blob: 9e496319f6061ae234b36be58782f3d955f5f3d5 [file] [log] [blame]
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001/* (C) 1999-2001 Paul `Rusty' Russell
2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>:
9 * - Real stateful connection tracking
10 * - Modified state transitions table
11 * - Window scaling support added
12 * - SACK support added
13 *
14 * Willy Tarreau:
15 * - State table bugfixes
16 * - More robust state changes
17 * - Tuning timer parameters
18 *
19 * 27 Oct 2004: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
20 * - genelized Layer 3 protocol part.
21 *
22 * Derived from net/ipv4/netfilter/ip_conntrack_proto_tcp.c
23 *
24 * version 2.2
25 */
26
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080027#include <linux/types.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080028#include <linux/timer.h>
29#include <linux/netfilter.h>
30#include <linux/module.h>
31#include <linux/in.h>
32#include <linux/tcp.h>
33#include <linux/spinlock.h>
34#include <linux/skbuff.h>
35#include <linux/ipv6.h>
36#include <net/ip6_checksum.h>
37
38#include <net/tcp.h>
39
40#include <linux/netfilter.h>
41#include <linux/netfilter_ipv4.h>
42#include <linux/netfilter_ipv6.h>
43#include <net/netfilter/nf_conntrack.h>
Martin Josefsson605dcad2006-11-29 02:35:06 +010044#include <net/netfilter/nf_conntrack_l4proto.h>
Martin Josefssonf6180122006-11-29 02:35:01 +010045#include <net/netfilter/nf_conntrack_ecache.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080046
47#if 0
48#define DEBUGP printk
49#define DEBUGP_VARS
50#else
51#define DEBUGP(format, args...)
52#endif
53
54/* Protects conntrack->proto.tcp */
55static DEFINE_RWLOCK(tcp_lock);
56
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -080057/* "Be conservative in what you do,
58 be liberal in what you accept from others."
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080059 If it's non-zero, we mark only out of window RST segments as INVALID. */
Patrick McHardy3aef0fd2007-02-12 11:16:58 -080060static int nf_ct_tcp_be_liberal __read_mostly = 0;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080061
Patrick McHardya09113c2007-02-07 15:05:33 -080062/* If it is set to zero, we disable picking up already established
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080063 connections. */
Patrick McHardy3aef0fd2007-02-12 11:16:58 -080064static int nf_ct_tcp_loose __read_mostly = 1;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080065
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -080066/* Max number of the retransmitted packets without receiving an (acceptable)
67 ACK from the destination. If this number is reached, a shorter timer
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080068 will be started. */
Patrick McHardy3aef0fd2007-02-12 11:16:58 -080069static int nf_ct_tcp_max_retrans __read_mostly = 3;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080070
71 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
72 closely. They're more complex. --RR */
73
74static const char *tcp_conntrack_names[] = {
75 "NONE",
76 "SYN_SENT",
77 "SYN_RECV",
78 "ESTABLISHED",
79 "FIN_WAIT",
80 "CLOSE_WAIT",
81 "LAST_ACK",
82 "TIME_WAIT",
83 "CLOSE",
84 "LISTEN"
85};
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -080086
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080087#define SECS * HZ
88#define MINS * 60 SECS
89#define HOURS * 60 MINS
90#define DAYS * 24 HOURS
91
Patrick McHardy933a41e2006-11-29 02:35:18 +010092static unsigned int nf_ct_tcp_timeout_syn_sent __read_mostly = 2 MINS;
93static unsigned int nf_ct_tcp_timeout_syn_recv __read_mostly = 60 SECS;
94static unsigned int nf_ct_tcp_timeout_established __read_mostly = 5 DAYS;
95static unsigned int nf_ct_tcp_timeout_fin_wait __read_mostly = 2 MINS;
96static unsigned int nf_ct_tcp_timeout_close_wait __read_mostly = 60 SECS;
97static unsigned int nf_ct_tcp_timeout_last_ack __read_mostly = 30 SECS;
98static unsigned int nf_ct_tcp_timeout_time_wait __read_mostly = 2 MINS;
99static unsigned int nf_ct_tcp_timeout_close __read_mostly = 10 SECS;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800100
101/* RFC1122 says the R2 limit should be at least 100 seconds.
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800102 Linux uses 15 packets as limit, which corresponds
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800103 to ~13-30min depending on RTO. */
Patrick McHardy933a41e2006-11-29 02:35:18 +0100104static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly = 5 MINS;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800105
Patrick McHardy933a41e2006-11-29 02:35:18 +0100106static unsigned int * tcp_timeouts[] = {
107 NULL, /* TCP_CONNTRACK_NONE */
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800108 &nf_ct_tcp_timeout_syn_sent, /* TCP_CONNTRACK_SYN_SENT, */
109 &nf_ct_tcp_timeout_syn_recv, /* TCP_CONNTRACK_SYN_RECV, */
110 &nf_ct_tcp_timeout_established, /* TCP_CONNTRACK_ESTABLISHED, */
111 &nf_ct_tcp_timeout_fin_wait, /* TCP_CONNTRACK_FIN_WAIT, */
112 &nf_ct_tcp_timeout_close_wait, /* TCP_CONNTRACK_CLOSE_WAIT, */
113 &nf_ct_tcp_timeout_last_ack, /* TCP_CONNTRACK_LAST_ACK, */
114 &nf_ct_tcp_timeout_time_wait, /* TCP_CONNTRACK_TIME_WAIT, */
115 &nf_ct_tcp_timeout_close, /* TCP_CONNTRACK_CLOSE, */
116 NULL, /* TCP_CONNTRACK_LISTEN */
117 };
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800118
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800119#define sNO TCP_CONNTRACK_NONE
120#define sSS TCP_CONNTRACK_SYN_SENT
121#define sSR TCP_CONNTRACK_SYN_RECV
122#define sES TCP_CONNTRACK_ESTABLISHED
123#define sFW TCP_CONNTRACK_FIN_WAIT
124#define sCW TCP_CONNTRACK_CLOSE_WAIT
125#define sLA TCP_CONNTRACK_LAST_ACK
126#define sTW TCP_CONNTRACK_TIME_WAIT
127#define sCL TCP_CONNTRACK_CLOSE
128#define sLI TCP_CONNTRACK_LISTEN
129#define sIV TCP_CONNTRACK_MAX
130#define sIG TCP_CONNTRACK_IGNORE
131
132/* What TCP flags are set from RST/SYN/FIN/ACK. */
133enum tcp_bit_set {
134 TCP_SYN_SET,
135 TCP_SYNACK_SET,
136 TCP_FIN_SET,
137 TCP_ACK_SET,
138 TCP_RST_SET,
139 TCP_NONE_SET,
140};
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800141
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800142/*
143 * The TCP state transition table needs a few words...
144 *
145 * We are the man in the middle. All the packets go through us
146 * but might get lost in transit to the destination.
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800147 * It is assumed that the destinations can't receive segments
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800148 * we haven't seen.
149 *
150 * The checked segment is in window, but our windows are *not*
151 * equivalent with the ones of the sender/receiver. We always
152 * try to guess the state of the current sender.
