1 /* (C) 1999-2001 Paul `Rusty' Russell
2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
9 #include <linux/types.h>
10 #include <linux/timer.h>
11 #include <linux/module.h>
13 #include <linux/tcp.h>
14 #include <linux/spinlock.h>
15 #include <linux/skbuff.h>
16 #include <linux/ipv6.h>
17 #include <net/ip6_checksum.h>
18 #include <asm/unaligned.h>
22 #include <linux/netfilter.h>
23 #include <linux/netfilter_ipv4.h>
24 #include <linux/netfilter_ipv6.h>
25 #include <net/netfilter/nf_conntrack.h>
26 #include <net/netfilter/nf_conntrack_l4proto.h>
27 #include <net/netfilter/nf_conntrack_ecache.h>
28 #include <net/netfilter/nf_log.h>
29 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
30 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
32 /* Protects ct->proto.tcp */
33 static DEFINE_RWLOCK(tcp_lock
);
35 /* "Be conservative in what you do,
36 be liberal in what you accept from others."
37 If it's non-zero, we mark only out of window RST segments as INVALID. */
38 static int nf_ct_tcp_be_liberal __read_mostly
= 0;
40 /* If it is set to zero, we disable picking up already established
42 static int nf_ct_tcp_loose __read_mostly
= 1;
44 /* Max number of the retransmitted packets without receiving an (acceptable)
45 ACK from the destination. If this number is reached, a shorter timer
47 static int nf_ct_tcp_max_retrans __read_mostly
= 3;
49 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
50 closely. They're more complex. --RR */
52 static const char *const tcp_conntrack_names
[] = {
66 #define MINS * 60 SECS
67 #define HOURS * 60 MINS
68 #define DAYS * 24 HOURS
70 /* RFC1122 says the R2 limit should be at least 100 seconds.
71 Linux uses 15 packets as limit, which corresponds
72 to ~13-30min depending on RTO. */
73 static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly
= 5 MINS
;
74 static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly
= 5 MINS
;
76 static unsigned int tcp_timeouts
[TCP_CONNTRACK_MAX
] __read_mostly
= {
77 [TCP_CONNTRACK_SYN_SENT
] = 2 MINS
,
78 [TCP_CONNTRACK_SYN_RECV
] = 60 SECS
,
79 [TCP_CONNTRACK_ESTABLISHED
] = 5 DAYS
,
80 [TCP_CONNTRACK_FIN_WAIT
] = 2 MINS
,
81 [TCP_CONNTRACK_CLOSE_WAIT
] = 60 SECS
,
82 [TCP_CONNTRACK_LAST_ACK
] = 30 SECS
,
83 [TCP_CONNTRACK_TIME_WAIT
] = 2 MINS
,
84 [TCP_CONNTRACK_CLOSE
] = 10 SECS
,
87 #define sNO TCP_CONNTRACK_NONE
88 #define sSS TCP_CONNTRACK_SYN_SENT
89 #define sSR TCP_CONNTRACK_SYN_RECV
90 #define sES TCP_CONNTRACK_ESTABLISHED
91 #define sFW TCP_CONNTRACK_FIN_WAIT
92 #define sCW TCP_CONNTRACK_CLOSE_WAIT
93 #define sLA TCP_CONNTRACK_LAST_ACK
94 #define sTW TCP_CONNTRACK_TIME_WAIT
95 #define sCL TCP_CONNTRACK_CLOSE
96 #define sLI TCP_CONNTRACK_LISTEN
97 #define sIV TCP_CONNTRACK_MAX
98 #define sIG TCP_CONNTRACK_IGNORE
100 /* What TCP flags are set from RST/SYN/FIN/ACK. */
111 * The TCP state transition table needs a few words...
113 * We are the man in the middle. All the packets go through us
114 * but might get lost in transit to the destination.
115 * It is assumed that the destinations can't receive segments
118 * The checked segment is in window, but our windows are *not*
119 * equivalent with the ones of the sender/receiver. We always
120 * try to guess the state of the current sender.
122 * The meaning of the states are:
124 * NONE: initial state
125 * SYN_SENT: SYN-only packet seen
126 * SYN_RECV: SYN-ACK packet seen
127 * ESTABLISHED: ACK packet seen
128 * FIN_WAIT: FIN packet seen
129 * CLOSE_WAIT: ACK seen (after FIN)
130 * LAST_ACK: FIN seen (after FIN)
131 * TIME_WAIT: last ACK seen
132 * CLOSE: closed connection (RST)
134 * LISTEN state is not used.
136 * Packets marked as IGNORED (sIG):
137 * if they may be either invalid or valid
138 * and the receiver may send back a connection
139 * closing RST or a SYN/ACK.
141 * Packets marked as INVALID (sIV):
142 * if they are invalid
143 * or we do not support the request (simultaneous open)
145 static const u8 tcp_conntracks
[2][6][TCP_CONNTRACK_MAX
] = {
148 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
149 /*syn*/ { sSS
, sSS
, sIG
, sIG
, sIG
, sIG
, sIG
, sSS
, sSS
, sIV
},
151 * sNO -> sSS Initialize a new connection
152 * sSS -> sSS Retransmitted SYN
153 * sSR -> sIG Late retransmitted SYN?
154 * sES -> sIG Error: SYNs in window outside the SYN_SENT state
155 * are errors. Receiver will reply with RST
156 * and close the connection.
157 * Or we are not in sync and hold a dead connection.
161 * sTW -> sSS Reopened connection (RFC 1122).
164 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
165 /*synack*/ { sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
},
167 * A SYN/ACK from the client is always invalid:
168 * - either it tries to set up a simultaneous open, which is
170 * - or the firewall has just been inserted between the two hosts
171 * during the session set-up. The SYN will be retransmitted
172 * by the true client (or it'll time out).
174 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
175 /*fin*/ { sIV
, sIV
, sFW
, sFW
, sLA
, sLA
, sLA
, sTW
, sCL
, sIV
},
177 * sNO -> sIV Too late and no reason to do anything...
178 * sSS -> sIV Client migth not send FIN in this state:
179 * we enforce waiting for a SYN/ACK reply first.
180 * sSR -> sFW Close started.
182 * sFW -> sLA FIN seen in both directions, waiting for
184 * Migth be a retransmitted FIN as well...
186 * sLA -> sLA Retransmitted FIN. Remain in the same state.
190 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
191 /*ack*/ { sES
, sIV
, sES
, sES
, sCW
, sCW
, sTW
, sTW
, sCL
, sIV
},
193 * sNO -> sES Assumed.
194 * sSS -> sIV ACK is invalid: we haven't seen a SYN/ACK yet.
195 * sSR -> sES Established state is reached.
197 * sFW -> sCW Normal close request answered by ACK.
199 * sLA -> sTW Last ACK detected.
200 * sTW -> sTW Retransmitted last ACK. Remain in the same state.
