1
2
3
4
5
6
7
8
9#include <linux/types.h>
10#include <linux/timer.h>
11#include <linux/module.h>
12#include <linux/in.h>
13#include <linux/tcp.h>
14#include <linux/spinlock.h>
15#include <linux/skbuff.h>
16#include <linux/ipv6.h>
17#include <net/ip6_checksum.h>
18#include <asm/unaligned.h>
19
20#include <net/tcp.h>
21
22#include <linux/netfilter.h>
23#include <linux/netfilter_ipv4.h>
24#include <linux/netfilter_ipv6.h>
25#include <net/netfilter/nf_conntrack.h>
26#include <net/netfilter/nf_conntrack_l4proto.h>
27#include <net/netfilter/nf_conntrack_ecache.h>
28#include <net/netfilter/nf_log.h>
29#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
30#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
31
32
33
34
35static int nf_ct_tcp_be_liberal __read_mostly = 0;
36
37
38
39static int nf_ct_tcp_loose __read_mostly = 1;
40
41
42
43
44static int nf_ct_tcp_max_retrans __read_mostly = 3;
45
46
47
48
49static const char *const tcp_conntrack_names[] = {
50 "NONE",
51 "SYN_SENT",
52 "SYN_RECV",
53 "ESTABLISHED",
54 "FIN_WAIT",
55 "CLOSE_WAIT",
56 "LAST_ACK",
57 "TIME_WAIT",
58 "CLOSE",
59 "SYN_SENT2",
60};
61
62#define SECS * HZ
63#define MINS * 60 SECS
64#define HOURS * 60 MINS
65#define DAYS * 24 HOURS
66
67
68
69
70static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly = 5 MINS;
71static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly = 5 MINS;
72
73static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
74 [TCP_CONNTRACK_SYN_SENT] = 2 MINS,
75 [TCP_CONNTRACK_SYN_RECV] = 60 SECS,
76 [TCP_CONNTRACK_ESTABLISHED] = 5 DAYS,
77 [TCP_CONNTRACK_FIN_WAIT] = 2 MINS,
78 [TCP_CONNTRACK_CLOSE_WAIT] = 60 SECS,
79 [TCP_CONNTRACK_LAST_ACK] = 30 SECS,
80 [TCP_CONNTRACK_TIME_WAIT] = 2 MINS,
81 [TCP_CONNTRACK_CLOSE] = 10 SECS,
82 [TCP_CONNTRACK_SYN_SENT2] = 2 MINS,
83};
84
85#define sNO TCP_CONNTRACK_NONE
86#define sSS TCP_CONNTRACK_SYN_SENT
87#define sSR TCP_CONNTRACK_SYN_RECV
88#define sES TCP_CONNTRACK_ESTABLISHED
89#define sFW TCP_CONNTRACK_FIN_WAIT
90#define sCW TCP_CONNTRACK_CLOSE_WAIT
91#define sLA TCP_CONNTRACK_LAST_ACK
92#define sTW TCP_CONNTRACK_TIME_WAIT
93#define sCL TCP_CONNTRACK_CLOSE
94#define sS2 TCP_CONNTRACK_SYN_SENT2
95#define sIV TCP_CONNTRACK_MAX
96#define sIG TCP_CONNTRACK_IGNORE
97
98
99enum tcp_bit_set {
100 TCP_SYN_SET,
101 TCP_SYNACK_SET,
102 TCP_FIN_SET,
103 TCP_ACK_SET,
104 TCP_RST_SET,
105 TCP_NONE_SET,
106};
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
142 {
143
144
145 { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sS2 },
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162 { sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179 { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196 { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
197
198
199
200
201
202
203
204
205
206
207
208
209
210 { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
211 { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
212 },
213 {
214
215
216 { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sS2 },
217
218
219
220
221
222
223
224
225
226
227
228
229
230 { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
231
232
233
234
235
236
237
238
239
240
241
242
243 { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
244
245
246
247
248
249
250
251
252
253
254
255
256 { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIG },
257
258
259
260
261
262
263
264
265
266
267
268
269 { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
270 { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
271 }
272};
273
274static bool tcp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
275 struct nf_conntrack_tuple *tuple)
276{
277 const struct tcphdr *hp;
278 struct tcphdr _hdr;
279
280
281 hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
282 if (hp == NULL)
283 return false;
284
285 tuple->src.u.tcp.port = hp->source;
286 tuple->dst.u.tcp.port = hp->dest;
287
288 return true;
289}
290
291static bool tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
292 const struct nf_conntrack_tuple *orig)
293{
294 tuple->src.u.tcp.port = orig->dst.u.tcp.port;
295 tuple->dst.u.tcp.port = orig->src.u.tcp.port;
296 return true;
297}
298
299
300static int tcp_print_tuple(struct seq_file *s,
301 const struct nf_conntrack_tuple *tuple)
302{
303 return seq_printf(s, "sport=%hu dport=%hu ",
304 ntohs(tuple->src.u.tcp.port),
305 ntohs(tuple->dst.u.tcp.port));
306}
307
308
309static int tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
310{
311 enum tcp_conntrack state;
312
313 spin_lock_bh(&ct->lock);
314 state = ct->proto.tcp.state;
315 spin_unlock_bh(&ct->lock);
316
317 return seq_printf(s, "%s ", tcp_conntrack_names[state]);