153 *
154 * The meaning of the states are:
155 *
156 * NONE: initial state
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800157 * SYN_SENT: SYN-only packet seen
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800158 * SYN_RECV: SYN-ACK packet seen
159 * ESTABLISHED: ACK packet seen
160 * FIN_WAIT: FIN packet seen
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800161 * CLOSE_WAIT: ACK seen (after FIN)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800162 * LAST_ACK: FIN seen (after FIN)
163 * TIME_WAIT: last ACK seen
164 * CLOSE: closed connection
165 *
166 * LISTEN state is not used.
167 *
168 * Packets marked as IGNORED (sIG):
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800169 * if they may be either invalid or valid
170 * and the receiver may send back a connection
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800171 * closing RST or a SYN/ACK.
172 *
173 * Packets marked as INVALID (sIV):
174 * if they are invalid
175 * or we do not support the request (simultaneous open)
176 */
177static enum tcp_conntrack tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
178 {
179/* ORIGINAL */
180/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
181/*syn*/ { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sIV },
182/*
183 * sNO -> sSS Initialize a new connection
184 * sSS -> sSS Retransmitted SYN
185 * sSR -> sIG Late retransmitted SYN?
186 * sES -> sIG Error: SYNs in window outside the SYN_SENT state
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800187 * are errors. Receiver will reply with RST
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800188 * and close the connection.
189 * Or we are not in sync and hold a dead connection.
190 * sFW -> sIG
191 * sCW -> sIG
192 * sLA -> sIG
193 * sTW -> sSS Reopened connection (RFC 1122).
194 * sCL -> sSS
195 */
196/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
197/*synack*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
198/*
199 * A SYN/ACK from the client is always invalid:
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800200 * - either it tries to set up a simultaneous open, which is
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800201 * not supported;
202 * - or the firewall has just been inserted between the two hosts
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800203 * during the session set-up. The SYN will be retransmitted
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800204 * by the true client (or it'll time out).
205 */
206/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
207/*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
208/*
209 * sNO -> sIV Too late and no reason to do anything...
210 * sSS -> sIV Client migth not send FIN in this state:
211 * we enforce waiting for a SYN/ACK reply first.
212 * sSR -> sFW Close started.
213 * sES -> sFW
214 * sFW -> sLA FIN seen in both directions, waiting for
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800215 * the last ACK.
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800216 * Migth be a retransmitted FIN as well...
217 * sCW -> sLA
218 * sLA -> sLA Retransmitted FIN. Remain in the same state.
219 * sTW -> sTW
220 * sCL -> sCL
221 */
222/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
223/*ack*/ { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
224/*
225 * sNO -> sES Assumed.
226 * sSS -> sIV ACK is invalid: we haven't seen a SYN/ACK yet.
227 * sSR -> sES Established state is reached.
228 * sES -> sES :-)
229 * sFW -> sCW Normal close request answered by ACK.
230 * sCW -> sCW
231 * sLA -> sTW Last ACK detected.
232 * sTW -> sTW Retransmitted last ACK. Remain in the same state.
233 * sCL -> sCL
234 */
235/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
236/*rst*/ { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
237/*none*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
238 },
239 {
240/* REPLY */
241/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
242/*syn*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
243/*
244 * sNO -> sIV Never reached.
245 * sSS -> sIV Simultaneous open, not supported
246 * sSR -> sIV Simultaneous open, not supported.
247 * sES -> sIV Server may not initiate a connection.
248 * sFW -> sIV
249 * sCW -> sIV
250 * sLA -> sIV
251 * sTW -> sIV Reopened connection, but server may not do it.
252 * sCL -> sIV
253 */
254/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
255/*synack*/ { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIV },
256/*
257 * sSS -> sSR Standard open.
258 * sSR -> sSR Retransmitted SYN/ACK.
259 * sES -> sIG Late retransmitted SYN/ACK?
260 * sFW -> sIG Might be SYN/ACK answering ignored SYN
261 * sCW -> sIG
262 * sLA -> sIG
263 * sTW -> sIG
264 * sCL -> sIG
265 */
266/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
267/*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
268/*
269 * sSS -> sIV Server might not send FIN in this state.
270 * sSR -> sFW Close started.
271 * sES -> sFW
272 * sFW -> sLA FIN seen in both directions.
273 * sCW -> sLA
274 * sLA -> sLA Retransmitted FIN.
275 * sTW -> sTW
276 * sCL -> sCL
277 */
278/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
Jozsef Kadlecsik73f30602005-12-01 14:28:58 -0800279/*ack*/ { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800280/*
Jozsef Kadlecsik73f30602005-12-01 14:28:58 -0800281 * sSS -> sIG Might be a half-open connection.
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800282 * sSR -> sSR Might answer late resent SYN.
283 * sES -> sES :-)
284 * sFW -> sCW Normal close request answered by ACK.
285 * sCW -> sCW
286 * sLA -> sTW Last ACK detected.
287 * sTW -> sTW Retransmitted last ACK.
288 * sCL -> sCL
289 */
290/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
291/*rst*/ { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
292/*none*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800293 }
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800294};
295
296static int tcp_pkt_to_tuple(const struct sk_buff *skb,
297 unsigned int dataoff,
298 struct nf_conntrack_tuple *tuple)
299{
300 struct tcphdr _hdr, *hp;
301
302 /* Actually only need first 8 bytes. */
303 hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
304 if (hp == NULL)
305 return 0;
306
307 tuple->src.u.tcp.port = hp->source;
308 tuple->dst.u.tcp.port = hp->dest;
309
310 return 1;
311}
312
313static int tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
314 const struct nf_conntrack_tuple *orig)
315{
316 tuple->src.u.tcp.port = orig->dst.u.tcp.port;
317 tuple->dst.u.tcp.port = orig->src.u.tcp.port;
318 return 1;
319}
320
321/* Print out the per-protocol part of the tuple. */
322static int tcp_print_tuple(struct seq_file *s,
323 const struct nf_conntrack_tuple *tuple)
324{
325 return seq_printf(s, "sport=%hu dport=%hu ",
326 ntohs(tuple->src.u.tcp.port),
327 ntohs(tuple->dst.u.tcp.port));
328}
329
330/* Print out the private part of the conntrack. */
331static int tcp_print_conntrack(struct seq_file *s,
332 const struct nf_conn *conntrack)
333{
334 enum tcp_conntrack state;
335
336 read_lock_bh(&tcp_lock);
337 state = conntrack->proto.tcp.state;
338 read_unlock_bh(&tcp_lock);
339
340 return seq_printf(s, "%s ", tcp_conntrack_names[state]);
341}
342
343static unsigned int get_conntrack_index(const struct tcphdr *tcph)
344{
345 if (tcph->rst) return TCP_RST_SET;
346 else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
347 else if (tcph->fin) return TCP_FIN_SET;
348 else if (tcph->ack) return TCP_ACK_SET;
349 else return TCP_NONE_SET;
350}
351
352/* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
353 in IP Filter' by Guido van Rooij.
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800354
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800355 http://www.nluug.nl/events/sane2000/papers.html
356 http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800357
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800358 The boundaries and the conditions are changed according to RFC793:
359 the packet must intersect the window (i.e. segments may be
360 after the right or before the left edge) and thus receivers may ACK
361 segments after the right edge of the window.
