xref: /linux/net/netfilter/nf_conntrack_proto_tcp.c (revision 91ec2035134982b98fab0609a9fd8480e8217dc1)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /* (C) 1999-2001 Paul `Rusty' Russell
3  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
4  * (C) 2002-2013 Jozsef Kadlecsik <kadlec@netfilter.org>
5  * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
6  */
7 
8 #include <linux/types.h>
9 #include <linux/timer.h>
10 #include <linux/module.h>
11 #include <linux/in.h>
12 #include <linux/tcp.h>
13 #include <linux/spinlock.h>
14 #include <linux/skbuff.h>
15 #include <linux/ipv6.h>
16 #include <net/ip6_checksum.h>
17 #include <linux/unaligned.h>
18 
19 #include <net/tcp.h>
20 
21 #include <linux/netfilter.h>
22 #include <linux/netfilter_ipv4.h>
23 #include <linux/netfilter_ipv6.h>
24 #include <net/netfilter/nf_conntrack.h>
25 #include <net/netfilter/nf_conntrack_l4proto.h>
26 #include <net/netfilter/nf_conntrack_ecache.h>
27 #include <net/netfilter/nf_conntrack_seqadj.h>
28 #include <net/netfilter/nf_conntrack_synproxy.h>
29 #include <net/netfilter/nf_conntrack_timeout.h>
30 #include <net/netfilter/nf_log.h>
31 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
32 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
33 
34   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
35      closely.  They're more complex. --RR */
36 
37 static const char *const tcp_conntrack_names[] = {
38 	"NONE",
39 	"SYN_SENT",
40 	"SYN_RECV",
41 	"ESTABLISHED",
42 	"FIN_WAIT",
43 	"CLOSE_WAIT",
44 	"LAST_ACK",
45 	"TIME_WAIT",
46 	"CLOSE",
47 	"SYN_SENT2",
48 };
49 
50 enum nf_ct_tcp_action {
51 	NFCT_TCP_IGNORE,
52 	NFCT_TCP_INVALID,
53 	NFCT_TCP_ACCEPT,
54 };
55 
56 #define SECS * HZ
57 #define MINS * 60 SECS
58 #define HOURS * 60 MINS
59 #define DAYS * 24 HOURS
60 
61 static const unsigned int tcp_timeouts[TCP_CONNTRACK_TIMEOUT_MAX] = {
62 	[TCP_CONNTRACK_SYN_SENT]	= 2 MINS,
63 	[TCP_CONNTRACK_SYN_RECV]	= 60 SECS,
64 	[TCP_CONNTRACK_ESTABLISHED]	= 5 DAYS,
65 	[TCP_CONNTRACK_FIN_WAIT]	= 2 MINS,
66 	[TCP_CONNTRACK_CLOSE_WAIT]	= 60 SECS,
67 	[TCP_CONNTRACK_LAST_ACK]	= 30 SECS,
68 	[TCP_CONNTRACK_TIME_WAIT]	= 2 MINS,
69 	[TCP_CONNTRACK_CLOSE]		= 10 SECS,
70 	[TCP_CONNTRACK_SYN_SENT2]	= 2 MINS,
71 /* RFC1122 says the R2 limit should be at least 100 seconds.
72    Linux uses 15 packets as limit, which corresponds
73    to ~13-30min depending on RTO. */
74 	[TCP_CONNTRACK_RETRANS]		= 5 MINS,
75 	[TCP_CONNTRACK_UNACK]		= 5 MINS,
76 };
77 
78 #define sNO TCP_CONNTRACK_NONE
79 #define sSS TCP_CONNTRACK_SYN_SENT
80 #define sSR TCP_CONNTRACK_SYN_RECV
81 #define sES TCP_CONNTRACK_ESTABLISHED
82 #define sFW TCP_CONNTRACK_FIN_WAIT
83 #define sCW TCP_CONNTRACK_CLOSE_WAIT
84 #define sLA TCP_CONNTRACK_LAST_ACK
85 #define sTW TCP_CONNTRACK_TIME_WAIT
86 #define sCL TCP_CONNTRACK_CLOSE
87 #define sS2 TCP_CONNTRACK_SYN_SENT2
88 #define sIV TCP_CONNTRACK_MAX
89 #define sIG TCP_CONNTRACK_IGNORE
90 
91 /* What TCP flags are set from RST/SYN/FIN/ACK. */
92 enum tcp_bit_set {
93 	TCP_SYN_SET,
94 	TCP_SYNACK_SET,
95 	TCP_FIN_SET,
96 	TCP_ACK_SET,
97 	TCP_RST_SET,
98 	TCP_NONE_SET,
99 };
100 
101 /*
102  * The TCP state transition table needs a few words...
103  *
104  * We are the man in the middle. All the packets go through us
105  * but might get lost in transit to the destination.
106  * It is assumed that the destinations can't receive segments
107  * we haven't seen.
108  *
109  * The checked segment is in window, but our windows are *not*
110  * equivalent with the ones of the sender/receiver. We always
111  * try to guess the state of the current sender.