203 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
204 /*rst*/ { sIV
, sCL
, sCL
, sCL
, sCL
, sCL
, sCL
, sCL
, sCL
, sIV
},
205 /*none*/ { sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
}
209 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
210 /*syn*/ { sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
},
212 * sNO -> sIV Never reached.
213 * sSS -> sIV Simultaneous open, not supported
214 * sSR -> sIV Simultaneous open, not supported.
215 * sES -> sIV Server may not initiate a connection.
219 * sTW -> sIV Reopened connection, but server may not do it.
222 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
223 /*synack*/ { sIV
, sSR
, sSR
, sIG
, sIG
, sIG
, sIG
, sIG
, sIG
, sIV
},
225 * sSS -> sSR Standard open.
226 * sSR -> sSR Retransmitted SYN/ACK.
227 * sES -> sIG Late retransmitted SYN/ACK?
228 * sFW -> sIG Might be SYN/ACK answering ignored SYN
234 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
235 /*fin*/ { sIV
, sIV
, sFW
, sFW
, sLA
, sLA
, sLA
, sTW
, sCL
, sIV
},
237 * sSS -> sIV Server might not send FIN in this state.
238 * sSR -> sFW Close started.
240 * sFW -> sLA FIN seen in both directions.
242 * sLA -> sLA Retransmitted FIN.
246 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
247 /*ack*/ { sIV
, sIG
, sSR
, sES
, sCW
, sCW
, sTW
, sTW
, sCL
, sIV
},
249 * sSS -> sIG Might be a half-open connection.
250 * sSR -> sSR Might answer late resent SYN.
252 * sFW -> sCW Normal close request answered by ACK.
254 * sLA -> sTW Last ACK detected.
255 * sTW -> sTW Retransmitted last ACK.
258 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
259 /*rst*/ { sIV
, sCL
, sCL
, sCL
, sCL
, sCL
, sCL
, sCL
, sCL
, sIV
},
260 /*none*/ { sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
, sIV
}
264 static bool tcp_pkt_to_tuple(const struct sk_buff
*skb
, unsigned int dataoff
,
265 struct nf_conntrack_tuple
*tuple
)
267 const struct tcphdr
*hp
;
270 /* Actually only need first 8 bytes. */
271 hp
= skb_header_pointer(skb
, dataoff
, 8, &_hdr
);
275 tuple
->src
.u
.tcp
.port
= hp
->source
;
276 tuple
->dst
.u
.tcp
.port
= hp
->dest
;
281 static bool tcp_invert_tuple(struct nf_conntrack_tuple
*tuple
,
282 const struct nf_conntrack_tuple
*orig
)
284 tuple
->src
.u
.tcp
.port
= orig
->dst
.u
.tcp
.port
;
285 tuple
->dst
.u
.tcp
.port
= orig
->src
.u
.tcp
.port
;
289 /* Print out the per-protocol part of the tuple. */
290 static int tcp_print_tuple(struct seq_file
*s
,
291 const struct nf_conntrack_tuple
*tuple
)
293 return seq_printf(s
, "sport=%hu dport=%hu ",
294 ntohs(tuple
->src
.u
.tcp
.port
),
295 ntohs(tuple
->dst
.u
.tcp
.port
));
298 /* Print out the private part of the conntrack. */
299 static int tcp_print_conntrack(struct seq_file
*s
, const struct nf_conn
*ct
)
301 enum tcp_conntrack state
;
303 read_lock_bh(&tcp_lock
);
304 state
= ct
->proto
.tcp
.state
;
305 read_unlock_bh(&tcp_lock
);
307 return seq_printf(s
, "%s ", tcp_conntrack_names
[state
]);
310 static unsigned int get_conntrack_index(const struct tcphdr
*tcph
)
312 if (tcph
->rst
) return TCP_RST_SET
;
313 else if (tcph
->syn
) return (tcph
->ack
? TCP_SYNACK_SET
: TCP_SYN_SET
);
314 else if (tcph
->fin
) return TCP_FIN_SET
;
315 else if (tcph
->ack
) return TCP_ACK_SET
;
316 else return TCP_NONE_SET
;
319 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
320 in IP Filter' by Guido van Rooij.
322 http://www.nluug.nl/events/sane2000/papers.html
323 http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
325 The boundaries and the conditions are changed according to RFC793:
326 the packet must intersect the window (i.e. segments may be
327 after the right or before the left edge) and thus receivers may ACK
328 segments after the right edge of the window.
330 td_maxend = max(sack + max(win,1)) seen in reply packets
331 td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
332 td_maxwin += seq + len - sender.td_maxend
333 if seq + len > sender.td_maxend
334 td_end = max(seq + len) seen in sent packets
336 I. Upper bound for valid data: seq <= sender.td_maxend
337 II. Lower bound for valid data: seq + len >= sender.td_end - receiver.td_maxwin
338 III. Upper bound for valid (s)ack: sack <= receiver.td_end
339 IV. Lower bound for valid (s)ack: sack >= receiver.td_end - MAXACKWINDOW
341 where sack is the highest right edge of sack block found in the packet
342 or ack in the case of packet without SACK option.
344 The upper bound limit for a valid (s)ack is not ignored -
345 we doesn't have to deal with fragments.
348 static inline __u32
segment_seq_plus_len(__u32 seq
,
350 unsigned int dataoff
,
351 const struct tcphdr
*tcph
)
353 /* XXX Should I use payload length field in IP/IPv6 header ?