362
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800363 td_maxend = max(sack + max(win,1)) seen in reply packets
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800364 td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
365 td_maxwin += seq + len - sender.td_maxend
366 if seq + len > sender.td_maxend
367 td_end = max(seq + len) seen in sent packets
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800368
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800369 I. Upper bound for valid data: seq <= sender.td_maxend
370 II. Lower bound for valid data: seq + len >= sender.td_end - receiver.td_maxwin
371 III. Upper bound for valid ack: sack <= receiver.td_end
372 IV. Lower bound for valid ack: ack >= receiver.td_end - MAXACKWINDOW
373
374 where sack is the highest right edge of sack block found in the packet.
375
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800376 The upper bound limit for a valid ack is not ignored -
377 we doesn't have to deal with fragments.
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800378*/
379
380static inline __u32 segment_seq_plus_len(__u32 seq,
381 size_t len,
382 unsigned int dataoff,
383 struct tcphdr *tcph)
384{
385 /* XXX Should I use payload length field in IP/IPv6 header ?
386 * - YK */
387 return (seq + len - dataoff - tcph->doff*4
388 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
389}
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800390
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800391/* Fixme: what about big packets? */
392#define MAXACKWINCONST 66000
393#define MAXACKWINDOW(sender) \
394 ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin \
395 : MAXACKWINCONST)
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800396
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800397/*
398 * Simplified tcp_parse_options routine from tcp_input.c
399 */
400static void tcp_options(const struct sk_buff *skb,
401 unsigned int dataoff,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800402 struct tcphdr *tcph,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800403 struct ip_ct_tcp_state *state)
404{
405 unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
406 unsigned char *ptr;
407 int length = (tcph->doff*4) - sizeof(struct tcphdr);
408
409 if (!length)
410 return;
411
412 ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
413 length, buff);
414 BUG_ON(ptr == NULL);
415
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800416 state->td_scale =
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800417 state->flags = 0;
418
419 while (length > 0) {
420 int opcode=*ptr++;
421 int opsize;
422
423 switch (opcode) {
424 case TCPOPT_EOL:
425 return;
426 case TCPOPT_NOP: /* Ref: RFC 793 section 3.1 */
427 length--;
428 continue;
429 default:
430 opsize=*ptr++;
431 if (opsize < 2) /* "silly options" */
432 return;
433 if (opsize > length)
434 break; /* don't parse partial options */
435
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800436 if (opcode == TCPOPT_SACK_PERM
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800437 && opsize == TCPOLEN_SACK_PERM)
438 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
439 else if (opcode == TCPOPT_WINDOW
440 && opsize == TCPOLEN_WINDOW) {
441 state->td_scale = *(u_int8_t *)ptr;
442
443 if (state->td_scale > 14) {
444 /* See RFC1323 */
445 state->td_scale = 14;
446 }
447 state->flags |=
448 IP_CT_TCP_FLAG_WINDOW_SCALE;
449 }
450 ptr += opsize - 2;
451 length -= opsize;
452 }
453 }
454}
455
456static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
457 struct tcphdr *tcph, __u32 *sack)
458{
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800459 unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800460 unsigned char *ptr;
461 int length = (tcph->doff*4) - sizeof(struct tcphdr);
462 __u32 tmp;
463
464 if (!length)
465 return;
466
467 ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
468 length, buff);
469 BUG_ON(ptr == NULL);
470
471 /* Fast path for timestamp-only option */
472 if (length == TCPOLEN_TSTAMP_ALIGNED*4
YOSHIFUJI Hideaki8f05ce92007-03-07 14:21:00 +0900473 && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
474 | (TCPOPT_NOP << 16)
475 | (TCPOPT_TIMESTAMP << 8)
476 | TCPOLEN_TIMESTAMP))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800477 return;
478
479 while (length > 0) {
480 int opcode = *ptr++;
481 int opsize, i;
482
483 switch (opcode) {
484 case TCPOPT_EOL:
485 return;
486 case TCPOPT_NOP: /* Ref: RFC 793 section 3.1 */
487 length--;
488 continue;
489 default:
490 opsize = *ptr++;
491 if (opsize < 2) /* "silly options" */
492 return;
493 if (opsize > length)
494 break; /* don't parse partial options */
495
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800496 if (opcode == TCPOPT_SACK
497 && opsize >= (TCPOLEN_SACK_BASE
498 + TCPOLEN_SACK_PERBLOCK)
499 && !((opsize - TCPOLEN_SACK_BASE)
500 % TCPOLEN_SACK_PERBLOCK)) {
501 for (i = 0;
502 i < (opsize - TCPOLEN_SACK_BASE);
503 i += TCPOLEN_SACK_PERBLOCK) {
504 tmp = ntohl(*((__be32 *)(ptr+i)+1));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800505
506 if (after(tmp, *sack))
507 *sack = tmp;
508 }
509 return;
510 }
511 ptr += opsize - 2;
512 length -= opsize;
513 }
514 }
515}
516
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800517static int tcp_in_window(struct ip_ct_tcp *state,
518 enum ip_conntrack_dir dir,
519 unsigned int index,
520 const struct sk_buff *skb,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800521 unsigned int dataoff,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800522 struct tcphdr *tcph,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800523 int pf)
524{
525 struct ip_ct_tcp_state *sender = &state->seen[dir];
526 struct ip_ct_tcp_state *receiver = &state->seen[!dir];
527 __u32 seq, ack, sack, end, win, swin;
528 int res;
529
530 /*
531 * Get the required data from the packet.
532 */
533 seq = ntohl(tcph->seq);
534 ack = sack = ntohl(tcph->ack_seq);
535 win = ntohs(tcph->window);
536 end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
537
538 if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
539 tcp_sack(skb, dataoff, tcph, &sack);
540
541 DEBUGP("tcp_in_window: START\n");
542 DEBUGP("tcp_in_window: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
543 "seq=%u ack=%u sack=%u win=%u end=%u\n",
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800544 NIPQUAD(iph->saddr), ntohs(tcph->source),
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800545 NIPQUAD(iph->daddr), ntohs(tcph->dest),
546 seq, ack, sack, win, end);
547 DEBUGP("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
548 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
549 sender->td_end, sender->td_maxend, sender->td_maxwin,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800550 sender->td_scale,
551 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800552 receiver->td_scale);
553
554 if (sender->td_end == 0) {
555 /*
556 * Initialize sender data.
557 */
558 if (tcph->syn && tcph->ack) {
559 /*
560 * Outgoing SYN-ACK in reply to a SYN.
561 */
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800562 sender->td_end =
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800563 sender->td_maxend = end;
564 sender->td_maxwin = (win == 0 ? 1 : win);
565
566 tcp_options(skb, dataoff, tcph, sender);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800567 /*
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800568 * RFC 1323:
569 * Both sides must send the Window Scale option
570 * to enable window scaling in either direction.
571 */
572 if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
573 && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800574 sender->td_scale =
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800575 receiver->td_scale = 0;
576 } else {
577 /*
578 * We are in the middle of a connection,
579 * its history is lost for us.
580 * Let's try to use the data from the packet.