112  *
113  * The meaning of the states are:
114  *
115  * NONE:	initial state
116  * SYN_SENT:	SYN-only packet seen
117  * SYN_SENT2:	SYN-only packet seen from reply dir, simultaneous open
118  * SYN_RECV:	SYN-ACK packet seen
119  * ESTABLISHED:	ACK packet seen
120  * FIN_WAIT:	FIN packet seen
121  * CLOSE_WAIT:	ACK seen (after FIN)
122  * LAST_ACK:	FIN seen (after FIN)
123  * TIME_WAIT:	last ACK seen
124  * CLOSE:	closed connection (RST)
125  *
126  * Packets marked as IGNORED (sIG):
127  *	if they may be either invalid or valid
128  *	and the receiver may send back a connection
129  *	closing RST or a SYN/ACK.
130  *
131  * Packets marked as INVALID (sIV):
132  *	if we regard them as truly invalid packets
133  */
134 static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
135 	{
136 /* ORIGINAL */
137 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
138 /*syn*/	   { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sS2 },
139 /*
140  *	sNO -> sSS	Initialize a new connection
141  *	sSS -> sSS	Retransmitted SYN
142  *	sS2 -> sS2	Late retransmitted SYN
143  *	sSR -> sIG
144  *	sES -> sIG	Error: SYNs in window outside the SYN_SENT state
145  *			are errors. Receiver will reply with RST
146  *			and close the connection.
147  *			Or we are not in sync and hold a dead connection.
148  *	sFW -> sIG
149  *	sCW -> sIG
150  *	sLA -> sIG
151  *	sTW -> sSS	Reopened connection (RFC 1122).
152  *	sCL -> sSS
153  */
154 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
155 /*synack*/ { sIV, sIV, sSR, sIV, sIV, sIV, sIV, sIV, sIV, sSR },
156 /*
157  *	sNO -> sIV	Too late and no reason to do anything
158  *	sSS -> sIV	Client can't send SYN and then SYN/ACK
159  *	sS2 -> sSR	SYN/ACK sent to SYN2 in simultaneous open
160  *	sSR -> sSR	Late retransmitted SYN/ACK in simultaneous open
161  *	sES -> sIV	Invalid SYN/ACK packets sent by the client
162  *	sFW -> sIV
163  *	sCW -> sIV
164  *	sLA -> sIV
165  *	sTW -> sIV
166  *	sCL -> sIV
167  */
168 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
169 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
170 /*
171  *	sNO -> sIV	Too late and no reason to do anything...
172  *	sSS -> sIV	Client might not send FIN in this state:
173  *			we enforce waiting for a SYN/ACK reply first.
174  *	sS2 -> sIV
175  *	sSR -> sFW	Close started.
176  *	sES -> sFW
177  *	sFW -> sLA	FIN seen in both directions, waiting for
178  *			the last ACK.
179  *			Might be a retransmitted FIN as well...
180  *	sCW -> sLA
181  *	sLA -> sLA	Retransmitted FIN. Remain in the same state.
182  *	sTW -> sTW
183  *	sCL -> sCL
184  */
185 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
186 /*ack*/	   { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
187 /*
188  *	sNO -> sES	Assumed.
189  *	sSS -> sIV	ACK is invalid: we haven't seen a SYN/ACK yet.
190  *	sS2 -> sIV
191  *	sSR -> sES	Established state is reached.
192  *	sES -> sES	:-)
193  *	sFW -> sCW	Normal close request answered by ACK.
194  *	sCW -> sCW
195  *	sLA -> sTW	Last ACK detected (RFC5961 challenged)
196  *	sTW -> sTW	Retransmitted last ACK. Remain in the same state.
197  *	sCL -> sCL
198  */
199 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
200 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
201 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
202 	},
203 	{
204 /* REPLY */
205 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
206 /*syn*/	   { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sSS, sIV, sS2 },
207 /*
208  *	sNO -> sIV	Never reached.
209  *	sSS -> sS2	Simultaneous open
210  *	sS2 -> sS2	Retransmitted simultaneous SYN
211  *	sSR -> sIV	Invalid SYN packets sent by the server
212  *	sES -> sIV
213  *	sFW -> sIV
214  *	sCW -> sIV
215  *	sLA -> sIV
216  *	sTW -> sSS	Reopened connection, but server may have switched role
217  *	sCL -> sIV
218  */
219 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
220 /*synack*/ { sIV, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
221 /*
222  *	sSS -> sSR	Standard open.
223  *	sS2 -> sSR	Simultaneous open
224  *	sSR -> sIG	Retransmitted SYN/ACK, ignore it.
225  *	sES -> sIG	Late retransmitted SYN/ACK?
226  *	sFW -> sIG	Might be SYN/ACK answering ignored SYN
227  *	sCW -> sIG
228  *	sLA -> sIG
229  *	sTW -> sIG
230  *	sCL -> sIG
231  */
232 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
233 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
234 /*
235  *	sSS -> sIV	Server might not send FIN in this state.
236  *	sS2 -> sIV
237  *	sSR -> sFW	Close started.
238  *	sES -> sFW
239  *	sFW -> sLA	FIN seen in both directions.
240  *	sCW -> sLA
241  *	sLA -> sLA	Retransmitted FIN.