355 return (seq
+ len
- dataoff
- tcph
->doff
*4
356 + (tcph
->syn
? 1 : 0) + (tcph
->fin
? 1 : 0));
359 /* Fixme: what about big packets? */
360 #define MAXACKWINCONST 66000
361 #define MAXACKWINDOW(sender) \
362 ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin \
366 * Simplified tcp_parse_options routine from tcp_input.c
368 static void tcp_options(const struct sk_buff
*skb
,
369 unsigned int dataoff
,
370 const struct tcphdr
*tcph
,
371 struct ip_ct_tcp_state
*state
)
373 unsigned char buff
[(15 * 4) - sizeof(struct tcphdr
)];
374 const unsigned char *ptr
;
375 int length
= (tcph
->doff
*4) - sizeof(struct tcphdr
);
380 ptr
= skb_header_pointer(skb
, dataoff
+ sizeof(struct tcphdr
),
394 case TCPOPT_NOP
: /* Ref: RFC 793 section 3.1 */
399 if (opsize
< 2) /* "silly options" */
402 break; /* don't parse partial options */
404 if (opcode
== TCPOPT_SACK_PERM
405 && opsize
== TCPOLEN_SACK_PERM
)
406 state
->flags
|= IP_CT_TCP_FLAG_SACK_PERM
;
407 else if (opcode
== TCPOPT_WINDOW
408 && opsize
== TCPOLEN_WINDOW
) {
409 state
->td_scale
= *(u_int8_t
*)ptr
;
411 if (state
->td_scale
> 14) {
413 state
->td_scale
= 14;
416 IP_CT_TCP_FLAG_WINDOW_SCALE
;
424 static void tcp_sack(const struct sk_buff
*skb
, unsigned int dataoff
,
425 const struct tcphdr
*tcph
, __u32
*sack
)
427 unsigned char buff
[(15 * 4) - sizeof(struct tcphdr
)];
428 const unsigned char *ptr
;
429 int length
= (tcph
->doff
*4) - sizeof(struct tcphdr
);
435 ptr
= skb_header_pointer(skb
, dataoff
+ sizeof(struct tcphdr
),
439 /* Fast path for timestamp-only option */
440 if (length
== TCPOLEN_TSTAMP_ALIGNED
*4
441 && *(__be32
*)ptr
== htonl((TCPOPT_NOP
<< 24)
443 | (TCPOPT_TIMESTAMP
<< 8)
444 | TCPOLEN_TIMESTAMP
))
454 case TCPOPT_NOP
: /* Ref: RFC 793 section 3.1 */
459 if (opsize
< 2) /* "silly options" */
462 break; /* don't parse partial options */
464 if (opcode
== TCPOPT_SACK
465 && opsize
>= (TCPOLEN_SACK_BASE
466 + TCPOLEN_SACK_PERBLOCK
)
467 && !((opsize
- TCPOLEN_SACK_BASE
)
468 % TCPOLEN_SACK_PERBLOCK
)) {
470 i
< (opsize
- TCPOLEN_SACK_BASE
);
471 i
+= TCPOLEN_SACK_PERBLOCK
) {
472 tmp
= get_unaligned_be32((__be32
*)(ptr
+i
)+1);
474 if (after(tmp
, *sack
))
485 static bool tcp_in_window(const struct nf_conn
*ct
,
486 struct ip_ct_tcp
*state
,
487 enum ip_conntrack_dir dir
,
489 const struct sk_buff
*skb
,
490 unsigned int dataoff
,
491 const struct tcphdr
*tcph
,
494 struct net
*net
= nf_ct_net(ct
);
495 struct ip_ct_tcp_state
*sender
= &state
->seen
[dir
];
496 struct ip_ct_tcp_state
*receiver
= &state
->seen
[!dir
];
497 const struct nf_conntrack_tuple
*tuple
= &ct
->tuplehash
[dir
].tuple
;
498 __u32 seq
, ack
, sack
, end
, win
, swin
;
502 * Get the required data from the packet.
504 seq
= ntohl(tcph
->seq
);
505 ack
= sack
= ntohl(tcph
->ack_seq
);
506 win
= ntohs(tcph
->window
);
507 end
= segment_seq_plus_len(seq
, skb
->len
, dataoff
, tcph
);
509 if (receiver
->flags
& IP_CT_TCP_FLAG_SACK_PERM
)
510 tcp_sack(skb
, dataoff
, tcph
, &sack
);
512 pr_debug("tcp_in_window: START\n");
513 pr_debug("tcp_in_window: ");
514 nf_ct_dump_tuple(tuple
);
515 pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
516 seq
, ack
, sack
, win
, end
);
517 pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
518 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
519 sender
->td_end
, sender
->td_maxend
, sender
->td_maxwin
,
521 receiver
->td_end
, receiver
->td_maxend
, receiver
->td_maxwin
,
524 if (sender
->td_end
== 0) {
526 * Initialize sender data.
528 if (tcph
->syn
&& tcph
->ack
) {
530 * Outgoing SYN-ACK in reply to a SYN.
533 sender
->td_maxend
= end
;
534 sender
->td_maxwin
= (win
== 0 ? 1 : win
);
536 tcp_options(skb
, dataoff
, tcph
, sender
);
539 * Both sides must send the Window Scale option
540 * to enable window scaling in either direction.
542 if (!(sender
->flags
& IP_CT_TCP_FLAG_WINDOW_SCALE
543 && receiver
->flags
& IP_CT_TCP_FLAG_WINDOW_SCALE
))
545 receiver
->td_scale
= 0;
548 * We are in the middle of a connection,
549 * its history is lost for us.
550 * Let's try to use the data from the packet.
552 sender
->td_end
= end
;
553 sender
->td_maxwin
= (win
== 0 ? 1 : win
);
554 sender
->td_maxend
= end
+ sender
->td_maxwin
;
556 } else if (((state
->state
== TCP_CONNTRACK_SYN_SENT
557 && dir
== IP_CT_DIR_ORIGINAL
)
558 || (state
->state
== TCP_CONNTRACK_SYN_RECV
559 && dir
== IP_CT_DIR_REPLY
))
560 && after(end
, sender
->td_end
)) {
562 * RFC 793: "if a TCP is reinitialized ... then it need
563 * not wait at all; it must only be sure to use sequence
564 * numbers larger than those recently used."
567 sender
->td_maxend
= end
;
568 sender
->td_maxwin
= (win
== 0 ? 1 : win
);
570 tcp_options(skb
, dataoff
, tcph
, sender
);
575 * If there is no ACK, just pretend it was set and OK.
577 ack
= sack
= receiver
->td_end
;
578 } else if (((tcp_flag_word(tcph
) & (TCP_FLAG_ACK
|TCP_FLAG_RST
)) ==
579 (TCP_FLAG_ACK
|TCP_FLAG_RST
))
582 * Broken TCP stacks, that set ACK in RST packets as well
583 * with zero ack value.
585 ack
= sack
= receiver
->td_end
;
590 || (seq
== 0 && state
->state
== TCP_CONNTRACK_SYN_SENT
)))
592 * Packets contains no data: we assume it is valid
593 * and check the ack value only.
594 * However RST segments are always validated by their
595 * SEQ number, except when seq == 0 (reset sent answering
598 seq
= end
= sender
->td_end
;
600 pr_debug("tcp_in_window: ");
601 nf_ct_dump_tuple(tuple
);
602 pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
603 seq
, ack
, sack
, win
, end
);
604 pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
605 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
606 sender
->td_end
, sender
->td_maxend
, sender
->td_maxwin
,
608 receiver
->td_end
, receiver
->td_maxend
, receiver
->td_maxwin
,
611 pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
612 before(seq
, sender
->td_maxend
+ 1),
613 after(end
, sender
->td_end
- receiver
->td_maxwin
- 1),
614 before(sack
, receiver
->td_end
+ 1),
615 after(sack
, receiver
->td_end
- MAXACKWINDOW(sender
) - 1));
617 if (before(seq
, sender
->td_maxend
+ 1) &&
618 after(end
, sender
->td_end
- receiver
->td_maxwin
- 1) &&
619 before(sack
, receiver
->td_end
+ 1) &&
620 after(sack
, receiver
->td_end
- MAXACKWINDOW(sender
) - 1)) {
622 * Take into account window scaling (RFC 1323).