318}
319
320static unsigned int get_conntrack_index(const struct tcphdr *tcph)
321{
322 if (tcph->rst) return TCP_RST_SET;
323 else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
324 else if (tcph->fin) return TCP_FIN_SET;
325 else if (tcph->ack) return TCP_ACK_SET;
326 else return TCP_NONE_SET;
327}
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358static inline __u32 segment_seq_plus_len(__u32 seq,
359 size_t len,
360 unsigned int dataoff,
361 const struct tcphdr *tcph)
362{
363
364
365 return (seq + len - dataoff - tcph->doff*4
366 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
367}
368
369
370#define MAXACKWINCONST 66000
371#define MAXACKWINDOW(sender) \
372 ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin \
373 : MAXACKWINCONST)
374
375
376
377
378static void tcp_options(const struct sk_buff *skb,
379 unsigned int dataoff,
380 const struct tcphdr *tcph,
381 struct ip_ct_tcp_state *state)
382{
383 unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
384 const unsigned char *ptr;
385 int length = (tcph->doff*4) - sizeof(struct tcphdr);
386
387 if (!length)
388 return;
389
390 ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
391 length, buff);
392 BUG_ON(ptr == NULL);
393
394 state->td_scale =
395 state->flags = 0;
396
397 while (length > 0) {
398 int opcode=*ptr++;
399 int opsize;
400
401 switch (opcode) {
402 case TCPOPT_EOL:
403 return;
404 case TCPOPT_NOP:
405 length--;
406 continue;
407 default:
408 opsize=*ptr++;
409 if (opsize < 2)
410 return;
411 if (opsize > length)
412 break;
413
414 if (opcode == TCPOPT_SACK_PERM
415 && opsize == TCPOLEN_SACK_PERM)
416 state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
417 else if (opcode == TCPOPT_WINDOW
418 && opsize == TCPOLEN_WINDOW) {
419 state->td_scale = *(u_int8_t *)ptr;
420
421 if (state->td_scale > 14) {
422
423 state->td_scale = 14;
424 }
425 state->flags |=
426 IP_CT_TCP_FLAG_WINDOW_SCALE;
427 }
428 ptr += opsize - 2;
429 length -= opsize;
430 }
431 }
432}
433
434static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
435 const struct tcphdr *tcph, __u32 *sack)
436{
437 unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
438 const unsigned char *ptr;
439 int length = (tcph->doff*4) - sizeof(struct tcphdr);
440 __u32 tmp;
441
442 if (!length)
443 return;
444
445 ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
446 length, buff);
447 BUG_ON(ptr == NULL);
448
449
450 if (length == TCPOLEN_TSTAMP_ALIGNED*4
451 && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
452 | (TCPOPT_NOP << 16)
453 | (TCPOPT_TIMESTAMP << 8)
454 | TCPOLEN_TIMESTAMP))
455 return;
456
457 while (length > 0) {
458 int opcode = *ptr++;
459 int opsize, i;
460
461 switch (opcode) {
462 case TCPOPT_EOL:
463 return;
464 case TCPOPT_NOP:
465 length--;
466 continue;
467 default:
468 opsize = *ptr++;
469 if (opsize < 2)
470 return;
471 if (opsize > length)
472 break;
473
474 if (opcode == TCPOPT_SACK
475 && opsize >= (TCPOLEN_SACK_BASE
476 + TCPOLEN_SACK_PERBLOCK)
477 && !((opsize - TCPOLEN_SACK_BASE)
478 % TCPOLEN_SACK_PERBLOCK)) {
479 for (i = 0;
480 i < (opsize - TCPOLEN_SACK_BASE);
481 i += TCPOLEN_SACK_PERBLOCK) {
482 tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
483
484 if (after(tmp, *sack))
485 *sack = tmp;
486 }
487 return;
488 }
489 ptr += opsize - 2;
490 length -= opsize;
491 }
492 }
493}
494
495#ifdef CONFIG_NF_NAT_NEEDED
496static inline s16 nat_offset(const struct nf_conn *ct,
497 enum ip_conntrack_dir dir,
498 u32 seq)
499{
500 typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
501
502 return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
503}
504#define NAT_OFFSET(pf, ct, dir, seq) \
505 (pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0)
506#else
507#define NAT_OFFSET(pf, ct, dir, seq) 0
508#endif
509
510static bool tcp_in_window(const struct nf_conn *ct,
511 struct ip_ct_tcp *state,
512 enum ip_conntrack_dir dir,
513 unsigned int index,
514 const struct sk_buff *skb,
515 unsigned int dataoff,
516 const struct tcphdr *tcph,
517 u_int8_t pf)
518{
519 struct net *net = nf_ct_net(ct);
520 struct ip_ct_tcp_state *sender = &state->seen[dir];
521 struct ip_ct_tcp_state *receiver = &state->seen[!dir];
522 const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
523 __u32 seq, ack, sack, end, win, swin;
524 s16 receiver_offset;
525 bool res;
526
527
528
529
530 seq = ntohl(tcph->seq);
531 ack = sack = ntohl(tcph->ack_seq);
532 win = ntohs(tcph->window);
533 end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
534
535 if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
536 tcp_sack(skb, dataoff, tcph, &sack);