242  *	sTW -> sTW
243  *	sCL -> sCL
244  */
245 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
246 /*ack*/	   { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIG },
247 /*
248  *	sSS -> sIG	Might be a half-open connection.
249  *	sS2 -> sIG
250  *	sSR -> sSR	Might answer late resent SYN.
251  *	sES -> sES	:-)
252  *	sFW -> sCW	Normal close request answered by ACK.
253  *	sCW -> sCW
254  *	sLA -> sTW	Last ACK detected (RFC5961 challenged)
255  *	sTW -> sTW	Retransmitted last ACK.
256  *	sCL -> sCL
257  */
258 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
259 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
260 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
261 	}
262 };
263 
264 #ifdef CONFIG_NF_CONNTRACK_PROCFS
265 /* Print out the private part of the conntrack. */
tcp_print_conntrack(struct seq_file * s,struct nf_conn * ct)266 static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
267 {
268 	if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
269 		return;
270 
271 	seq_printf(s, "%s ", tcp_conntrack_names[ct->proto.tcp.state]);
272 }
273 #endif
274 
get_conntrack_index(const struct tcphdr * tcph)275 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
276 {
277 	if (tcph->rst) return TCP_RST_SET;
278 	else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
279 	else if (tcph->fin) return TCP_FIN_SET;
280 	else if (tcph->ack) return TCP_ACK_SET;
281 	else return TCP_NONE_SET;
282 }
283 
284 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
285    in IP Filter' by Guido van Rooij.
286 
287    http://www.sane.nl/events/sane2000/papers.html
288    http://www.darkart.com/mirrors/www.obfuscation.org/ipf/
289 
290    The boundaries and the conditions are changed according to RFC793:
291    the packet must intersect the window (i.e. segments may be
292    after the right or before the left edge) and thus receivers may ACK
293    segments after the right edge of the window.
294 
295 	td_maxend = max(sack + max(win,1)) seen in reply packets
296 	td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
297 	td_maxwin += seq + len - sender.td_maxend
298 			if seq + len > sender.td_maxend
299 	td_end    = max(seq + len) seen in sent packets
300 
301    I.   Upper bound for valid data:	seq <= sender.td_maxend
302    II.  Lower bound for valid data:	seq + len >= sender.td_end - receiver.td_maxwin
303    III.	Upper bound for valid (s)ack:   sack <= receiver.td_end
304    IV.	Lower bound for valid (s)ack:	sack >= receiver.td_end - MAXACKWINDOW
305 
306    where sack is the highest right edge of sack block found in the packet
307    or ack in the case of packet without SACK option.
308 
309    The upper bound limit for a valid (s)ack is not ignored -
310    we doesn't have to deal with fragments.
311 */
312 
segment_seq_plus_len(__u32 seq,size_t len,unsigned int dataoff,const struct tcphdr * tcph)313 static inline __u32 segment_seq_plus_len(__u32 seq,
314 					 size_t len,
315 					 unsigned int dataoff,
316 					 const struct tcphdr *tcph)
317 {
318 	/* XXX Should I use payload length field in IP/IPv6 header ?
319 	 * - YK */
320 	return (seq + len - dataoff - tcph->doff*4
321 		+ (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
322 }
323 
324 /* Fixme: what about big packets? */
325 #define MAXACKWINCONST			66000
326 #define MAXACKWINDOW(sender)						\
327 	((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin	\
328 					      : MAXACKWINCONST)
329 
330 /*
331  * Simplified tcp_parse_options routine from tcp_input.c
332  */
tcp_options(const struct sk_buff * skb,unsigned int dataoff,const struct tcphdr * tcph,struct ip_ct_tcp_state * state)333 static void tcp_options(const struct sk_buff *skb,
334 			unsigned int dataoff,
335 			const struct tcphdr *tcph,
336 			struct ip_ct_tcp_state *state)
337 {
338 	unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
339 	const unsigned char *ptr;
340 	int length = (tcph->doff*4) - sizeof(struct tcphdr);
341 
342 	if (!length)
343 		return;
344 
345 	ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
346 				 length, buff);
347 	if (!ptr)
348 		return;
349 
350 	state->td_scale = 0;
351 	state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;
352 
353 	while (length > 0) {
354 		int opcode=*ptr++;
355 		int opsize;
356 
357 		switch (opcode) {
358 		case TCPOPT_EOL:
359 			return;
360 		case TCPOPT_NOP:	/* Ref: RFC 793 section 3.1 */
361 			length--;
362 			continue;