625 win
<<= sender
->td_scale
;
628 * Update sender data.
630 swin
= win
+ (sack
- ack
);
631 if (sender
->td_maxwin
< swin
)
632 sender
->td_maxwin
= swin
;
633 if (after(end
, sender
->td_end
)) {
634 sender
->td_end
= end
;
635 sender
->flags
|= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED
;
638 * Update receiver data.
640 if (after(end
, sender
->td_maxend
))
641 receiver
->td_maxwin
+= end
- sender
->td_maxend
;
642 if (after(sack
+ win
, receiver
->td_maxend
- 1)) {
643 receiver
->td_maxend
= sack
+ win
;
645 receiver
->td_maxend
++;
647 if (ack
== receiver
->td_end
)
648 receiver
->flags
&= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED
;
651 * Check retransmissions.
653 if (index
== TCP_ACK_SET
) {
654 if (state
->last_dir
== dir
655 && state
->last_seq
== seq
656 && state
->last_ack
== ack
657 && state
->last_end
== end
658 && state
->last_win
== win
)
661 state
->last_dir
= dir
;
662 state
->last_seq
= seq
;
663 state
->last_ack
= ack
;
664 state
->last_end
= end
;
665 state
->last_win
= win
;
672 if (sender
->flags
& IP_CT_TCP_FLAG_BE_LIBERAL
||
673 nf_ct_tcp_be_liberal
)
675 if (!res
&& LOG_INVALID(net
, IPPROTO_TCP
))
676 nf_log_packet(pf
, 0, skb
, NULL
, NULL
, NULL
,
678 before(seq
, sender
->td_maxend
+ 1) ?
679 after(end
, sender
->td_end
- receiver
->td_maxwin
- 1) ?
680 before(sack
, receiver
->td_end
+ 1) ?
681 after(ack
, receiver
->td_end
- MAXACKWINDOW(sender
)) ? "BUG"
682 : "ACK is under the lower bound (possible overly delayed ACK)"
683 : "ACK is over the upper bound (ACKed data not seen yet)"
684 : "SEQ is under the lower bound (already ACKed data retransmitted)"
685 : "SEQ is over the upper bound (over the window of the receiver)");
688 pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
689 "receiver end=%u maxend=%u maxwin=%u\n",
690 res
, sender
->td_end
, sender
->td_maxend
, sender
->td_maxwin
,
691 receiver
->td_end
, receiver
->td_maxend
, receiver
->td_maxwin
);
696 #ifdef CONFIG_NF_NAT_NEEDED
697 /* Update sender->td_end after NAT successfully mangled the packet */
698 /* Caller must linearize skb at tcp header. */
699 void nf_conntrack_tcp_update(const struct sk_buff
*skb
,
700 unsigned int dataoff
,
704 const struct tcphdr
*tcph
= (const void *)skb
->data
+ dataoff
;
705 const struct ip_ct_tcp_state
*sender
= &ct
->proto
.tcp
.seen
[dir
];
706 const struct ip_ct_tcp_state
*receiver
= &ct
->proto
.tcp
.seen
[!dir
];
709 end
= segment_seq_plus_len(ntohl(tcph
->seq
), skb
->len
, dataoff
, tcph
);
711 write_lock_bh(&tcp_lock
);
713 * We have to worry for the ack in the reply packet only...
715 if (after(end
, ct
->proto
.tcp
.seen
[dir
].td_end
))
716 ct
->proto
.tcp
.seen
[dir
].td_end
= end
;
717 ct
->proto
.tcp
.last_end
= end
;
718 write_unlock_bh(&tcp_lock
);
719 pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
720 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
721 sender
->td_end
, sender
->td_maxend
, sender
->td_maxwin
,
723 receiver
->td_end
, receiver
->td_maxend
, receiver
->td_maxwin
,
726 EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update
);
738 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
739 static const u8 tcp_valid_flags
[(TH_FIN
|TH_SYN
|TH_RST
|TH_ACK
|TH_URG
) + 1] =
747 [TH_FIN
|TH_ACK
|TH_URG
] = 1,
752 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c. */
753 static int tcp_error(struct net
*net
,
755 unsigned int dataoff
,
756 enum ip_conntrack_info
*ctinfo
,
758 unsigned int hooknum
)
760 const struct tcphdr
*th
;
762 unsigned int tcplen
= skb
->len
- dataoff
;
765 /* Smaller that minimal TCP header? */
766 th
= skb_header_pointer(skb
, dataoff
, sizeof(_tcph
), &_tcph
);
768 if (LOG_INVALID(net
, IPPROTO_TCP
))
769 nf_log_packet(pf
, 0, skb
, NULL
, NULL
, NULL
,
770 "nf_ct_tcp: short packet ");
774 /* Not whole TCP header or malformed packet */
775 if (th
->doff
*4 < sizeof(struct tcphdr
) || tcplen
< th
->doff
*4) {
776 if (LOG_INVALID(net
, IPPROTO_TCP
))
777 nf_log_packet(pf
, 0, skb
, NULL
, NULL
, NULL
,
778 "nf_ct_tcp: truncated/malformed packet ");
782 /* Checksum invalid? Ignore.
783 * We skip checking packets on the outgoing path
784 * because the checksum is assumed to be correct.
786 /* FIXME: Source route IP option packets --RR */
787 if (net
->ct
.sysctl_checksum
&& hooknum
== NF_INET_PRE_ROUTING
&&
788 nf_checksum(skb
, hooknum
, dataoff
, IPPROTO_TCP
, pf
)) {
789 if (LOG_INVALID(net
, IPPROTO_TCP
))
790 nf_log_packet(pf
, 0, skb
, NULL
, NULL
, NULL
,
791 "nf_ct_tcp: bad TCP checksum ");
795 /* Check TCP flags. */
796 tcpflags
= (((u_int8_t
*)th
)[13] & ~(TH_ECE
|TH_CWR
|TH_PUSH
));
797 if (!tcp_valid_flags
[tcpflags
]) {
798 if (LOG_INVALID(net
, IPPROTO_TCP
))
799 nf_log_packet(pf
, 0, skb
, NULL
, NULL
, NULL
,
800 "nf_ct_tcp: invalid TCP flag combination ");
807 /* Returns verdict for packet, or -1 for invalid. */
808 static int tcp_packet(struct nf_conn
*ct
,
809 const struct sk_buff
*skb
,
810 unsigned int dataoff
,
811 enum ip_conntrack_info ctinfo
,
813 unsigned int hooknum
)
815 struct net
*net
= nf_ct_net(ct
);
816 struct nf_conntrack_tuple
*tuple
;
817 enum tcp_conntrack new_state
, old_state
;
818 enum ip_conntrack_dir dir
;
819 const struct tcphdr
*th
;
821 unsigned long timeout
;
824 th
= skb_header_pointer(skb
, dataoff
, sizeof(_tcph
), &_tcph
);
827 write_lock_bh(&tcp_lock
);
828 old_state
= ct
->proto
.tcp
.state
;
829 dir
= CTINFO2DIR(ctinfo
);
830 index
= get_conntrack_index(th
);
831 new_state
= tcp_conntracks
[dir
][index
][old_state
];
832 tuple
= &ct
->tuplehash
[dir
].tuple
;
835 case TCP_CONNTRACK_SYN_SENT
:
836 if (old_state
< TCP_CONNTRACK_TIME_WAIT
)
838 /* RFC 1122: "When a connection is closed actively,
839 * it MUST linger in TIME-WAIT state for a time 2xMSL
840 * (Maximum Segment Lifetime). However, it MAY accept
841 * a new SYN from the remote TCP to reopen the connection
842 * directly from TIME-WAIT state, if..."