537
538
539 receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);
540 ack -= receiver_offset;
541 sack -= receiver_offset;
542
543 pr_debug("tcp_in_window: START\n");
544 pr_debug("tcp_in_window: ");
545 nf_ct_dump_tuple(tuple);
546 pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
547 seq, ack, receiver_offset, sack, receiver_offset, win, end);
548 pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
549 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
550 sender->td_end, sender->td_maxend, sender->td_maxwin,
551 sender->td_scale,
552 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
553 receiver->td_scale);
554
555 if (sender->td_maxwin == 0) {
556
557
558
559 if (tcph->syn) {
560
561
562
563
564 sender->td_end =
565 sender->td_maxend = end;
566 sender->td_maxwin = (win == 0 ? 1 : win);
567
568 tcp_options(skb, dataoff, tcph, sender);
569
570
571
572
573
574 if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
575 && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
576 sender->td_scale =
577 receiver->td_scale = 0;
578 if (!tcph->ack)
579
580 return true;
581 } else {
582
583
584
585
586
587 sender->td_end = end;
588 sender->td_maxwin = (win == 0 ? 1 : win);
589 sender->td_maxend = end + sender->td_maxwin;
590 }
591 } else if (((state->state == TCP_CONNTRACK_SYN_SENT
592 && dir == IP_CT_DIR_ORIGINAL)
593 || (state->state == TCP_CONNTRACK_SYN_RECV
594 && dir == IP_CT_DIR_REPLY))
595 && after(end, sender->td_end)) {
596
597
598
599
600
601 sender->td_end =
602 sender->td_maxend = end;
603 sender->td_maxwin = (win == 0 ? 1 : win);
604
605 tcp_options(skb, dataoff, tcph, sender);
606 }
607
608 if (!(tcph->ack)) {
609
610
611
612 ack = sack = receiver->td_end;
613 } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
614 (TCP_FLAG_ACK|TCP_FLAG_RST))
615 && (ack == 0)) {
616
617
618
619
620 ack = sack = receiver->td_end;
621 }
622
623 if (seq == end
624 && (!tcph->rst
625 || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
626
627
628
629
630
631
632
633 seq = end = sender->td_end;
634
635 pr_debug("tcp_in_window: ");
636 nf_ct_dump_tuple(tuple);
637 pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
638 seq, ack, receiver_offset, sack, receiver_offset, win, end);
639 pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
640 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
641 sender->td_end, sender->td_maxend, sender->td_maxwin,
642 sender->td_scale,
643 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
644 receiver->td_scale);
645
646 pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
647 before(seq, sender->td_maxend + 1),
648 after(end, sender->td_end - receiver->td_maxwin - 1),
649 before(sack, receiver->td_end + 1),
650 after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
651
652 if (before(seq, sender->td_maxend + 1) &&
653 after(end, sender->td_end - receiver->td_maxwin - 1) &&
654 before(sack, receiver->td_end + 1) &&
655 after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
656
657
658
659 if (!tcph->syn)
660 win <<= sender->td_scale;
661
662
663
664
665 swin = win + (sack - ack);
666 if (sender->td_maxwin < swin)
667 sender->td_maxwin = swin;
668 if (after(end, sender->td_end)) {
669 sender->td_end = end;
670 sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
671 }
672 if (tcph->ack) {
673 if (!(sender->flags & IP_CT_TCP_FLAG_MAXACK_SET)) {
674 sender->td_maxack = ack;
675 sender->flags |= IP_CT_TCP_FLAG_MAXACK_SET;
676 } else if (after(ack, sender->td_maxack))
677 sender->td_maxack = ack;
678 }
679
680
681
682
683 if (after(end, sender->td_maxend))
684 receiver->td_maxwin += end - sender->td_maxend;
685 if (after(sack + win, receiver->td_maxend - 1)) {
686 receiver->td_maxend = sack + win;
687 if (win == 0)
688 receiver->td_maxend++;
689 }
690 if (ack == receiver->td_end)
691 receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
692
693
694
695
696 if (index == TCP_ACK_SET) {
697 if (state->last_dir == dir
698 && state->last_seq == seq
699 && state->last_ack == ack
700 && state->last_end == end
701 && state->last_win == win)
702 state->retrans++;
703 else {
704 state->last_dir = dir;
705 state->last_seq = seq;
706 state->last_ack = ack;
707 state->last_end = end;
708 state->last_win = win;
709 state->retrans = 0;
710 }
711 }
712 res = true;
713 } else {
714 res = false;
715 if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
716 nf_ct_tcp_be_liberal)
717 res = true;
718 if (!res && LOG_INVALID(net, IPPROTO_TCP))
719 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
720 "nf_ct_tcp: %s ",
721 before(seq, sender->td_maxend + 1) ?