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800581 */
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800582 sender->td_end = end;
583 sender->td_maxwin = (win == 0 ? 1 : win);
584 sender->td_maxend = end + sender->td_maxwin;
585 }
586 } else if (((state->state == TCP_CONNTRACK_SYN_SENT
587 && dir == IP_CT_DIR_ORIGINAL)
588 || (state->state == TCP_CONNTRACK_SYN_RECV
589 && dir == IP_CT_DIR_REPLY))
590 && after(end, sender->td_end)) {
591 /*
592 * RFC 793: "if a TCP is reinitialized ... then it need
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800593 * not wait at all; it must only be sure to use sequence
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800594 * numbers larger than those recently used."
595 */
596 sender->td_end =
597 sender->td_maxend = end;
598 sender->td_maxwin = (win == 0 ? 1 : win);
599
600 tcp_options(skb, dataoff, tcph, sender);
601 }
602
603 if (!(tcph->ack)) {
604 /*
605 * If there is no ACK, just pretend it was set and OK.
606 */
607 ack = sack = receiver->td_end;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800608 } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
609 (TCP_FLAG_ACK|TCP_FLAG_RST))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800610 && (ack == 0)) {
611 /*
612 * Broken TCP stacks, that set ACK in RST packets as well
613 * with zero ack value.
614 */
615 ack = sack = receiver->td_end;
616 }
617
618 if (seq == end
619 && (!tcph->rst
620 || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
621 /*
622 * Packets contains no data: we assume it is valid
623 * and check the ack value only.
624 * However RST segments are always validated by their
625 * SEQ number, except when seq == 0 (reset sent answering
626 * SYN.
627 */
628 seq = end = sender->td_end;
629
630 DEBUGP("tcp_in_window: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
631 "seq=%u ack=%u sack =%u win=%u end=%u\n",
632 NIPQUAD(iph->saddr), ntohs(tcph->source),
633 NIPQUAD(iph->daddr), ntohs(tcph->dest),
634 seq, ack, sack, win, end);
635 DEBUGP("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
636 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
637 sender->td_end, sender->td_maxend, sender->td_maxwin,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800638 sender->td_scale,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800639 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
640 receiver->td_scale);
641
642 DEBUGP("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
643 before(seq, sender->td_maxend + 1),
644 after(end, sender->td_end - receiver->td_maxwin - 1),
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800645 before(sack, receiver->td_end + 1),
646 after(ack, receiver->td_end - MAXACKWINDOW(sender)));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800647
Patrick McHardya09113c2007-02-07 15:05:33 -0800648 if (before(seq, sender->td_maxend + 1) &&
649 after(end, sender->td_end - receiver->td_maxwin - 1) &&
650 before(sack, receiver->td_end + 1) &&
651 after(ack, receiver->td_end - MAXACKWINDOW(sender))) {
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800652 /*
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800653 * Take into account window scaling (RFC 1323).
654 */
655 if (!tcph->syn)
656 win <<= sender->td_scale;
657
658 /*
659 * Update sender data.
660 */
661 swin = win + (sack - ack);
662 if (sender->td_maxwin < swin)
663 sender->td_maxwin = swin;
664 if (after(end, sender->td_end))
665 sender->td_end = end;
666 /*
667 * Update receiver data.
668 */
669 if (after(end, sender->td_maxend))
670 receiver->td_maxwin += end - sender->td_maxend;
671 if (after(sack + win, receiver->td_maxend - 1)) {
672 receiver->td_maxend = sack + win;
673 if (win == 0)
674 receiver->td_maxend++;
675 }
676
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800677 /*
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800678 * Check retransmissions.
679 */
680 if (index == TCP_ACK_SET) {
681 if (state->last_dir == dir
682 && state->last_seq == seq
683 && state->last_ack == ack
George Hansperc1fe3ca2006-09-20 12:03:23 -0700684 && state->last_end == end
685 && state->last_win == win)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800686 state->retrans++;
687 else {
688 state->last_dir = dir;
689 state->last_seq = seq;
690 state->last_ack = ack;
691 state->last_end = end;
George Hansperc1fe3ca2006-09-20 12:03:23 -0700692 state->last_win = win;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800693 state->retrans = 0;
694 }
695 }
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800696 res = 1;
697 } else {
Patrick McHardya09113c2007-02-07 15:05:33 -0800698 res = 0;
699 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
700 nf_ct_tcp_be_liberal)
701 res = 1;
702 if (!res && LOG_INVALID(IPPROTO_TCP))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800703 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
704 "nf_ct_tcp: %s ",
705 before(seq, sender->td_maxend + 1) ?
706 after(end, sender->td_end - receiver->td_maxwin - 1) ?
707 before(sack, receiver->td_end + 1) ?
708 after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
709 : "ACK is under the lower bound (possible overly delayed ACK)"
710 : "ACK is over the upper bound (ACKed data not seen yet)"
711 : "SEQ is under the lower bound (already ACKed data retransmitted)"
712 : "SEQ is over the upper bound (over the window of the receiver)");
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800713 }
714
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800715 DEBUGP("tcp_in_window: res=%i sender end=%u maxend=%u maxwin=%u "
716 "receiver end=%u maxend=%u maxwin=%u\n",
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800717 res, sender->td_end, sender->td_maxend, sender->td_maxwin,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800718 receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
719
720 return res;
721}
722
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800723#ifdef CONFIG_NF_NAT_NEEDED
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800724/* Update sender->td_end after NAT successfully mangled the packet */
725/* Caller must linearize skb at tcp header. */
726void nf_conntrack_tcp_update(struct sk_buff *skb,
727 unsigned int dataoff,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800728 struct nf_conn *conntrack,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800729 int dir)
730{
731 struct tcphdr *tcph = (void *)skb->data + dataoff;
732 __u32 end;
733#ifdef DEBUGP_VARS
734 struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[dir];
735 struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[!dir];
736#endif
737
738 end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
739
740 write_lock_bh(&tcp_lock);
741 /*
742 * We have to worry for the ack in the reply packet only...