843 * We ignore the conditions because we are in the
844 * TIME-WAIT state anyway.
846 * Handle aborted connections: we and the server
847 * think there is an existing connection but the client
848 * aborts it and starts a new one.
850 if (((ct
->proto
.tcp
.seen
[dir
].flags
851 | ct
->proto
.tcp
.seen
[!dir
].flags
)
852 & IP_CT_TCP_FLAG_CLOSE_INIT
)
853 || (ct
->proto
.tcp
.last_dir
== dir
854 && ct
->proto
.tcp
.last_index
== TCP_RST_SET
)) {
855 /* Attempt to reopen a closed/aborted connection.
856 * Delete this connection and look up again. */
857 write_unlock_bh(&tcp_lock
);
859 /* Only repeat if we can actually remove the timer.
860 * Destruction may already be in progress in process
861 * context and we must give it a chance to terminate.
868 case TCP_CONNTRACK_IGNORE
:
871 * Our connection entry may be out of sync, so ignore
872 * packets which may signal the real connection between
873 * the client and the server.
876 * b) SYN/ACK in REPLY
877 * c) ACK in reply direction after initial SYN in original.
879 * If the ignored packet is invalid, the receiver will send
880 * a RST we'll catch below.
882 if (index
== TCP_SYNACK_SET
883 && ct
->proto
.tcp
.last_index
== TCP_SYN_SET
884 && ct
->proto
.tcp
.last_dir
!= dir
885 && ntohl(th
->ack_seq
) == ct
->proto
.tcp
.last_end
) {
886 /* b) This SYN/ACK acknowledges a SYN that we earlier
887 * ignored as invalid. This means that the client and
888 * the server are both in sync, while the firewall is
889 * not. We kill this session and block the SYN/ACK so
890 * that the client cannot but retransmit its SYN and
891 * thus initiate a clean new session.
893 write_unlock_bh(&tcp_lock
);
894 if (LOG_INVALID(net
, IPPROTO_TCP
))
895 nf_log_packet(pf
, 0, skb
, NULL
, NULL
, NULL
,
896 "nf_ct_tcp: killing out of sync session ");
900 ct
->proto
.tcp
.last_index
= index
;
901 ct
->proto
.tcp
.last_dir
= dir
;
902 ct
->proto
.tcp
.last_seq
= ntohl(th
->seq
);
903 ct
->proto
.tcp
.last_end
=
904 segment_seq_plus_len(ntohl(th
->seq
), skb
->len
, dataoff
, th
);
906 write_unlock_bh(&tcp_lock
);
907 if (LOG_INVALID(net
, IPPROTO_TCP
))
908 nf_log_packet(pf
, 0, skb
, NULL
, NULL
, NULL
,
909 "nf_ct_tcp: invalid packet ignored ");
911 case TCP_CONNTRACK_MAX
:
913 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
914 dir
, get_conntrack_index(th
), old_state
);
915 write_unlock_bh(&tcp_lock
);
916 if (LOG_INVALID(net
, IPPROTO_TCP
))
917 nf_log_packet(pf
, 0, skb
, NULL
, NULL
, NULL
,
918 "nf_ct_tcp: invalid state ");
920 case TCP_CONNTRACK_CLOSE
:
921 if (index
== TCP_RST_SET
922 && ((test_bit(IPS_SEEN_REPLY_BIT
, &ct
->status
)
923 && ct
->proto
.tcp
.last_index
== TCP_SYN_SET
)
924 || (!test_bit(IPS_ASSURED_BIT
, &ct
->status
)
925 && ct
->proto
.tcp
.last_index
== TCP_ACK_SET
))
926 && ntohl(th
->ack_seq
) == ct
->proto
.tcp
.last_end
) {
927 /* RST sent to invalid SYN or ACK we had let through
928 * at a) and c) above:
930 * a) SYN was in window then
931 * c) we hold a half-open connection.
933 * Delete our connection entry.
934 * We skip window checking, because packet might ACK
935 * segments we ignored. */
938 /* Just fall through */
940 /* Keep compilers happy. */
944 if (!tcp_in_window(ct
, &ct
->proto
.tcp
, dir
, index
,
945 skb
, dataoff
, th
, pf
)) {
946 write_unlock_bh(&tcp_lock
);
950 /* From now on we have got in-window packets */
951 ct
->proto
.tcp
.last_index
= index
;
952 ct
->proto
.tcp
.last_dir
= dir
;
954 pr_debug("tcp_conntracks: ");
955 nf_ct_dump_tuple(tuple
);
956 pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
957 (th
->syn
? 1 : 0), (th
->ack
? 1 : 0),
958 (th
->fin
? 1 : 0), (th
->rst
? 1 : 0),
959 old_state
, new_state
);
961 ct
->proto
.tcp
.state
= new_state
;
962 if (old_state
!= new_state
963 && new_state
== TCP_CONNTRACK_FIN_WAIT
)
964 ct
->proto
.tcp
.seen
[dir
].flags
|= IP_CT_TCP_FLAG_CLOSE_INIT
;
966 if (ct
->proto
.tcp
.retrans
>= nf_ct_tcp_max_retrans
&&
967 tcp_timeouts
[new_state
] > nf_ct_tcp_timeout_max_retrans
)
968 timeout
= nf_ct_tcp_timeout_max_retrans
;
969 else if ((ct
->proto
.tcp
.seen
[0].flags
| ct
->proto
.tcp
.seen
[1].flags
) &
970 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED
&&
971 tcp_timeouts
[new_state
] > nf_ct_tcp_timeout_unacknowledged
)
972 timeout
= nf_ct_tcp_timeout_unacknowledged
;
974 timeout
= tcp_timeouts
[new_state
];
975 write_unlock_bh(&tcp_lock
);
977 nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE
, ct
);
978 if (new_state
!= old_state
)
979 nf_conntrack_event_cache(IPCT_PROTOINFO
, ct
);
981 if (!test_bit(IPS_SEEN_REPLY_BIT
, &ct
->status
)) {
982 /* If only reply is a RST, we can consider ourselves not to
983 have an established connection: this is a fairly common