722 after(end, sender->td_end - receiver->td_maxwin - 1) ?
723 before(sack, receiver->td_end + 1) ?
724 after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
725 : "ACK is under the lower bound (possible overly delayed ACK)"
726 : "ACK is over the upper bound (ACKed data not seen yet)"
727 : "SEQ is under the lower bound (already ACKed data retransmitted)"
728 : "SEQ is over the upper bound (over the window of the receiver)");
729 }
730
731 pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
732 "receiver end=%u maxend=%u maxwin=%u\n",
733 res, sender->td_end, sender->td_maxend, sender->td_maxwin,
734 receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
735
736 return res;
737}
738
739#define TH_FIN 0x01
740#define TH_SYN 0x02
741#define TH_RST 0x04
742#define TH_PUSH 0x08
743#define TH_ACK 0x10
744#define TH_URG 0x20
745#define TH_ECE 0x40
746#define TH_CWR 0x80
747
748
749static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
750{
751 [TH_SYN] = 1,
752 [TH_SYN|TH_URG] = 1,
753 [TH_SYN|TH_ACK] = 1,
754 [TH_RST] = 1,
755 [TH_RST|TH_ACK] = 1,
756 [TH_FIN|TH_ACK] = 1,
757 [TH_FIN|TH_ACK|TH_URG] = 1,
758 [TH_ACK] = 1,
759 [TH_ACK|TH_URG] = 1,
760};
761
762
763static int tcp_error(struct net *net,
764 struct sk_buff *skb,
765 unsigned int dataoff,
766 enum ip_conntrack_info *ctinfo,
767 u_int8_t pf,
768 unsigned int hooknum)
769{
770 const struct tcphdr *th;
771 struct tcphdr _tcph;
772 unsigned int tcplen = skb->len - dataoff;
773 u_int8_t tcpflags;
774
775
776 th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
777 if (th == NULL) {
778 if (LOG_INVALID(net, IPPROTO_TCP))
779 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
780 "nf_ct_tcp: short packet ");
781 return -NF_ACCEPT;
782 }
783
784
785 if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
786 if (LOG_INVALID(net, IPPROTO_TCP))
787 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
788 "nf_ct_tcp: truncated/malformed packet ");
789 return -NF_ACCEPT;
790 }
791
792
793
794
795
796
797 if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
798 nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
799 if (LOG_INVALID(net, IPPROTO_TCP))
800 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
801 "nf_ct_tcp: bad TCP checksum ");
802 return -NF_ACCEPT;
803 }
804
805
806 tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR|TH_PUSH));
807 if (!tcp_valid_flags[tcpflags]) {
808 if (LOG_INVALID(net, IPPROTO_TCP))
809 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
810 "nf_ct_tcp: invalid TCP flag combination ");
811 return -NF_ACCEPT;
812 }
813
814 return NF_ACCEPT;
815}
816
817
818static int tcp_packet(struct nf_conn *ct,
819 const struct sk_buff *skb,
820 unsigned int dataoff,
821 enum ip_conntrack_info ctinfo,
822 u_int8_t pf,
823 unsigned int hooknum)
824{
825 struct net *net = nf_ct_net(ct);
826 struct nf_conntrack_tuple *tuple;
827 enum tcp_conntrack new_state, old_state;
828 enum ip_conntrack_dir dir;
829 const struct tcphdr *th;
830 struct tcphdr _tcph;
831 unsigned long timeout;
832 unsigned int index;
833
834 th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
835 BUG_ON(th == NULL);
836
837 spin_lock_bh(&ct->lock);
838 old_state = ct->proto.tcp.state;
839 dir = CTINFO2DIR(ctinfo);
840 index = get_conntrack_index(th);
841 new_state = tcp_conntracks[dir][index][old_state];
842 tuple = &ct->tuplehash[dir].tuple;
843
844 switch (new_state) {
845 case TCP_CONNTRACK_SYN_SENT:
846 if (old_state < TCP_CONNTRACK_TIME_WAIT)
847 break;
848
849
850
851
852
853
854
855
856
857
858
859
860 if (((ct->proto.tcp.seen[dir].flags
861 | ct->proto.tcp.seen[!dir].flags)
862 & IP_CT_TCP_FLAG_CLOSE_INIT)
863 || (ct->proto.tcp.last_dir == dir
864 && ct->proto.tcp.last_index == TCP_RST_SET)) {
865
866
867 spin_unlock_bh(&ct->lock);
868
869
870
871
872
873 if (nf_ct_kill(ct))
874 return -NF_REPEAT;
875 return NF_DROP;
876 }
877
878 case TCP_CONNTRACK_IGNORE:
879
880
881
882
883
884
885
886
887
888
889
890
891
892 if (index == TCP_SYNACK_SET
893 && ct->proto.tcp.last_index == TCP_SYN_SET
894 && ct->proto.tcp.last_dir != dir
895 && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
896
897
898
899
900
901
902
903 spin_unlock_bh(&ct->lock);
904 if (LOG_INVALID(net, IPPROTO_TCP))
905 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
906 "nf_ct_tcp: killing out of sync session ");
907 nf_ct_kill(ct);
908 return NF_DROP;
909 }
910 ct->proto.tcp.last_index = index;
911 ct->proto.tcp.last_dir = dir;
912 ct->proto.tcp.last_seq = ntohl(th->seq);