743 */
744 if (after(end, conntrack->proto.tcp.seen[dir].td_end))
745 conntrack->proto.tcp.seen[dir].td_end = end;
746 conntrack->proto.tcp.last_end = end;
747 write_unlock_bh(&tcp_lock);
748 DEBUGP("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
749 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
750 sender->td_end, sender->td_maxend, sender->td_maxwin,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800751 sender->td_scale,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800752 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
753 receiver->td_scale);
754}
Patrick McHardy13b18332006-12-02 22:11:25 -0800755EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800756#endif
757
758#define TH_FIN 0x01
759#define TH_SYN 0x02
760#define TH_RST 0x04
761#define TH_PUSH 0x08
762#define TH_ACK 0x10
763#define TH_URG 0x20
764#define TH_ECE 0x40
765#define TH_CWR 0x80
766
767/* table of valid flag combinations - ECE and CWR are always valid */
768static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
769{
770 [TH_SYN] = 1,
Vlad Drukkera2d72222005-11-12 12:13:14 -0800771 [TH_SYN|TH_PUSH] = 1,
Patrick McHardyd3ab4292007-03-04 15:57:46 -0800772 [TH_SYN|TH_URG] = 1,
773 [TH_SYN|TH_PUSH|TH_URG] = 1,
774 [TH_SYN|TH_ACK] = 1,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800775 [TH_SYN|TH_ACK|TH_PUSH] = 1,
776 [TH_RST] = 1,
777 [TH_RST|TH_ACK] = 1,
778 [TH_RST|TH_ACK|TH_PUSH] = 1,
779 [TH_FIN|TH_ACK] = 1,
780 [TH_ACK] = 1,
781 [TH_ACK|TH_PUSH] = 1,
782 [TH_ACK|TH_URG] = 1,
783 [TH_ACK|TH_URG|TH_PUSH] = 1,
784 [TH_FIN|TH_ACK|TH_PUSH] = 1,
785 [TH_FIN|TH_ACK|TH_URG] = 1,
786 [TH_FIN|TH_ACK|TH_URG|TH_PUSH] = 1,
787};
788
789/* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c. */
790static int tcp_error(struct sk_buff *skb,
791 unsigned int dataoff,
792 enum ip_conntrack_info *ctinfo,
793 int pf,
Patrick McHardy96f6bf82006-04-06 14:19:24 -0700794 unsigned int hooknum)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800795{
796 struct tcphdr _tcph, *th;
797 unsigned int tcplen = skb->len - dataoff;
798 u_int8_t tcpflags;
799
800 /* Smaller that minimal TCP header? */
801 th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
802 if (th == NULL) {
803 if (LOG_INVALID(IPPROTO_TCP))
804 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
805 "nf_ct_tcp: short packet ");
806 return -NF_ACCEPT;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800807 }
808
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800809 /* Not whole TCP header or malformed packet */
810 if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
811 if (LOG_INVALID(IPPROTO_TCP))
812 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
813 "nf_ct_tcp: truncated/malformed packet ");
814 return -NF_ACCEPT;
815 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800816
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800817 /* Checksum invalid? Ignore.
818 * We skip checking packets on the outgoing path
Patrick McHardy84fa7932006-08-29 16:44:56 -0700819 * because the checksum is assumed to be correct.
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800820 */
821 /* FIXME: Source route IP option packets --RR */
Patrick McHardy39a27a32006-05-29 18:23:54 -0700822 if (nf_conntrack_checksum &&
823 ((pf == PF_INET && hooknum == NF_IP_PRE_ROUTING) ||
824 (pf == PF_INET6 && hooknum == NF_IP6_PRE_ROUTING)) &&
Patrick McHardy96f6bf82006-04-06 14:19:24 -0700825 nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800826 if (LOG_INVALID(IPPROTO_TCP))
827 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
828 "nf_ct_tcp: bad TCP checksum ");
829 return -NF_ACCEPT;
830 }
831
832 /* Check TCP flags. */
833 tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR));
834 if (!tcp_valid_flags[tcpflags]) {
835 if (LOG_INVALID(IPPROTO_TCP))
836 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
837 "nf_ct_tcp: invalid TCP flag combination ");
838 return -NF_ACCEPT;
839 }
840
841 return NF_ACCEPT;
842}
843
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800844/* Returns verdict for packet, or -1 for invalid. */
845static int tcp_packet(struct nf_conn *conntrack,
846 const struct sk_buff *skb,
847 unsigned int dataoff,
848 enum ip_conntrack_info ctinfo,
849 int pf,
850 unsigned int hooknum)
851{
852 enum tcp_conntrack new_state, old_state;
853 enum ip_conntrack_dir dir;
854 struct tcphdr *th, _tcph;
855 unsigned long timeout;
856 unsigned int index;
857
858 th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
859 BUG_ON(th == NULL);
860
861 write_lock_bh(&tcp_lock);
862 old_state = conntrack->proto.tcp.state;
863 dir = CTINFO2DIR(ctinfo);
864 index = get_conntrack_index(th);
865 new_state = tcp_conntracks[dir][index][old_state];
866
867 switch (new_state) {
868 case TCP_CONNTRACK_IGNORE:
Jozsef Kadlecsik73f30602005-12-01 14:28:58 -0800869 /* Ignored packets:
870 *
871 * a) SYN in ORIGINAL
872 * b) SYN/ACK in REPLY
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800873 * c) ACK in reply direction after initial SYN in original.
Jozsef Kadlecsik73f30602005-12-01 14:28:58 -0800874 */
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800875 if (index == TCP_SYNACK_SET
876 && conntrack->proto.tcp.last_index == TCP_SYN_SET
877 && conntrack->proto.tcp.last_dir != dir
878 && ntohl(th->ack_seq) ==
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800879 conntrack->proto.tcp.last_end) {
880 /* This SYN/ACK acknowledges a SYN that we earlier
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800881 * ignored as invalid. This means that the client and
882 * the server are both in sync, while the firewall is
883 * not. We kill this session and block the SYN/ACK so
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800884 * that the client cannot but retransmit its SYN and
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800885 * thus initiate a clean new session.
886 */
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800887 write_unlock_bh(&tcp_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800888 if (LOG_INVALID(IPPROTO_TCP))
889 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
890 "nf_ct_tcp: killing out of sync session ");
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800891 if (del_timer(&conntrack->timeout))
892 conntrack->timeout.function((unsigned long)
893 conntrack);
894 return -NF_DROP;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800895 }
896 conntrack->proto.tcp.last_index = index;
897 conntrack->proto.tcp.last_dir = dir;
898 conntrack->proto.tcp.last_seq = ntohl(th->seq);
899 conntrack->proto.tcp.last_end =
900 segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
901
902 write_unlock_bh(&tcp_lock);
903 if (LOG_INVALID(IPPROTO_TCP))
904 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
905 "nf_ct_tcp: invalid packed ignored ");
906 return NF_ACCEPT;
907 case TCP_CONNTRACK_MAX:
908 /* Invalid packet */
909 DEBUGP("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
910 dir, get_conntrack_index(th),
911 old_state);
912 write_unlock_bh(&tcp_lock);
913 if (LOG_INVALID(IPPROTO_TCP))
914 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
915 "nf_ct_tcp: invalid state ");
916 return -NF_ACCEPT;
917 case TCP_CONNTRACK_SYN_SENT:
918 if (old_state < TCP_CONNTRACK_TIME_WAIT)
919 break;
920 if ((conntrack->proto.tcp.seen[dir].flags &
921 IP_CT_TCP_FLAG_CLOSE_INIT)
922 || after(ntohl(th->seq),
923 conntrack->proto.tcp.seen[dir].td_end)) {
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800924 /* Attempt to reopen a closed connection.
