 724                         before(sack, receiver->td_end + 1) ?
 725                         after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
 726                         : "ACK is under the lower bound (possible overly delayed ACK)"
 727                         : "ACK is over the upper bound (ACKed data not seen yet)"
 728                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
 729                         : "SEQ is over the upper bound (over the window of the receiver)");
 730
 731                 res = ip_ct_tcp_be_liberal;
 732         }
 733
 734         DEBUGP("tcp_in_window: res=%i sender end=%u maxend=%u maxwin=%u "
 735                "receiver end=%u maxend=%u maxwin=%u\n",
 736                 res, sender->td_end, sender->td_maxend, sender->td_maxwin,
 737                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
 738
 739         return res;
 740 }
 741
 742 #ifdef CONFIG_IP_NF_NAT_NEEDED
 743 /* Update sender->td_end after NAT successfully mangled the packet */
 744 void ip_conntrack_tcp_update(struct sk_buff *skb,
 745                              struct ip_conntrack *conntrack,
 746                              enum ip_conntrack_dir dir)
 747 {
 748         struct iphdr *iph = skb->nh.iph;
 749         struct tcphdr *tcph = (void *)skb->nh.iph + skb->nh.iph->ihl*4;
 750         __u32 end;
 751 #ifdef DEBUGP_VARS
 752         struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[dir];
 753         struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[!dir];
 754 #endif
 755
 756         end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, iph, tcph);
 757
 758         write_lock_bh(&tcp_lock);
 759         /*
 760          * We have to worry for the ack in the reply packet only...
 761          */
 762         if (after(end, conntrack->proto.tcp.seen[dir].td_end))
 763                 conntrack->proto.tcp.seen[dir].td_end = end;
 764         conntrack->proto.tcp.last_end = end;
 765         write_unlock_bh(&tcp_lock);
 766         DEBUGP("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
 767                "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 768                 sender->td_end, sender->td_maxend, sender->td_maxwin,
 769                 sender->td_scale,
 770                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 771                 receiver->td_scale);
 772 }
 773
 774 #endif
 775
 776 #define TH_FIN  0x01
 777 #define TH_SYN  0x02
 778 #define TH_RST  0x04
 779 #define TH_PUSH 0x08
 780 #define TH_ACK  0x10
 781 #define TH_URG  0x20
 782 #define TH_ECE  0x40
 783 #define TH_CWR  0x80
 784
 785 /* table of valid flag combinations - ECE and CWR are always valid */
 786 static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
 787 {
 788         [TH_SYN]                        = 1,
 789         [TH_SYN|TH_ACK]                 = 1,
 790         [TH_SYN|TH_ACK|TH_PUSH]         = 1,
 791         [TH_RST]                        = 1,
 792         [TH_RST|TH_ACK]                 = 1,
 793         [TH_RST|TH_ACK|TH_PUSH]         = 1,
 794         [TH_FIN|TH_ACK]                 = 1,
 795         [TH_ACK]                        = 1,
 796         [TH_ACK|TH_PUSH]                = 1,
 797         [TH_ACK|TH_URG]                 = 1,
 798         [TH_ACK|TH_URG|TH_PUSH]         = 1,
 799         [TH_FIN|TH_ACK|TH_PUSH]         = 1,
 800         [TH_FIN|TH_ACK|TH_URG]          = 1,
 801         [TH_FIN|TH_ACK|TH_URG|TH_PUSH]  = 1,
 802 };
 803
 804 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
 805 static int tcp_error(struct sk_buff *skb,
 806                      enum ip_conntrack_info *ctinfo,
 807                      unsigned int hooknum)
 808 {
 809         struct iphdr *iph = skb->nh.iph;
 810         struct tcphdr _tcph, *th;
 811         unsigned int tcplen = skb->len - iph->ihl * 4;
 812         u_int8_t tcpflags;
 813
 814         /* Smaller that minimal TCP header? */
 815         th = skb_header_pointer(skb, iph->ihl * 4,
 816                                 sizeof(_tcph), &_tcph);
 817         if (th == NULL) {
 818                 if (LOG_INVALID(IPPROTO_TCP))
 819                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
 820                                 "ip_ct_tcp: short packet ");
 821                 return -NF_ACCEPT;
 822         }
 823
 824         /* Not whole TCP header or malformed packet */
 825         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
 826                 if (LOG_INVALID(IPPROTO_TCP))
 827                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
 828                                 "ip_ct_tcp: truncated/malformed packet ");
 829                 return -NF_ACCEPT;
 830         }
 831
 832         /* Checksum invalid? Ignore.