913 ct->proto.tcp.last_end =
914 segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
915
916 spin_unlock_bh(&ct->lock);
917 if (LOG_INVALID(net, IPPROTO_TCP))
918 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
919 "nf_ct_tcp: invalid packet ignored ");
920 return NF_ACCEPT;
921 case TCP_CONNTRACK_MAX:
922
923 pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
924 dir, get_conntrack_index(th), old_state);
925 spin_unlock_bh(&ct->lock);
926 if (LOG_INVALID(net, IPPROTO_TCP))
927 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
928 "nf_ct_tcp: invalid state ");
929 return -NF_ACCEPT;
930 case TCP_CONNTRACK_CLOSE:
931 if (index == TCP_RST_SET
932 && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
933 && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) {
934
935 spin_unlock_bh(&ct->lock);
936 if (LOG_INVALID(net, IPPROTO_TCP))
937 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
938 "nf_ct_tcp: invalid RST ");
939 return -NF_ACCEPT;
940 }
941 if (index == TCP_RST_SET
942 && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
943 && ct->proto.tcp.last_index == TCP_SYN_SET)
944 || (!test_bit(IPS_ASSURED_BIT, &ct->status)
945 && ct->proto.tcp.last_index == TCP_ACK_SET))
946 && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
947
948
949
950
951
952
953
954
955
956 goto in_window;
957 }
958
959 default:
960
961 break;
962 }
963
964 if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
965 skb, dataoff, th, pf)) {
966 spin_unlock_bh(&ct->lock);
967 return -NF_ACCEPT;
968 }
969 in_window:
970
971 ct->proto.tcp.last_index = index;
972 ct->proto.tcp.last_dir = dir;
973
974 pr_debug("tcp_conntracks: ");
975 nf_ct_dump_tuple(tuple);
976 pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
977 (th->syn ? 1 : 0), (th->ack ? 1 : 0),
978 (th->fin ? 1 : 0), (th->rst ? 1 : 0),
979 old_state, new_state);
980
981 ct->proto.tcp.state = new_state;
982 if (old_state != new_state
983 && new_state == TCP_CONNTRACK_FIN_WAIT)
984 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
985
986 if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
987 tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
988 timeout = nf_ct_tcp_timeout_max_retrans;
989 else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
990 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
991 tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
992 timeout = nf_ct_tcp_timeout_unacknowledged;
993 else
994 timeout = tcp_timeouts[new_state];
995 spin_unlock_bh(&ct->lock);
996
997 if (new_state != old_state)
998 nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
999
1000 if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
1001
1002
1003
1004
1005 if (th->rst) {
1006 nf_ct_kill_acct(ct, ctinfo, skb);
1007 return NF_ACCEPT;
1008 }
1009 } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
1010 && (old_state == TCP_CONNTRACK_SYN_RECV
1011 || old_state == TCP_CONNTRACK_ESTABLISHED)
1012 && new_state == TCP_CONNTRACK_ESTABLISHED) {
1013
1014
1015
1016 set_bit(IPS_ASSURED_BIT, &ct->status);
1017 nf_conntrack_event_cache(IPCT_STATUS, ct);
1018 }
1019 nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
1020
1021 return NF_ACCEPT;
1022}
1023
1024
1025static bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
1026 unsigned int dataoff)
1027{
1028 enum tcp_conntrack new_state;
1029 const struct tcphdr *th;
1030 struct tcphdr _tcph;
1031 const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
1032 const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
1033
1034 th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1035 BUG_ON(th == NULL);
1036
1037
1038 new_state
1039 = tcp_conntracks[0][get_conntrack_index(th)]
1040 [TCP_CONNTRACK_NONE];
1041
1042
1043 if (new_state >= TCP_CONNTRACK_MAX) {
1044 pr_debug("nf_ct_tcp: invalid new deleting.\n");
1045 return false;
1046 }
1047
1048 if (new_state == TCP_CONNTRACK_SYN_SENT) {
1049
1050 ct->proto.tcp.seen[0].td_end =
1051 segment_seq_plus_len(ntohl(th->seq), skb->len,
1052 dataoff, th);
1053 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1054 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1055 ct->proto.tcp.seen[0].td_maxwin = 1;
1056 ct->proto.tcp.seen[0].td_maxend =
1057 ct->proto.tcp.seen[0].td_end;
1058
1059 tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
1060 ct->proto.tcp.seen[1].flags = 0;
1061 } else if (nf_ct_tcp_loose == 0) {
1062
1063 return false;
1064 } else {
1065
1066
1067
1068
1069