363 		default:
364 			if (length < 2)
365 				return;
366 			opsize=*ptr++;
367 			if (opsize < 2) /* "silly options" */
368 				return;
369 			if (opsize > length)
370 				return;	/* don't parse partial options */
371 
372 			if (opcode == TCPOPT_SACK_PERM
373 			    && opsize == TCPOLEN_SACK_PERM)
374 				state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
375 			else if (opcode == TCPOPT_WINDOW
376 				 && opsize == TCPOLEN_WINDOW) {
377 				state->td_scale = *(u_int8_t *)ptr;
378 
379 				if (state->td_scale > TCP_MAX_WSCALE)
380 					state->td_scale = TCP_MAX_WSCALE;
381 
382 				state->flags |=
383 					IP_CT_TCP_FLAG_WINDOW_SCALE;
384 			}
385 			ptr += opsize - 2;
386 			length -= opsize;
387 		}
388 	}
389 }
390 
tcp_sack(const struct sk_buff * skb,unsigned int dataoff,const struct tcphdr * tcph,__u32 * sack)391 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
392                      const struct tcphdr *tcph, __u32 *sack)
393 {
394 	unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
395 	const unsigned char *ptr;
396 	int length = (tcph->doff*4) - sizeof(struct tcphdr);
397 	__u32 tmp;
398 
399 	if (!length)
400 		return;
401 
402 	ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
403 				 length, buff);
404 	if (!ptr)
405 		return;
406 
407 	/* Fast path for timestamp-only option */
408 	if (length == TCPOLEN_TSTAMP_ALIGNED &&
409 	    get_unaligned_be32(ptr) == ((TCPOPT_NOP << 24) |
410 					(TCPOPT_NOP << 16) |
411 					(TCPOPT_TIMESTAMP << 8) |
412 					TCPOLEN_TIMESTAMP))
413 		return;
414 
415 	while (length > 0) {
416 		int opcode = *ptr++;
417 		int opsize, i;
418 
419 		switch (opcode) {
420 		case TCPOPT_EOL:
421 			return;
422 		case TCPOPT_NOP:	/* Ref: RFC 793 section 3.1 */
423 			length--;
424 			continue;
425 		default:
426 			if (length < 2)
427 				return;
428 			opsize = *ptr++;
429 			if (opsize < 2) /* "silly options" */
430 				return;
431 			if (opsize > length)
432 				return;	/* don't parse partial options */
433 
434 			if (opcode == TCPOPT_SACK
435 			    && opsize >= (TCPOLEN_SACK_BASE
436 					  + TCPOLEN_SACK_PERBLOCK)
437 			    && !((opsize - TCPOLEN_SACK_BASE)
438 				 % TCPOLEN_SACK_PERBLOCK)) {
439 				for (i = 0;
440 				     i < (opsize - TCPOLEN_SACK_BASE);
441 				     i += TCPOLEN_SACK_PERBLOCK) {
442 					tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
443 
444 					if (after(tmp, *sack))
445 						*sack = tmp;
446 				}
447 				return;
448 			}
449 			ptr += opsize - 2;
450 			length -= opsize;
451 		}
452 	}
453 }
454 
tcp_init_sender(struct ip_ct_tcp_state * sender,struct ip_ct_tcp_state * receiver,const struct sk_buff * skb,unsigned int dataoff,const struct tcphdr * tcph,u32 end,u32 win,enum ip_conntrack_dir dir)455 static void tcp_init_sender(struct ip_ct_tcp_state *sender,
456 			    struct ip_ct_tcp_state *receiver,
457 			    const struct sk_buff *skb,
458 			    unsigned int dataoff,
459 			    const struct tcphdr *tcph,
460 			    u32 end, u32 win,
461 			    enum ip_conntrack_dir dir)
462 {
463 	/* SYN-ACK in reply to a SYN
464 	 * or SYN from reply direction in simultaneous open.
465 	 */
466 	sender->td_end =
467 	sender->td_maxend = end;
468 	sender->td_maxwin = (win == 0 ? 1 : win);
469 
470 	tcp_options(skb, dataoff, tcph, sender);
471 	/* RFC 1323:
472 	 * Both sides must send the Window Scale option
473 	 * to enable window scaling in either direction.
474 	 */
475 	if (dir == IP_CT_DIR_REPLY &&
476 	    !(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
477 	      receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE)) {
478 		sender->td_scale = 0;
479 		receiver->td_scale = 0;
480 	}
481 }
482 
483 enum nf_tcp_invalid_log_type {
484 	NF_TCP_LOG_NONE,
485 	NF_TCP_LOG_OVERSHOT,
486 	NF_TCP_LOG_SEQ_OVER,
487 	NF_TCP_LOG_ACK_OVER,
488 	NF_TCP_LOG_SEQ_UNDER,
489 	NF_TCP_LOG_ACK_UNDER,
490 };
491 
492 struct nf_tcp_invalid_log {
493 	enum nf_tcp_invalid_log_type type;
494 	u32 value;
495 };
496 
497 static enum nf_ct_tcp_action
nf_tcp_store_invalid(const struct nf_conn * ct,const struct ip_ct_tcp_state * sender,struct nf_tcp_invalid_log * log,enum nf_ct_tcp_action ret,enum nf_tcp_invalid_log_type type,u32 value)498 nf_tcp_store_invalid(const struct nf_conn *ct,
499 		     const struct ip_ct_tcp_state *sender,
500 		     struct nf_tcp_invalid_log *log,
501 		     enum nf_ct_tcp_action ret,
502 		     enum nf_tcp_invalid_log_type type,