 833          * We skip checking packets on the outgoing path
 834          * because the semantic of CHECKSUM_HW is different there
 835          * and moreover root might send raw packets.
 836          */
 837         /* FIXME: Source route IP option packets --RR */
 838         if (hooknum == NF_IP_PRE_ROUTING
 839             && skb->ip_summed != CHECKSUM_UNNECESSARY
 840             && csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
 841                                  skb->ip_summed == CHECKSUM_HW ? skb->csum
 842                                  : skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
 843                 if (LOG_INVALID(IPPROTO_TCP))
 844                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
 845                                   "ip_ct_tcp: bad TCP checksum ");
 846                 return -NF_ACCEPT;
 847         }
 848
 849         /* Check TCP flags. */
 850         tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR));
 851         if (!tcp_valid_flags[tcpflags]) {
 852                 if (LOG_INVALID(IPPROTO_TCP))
 853                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
 854                                   "ip_ct_tcp: invalid TCP flag combination ");
 855                 return -NF_ACCEPT;
 856         }
 857
 858         return NF_ACCEPT;
 859 }
 860
 861 /* Returns verdict for packet, or -1 for invalid. */
 862 static int tcp_packet(struct ip_conntrack *conntrack,
 863                       const struct sk_buff *skb,
 864                       enum ip_conntrack_info ctinfo)
 865 {
 866         enum tcp_conntrack new_state, old_state;
 867         enum ip_conntrack_dir dir;
 868         struct iphdr *iph = skb->nh.iph;
 869         struct tcphdr *th, _tcph;
 870         unsigned long timeout;
 871         unsigned int index;
 872
 873         th = skb_header_pointer(skb, iph->ihl * 4,
 874                                 sizeof(_tcph), &_tcph);
 875         BUG_ON(th == NULL);
 876
 877         write_lock_bh(&tcp_lock);
 878         old_state = conntrack->proto.tcp.state;
 879         dir = CTINFO2DIR(ctinfo);
 880         index = get_conntrack_index(th);
 881         new_state = tcp_conntracks[dir][index][old_state];
 882
 883         switch (new_state) {
 884         case TCP_CONNTRACK_IGNORE:
 885                 /* Either SYN in ORIGINAL
 886                  * or SYN/ACK in REPLY. */
 887                 if (index == TCP_SYNACK_SET
 888                     && conntrack->proto.tcp.last_index == TCP_SYN_SET
 889                     && conntrack->proto.tcp.last_dir != dir
 890                     && ntohl(th->ack_seq) ==
 891                              conntrack->proto.tcp.last_end) {
 892                         /* This SYN/ACK acknowledges a SYN that we earlier
 893                          * ignored as invalid. This means that the client and
 894                          * the server are both in sync, while the firewall is
 895                          * not. We kill this session and block the SYN/ACK so
 896                          * that the client cannot but retransmit its SYN and
 897                          * thus initiate a clean new session.
 898                          */
 899                         write_unlock_bh(&tcp_lock);
 900                         if (LOG_INVALID(IPPROTO_TCP))
 901                                 nf_log_packet(PF_INET, 0, skb, NULL, NULL,
 902                                               NULL, "ip_ct_tcp: "
 903                                               "killing out of sync session ");
 904                         if (del_timer(&conntrack->timeout))
 905                                 conntrack->timeout.function((unsigned long)
 906                                                             conntrack);
 907                         return -NF_DROP;
 908                 }
 909                 conntrack->proto.tcp.last_index = index;
 910                 conntrack->proto.tcp.last_dir = dir;
 911                 conntrack->proto.tcp.last_seq = ntohl(th->seq);
 912                 conntrack->proto.tcp.last_end =
 913                     segment_seq_plus_len(ntohl(th->seq), skb->len, iph, th);
 914
 915                 write_unlock_bh(&tcp_lock);
 916                 if (LOG_INVALID(IPPROTO_TCP))
 917                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
 918                                   "ip_ct_tcp: invalid packet ignored ");
 919                 return NF_ACCEPT;
 920         case TCP_CONNTRACK_MAX:
 921                 /* Invalid packet */
 922                 DEBUGP("ip_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
 923                        dir, get_conntrack_index(th),
 924                        old_state);
 925                 write_unlock_bh(&tcp_lock);
 926                 if (LOG_INVALID(IPPROTO_TCP))
 927                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
 928                                   "ip_ct_tcp: invalid state ");
 929                 return -NF_ACCEPT;
 930         case TCP_CONNTRACK_SYN_SENT:
 931                 if (old_state < TCP_CONNTRACK_TIME_WAIT)
 932                         break;
 933                 if ((conntrack->proto.tcp.seen[dir].flags &
 934                          IP_CT_TCP_FLAG_CLOSE_INIT)
 935                     || after(ntohl(th->seq),
 936                              conntrack->proto.tcp.seen[dir].td_end)) {
 937                         /* Attempt to reopen a closed connection.