1070 ct->proto.tcp.seen[0].td_end =
1071 segment_seq_plus_len(ntohl(th->seq), skb->len,
1072 dataoff, th);
1073 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
1074 if (ct->proto.tcp.seen[0].td_maxwin == 0)
1075 ct->proto.tcp.seen[0].td_maxwin = 1;
1076 ct->proto.tcp.seen[0].td_maxend =
1077 ct->proto.tcp.seen[0].td_end +
1078 ct->proto.tcp.seen[0].td_maxwin;
1079 ct->proto.tcp.seen[0].td_scale = 0;
1080
1081
1082
1083 ct->proto.tcp.seen[0].flags =
1084 ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
1085 IP_CT_TCP_FLAG_BE_LIBERAL;
1086 }
1087
1088 ct->proto.tcp.seen[1].td_end = 0;
1089 ct->proto.tcp.seen[1].td_maxend = 0;
1090 ct->proto.tcp.seen[1].td_maxwin = 0;
1091 ct->proto.tcp.seen[1].td_scale = 0;
1092
1093
1094 ct->proto.tcp.state = TCP_CONNTRACK_NONE;
1095 ct->proto.tcp.last_index = TCP_NONE_SET;
1096
1097 pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
1098 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
1099 sender->td_end, sender->td_maxend, sender->td_maxwin,
1100 sender->td_scale,
1101 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
1102 receiver->td_scale);
1103 return true;
1104}
1105
1106#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1107
1108#include <linux/netfilter/nfnetlink.h>
1109#include <linux/netfilter/nfnetlink_conntrack.h>
1110
1111static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
1112 struct nf_conn *ct)
1113{
1114 struct nlattr *nest_parms;
1115 struct nf_ct_tcp_flags tmp = {};
1116
1117 spin_lock_bh(&ct->lock);
1118 nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP | NLA_F_NESTED);
1119 if (!nest_parms)
1120 goto nla_put_failure;
1121
1122 NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state);
1123
1124 NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
1125 ct->proto.tcp.seen[0].td_scale);
1126
1127 NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
1128 ct->proto.tcp.seen[1].td_scale);
1129
1130 tmp.flags = ct->proto.tcp.seen[0].flags;
1131 NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
1132 sizeof(struct nf_ct_tcp_flags), &tmp);
1133
1134 tmp.flags = ct->proto.tcp.seen[1].flags;
1135 NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
1136 sizeof(struct nf_ct_tcp_flags), &tmp);
1137 spin_unlock_bh(&ct->lock);
1138
1139 nla_nest_end(skb, nest_parms);
1140
1141 return 0;
1142
1143nla_put_failure:
1144 spin_unlock_bh(&ct->lock);
1145 return -1;
1146}
1147
1148static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
1149 [CTA_PROTOINFO_TCP_STATE] = { .type = NLA_U8 },
1150 [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
1151 [CTA_PROTOINFO_TCP_WSCALE_REPLY] = { .type = NLA_U8 },
1152 [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL] = { .len = sizeof(struct nf_ct_tcp_flags) },
1153 [CTA_PROTOINFO_TCP_FLAGS_REPLY] = { .len = sizeof(struct nf_ct_tcp_flags) },
1154};
1155
1156static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
1157{
1158 struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
1159 struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
1160 int err;
1161
1162
1163
1164 if (!pattr)
1165 return 0;
1166
1167 err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
1168 if (err < 0)
1169 return err;
1170
1171 if (tb[CTA_PROTOINFO_TCP_STATE] &&
1172 nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
1173 return -EINVAL;
1174
1175 spin_lock_bh(&ct->lock);
1176 if (tb[CTA_PROTOINFO_TCP_STATE])
1177 ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
1178
1179 if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
1180 struct nf_ct_tcp_flags *attr =
1181 nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
1182 ct->proto.tcp.seen[0].flags &= ~attr->mask;
1183 ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
1184 }
1185
1186 if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
1187 struct nf_ct_tcp_flags *attr =
1188 nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
1189 ct->proto.tcp.seen[1].flags &= ~attr->mask;
1190 ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
1191 }
1192
1193 if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
1194 tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
1195 ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
1196 ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1197 ct->proto.tcp.seen[0].td_scale =
1198 nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
1199 ct->proto.tcp.seen[1].td_scale =
1200 nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
1201 }
1202 spin_unlock_bh(&ct->lock);
1203