503 		     u32 value)
504 {
505 	const struct nf_tcp_net *tn = nf_tcp_pernet(nf_ct_net(ct));
506 	bool be_liberal;
507 
508 	be_liberal = sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL || tn->tcp_be_liberal;
509 	if (be_liberal)
510 		return NFCT_TCP_ACCEPT;
511 
512 	log->type = type;
513 	log->value = value;
514 	return ret;
515 }
516 
nf_tcp_log_invalid(const struct sk_buff * skb,const struct nf_conn * ct,const struct nf_hook_state * state,const struct nf_tcp_invalid_log * log)517 static void nf_tcp_log_invalid(const struct sk_buff *skb,
518 			       const struct nf_conn *ct,
519 			       const struct nf_hook_state *state,
520 			       const struct nf_tcp_invalid_log *log)
521 {
522 	switch (log->type) {
523 	case NF_TCP_LOG_OVERSHOT:
524 		nf_ct_l4proto_log_invalid(skb, ct, state,
525 					  "%u bytes more than expected",
526 					  log->value);
527 		break;
528 	case NF_TCP_LOG_SEQ_OVER:
529 		nf_ct_l4proto_log_invalid(skb, ct, state,
530 					  "SEQ is over upper bound %u (over the window of the receiver)",
531 					  log->value);
532 		break;
533 	case NF_TCP_LOG_ACK_OVER:
534 		nf_ct_l4proto_log_invalid(skb, ct, state,
535 					  "ACK is over upper bound %u (ACKed data not seen yet)",
536 					  log->value);
537 		break;
538 	case NF_TCP_LOG_SEQ_UNDER:
539 		nf_ct_l4proto_log_invalid(skb, ct, state,
540 					  "SEQ is under lower bound %u (already ACKed data retransmitted)",
541 					  log->value);
542 		break;
543 	case NF_TCP_LOG_ACK_UNDER:
544 		nf_ct_l4proto_log_invalid(skb, ct, state,
545 					  "ignored ACK under lower bound %u (possible overly delayed)",
546 					  log->value);
547 		break;
548 	case NF_TCP_LOG_NONE:
549 		break;
550 	}
551 }
552 
553 static enum nf_ct_tcp_action
tcp_in_window(struct nf_conn * ct,enum ip_conntrack_dir dir,unsigned int index,const struct sk_buff * skb,unsigned int dataoff,const struct tcphdr * tcph,struct nf_tcp_invalid_log * log)554 tcp_in_window(struct nf_conn *ct, enum ip_conntrack_dir dir,
555 	      unsigned int index, const struct sk_buff *skb,
556 	      unsigned int dataoff, const struct tcphdr *tcph,
557 	      struct nf_tcp_invalid_log *log)
558 {
559 	struct ip_ct_tcp *state = &ct->proto.tcp;
560 	struct ip_ct_tcp_state *sender = &state->seen[dir];
561 	struct ip_ct_tcp_state *receiver = &state->seen[!dir];
562 	__u32 seq, ack, sack, end, win, swin;
563 	bool in_recv_win, seq_ok;
564 	s32 receiver_offset;
565 	u16 win_raw;
566 
567 	/*
568 	 * Get the required data from the packet.
569 	 */
570 	seq = ntohl(tcph->seq);
571 	ack = sack = ntohl(tcph->ack_seq);
572 	win_raw = ntohs(tcph->window);
573 	win = win_raw;
574 	end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
575 
576 	if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
577 		tcp_sack(skb, dataoff, tcph, &sack);
578 
579 	/* Take into account NAT sequence number mangling */
580 	receiver_offset = nf_ct_seq_offset(ct, !dir, ack - 1);
581 	ack -= receiver_offset;
582 	sack -= receiver_offset;
583 
584 	if (sender->td_maxwin == 0) {
585 		/*
586 		 * Initialize sender data.
587 		 */
588 		if (tcph->syn) {
589 			tcp_init_sender(sender, receiver,
590 					skb, dataoff, tcph,
591 					end, win, dir);
592 			if (!tcph->ack)
593 				/* Simultaneous open */
594 				return NFCT_TCP_ACCEPT;
595 		} else {
596 			/*
597 			 * We are in the middle of a connection,
598 			 * its history is lost for us.
599 			 * Let's try to use the data from the packet.
600 			 */
601 			sender->td_end = end;
602 			swin = win << sender->td_scale;
603 			sender->td_maxwin = (swin == 0 ? 1 : swin);
604 			sender->td_maxend = end + sender->td_maxwin;
605 			if (receiver->td_maxwin == 0) {
606 				/* We haven't seen traffic in the other
607 				 * direction yet but we have to tweak window
608 				 * tracking to pass III and IV until that
609 				 * happens.
610 				 */
611 				receiver->td_end = receiver->td_maxend = sack;
612 			} else if (sack == receiver->td_end + 1) {
613 				/* Likely a reply to a keepalive.
614 				 * Needed for III.
615 				 */
616 				receiver->td_end++;
617 			}
618 
619 		}
620 	} else if (tcph->syn &&
621 		   after(end, sender->td_end) &&
622 		   (state->state == TCP_CONNTRACK_SYN_SENT ||
623 		    state->state == TCP_CONNTRACK_SYN_RECV)) {
624 		/*
625 		 * RFC 793: "if a TCP is reinitialized ... then it need
626 		 * not wait at all; it must only be sure to use sequence
627 		 * numbers larger than those recently used."