925 * Delete this connection and look up again. */
926 write_unlock_bh(&tcp_lock);
927 if (del_timer(&conntrack->timeout))
928 conntrack->timeout.function((unsigned long)
929 conntrack);
930 return -NF_REPEAT;
KOVACS Krisztian3746a2b2005-11-14 15:23:01 -0800931 } else {
932 write_unlock_bh(&tcp_lock);
933 if (LOG_INVALID(IPPROTO_TCP))
934 nf_log_packet(pf, 0, skb, NULL, NULL,
935 NULL, "nf_ct_tcp: invalid SYN");
936 return -NF_ACCEPT;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800937 }
938 case TCP_CONNTRACK_CLOSE:
939 if (index == TCP_RST_SET
Jozsef Kadlecsik73f30602005-12-01 14:28:58 -0800940 && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800941 && conntrack->proto.tcp.last_index == TCP_SYN_SET)
942 || (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
943 && conntrack->proto.tcp.last_index == TCP_ACK_SET))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800944 && ntohl(th->ack_seq) == conntrack->proto.tcp.last_end) {
Adrian Bunk93b1fae2006-01-10 00:13:33 +0100945 /* RST sent to invalid SYN or ACK we had let through
Jozsef Kadlecsik73f30602005-12-01 14:28:58 -0800946 * at a) and c) above:
947 *
948 * a) SYN was in window then
949 * c) we hold a half-open connection.
950 *
951 * Delete our connection entry.
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800952 * We skip window checking, because packet might ACK
Jozsef Kadlecsik73f30602005-12-01 14:28:58 -0800953 * segments we ignored. */
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800954 goto in_window;
955 }
Adrian Bunk93b1fae2006-01-10 00:13:33 +0100956 /* Just fall through */
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800957 default:
958 /* Keep compilers happy. */
959 break;
960 }
961
962 if (!tcp_in_window(&conntrack->proto.tcp, dir, index,
963 skb, dataoff, th, pf)) {
964 write_unlock_bh(&tcp_lock);
965 return -NF_ACCEPT;
966 }
967 in_window:
968 /* From now on we have got in-window packets */
969 conntrack->proto.tcp.last_index = index;
970
971 DEBUGP("tcp_conntracks: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "
972 "syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
973 NIPQUAD(iph->saddr), ntohs(th->source),
974 NIPQUAD(iph->daddr), ntohs(th->dest),
975 (th->syn ? 1 : 0), (th->ack ? 1 : 0),
976 (th->fin ? 1 : 0), (th->rst ? 1 : 0),
977 old_state, new_state);
978
979 conntrack->proto.tcp.state = new_state;
980 if (old_state != new_state
981 && (new_state == TCP_CONNTRACK_FIN_WAIT
982 || new_state == TCP_CONNTRACK_CLOSE))
983 conntrack->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
984 timeout = conntrack->proto.tcp.retrans >= nf_ct_tcp_max_retrans
985 && *tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans
986 ? nf_ct_tcp_timeout_max_retrans : *tcp_timeouts[new_state];
987 write_unlock_bh(&tcp_lock);
988
989 nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
990 if (new_state != old_state)
991 nf_conntrack_event_cache(IPCT_PROTOINFO, skb);
992
993 if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
994 /* If only reply is a RST, we can consider ourselves not to
995 have an established connection: this is a fairly common
996 problem case, so we can delete the conntrack
997 immediately. --RR */
998 if (th->rst) {
999 if (del_timer(&conntrack->timeout))
1000 conntrack->timeout.function((unsigned long)
1001 conntrack);
1002 return NF_ACCEPT;
1003 }
1004 } else if (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
1005 && (old_state == TCP_CONNTRACK_SYN_RECV
1006 || old_state == TCP_CONNTRACK_ESTABLISHED)
1007 && new_state == TCP_CONNTRACK_ESTABLISHED) {
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001008 /* Set ASSURED if we see see valid ack in ESTABLISHED
1009 after SYN_RECV or a valid answer for a picked up
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001010 connection. */
1011 set_bit(IPS_ASSURED_BIT, &conntrack->status);
1012 nf_conntrack_event_cache(IPCT_STATUS, skb);
1013 }
1014 nf_ct_refresh_acct(conntrack, ctinfo, skb, timeout);
1015
1016 return NF_ACCEPT;
1017}
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001018
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001019/* Called when a new connection for this protocol found. */
1020static int tcp_new(struct nf_conn *conntrack,
1021 const struct sk_buff *skb,
1022 unsigned int dataoff)
1023{
1024 enum tcp_conntrack new_state;
1025 struct tcphdr *th, _tcph;
1026#ifdef DEBUGP_VARS
1027 struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[0];
1028 struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[1];
1029#endif
1030
1031 th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1032 BUG_ON(th == NULL);
1033
1034 /* Don't need lock here: this conntrack not in circulation yet */
1035 new_state
1036 = tcp_conntracks[0][get_conntrack_index(th)]
1037 [TCP_CONNTRACK_NONE];
1038
1039 /* Invalid: delete conntrack */
1040 if (new_state >= TCP_CONNTRACK_MAX) {
1041 DEBUGP("nf_ct_tcp: invalid new deleting.\n");
1042 return 0;
1043 }
1044
1045 if (new_state == TCP_CONNTRACK_SYN_SENT) {
1046 /* SYN packet */
1047 conntrack->proto.tcp.seen[0].td_end =
1048 segment_seq_plus_len(ntohl(th->seq), skb->len,
1049 dataoff, th);
1050 conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1051 if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
1052 conntrack->proto.tcp.seen[0].td_maxwin = 1;
1053 conntrack->proto.tcp.seen[0].td_maxend =
1054 conntrack->proto.tcp.seen[0].td_end;
1055
1056 tcp_options(skb, dataoff, th, &conntrack->proto.tcp.seen[0]);
1057 conntrack->proto.tcp.seen[1].flags = 0;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001058 } else if (nf_ct_tcp_loose == 0) {
1059 /* Don't try to pick up connections. */
1060 return 0;
1061 } else {
1062 /*
1063 * We are in the middle of a connection,
1064 * its history is lost for us.
1065 * Let's try to use the data from the packet.