1204 return 0;
1205}
1206
1207static int tcp_nlattr_size(void)
1208{
1209 return nla_total_size(0)
1210 + nla_policy_len(tcp_nla_policy, CTA_PROTOINFO_TCP_MAX + 1);
1211}
1212
1213static int tcp_nlattr_tuple_size(void)
1214{
1215 return nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
1216}
1217#endif
1218
1219#ifdef CONFIG_SYSCTL
1220static unsigned int tcp_sysctl_table_users;
1221static struct ctl_table_header *tcp_sysctl_header;
1222static struct ctl_table tcp_sysctl_table[] = {
1223 {
1224 .procname = "nf_conntrack_tcp_timeout_syn_sent",
1225 .data = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1226 .maxlen = sizeof(unsigned int),
1227 .mode = 0644,
1228 .proc_handler = proc_dointvec_jiffies,
1229 },
1230 {
1231 .procname = "nf_conntrack_tcp_timeout_syn_recv",
1232 .data = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1233 .maxlen = sizeof(unsigned int),
1234 .mode = 0644,
1235 .proc_handler = proc_dointvec_jiffies,
1236 },
1237 {
1238 .procname = "nf_conntrack_tcp_timeout_established",
1239 .data = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1240 .maxlen = sizeof(unsigned int),
1241 .mode = 0644,
1242 .proc_handler = proc_dointvec_jiffies,
1243 },
1244 {
1245 .procname = "nf_conntrack_tcp_timeout_fin_wait",
1246 .data = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1247 .maxlen = sizeof(unsigned int),
1248 .mode = 0644,
1249 .proc_handler = proc_dointvec_jiffies,
1250 },
1251 {
1252 .procname = "nf_conntrack_tcp_timeout_close_wait",
1253 .data = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1254 .maxlen = sizeof(unsigned int),
1255 .mode = 0644,
1256 .proc_handler = proc_dointvec_jiffies,
1257 },
1258 {
1259 .procname = "nf_conntrack_tcp_timeout_last_ack",
1260 .data = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1261 .maxlen = sizeof(unsigned int),
1262 .mode = 0644,
1263 .proc_handler = proc_dointvec_jiffies,
1264 },
1265 {
1266 .procname = "nf_conntrack_tcp_timeout_time_wait",
1267 .data = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1268 .maxlen = sizeof(unsigned int),
1269 .mode = 0644,
1270 .proc_handler = proc_dointvec_jiffies,
1271 },
1272 {
1273 .procname = "nf_conntrack_tcp_timeout_close",
1274 .data = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1275 .maxlen = sizeof(unsigned int),
1276 .mode = 0644,
1277 .proc_handler = proc_dointvec_jiffies,
1278 },
1279 {
1280 .procname = "nf_conntrack_tcp_timeout_max_retrans",
1281 .data = &nf_ct_tcp_timeout_max_retrans,
1282 .maxlen = sizeof(unsigned int),
1283 .mode = 0644,
1284 .proc_handler = proc_dointvec_jiffies,
1285 },
1286 {
1287 .procname = "nf_conntrack_tcp_timeout_unacknowledged",
1288 .data = &nf_ct_tcp_timeout_unacknowledged,
1289 .maxlen = sizeof(unsigned int),
1290 .mode = 0644,
1291 .proc_handler = proc_dointvec_jiffies,
1292 },
1293 {
1294 .ctl_name = NET_NF_CONNTRACK_TCP_LOOSE,
1295 .procname = "nf_conntrack_tcp_loose",
1296 .data = &nf_ct_tcp_loose,
1297 .maxlen = sizeof(unsigned int),
1298 .mode = 0644,
1299 .proc_handler = proc_dointvec,
1300 },
1301 {
1302 .ctl_name = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
1303 .procname = "nf_conntrack_tcp_be_liberal",
1304 .data = &nf_ct_tcp_be_liberal,
1305 .maxlen = sizeof(unsigned int),
1306 .mode = 0644,
1307 .proc_handler = proc_dointvec,
1308 },
1309 {
1310 .ctl_name = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
1311 .procname = "nf_conntrack_tcp_max_retrans",
1312 .data = &nf_ct_tcp_max_retrans,
1313 .maxlen = sizeof(unsigned int),
1314 .mode = 0644,
1315 .proc_handler = proc_dointvec,
1316 },
1317 {
1318 .ctl_name = 0
1319 }
1320};
1321
1322#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1323static struct ctl_table tcp_compat_sysctl_table[] = {
1324 {
1325 .procname = "ip_conntrack_tcp_timeout_syn_sent",
1326 .data = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
1327 .maxlen = sizeof(unsigned int),
1328 .mode = 0644,
1329 .proc_handler = proc_dointvec_jiffies,
1330 },
1331 {
1332 .procname = "ip_conntrack_tcp_timeout_syn_sent2",
1333 .data = &tcp_timeouts[TCP_CONNTRACK_SYN_SENT2],
1334 .maxlen = sizeof(unsigned int),
1335 .mode = 0644,
1336 .proc_handler = proc_dointvec_jiffies,
1337 },
1338 {
1339 .procname = "ip_conntrack_tcp_timeout_syn_recv",
1340 .data = &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
1341 .maxlen = sizeof(unsigned int),
1342 .mode = 0644,
1343 .proc_handler = proc_dointvec_jiffies,
1344 },
1345 {
1346 .procname = "ip_conntrack_tcp_timeout_established",