 938                         * Delete this connection and look up again. */
 939                         write_unlock_bh(&tcp_lock);
 940                         if (del_timer(&conntrack->timeout))
 941                                 conntrack->timeout.function((unsigned long)
 942                                                             conntrack);
 943                         return -NF_REPEAT;
 944                 } else {
 945                         write_unlock_bh(&tcp_lock);
 946                         if (LOG_INVALID(IPPROTO_TCP))
 947                                 nf_log_packet(PF_INET, 0, skb, NULL, NULL,
 948                                               NULL, "ip_ct_tcp: invalid SYN");
 949                         return -NF_ACCEPT;
 950                 }
 951         case TCP_CONNTRACK_CLOSE:
 952                 if (index == TCP_RST_SET
 953                     && test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
 954                     && conntrack->proto.tcp.last_index == TCP_SYN_SET
 955                     && ntohl(th->ack_seq) == conntrack->proto.tcp.last_end) {
 956                         /* RST sent to invalid SYN we had let trough
 957                          * SYN was in window then, tear down connection.
 958                          * We skip window checking, because packet might ACK
 959                          * segments we ignored in the SYN. */
 960                         goto in_window;
 961                 }
 962                 /* Just fall trough */
 963         default:
 964                 /* Keep compilers happy. */
 965                 break;
 966         }
 967
 968         if (!tcp_in_window(&conntrack->proto.tcp, dir, index,
 969                            skb, iph, th)) {
 970                 write_unlock_bh(&tcp_lock);
 971                 return -NF_ACCEPT;
 972         }
 973     in_window:
 974         /* From now on we have got in-window packets */
 975         conntrack->proto.tcp.last_index = index;
 976
 977         DEBUGP("tcp_conntracks: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
 978                "syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
 979                 NIPQUAD(iph->saddr), ntohs(th->source),
 980                 NIPQUAD(iph->daddr), ntohs(th->dest),
 981                 (th->syn ? 1 : 0), (th->ack ? 1 : 0),
 982                 (th->fin ? 1 : 0), (th->rst ? 1 : 0),
 983                 old_state, new_state);
 984
 985         conntrack->proto.tcp.state = new_state;
 986         if (old_state != new_state
 987             && (new_state == TCP_CONNTRACK_FIN_WAIT
 988                 || new_state == TCP_CONNTRACK_CLOSE))
 989                 conntrack->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
 990         timeout = conntrack->proto.tcp.retrans >= ip_ct_tcp_max_retrans
 991                   && *tcp_timeouts[new_state] > ip_ct_tcp_timeout_max_retrans
 992                   ? ip_ct_tcp_timeout_max_retrans : *tcp_timeouts[new_state];
 993         write_unlock_bh(&tcp_lock);
 994
 995         ip_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
 996         if (new_state != old_state)
 997                 ip_conntrack_event_cache(IPCT_PROTOINFO, skb);
 998
 999         if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
1000                 /* If only reply is a RST, we can consider ourselves not to
1001                    have an established connection: this is a fairly common
1002                    problem case, so we can delete the conntrack
1003                    immediately.  --RR */
1004                 if (th->rst) {
1005                         if (del_timer(&conntrack->timeout))
1006                                 conntrack->timeout.function((unsigned long)
1007                                                             conntrack);
1008                         return NF_ACCEPT;
1009                 }
1010         } else if (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
1011                    && (old_state == TCP_CONNTRACK_SYN_RECV
1012                        || old_state == TCP_CONNTRACK_ESTABLISHED)
1013                    && new_state == TCP_CONNTRACK_ESTABLISHED) {
1014                 /* Set ASSURED if we see see valid ack in ESTABLISHED
1015                    after SYN_RECV or a valid answer for a picked up
1016                    connection. */
1017                         set_bit(IPS_ASSURED_BIT, &conntrack->status);
1018         }
1019         ip_ct_refresh_acct(conntrack, ctinfo, skb, timeout);
1020
1021         return NF_ACCEPT;
1022 }
1023
1024 /* Called when a new connection for this protocol found. */
1025 static int tcp_new(struct ip_conntrack *conntrack,
1026                    const struct sk_buff *skb)
1027 {
1028         enum tcp_conntrack new_state;
1029         struct iphdr *iph = skb->nh.iph;