1066 */
1067 conntrack->proto.tcp.seen[0].td_end =
1068 segment_seq_plus_len(ntohl(th->seq), skb->len,
1069 dataoff, th);
1070 conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1071 if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
1072 conntrack->proto.tcp.seen[0].td_maxwin = 1;
1073 conntrack->proto.tcp.seen[0].td_maxend =
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001074 conntrack->proto.tcp.seen[0].td_end +
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001075 conntrack->proto.tcp.seen[0].td_maxwin;
1076 conntrack->proto.tcp.seen[0].td_scale = 0;
1077
Patrick McHardya09113c2007-02-07 15:05:33 -08001078 /* We assume SACK and liberal window checking to handle
1079 * window scaling */
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001080 conntrack->proto.tcp.seen[0].flags =
Patrick McHardya09113c2007-02-07 15:05:33 -08001081 conntrack->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1082 IP_CT_TCP_FLAG_BE_LIBERAL;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001083 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001084
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001085 conntrack->proto.tcp.seen[1].td_end = 0;
1086 conntrack->proto.tcp.seen[1].td_maxend = 0;
1087 conntrack->proto.tcp.seen[1].td_maxwin = 1;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001088 conntrack->proto.tcp.seen[1].td_scale = 0;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001089
1090 /* tcp_packet will set them */
1091 conntrack->proto.tcp.state = TCP_CONNTRACK_NONE;
1092 conntrack->proto.tcp.last_index = TCP_NONE_SET;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001093
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001094 DEBUGP("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1095 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1096 sender->td_end, sender->td_maxend, sender->td_maxwin,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001097 sender->td_scale,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001098 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1099 receiver->td_scale);
1100 return 1;
1101}
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001102
Patrick McHardye281db5c2007-03-04 15:57:25 -08001103#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001104
1105#include <linux/netfilter/nfnetlink.h>
1106#include <linux/netfilter/nfnetlink_conntrack.h>
1107
1108static int tcp_to_nfattr(struct sk_buff *skb, struct nfattr *nfa,
1109 const struct nf_conn *ct)
1110{
1111 struct nfattr *nest_parms;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001112
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001113 read_lock_bh(&tcp_lock);
1114 nest_parms = NFA_NEST(skb, CTA_PROTOINFO_TCP);
1115 NFA_PUT(skb, CTA_PROTOINFO_TCP_STATE, sizeof(u_int8_t),
1116 &ct->proto.tcp.state);
1117 read_unlock_bh(&tcp_lock);
1118
1119 NFA_NEST_END(skb, nest_parms);
1120
1121 return 0;
1122
1123nfattr_failure:
1124 read_unlock_bh(&tcp_lock);
1125 return -1;
1126}
1127
1128static const size_t cta_min_tcp[CTA_PROTOINFO_TCP_MAX] = {
1129 [CTA_PROTOINFO_TCP_STATE-1] = sizeof(u_int8_t),
1130};
1131
1132static int nfattr_to_tcp(struct nfattr *cda[], struct nf_conn *ct)
1133{
1134 struct nfattr *attr = cda[CTA_PROTOINFO_TCP-1];
1135 struct nfattr *tb[CTA_PROTOINFO_TCP_MAX];
1136
1137 /* updates could not contain anything about the private
1138 * protocol info, in that case skip the parsing */
1139 if (!attr)
1140 return 0;
1141
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001142 nfattr_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, attr);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001143
1144 if (nfattr_bad_size(tb, CTA_PROTOINFO_TCP_MAX, cta_min_tcp))
1145 return -EINVAL;
1146
1147 if (!tb[CTA_PROTOINFO_TCP_STATE-1])
1148 return -EINVAL;
1149
1150 write_lock_bh(&tcp_lock);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001151 ct->proto.tcp.state =
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001152 *(u_int8_t *)NFA_DATA(tb[CTA_PROTOINFO_TCP_STATE-1]);
1153 write_unlock_bh(&tcp_lock);
1154
1155 return 0;
1156}
1157#endif
Patrick McHardy933a41e2006-11-29 02:35:18 +01001158
1159#ifdef CONFIG_SYSCTL
1160static unsigned int tcp_sysctl_table_users;
1161static struct ctl_table_header *tcp_sysctl_header;
1162static struct ctl_table tcp_sysctl_table[] = {
1163 {
1164 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_SYN_SENT,
1165 .procname = "nf_conntrack_tcp_timeout_syn_sent",
1166 .data = &nf_ct_tcp_timeout_syn_sent,
1167 .maxlen = sizeof(unsigned int),
1168 .mode = 0644,
1169 .proc_handler = &proc_dointvec_jiffies,
1170 },
1171 {
1172 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_SYN_RECV,
1173 .procname = "nf_conntrack_tcp_timeout_syn_recv",
1174 .data = &nf_ct_tcp_timeout_syn_recv,
1175 .maxlen = sizeof(unsigned int),
1176 .mode = 0644,
1177 .proc_handler = &proc_dointvec_jiffies,
1178 },
1179 {
1180 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_ESTABLISHED,
1181 .procname = "nf_conntrack_tcp_timeout_established",
1182 .data = &nf_ct_tcp_timeout_established,
1183 .maxlen = sizeof(unsigned int),
1184 .mode = 0644,
1185 .proc_handler = &proc_dointvec_jiffies,
1186 },
1187 {
1188 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_FIN_WAIT,
1189 .procname = "nf_conntrack_tcp_timeout_fin_wait",
1190 .data = &nf_ct_tcp_timeout_fin_wait,
1191 .maxlen = sizeof(unsigned int),
1192 .mode = 0644,
1193 .proc_handler = &proc_dointvec_jiffies,
1194 },
1195 {
1196 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_CLOSE_WAIT,
1197 .procname = "nf_conntrack_tcp_timeout_close_wait",
1198 .data = &nf_ct_tcp_timeout_close_wait,
1199 .maxlen = sizeof(unsigned int),
1200 .mode = 0644,
1201 .proc_handler = &proc_dointvec_jiffies,
1202 },
1203 {
1204 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_LAST_ACK,
1205 .procname = "nf_conntrack_tcp_timeout_last_ack",
1206 .data = &nf_ct_tcp_timeout_last_ack,
1207 .maxlen = sizeof(unsigned int),
1208 .mode = 0644,
1209 .proc_handler = &proc_dointvec_jiffies,
1210 },
1211 {
1212 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_TIME_WAIT,
1213 .procname = "nf_conntrack_tcp_timeout_time_wait",
1214 .data = &nf_ct_tcp_timeout_time_wait,
1215 .maxlen = sizeof(unsigned int),
1216 .mode = 0644,
1217 .proc_handler = &proc_dointvec_jiffies,
1218 },
1219 {
1220 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_CLOSE,
1221 .procname = "nf_conntrack_tcp_timeout_close",
1222 .data = &nf_ct_tcp_timeout_close,
1223 .maxlen = sizeof(unsigned int),
1224 .mode = 0644,
1225 .proc_handler = &proc_dointvec_jiffies,
1226 },
1227 {
1228 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_MAX_RETRANS,
1229 .procname = "nf_conntrack_tcp_timeout_max_retrans",
1230 .data = &nf_ct_tcp_timeout_max_retrans,
1231 .maxlen = sizeof(unsigned int),
1232 .mode = 0644,
1233 .proc_handler = &proc_dointvec_jiffies,
1234 },
1235 {
1236 .ctl_name = NET_NF_CONNTRACK_TCP_LOOSE,
1237 .procname = "nf_conntrack_tcp_loose",
1238 .data = &nf_ct_tcp_loose,
1239 .maxlen = sizeof(unsigned int),
1240 .mode = 0644,