1347 .data = &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
1348 .maxlen = sizeof(unsigned int),
1349 .mode = 0644,
1350 .proc_handler = proc_dointvec_jiffies,
1351 },
1352 {
1353 .procname = "ip_conntrack_tcp_timeout_fin_wait",
1354 .data = &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
1355 .maxlen = sizeof(unsigned int),
1356 .mode = 0644,
1357 .proc_handler = proc_dointvec_jiffies,
1358 },
1359 {
1360 .procname = "ip_conntrack_tcp_timeout_close_wait",
1361 .data = &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
1362 .maxlen = sizeof(unsigned int),
1363 .mode = 0644,
1364 .proc_handler = proc_dointvec_jiffies,
1365 },
1366 {
1367 .procname = "ip_conntrack_tcp_timeout_last_ack",
1368 .data = &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
1369 .maxlen = sizeof(unsigned int),
1370 .mode = 0644,
1371 .proc_handler = proc_dointvec_jiffies,
1372 },
1373 {
1374 .procname = "ip_conntrack_tcp_timeout_time_wait",
1375 .data = &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
1376 .maxlen = sizeof(unsigned int),
1377 .mode = 0644,
1378 .proc_handler = proc_dointvec_jiffies,
1379 },
1380 {
1381 .procname = "ip_conntrack_tcp_timeout_close",
1382 .data = &tcp_timeouts[TCP_CONNTRACK_CLOSE],
1383 .maxlen = sizeof(unsigned int),
1384 .mode = 0644,
1385 .proc_handler = proc_dointvec_jiffies,
1386 },
1387 {
1388 .procname = "ip_conntrack_tcp_timeout_max_retrans",
1389 .data = &nf_ct_tcp_timeout_max_retrans,
1390 .maxlen = sizeof(unsigned int),
1391 .mode = 0644,
1392 .proc_handler = proc_dointvec_jiffies,
1393 },
1394 {
1395 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
1396 .procname = "ip_conntrack_tcp_loose",
1397 .data = &nf_ct_tcp_loose,
1398 .maxlen = sizeof(unsigned int),
1399 .mode = 0644,
1400 .proc_handler = proc_dointvec,
1401 },
1402 {
1403 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
1404 .procname = "ip_conntrack_tcp_be_liberal",
1405 .data = &nf_ct_tcp_be_liberal,
1406 .maxlen = sizeof(unsigned int),
1407 .mode = 0644,
1408 .proc_handler = proc_dointvec,
1409 },
1410 {
1411 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
1412 .procname = "ip_conntrack_tcp_max_retrans",
1413 .data = &nf_ct_tcp_max_retrans,
1414 .maxlen = sizeof(unsigned int),
1415 .mode = 0644,
1416 .proc_handler = proc_dointvec,
1417 },
1418 {
1419 .ctl_name = 0
1420 }
1421};
1422#endif
1423#endif
1424
1425struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
1426{
1427 .l3proto = PF_INET,
1428 .l4proto = IPPROTO_TCP,
1429 .name = "tcp",
1430 .pkt_to_tuple = tcp_pkt_to_tuple,
1431 .invert_tuple = tcp_invert_tuple,
1432 .print_tuple = tcp_print_tuple,
1433 .print_conntrack = tcp_print_conntrack,
1434 .packet = tcp_packet,
1435 .new = tcp_new,
1436 .error = tcp_error,
1437#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1438 .to_nlattr = tcp_to_nlattr,
1439 .nlattr_size = tcp_nlattr_size,
1440 .from_nlattr = nlattr_to_tcp,
1441 .tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
1442 .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
1443 .nlattr_tuple_size = tcp_nlattr_tuple_size,
1444 .nla_policy = nf_ct_port_nla_policy,
1445#endif
1446#ifdef CONFIG_SYSCTL
1447 .ctl_table_users = &tcp_sysctl_table_users,
1448 .ctl_table_header = &tcp_sysctl_header,
1449 .ctl_table = tcp_sysctl_table,
1450#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
1451 .ctl_compat_table = tcp_compat_sysctl_table,
1452#endif
1453#endif
1454};
1455EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
1456
1457struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
1458{
1459 .l3proto = PF_INET6,
1460 .l4proto = IPPROTO_TCP,
1461 .name = "tcp",
1462 .pkt_to_tuple = tcp_pkt_to_tuple,
1463 .invert_tuple = tcp_invert_tuple,
1464 .print_tuple = tcp_print_tuple,
1465 .print_conntrack = tcp_print_conntrack,
1466 .packet = tcp_packet,
1467 .new = tcp_new,
1468 .error = tcp_error,
1469#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
1470 .to_nlattr = tcp_to_nlattr,
1471 .nlattr_size = tcp_nlattr_size,
1472 .from_nlattr = nlattr_to_tcp,
1473 .tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
1474 .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
1475 .nlattr_tuple_size = tcp_nlattr_tuple_size,
1476 .nla_policy = nf_ct_port_nla_policy,
1477#endif
1478#ifdef CONFIG_SYSCTL
1479 .ctl_table_users = &tcp_sysctl_table_users,
1480 .ctl_table_header = &tcp_sysctl_header,
1481 .ctl_table = tcp_sysctl_table,
1482#endif
1483};
1484EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);
1485