984 problem case, so we can delete the conntrack
987 nf_ct_kill_acct(ct
, ctinfo
, skb
);
990 } else if (!test_bit(IPS_ASSURED_BIT
, &ct
->status
)
991 && (old_state
== TCP_CONNTRACK_SYN_RECV
992 || old_state
== TCP_CONNTRACK_ESTABLISHED
)
993 && new_state
== TCP_CONNTRACK_ESTABLISHED
) {
994 /* Set ASSURED if we see see valid ack in ESTABLISHED
995 after SYN_RECV or a valid answer for a picked up
997 set_bit(IPS_ASSURED_BIT
, &ct
->status
);
998 nf_conntrack_event_cache(IPCT_STATUS
, ct
);
1000 nf_ct_refresh_acct(ct
, ctinfo
, skb
, timeout
);
1005 /* Called when a new connection for this protocol found. */
1006 static bool tcp_new(struct nf_conn
*ct
, const struct sk_buff
*skb
,
1007 unsigned int dataoff
)
1009 enum tcp_conntrack new_state
;
1010 const struct tcphdr
*th
;
1011 struct tcphdr _tcph
;
1012 const struct ip_ct_tcp_state
*sender
= &ct
->proto
.tcp
.seen
[0];
1013 const struct ip_ct_tcp_state
*receiver
= &ct
->proto
.tcp
.seen
[1];
1015 th
= skb_header_pointer(skb
, dataoff
, sizeof(_tcph
), &_tcph
);
1018 /* Don't need lock here: this conntrack not in circulation yet */
1020 = tcp_conntracks
[0][get_conntrack_index(th
)]
1021 [TCP_CONNTRACK_NONE
];
1023 /* Invalid: delete conntrack */
1024 if (new_state
>= TCP_CONNTRACK_MAX
) {
1025 pr_debug("nf_ct_tcp: invalid new deleting.\n");
1029 if (new_state
== TCP_CONNTRACK_SYN_SENT
) {
1031 ct
->proto
.tcp
.seen
[0].td_end
=
1032 segment_seq_plus_len(ntohl(th
->seq
), skb
->len
,
1034 ct
->proto
.tcp
.seen
[0].td_maxwin
= ntohs(th
->window
);
1035 if (ct
->proto
.tcp
.seen
[0].td_maxwin
== 0)
1036 ct
->proto
.tcp
.seen
[0].td_maxwin
= 1;
1037 ct
->proto
.tcp
.seen
[0].td_maxend
=
1038 ct
->proto
.tcp
.seen
[0].td_end
;
1040 tcp_options(skb
, dataoff
, th
, &ct
->proto
.tcp
.seen
[0]);
1041 ct
->proto
.tcp
.seen
[1].flags
= 0;
1042 } else if (nf_ct_tcp_loose
== 0) {
1043 /* Don't try to pick up connections. */
1047 * We are in the middle of a connection,
1048 * its history is lost for us.
1049 * Let's try to use the data from the packet.
1051 ct
->proto
.tcp
.seen
[0].td_end
=
1052 segment_seq_plus_len(ntohl(th
->seq
), skb
->len
,
1054 ct
->proto
.tcp
.seen
[0].td_maxwin
= ntohs(th
->window
);
1055 if (ct
->proto
.tcp
.seen
[0].td_maxwin
== 0)
1056 ct
->proto
.tcp
.seen
[0].td_maxwin
= 1;
1057 ct
->proto
.tcp
.seen
[0].td_maxend
=
1058 ct
->proto
.tcp
.seen
[0].td_end
+
1059 ct
->proto
.tcp
.seen
[0].td_maxwin
;
1060 ct
->proto
.tcp
.seen
[0].td_scale
= 0;
1062 /* We assume SACK and liberal window checking to handle
1064 ct
->proto
.tcp
.seen
[0].flags
=
1065 ct
->proto
.tcp
.seen
[1].flags
= IP_CT_TCP_FLAG_SACK_PERM
|
1066 IP_CT_TCP_FLAG_BE_LIBERAL
;
1069 ct
->proto
.tcp
.seen
[1].td_end
= 0;
1070 ct
->proto
.tcp
.seen
[1].td_maxend
= 0;
1071 ct
->proto
.tcp
.seen
[1].td_maxwin
= 1;
1072 ct
->proto
.tcp
.seen
[1].td_scale
= 0;
1074 /* tcp_packet will set them */
1075 ct
->proto
.tcp
.state
= TCP_CONNTRACK_NONE
;
1076 ct
->proto
.tcp
.last_index
= TCP_NONE_SET
;
1078 pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1079 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1080 sender
->td_end
, sender
->td_maxend
, sender
->td_maxwin
,
1082 receiver
->td_end
, receiver
->td_maxend
, receiver
->td_maxwin
,
1083 receiver
->td_scale
);
1087 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1089 #include <linux/netfilter/nfnetlink.h>
1090 #include <linux/netfilter/nfnetlink_conntrack.h>
1092 static int tcp_to_nlattr(struct sk_buff
*skb
, struct nlattr
*nla
,
1093 const struct nf_conn
*ct
)
1095 struct nlattr
*nest_parms
;
1096 struct nf_ct_tcp_flags tmp
= {};
1098 read_lock_bh(&tcp_lock
);
1099 nest_parms
= nla_nest_start(skb
, CTA_PROTOINFO_TCP
| NLA_F_NESTED
);
1101 goto nla_put_failure
;
1103 NLA_PUT_U8(skb
, CTA_PROTOINFO_TCP_STATE
, ct
->proto
.tcp
.state
);
1105 NLA_PUT_U8(skb
, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL
,
1106 ct
->proto
.tcp
.seen
[0].td_scale
);
1108 NLA_PUT_U8(skb
, CTA_PROTOINFO_TCP_WSCALE_REPLY
,
1109 ct
->proto
.tcp
.seen
[1].td_scale
);
1111 tmp
.flags
= ct
->proto
.tcp
.seen
[0].flags
;
1112 NLA_PUT(skb
, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL
,
1113 sizeof(struct nf_ct_tcp_flags
), &tmp
);
1115 tmp
.flags
= ct
->proto
.tcp
.seen
[1].flags
;
1116 NLA_PUT(skb
, CTA_PROTOINFO_TCP_FLAGS_REPLY
,
1117 sizeof(struct nf_ct_tcp_flags
), &tmp
);
1118 read_unlock_bh(&tcp_lock
);
1120 nla_nest_end(skb
, nest_parms
);
1125 read_unlock_bh(&tcp_lock
);
1129 static const struct nla_policy tcp_nla_policy
[CTA_PROTOINFO_TCP_MAX
+1] = {
1130 [CTA_PROTOINFO_TCP_STATE
] = { .type
= NLA_U8
},
1131 [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL
] = { .type
= NLA_U8
},
1132 [CTA_PROTOINFO_TCP_WSCALE_REPLY