628 		 *
629 		 * Re-init state for this direction, just like for the first
630 		 * syn(-ack) reply, it might differ in seq, ack or tcp options.
631 		 */
632 		tcp_init_sender(sender, receiver,
633 				skb, dataoff, tcph,
634 				end, win, dir);
635 
636 		if (dir == IP_CT_DIR_REPLY && !tcph->ack)
637 			return NFCT_TCP_ACCEPT;
638 	}
639 
640 	if (!(tcph->ack)) {
641 		/*
642 		 * If there is no ACK, just pretend it was set and OK.
643 		 */
644 		ack = sack = receiver->td_end;
645 	} else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
646 		    (TCP_FLAG_ACK|TCP_FLAG_RST))
647 		   && (ack == 0)) {
648 		/*
649 		 * Broken TCP stacks, that set ACK in RST packets as well
650 		 * with zero ack value.
651 		 */
652 		ack = sack = receiver->td_end;
653 	}
654 
655 	if (tcph->rst && seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)
656 		/*
657 		 * RST sent answering SYN.
658 		 */
659 		seq = end = sender->td_end;
660 
661 	seq_ok = before(seq, sender->td_maxend + 1);
662 	if (!seq_ok) {
663 		u32 overshot = end - sender->td_maxend + 1;
664 		bool ack_ok;
665 
666 		ack_ok = after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1);
667 		in_recv_win = receiver->td_maxwin &&
668 			      after(end, sender->td_end - receiver->td_maxwin - 1);
669 
670 		if (in_recv_win &&
671 		    ack_ok &&
672 		    overshot <= receiver->td_maxwin &&
673 		    before(sack, receiver->td_end + 1)) {
674 			/* Work around TCPs that send more bytes than allowed by
675 			 * the receive window.
676 			 *
677 			 * If the (marked as invalid) packet is allowed to pass by
678 			 * the ruleset and the peer acks this data, then its possible
679 			 * all future packets will trigger 'ACK is over upper bound' check.
680 			 *
681 			 * Thus if only the sequence check fails then do update td_end so
682 			 * possible ACK for this data can update internal state.
683 			 */
684 			sender->td_end = end;
685 			sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
686 
687 			return nf_tcp_store_invalid(ct, sender, log, NFCT_TCP_IGNORE,
688 				   NF_TCP_LOG_OVERSHOT, overshot);
689 		}
690 
691 		return nf_tcp_store_invalid(ct, sender, log, NFCT_TCP_INVALID,
692 				   NF_TCP_LOG_SEQ_OVER, sender->td_maxend + 1);
693 	}
694 
695 	if (!before(sack, receiver->td_end + 1))
696 		return nf_tcp_store_invalid(ct, sender, log, NFCT_TCP_INVALID,
697 					   NF_TCP_LOG_ACK_OVER, receiver->td_end + 1);
698 
699 	/* Is the ending sequence in the receive window (if available)? */
700 	in_recv_win = !receiver->td_maxwin ||
701 		      after(end, sender->td_end - receiver->td_maxwin - 1);
702 	if (!in_recv_win)
703 		return nf_tcp_store_invalid(ct, sender, log, NFCT_TCP_IGNORE,
704 					   NF_TCP_LOG_SEQ_UNDER,
705 					   sender->td_end - receiver->td_maxwin - 1);
706 	if (!after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1))
707 		return nf_tcp_store_invalid(ct, sender, log, NFCT_TCP_IGNORE,
708 					   NF_TCP_LOG_ACK_UNDER,
709 					   receiver->td_end - MAXACKWINDOW(sender) - 1);
710 
711 	/* Take into account window scaling (RFC 1323). */
712 	if (!tcph->syn)
713 		win <<= sender->td_scale;
714 
715 	/* Update sender data. */
716 	swin = win + (sack - ack);
717 	if (sender->td_maxwin < swin)
718 		sender->td_maxwin = swin;
719 	if (after(end, sender->td_end)) {
720 		sender->td_end = end;
721 		sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
722 	}
723 	if (tcph->ack) {
724 		if (!(sender->flags & IP_CT_TCP_FLAG_MAXACK_SET)) {
725 			sender->td_maxack = ack;
726 			sender->flags |= IP_CT_TCP_FLAG_MAXACK_SET;
727 		} else if (after(ack, sender->td_maxack)) {
728 			sender->td_maxack = ack;
729 		}
730 	}
731 
732 	/* Update receiver data. */
733 	if (receiver->td_maxwin != 0 && after(end, sender->td_maxend))
734 		receiver->td_maxwin += end - sender->td_maxend;
735 	if (after(sack + win, receiver->td_maxend - 1)) {
736 		receiver->td_maxend = sack + win;
737 		if (win == 0)
738 			receiver->td_maxend++;
739 	}
740 	if (ack == receiver->td_end)
741 		receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
742 
743 	/* Check retransmissions. */
744 	if (index == TCP_ACK_SET) {
745 		if (state->last_dir == dir &&
746 		    state->last_seq == seq &&
747 		    state->last_ack == ack &&
748 		    state->last_end == end &&
749 		    state->last_win == win_raw) {
750 			state->retrans++;
751 		} else {
752 			state->last_dir = dir;
753 			state->last_seq = seq;
754 			state->last_ack = ack;
755 			state->last_end = end;
756 			state->last_win = win_raw;
757 			state->retrans = 0;
758 		}
759 	}
760 
761 	return NFCT_TCP_ACCEPT;
762 }
763 
764 static bool __cold
nf_tcp_handle_invalid(struct nf_conn * ct,enum ip_conntrack_dir dir,int index)765 nf_tcp_handle_invalid(struct nf_conn *ct, enum ip_conntrack_dir dir, int index)
766 {
767 	const unsigned int *timeouts;
768 	const struct nf_tcp_net *tn;
769 	unsigned int timeout;
770 	u32 expires;
771 
772 	if (!test_bit(IPS_ASSURED_BIT, &ct->status) ||
773 	    test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status))
774 		return false;
775 
776 	/* We don't want to have connections hanging around in ESTABLISHED
777 	 * state for long time 'just because' conntrack deemed a FIN/RST
778 	 * out-of-window.