1241 .proc_handler = &proc_dointvec,
1242 },
1243 {
1244 .ctl_name = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
1245 .procname = "nf_conntrack_tcp_be_liberal",
1246 .data = &nf_ct_tcp_be_liberal,
1247 .maxlen = sizeof(unsigned int),
1248 .mode = 0644,
1249 .proc_handler = &proc_dointvec,
1250 },
1251 {
1252 .ctl_name = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
1253 .procname = "nf_conntrack_tcp_max_retrans",
1254 .data = &nf_ct_tcp_max_retrans,
1255 .maxlen = sizeof(unsigned int),
1256 .mode = 0644,
1257 .proc_handler = &proc_dointvec,
1258 },
1259 {
1260 .ctl_name = 0
1261 }
1262};
Patrick McHardya999e682006-11-29 02:35:20 +01001263
1264#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1265static struct ctl_table tcp_compat_sysctl_table[] = {
1266 {
1267 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_SENT,
1268 .procname = "ip_conntrack_tcp_timeout_syn_sent",
1269 .data = &nf_ct_tcp_timeout_syn_sent,
1270 .maxlen = sizeof(unsigned int),
1271 .mode = 0644,
1272 .proc_handler = &proc_dointvec_jiffies,
1273 },
1274 {
1275 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_RECV,
1276 .procname = "ip_conntrack_tcp_timeout_syn_recv",
1277 .data = &nf_ct_tcp_timeout_syn_recv,
1278 .maxlen = sizeof(unsigned int),
1279 .mode = 0644,
1280 .proc_handler = &proc_dointvec_jiffies,
1281 },
1282 {
1283 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_ESTABLISHED,
1284 .procname = "ip_conntrack_tcp_timeout_established",
1285 .data = &nf_ct_tcp_timeout_established,
1286 .maxlen = sizeof(unsigned int),
1287 .mode = 0644,
1288 .proc_handler = &proc_dointvec_jiffies,
1289 },
1290 {
1291 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_FIN_WAIT,
1292 .procname = "ip_conntrack_tcp_timeout_fin_wait",
1293 .data = &nf_ct_tcp_timeout_fin_wait,
1294 .maxlen = sizeof(unsigned int),
1295 .mode = 0644,
1296 .proc_handler = &proc_dointvec_jiffies,
1297 },
1298 {
1299 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE_WAIT,
1300 .procname = "ip_conntrack_tcp_timeout_close_wait",
1301 .data = &nf_ct_tcp_timeout_close_wait,
1302 .maxlen = sizeof(unsigned int),
1303 .mode = 0644,
1304 .proc_handler = &proc_dointvec_jiffies,
1305 },
1306 {
1307 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_LAST_ACK,
1308 .procname = "ip_conntrack_tcp_timeout_last_ack",
1309 .data = &nf_ct_tcp_timeout_last_ack,
1310 .maxlen = sizeof(unsigned int),
1311 .mode = 0644,
1312 .proc_handler = &proc_dointvec_jiffies,
1313 },
1314 {
1315 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_TIME_WAIT,
1316 .procname = "ip_conntrack_tcp_timeout_time_wait",
1317 .data = &nf_ct_tcp_timeout_time_wait,
1318 .maxlen = sizeof(unsigned int),
1319 .mode = 0644,
1320 .proc_handler = &proc_dointvec_jiffies,
1321 },
1322 {
1323 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE,
1324 .procname = "ip_conntrack_tcp_timeout_close",
1325 .data = &nf_ct_tcp_timeout_close,
1326 .maxlen = sizeof(unsigned int),
1327 .mode = 0644,
1328 .proc_handler = &proc_dointvec_jiffies,
1329 },
1330 {
1331 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_MAX_RETRANS,
1332 .procname = "ip_conntrack_tcp_timeout_max_retrans",
1333 .data = &nf_ct_tcp_timeout_max_retrans,
1334 .maxlen = sizeof(unsigned int),
1335 .mode = 0644,
1336 .proc_handler = &proc_dointvec_jiffies,
1337 },
1338 {
1339 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
1340 .procname = "ip_conntrack_tcp_loose",
1341 .data = &nf_ct_tcp_loose,
1342 .maxlen = sizeof(unsigned int),
1343 .mode = 0644,
1344 .proc_handler = &proc_dointvec,
1345 },
1346 {
1347 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
1348 .procname = "ip_conntrack_tcp_be_liberal",
1349 .data = &nf_ct_tcp_be_liberal,
1350 .maxlen = sizeof(unsigned int),
1351 .mode = 0644,
1352 .proc_handler = &proc_dointvec,
1353 },
1354 {
1355 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
1356 .procname = "ip_conntrack_tcp_max_retrans",
1357 .data = &nf_ct_tcp_max_retrans,
1358 .maxlen = sizeof(unsigned int),
1359 .mode = 0644,
1360 .proc_handler = &proc_dointvec,
1361 },
1362 {
1363 .ctl_name = 0
1364 }
1365};
1366#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
Patrick McHardy933a41e2006-11-29 02:35:18 +01001367#endif /* CONFIG_SYSCTL */
1368
Martin Josefsson605dcad2006-11-29 02:35:06 +01001369struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 =
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001370{
1371 .l3proto = PF_INET,
Martin Josefsson605dcad2006-11-29 02:35:06 +01001372 .l4proto = IPPROTO_TCP,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001373 .name = "tcp",
1374 .pkt_to_tuple = tcp_pkt_to_tuple,
1375 .invert_tuple = tcp_invert_tuple,
1376 .print_tuple = tcp_print_tuple,
1377 .print_conntrack = tcp_print_conntrack,
1378 .packet = tcp_packet,
1379 .new = tcp_new,
Patrick McHardy96f6bf82006-04-06 14:19:24 -07001380 .error = tcp_error,
Patrick McHardye281db5c2007-03-04 15:57:25 -08001381#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001382 .to_nfattr = tcp_to_nfattr,
1383 .from_nfattr = nfattr_to_tcp,
1384 .tuple_to_nfattr = nf_ct_port_tuple_to_nfattr,
1385 .nfattr_to_tuple = nf_ct_port_nfattr_to_tuple,
1386#endif
Patrick McHardy933a41e2006-11-29 02:35:18 +01001387#ifdef CONFIG_SYSCTL
1388 .ctl_table_users = &tcp_sysctl_table_users,
1389 .ctl_table_header = &tcp_sysctl_header,
1390 .ctl_table = tcp_sysctl_table,
Patrick McHardya999e682006-11-29 02:35:20 +01001391#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1392 .ctl_compat_table = tcp_compat_sysctl_table,
1393#endif
Patrick McHardy933a41e2006-11-29 02:35:18 +01001394#endif
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001395};
Patrick McHardy13b18332006-12-02 22:11:25 -08001396EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001397
Martin Josefsson605dcad2006-11-29 02:35:06 +01001398struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 =
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001399{
1400 .l3proto = PF_INET6,
Martin Josefsson605dcad2006-11-29 02:35:06 +01001401 .l4proto = IPPROTO_TCP,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001402 .name = "tcp",
1403 .pkt_to_tuple = tcp_pkt_to_tuple,
1404 .invert_tuple = tcp_invert_tuple,
1405 .print_tuple = tcp_print_tuple,
1406 .print_conntrack = tcp_print_conntrack,
1407 .packet = tcp_packet,
1408 .new = tcp_new,
Patrick McHardy96f6bf82006-04-06 14:19:24 -07001409 .error = tcp_error,
Patrick McHardye281db5c2007-03-04 15:57:25 -08001410#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001411 .to_nfattr = tcp_to_nfattr,
1412 .from_nfattr = nfattr_to_tcp,
1413 .tuple_to_nfattr = nf_ct_port_tuple_to_nfattr,
1414 .nfattr_to_tuple = nf_ct_port_nfattr_to_tuple,
1415#endif
Patrick McHardy933a41e2006-11-29 02:35:18 +01001416#ifdef CONFIG_SYSCTL
1417 .ctl_table_users = &tcp_sysctl_table_users,
1418 .ctl_table_header = &tcp_sysctl_header,
1419 .ctl_table = tcp_sysctl_table,
1420#endif
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001421};
Patrick McHardy13b18332006-12-02 22:11:25 -08001422EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);