] = { .type
= NLA_U8
},
1133 [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL
] = { .len
= sizeof(struct nf_ct_tcp_flags
) },
1134 [CTA_PROTOINFO_TCP_FLAGS_REPLY
] = { .len
= sizeof(struct nf_ct_tcp_flags
) },
1137 static int nlattr_to_tcp(struct nlattr
*cda
[], struct nf_conn
*ct
)
1139 struct nlattr
*pattr
= cda
[CTA_PROTOINFO_TCP
];
1140 struct nlattr
*tb
[CTA_PROTOINFO_TCP_MAX
+1];
1143 /* updates could not contain anything about the private
1144 * protocol info, in that case skip the parsing */
1148 err
= nla_parse_nested(tb
, CTA_PROTOINFO_TCP_MAX
, pattr
, tcp_nla_policy
);
1152 if (tb
[CTA_PROTOINFO_TCP_STATE
] &&
1153 nla_get_u8(tb
[CTA_PROTOINFO_TCP_STATE
]) >= TCP_CONNTRACK_MAX
)
1156 write_lock_bh(&tcp_lock
);
1157 if (tb
[CTA_PROTOINFO_TCP_STATE
])
1158 ct
->proto
.tcp
.state
= nla_get_u8(tb
[CTA_PROTOINFO_TCP_STATE
]);
1160 if (tb
[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL
]) {
1161 struct nf_ct_tcp_flags
*attr
=
1162 nla_data(tb
[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL
]);
1163 ct
->proto
.tcp
.seen
[0].flags
&= ~attr
->mask
;
1164 ct
->proto
.tcp
.seen
[0].flags
|= attr
->flags
& attr
->mask
;
1167 if (tb
[CTA_PROTOINFO_TCP_FLAGS_REPLY
]) {
1168 struct nf_ct_tcp_flags
*attr
=
1169 nla_data(tb
[CTA_PROTOINFO_TCP_FLAGS_REPLY
]);
1170 ct
->proto
.tcp
.seen
[1].flags
&= ~attr
->mask
;
1171 ct
->proto
.tcp
.seen
[1].flags
|= attr
->flags
& attr
->mask
;
1174 if (tb
[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL
] &&
1175 tb
[CTA_PROTOINFO_TCP_WSCALE_REPLY
] &&
1176 ct
->proto
.tcp
.seen
[0].flags
& IP_CT_TCP_FLAG_WINDOW_SCALE
&&
1177 ct
->proto
.tcp
.seen
[1].flags
& IP_CT_TCP_FLAG_WINDOW_SCALE
) {
1178 ct
->proto
.tcp
.seen
[0].td_scale
=
1179 nla_get_u8(tb
[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL
]);
1180 ct
->proto
.tcp
.seen
[1].td_scale
=
1181 nla_get_u8(tb
[CTA_PROTOINFO_TCP_WSCALE_REPLY
]);
1183 write_unlock_bh(&tcp_lock
);
1188 static int tcp_nlattr_size(void)
1190 return nla_total_size(0) /* CTA_PROTOINFO_TCP */
1191 + nla_policy_len(tcp_nla_policy
, CTA_PROTOINFO_TCP_MAX
+ 1);
1194 static int tcp_nlattr_tuple_size(void)
1196 return nla_policy_len(nf_ct_port_nla_policy
, CTA_PROTO_MAX
+ 1);
1200 #ifdef CONFIG_SYSCTL
1201 static unsigned int tcp_sysctl_table_users
;
1202 static struct ctl_table_header
*tcp_sysctl_header
;
1203 static struct ctl_table tcp_sysctl_table
[] = {
1205 .procname
= "nf_conntrack_tcp_timeout_syn_sent",
1206 .data
= &tcp_timeouts
[TCP_CONNTRACK_SYN_SENT
],
1207 .maxlen
= sizeof(unsigned int),
1209 .proc_handler
= proc_dointvec_jiffies
,
1212 .procname
= "nf_conntrack_tcp_timeout_syn_recv",
1213 .data
= &tcp_timeouts
[TCP_CONNTRACK_SYN_RECV
],
1214 .maxlen
= sizeof(unsigned int),
1216 .proc_handler
= proc_dointvec_jiffies
,
1219 .procname
= "nf_conntrack_tcp_timeout_established",
1220 .data
= &tcp_timeouts
[TCP_CONNTRACK_ESTABLISHED
],
1221 .maxlen
= sizeof(unsigned int),
1223 .proc_handler
= proc_dointvec_jiffies
,
1226 .procname
= "nf_conntrack_tcp_timeout_fin_wait",
1227 .data
= &tcp_timeouts
[TCP_CONNTRACK_FIN_WAIT
],
1228 .maxlen
= sizeof(unsigned int),
1230 .proc_handler
= proc_dointvec_jiffies
,
1233 .procname
= "nf_conntrack_tcp_timeout_close_wait",
1234 .data
= &tcp_timeouts
[TCP_CONNTRACK_CLOSE_WAIT
],
1235 .maxlen
= sizeof(unsigned int),
1237 .proc_handler
= proc_dointvec_jiffies
,
1240 .procname
= "nf_conntrack_tcp_timeout_last_ack",
1241 .data
= &tcp_timeouts
[TCP_CONNTRACK_LAST_ACK
],
1242 .maxlen
= sizeof(unsigned int),
1244 .proc_handler
= proc_dointvec_jiffies
,
1247 .procname
= "nf_conntrack_tcp_timeout_time_wait",
1248 .data
= &tcp_timeouts
[TCP_CONNTRACK_TIME_WAIT
],
1249 .maxlen
= sizeof(unsigned int),
1251 .proc_handler
= proc_dointvec_jiffies
,
1254 .procname
= "nf_conntrack_tcp_timeout_close",
1255 .data
= &tcp_timeouts
[TCP_CONNTRACK_CLOSE
],
1256 .maxlen
= sizeof(unsigned int),
1258 .proc_handler
= proc_dointvec_jiffies
,
1261 .procname
= "nf_conntrack_tcp_timeout_max_retrans",
1262 .data
= &nf_ct_tcp_timeout_max_retrans
,
1263 .maxlen
= sizeof(unsigned int),
1265 .proc_handler
= proc_dointvec_jiffies
,
1268 .procname
= "nf_conntrack_tcp_timeout_unacknowledged",
1269 .data
= &nf_ct_tcp_timeout_unacknowledged
,
1270 .maxlen
= sizeof(unsigned int),
1272 .proc_handler
= proc_dointvec_jiffies
,
1275 .ctl_name
= NET_NF_CONNTRACK_TCP_LOOSE
,
1276 .procname
= "nf_conntrack_tcp_loose",
1277 .data
= &nf_ct_tcp_loose
,
1278 .maxlen
= sizeof(unsigned int),
1280 .proc_handler
= proc_dointvec
,
1283 .ctl_name
= NET_NF_CONNTRACK_TCP_BE_LIBERAL
,
1284 .procname
= "nf_conntrack_tcp_be_liberal",
1285 .data
= &nf_ct_tcp_be_liberal
,
1286 .maxlen
= sizeof(unsigned int),
1288 .proc_handler