779 	 *
780 	 * Shrink the timeout just like when there is unacked data.
781 	 * This speeds up eviction of 'dead' connections where the
782 	 * connection and conntracks internal state are out of sync.
783 	 */
784 	switch (index) {
785 	case TCP_RST_SET:
786 	case TCP_FIN_SET:
787 		break;
788 	default:
789 		return false;
790 	}
791 
792 	if (ct->proto.tcp.last_dir != dir &&
793 	    (ct->proto.tcp.last_index == TCP_FIN_SET ||
794 	     ct->proto.tcp.last_index == TCP_RST_SET)) {
795 		expires = nf_ct_expires(ct);
796 		if (expires < 120 * HZ)
797 			return false;
798 
799 		tn = nf_tcp_pernet(nf_ct_net(ct));
800 		timeouts = nf_ct_timeout_lookup(ct);
801 		if (!timeouts)
802 			timeouts = tn->timeouts;
803 
804 		timeout = READ_ONCE(timeouts[TCP_CONNTRACK_UNACK]);
805 		if (expires > timeout) {
806 			WRITE_ONCE(ct->timeout, timeout + nfct_time_stamp);
807 			return true;
808 		}
809 	} else {
810 		ct->proto.tcp.last_index = index;
811 		ct->proto.tcp.last_dir = dir;
812 	}
813 
814 	return false;
815 }
816 
817 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
818 static const u8 tcp_valid_flags[(TCPHDR_FIN|TCPHDR_SYN|TCPHDR_RST|TCPHDR_ACK|
819 				 TCPHDR_URG) + 1] =
820 {
821 	[TCPHDR_SYN]				= 1,
822 	[TCPHDR_SYN|TCPHDR_URG]			= 1,
823 	[TCPHDR_SYN|TCPHDR_ACK]			= 1,
824 	[TCPHDR_RST]				= 1,
825 	[TCPHDR_RST|TCPHDR_ACK]			= 1,
826 	[TCPHDR_FIN|TCPHDR_ACK]			= 1,
827 	[TCPHDR_FIN|TCPHDR_ACK|TCPHDR_URG]	= 1,
828 	[TCPHDR_ACK]				= 1,
829 	[TCPHDR_ACK|TCPHDR_URG]			= 1,
830 };
831 
tcp_error_log(const struct sk_buff * skb,const struct nf_hook_state * state,const char * msg)832 static void tcp_error_log(const struct sk_buff *skb,
833 			  const struct nf_hook_state *state,
834 			  const char *msg)
835 {
836 	nf_l4proto_log_invalid(skb, state, IPPROTO_TCP, "%s", msg);
837 }
838 
839 /* Protect conntrack against broken packets. Code taken from ipt_unclean.c.  */
tcp_error(const struct tcphdr * th,struct sk_buff * skb,unsigned int dataoff,const struct nf_hook_state * state)840 static bool tcp_error(const struct tcphdr *th,
841 		      struct sk_buff *skb,
842 		      unsigned int dataoff,
843 		      const struct nf_hook_state *state)
844 {
845 	unsigned int tcplen = skb->len - dataoff;
846 	u8 tcpflags;
847 
848 	/* Not whole TCP header or malformed packet */
849 	if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
850 		tcp_error_log(skb, state, "truncated packet");
851 		return true;
852 	}
853 
854 	/* Checksum invalid? Ignore.
855 	 * We skip checking packets on the outgoing path
856 	 * because the checksum is assumed to be correct.