1030         struct tcphdr *th, _tcph;
1031 #ifdef DEBUGP_VARS
1032         struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[0];
1033         struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[1];
1034 #endif
1035
1036         th = skb_header_pointer(skb, iph->ihl * 4,
1037                                 sizeof(_tcph), &_tcph);
1038         BUG_ON(th == NULL);
1039
1040         /* Don't need lock here: this conntrack not in circulation yet */
1041         new_state
1042                 = tcp_conntracks[0][get_conntrack_index(th)]
1043                 [TCP_CONNTRACK_NONE];
1044
1045         /* Invalid: delete conntrack */
1046         if (new_state >= TCP_CONNTRACK_MAX) {
1047                 DEBUGP("ip_ct_tcp: invalid new deleting.\n");
1048                 return 0;
1049         }
1050
1051         if (new_state == TCP_CONNTRACK_SYN_SENT) {
1052                 /* SYN packet */
1053                 conntrack->proto.tcp.seen[0].td_end =
1054                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1055                                              iph, th);
1056                 conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1057                 if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
1058                         conntrack->proto.tcp.seen[0].td_maxwin = 1;
1059                 conntrack->proto.tcp.seen[0].td_maxend =
1060                         conntrack->proto.tcp.seen[0].td_end;
1061
1062                 tcp_options(skb, iph, th, &conntrack->proto.tcp.seen[0]);
1063                 conntrack->proto.tcp.seen[1].flags = 0;
1064                 conntrack->proto.tcp.seen[0].loose =
1065                 conntrack->proto.tcp.seen[1].loose = 0;
1066         } else if (ip_ct_tcp_loose == 0) {
1067                 /* Don't try to pick up connections. */
1068                 return 0;
1069         } else {
1070                 /*
1071                  * We are in the middle of a connection,
1072                  * its history is lost for us.
1073                  * Let's try to use the data from the packet.
1074                  */
1075                 conntrack->proto.tcp.seen[0].td_end =
1076                         segment_seq_plus_len(ntohl(th->seq), skb->len,
1077                                              iph, th);
1078                 conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1079                 if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
1080                         conntrack->proto.tcp.seen[0].td_maxwin = 1;
1081                 conntrack->proto.tcp.seen[0].td_maxend =
1082                         conntrack->proto.tcp.seen[0].td_end +
1083                         conntrack->proto.tcp.seen[0].td_maxwin;
1084                 conntrack->proto.tcp.seen[0].td_scale = 0;
1085
1086                 /* We assume SACK. Should we assume window scaling too? */
1087                 conntrack->proto.tcp.seen[0].flags =
1088                 conntrack->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM;
1089                 conntrack->proto.tcp.seen[0].loose =
1090                 conntrack->proto.tcp.seen[1].loose = ip_ct_tcp_loose;
1091         }
1092
1093         conntrack->proto.tcp.seen[1].td_end = 0;
1094         conntrack->proto.tcp.seen[1].td_maxend = 0;
1095         conntrack->proto.tcp.seen[1].td_maxwin = 1;
1096         conntrack->proto.tcp.seen[1].td_scale = 0;
1097
1098         /* tcp_packet will set them */
1099         conntrack->proto.tcp.state = TCP_CONNTRACK_NONE;
1100         conntrack->proto.tcp.last_index = TCP_NONE_SET;
1101
1102         DEBUGP("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1103                "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1104                 sender->td_end, sender->td_maxend, sender->td_maxwin,
1105                 sender->td_scale,
1106                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1107                 receiver->td_scale);
1108         return 1;
1109 }
1110
1111 struct ip_conntrack_protocol ip_conntrack_protocol_tcp =
1112 {
1113         .proto                  = IPPROTO_TCP,
1114         .name                   = "tcp",
1115         .pkt_to_tuple           = tcp_pkt_to_tuple,
1116         .invert_tuple           = tcp_invert_tuple,
1117         .print_tuple            = tcp_print_tuple,
1118         .print_conntrack        = tcp_print_conntrack,
1119         .packet                 = tcp_packet,
1120         .new                    = tcp_new,
1121         .error                  = tcp_error,
1122 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
1123     defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
1124         .to_nfattr              = tcp_to_nfattr,
1125         .tuple_to_nfattr        = ip_ct_port_tuple_to_nfattr,
1126         .nfattr_to_tuple        = ip_ct_port_nfattr_to_tuple,
1127 #endif
1128 };