= proc_dointvec
,
1291 .ctl_name
= NET_NF_CONNTRACK_TCP_MAX_RETRANS
,
1292 .procname
= "nf_conntrack_tcp_max_retrans",
1293 .data
= &nf_ct_tcp_max_retrans
,
1294 .maxlen
= sizeof(unsigned int),
1296 .proc_handler
= proc_dointvec
,
1303 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1304 static struct ctl_table tcp_compat_sysctl_table
[] = {
1306 .procname
= "ip_conntrack_tcp_timeout_syn_sent",
1307 .data
= &tcp_timeouts
[TCP_CONNTRACK_SYN_SENT
],
1308 .maxlen
= sizeof(unsigned int),
1310 .proc_handler
= proc_dointvec_jiffies
,
1313 .procname
= "ip_conntrack_tcp_timeout_syn_recv",
1314 .data
= &tcp_timeouts
[TCP_CONNTRACK_SYN_RECV
],
1315 .maxlen
= sizeof(unsigned int),
1317 .proc_handler
= proc_dointvec_jiffies
,
1320 .procname
= "ip_conntrack_tcp_timeout_established",
1321 .data
= &tcp_timeouts
[TCP_CONNTRACK_ESTABLISHED
],
1322 .maxlen
= sizeof(unsigned int),
1324 .proc_handler
= proc_dointvec_jiffies
,
1327 .procname
= "ip_conntrack_tcp_timeout_fin_wait",
1328 .data
= &tcp_timeouts
[TCP_CONNTRACK_FIN_WAIT
],
1329 .maxlen
= sizeof(unsigned int),
1331 .proc_handler
= proc_dointvec_jiffies
,
1334 .procname
= "ip_conntrack_tcp_timeout_close_wait",
1335 .data
= &tcp_timeouts
[TCP_CONNTRACK_CLOSE_WAIT
],
1336 .maxlen
= sizeof(unsigned int),
1338 .proc_handler
= proc_dointvec_jiffies
,
1341 .procname
= "ip_conntrack_tcp_timeout_last_ack",
1342 .data
= &tcp_timeouts
[TCP_CONNTRACK_LAST_ACK
],
1343 .maxlen
= sizeof(unsigned int),
1345 .proc_handler
= proc_dointvec_jiffies
,
1348 .procname
= "ip_conntrack_tcp_timeout_time_wait",
1349 .data
= &tcp_timeouts
[TCP_CONNTRACK_TIME_WAIT
],
1350 .maxlen
= sizeof(unsigned int),
1352 .proc_handler
= proc_dointvec_jiffies
,
1355 .procname
= "ip_conntrack_tcp_timeout_close",
1356 .data
= &tcp_timeouts
[TCP_CONNTRACK_CLOSE
],
1357 .maxlen
= sizeof(unsigned int),
1359 .proc_handler
= proc_dointvec_jiffies
,
1362 .procname
= "ip_conntrack_tcp_timeout_max_retrans",
1363 .data
= &nf_ct_tcp_timeout_max_retrans
,
1364 .maxlen
= sizeof(unsigned int),
1366 .proc_handler
= proc_dointvec_jiffies
,
1369 .ctl_name
= NET_IPV4_NF_CONNTRACK_TCP_LOOSE
,
1370 .procname
= "ip_conntrack_tcp_loose",
1371 .data
= &nf_ct_tcp_loose
,
1372 .maxlen
= sizeof(unsigned int),
1374 .proc_handler
= proc_dointvec
,
1377 .ctl_name
= NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL
,
1378 .procname
= "ip_conntrack_tcp_be_liberal",
1379 .data
= &nf_ct_tcp_be_liberal
,
1380 .maxlen
= sizeof(unsigned int),
1382 .proc_handler
= proc_dointvec
,
1385 .ctl_name
= NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS
,
1386 .procname
= "ip_conntrack_tcp_max_retrans",
1387 .data
= &nf_ct_tcp_max_retrans
,
1388 .maxlen
= sizeof(unsigned int),
1390 .proc_handler
= proc_dointvec
,
1396 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
1397 #endif /* CONFIG_SYSCTL */
1399 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly
=
1402 .l4proto
= IPPROTO_TCP
,
1404 .pkt_to_tuple
= tcp_pkt_to_tuple
,
1405 .invert_tuple
= tcp_invert_tuple
,
1406 .print_tuple
= tcp_print_tuple
,
1407 .print_conntrack
= tcp_print_conntrack
,
1408 .packet
= tcp_packet
,
1411 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1412 .to_nlattr
= tcp_to_nlattr
,
1413 .nlattr_size
= tcp_nlattr_size
,
1414 .from_nlattr
= nlattr_to_tcp
,
1415 .tuple_to_nlattr
= nf_ct_port_tuple_to_nlattr
,
1416 .nlattr_to_tuple
= nf_ct_port_nlattr_to_tuple
,
1417 .nlattr_tuple_size
= tcp_nlattr_tuple_size
,
1418 .nla_policy
= nf_ct_port_nla_policy
,
1420 #ifdef CONFIG_SYSCTL
1421 .ctl_table_users
= &tcp_sysctl_table_users
,
1422 .ctl_table_header
= &tcp_sysctl_header
,
1423 .ctl_table
= tcp_sysctl_table
,
1424 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1425 .ctl_compat_table
= tcp_compat_sysctl_table
,
1429 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4
);
1431 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly
=
1433 .l3proto
= PF_INET6
,
1434 .l4proto
= IPPROTO_TCP
,
1436 .pkt_to_tuple
= tcp_pkt_to_tuple
,
1437 .invert_tuple
= tcp_invert_tuple
,
1438 .print_tuple
= tcp_print_tuple
,
1439 .print_conntrack
= tcp_print_conntrack
,
1440 .packet
= tcp_packet
,
1443 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1444 .to_nlattr
= tcp_to_nlattr
,
1445 .nlattr_size
= tcp_nlattr_size
,
1446 .from_nlattr
= nlattr_to_tcp
,
1447 .tuple_to_nlattr
= nf_ct_port_tuple_to_nlattr
,
1448 .nlattr_to_tuple
= nf_ct_port_nlattr_to_tuple
,
1449 .nlattr_tuple_size
= tcp_nlattr_tuple_size
,
1450 .nla_policy
= nf_ct_port_nla_policy
,
1452 #ifdef CONFIG_SYSCTL
1453 .ctl_table_users
= &tcp_sysctl_table_users
,
1454 .ctl_table_header
= &tcp_sysctl_header
,
1455 .ctl_table
= tcp_sysctl_table
,
1458 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6
);