857 	 */
858 	/* FIXME: Source route IP option packets --RR */
859 	if (state->net->ct.sysctl_checksum &&
860 	    state->hook == NF_INET_PRE_ROUTING &&
861 	    nf_checksum(skb, state->hook, dataoff, IPPROTO_TCP, state->pf)) {
862 		tcp_error_log(skb, state, "bad checksum");
863 		return true;
864 	}
865 
866 	/* Check TCP flags. */
867 	tcpflags = (tcp_flag_byte(th) & ~(TCPHDR_ECE|TCPHDR_CWR|TCPHDR_PSH));
868 	if (!tcp_valid_flags[tcpflags]) {
869 		tcp_error_log(skb, state, "invalid tcp flag combination");
870 		return true;
871 	}
872 
873 	return false;
874 }
875 
tcp_new(struct nf_conn * ct,const struct sk_buff * skb,unsigned int dataoff,const struct tcphdr * th,const struct nf_hook_state * state)876 static noinline bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
877 			     unsigned int dataoff,
878 			     const struct tcphdr *th,
879 			     const struct nf_hook_state *state)
880 {
881 	enum tcp_conntrack new_state;
882 	struct net *net = nf_ct_net(ct);
883 	const struct nf_tcp_net *tn = nf_tcp_pernet(net);
884 
885 	/* Don't need lock here: this conntrack not in circulation yet */
886 	new_state = tcp_conntracks[0][get_conntrack_index(th)][TCP_CONNTRACK_NONE];
887 
888 	/* Invalid: delete conntrack */
889 	if (new_state >= TCP_CONNTRACK_MAX) {
890 		tcp_error_log(skb, state, "invalid new");
891 		return false;
892 	}
893 
894 	if (new_state == TCP_CONNTRACK_SYN_SENT) {
895 		memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp));
896 		/* SYN packet */
897 		ct->proto.tcp.seen[0].td_end =
898 			segment_seq_plus_len(ntohl(th->seq), skb->len,
899 					     dataoff, th);
900 		ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
901 		if (ct->proto.tcp.seen[0].td_maxwin == 0)
902 			ct->proto.tcp.seen[0].td_maxwin = 1;
903 		ct->proto.tcp.seen[0].td_maxend =
904 			ct->proto.tcp.seen[0].td_end;
905 
906 		tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
907 	} else if (tn->tcp_loose == 0) {
908 		/* Don't try to pick up connections. */
909 		return false;
910 	} else {
911 		memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp));
912 		/*
913 		 * We are in the middle of a connection,
914 		 * its history is lost for us.
915 		 * Let's try to use the data from the packet.
916 		 */
917 		ct->proto.tcp.seen[0].td_end =
918 			segment_seq_plus_len(ntohl(th->seq), skb->len,
919 					     dataoff, th);
920 		ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
921 		if (ct->proto.tcp.seen[0].td_maxwin == 0)
922 			ct->proto.tcp.seen[0].td_maxwin = 1;
923 		ct->proto.tcp.seen[0].td_maxend =
924 			ct->proto.tcp.seen[0].td_end +
925 			ct->proto.tcp.seen[0].td_maxwin;
926 
927 		/* We assume SACK and liberal window checking to handle
928 		 * window scaling */
929 		ct->proto.tcp.seen[0].flags =
930 		ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
931 					      IP_CT_TCP_FLAG_BE_LIBERAL;
932 	}
933 
934 	/* tcp_packet will set them */
935 	ct->proto.tcp.last_index = TCP_NONE_SET;
936 	return true;
937 }
938 
tcp_can_early_drop(const struct nf_conn * ct)939 static bool tcp_can_early_drop(const struct nf_conn *ct)
940 {
941 	switch (ct->proto.tcp.state) {
942 	case TCP_CONNTRACK_FIN_WAIT:
943 	case TCP_CONNTRACK_LAST_ACK:
944 	case TCP_CONNTRACK_TIME_WAIT:
945 	case TCP_CONNTRACK_CLOSE:
946 	case TCP_CONNTRACK_CLOSE_WAIT:
947 		return true;
948 	default:
949 		break;
950 	}
951 
952 	return false;
953 }
954 
nf_conntrack_tcp_set_closing(struct nf_conn * ct)955 void nf_conntrack_tcp_set_closing(struct nf_conn *ct)
956 {
957 	enum tcp_conntrack old_state;
958 	const unsigned int *timeouts;
959 	u32 timeout;
960 
961 	if (!nf_ct_is_confirmed(ct))
962 		return;
963 
964 	spin_lock_bh(&ct->lock);
965 	old_state = ct->proto.tcp.state;
966 	ct->proto.tcp.state = TCP_CONNTRACK_CLOSE;
967 
968 	if (old_state == TCP_CONNTRACK_CLOSE ||
969 	    test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
970 		spin_unlock_bh(&ct->lock);
971 		return;
972 	}
973 
974 	timeouts = nf_ct_timeout_lookup(ct);
975 	if (!timeouts) {
976 		const struct nf_tcp_net *tn;
977 
978 		tn = nf_tcp_pernet(nf_ct_net(ct));
979 		timeouts = tn->timeouts;
980 	}
981 
982 	timeout = timeouts[TCP_CONNTRACK_CLOSE];
983 	WRITE_ONCE(ct->timeout, timeout + nfct_time_stamp);
984 
985 	spin_unlock_bh(&ct->lock);
986 
987 	nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
988 }
989 
nf_ct_tcp_state_reset(struct ip_ct_tcp_state * state)990 static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state)
991 {
992 	state->td_end		= 0;
993 	state->td_maxend	= 0;
994 	state->td_maxwin	= 0;
995 	state->td_maxack	= 0;
996 	state->td_scale		= 0;
997 	state->flags		&= IP_CT_TCP_FLAG_BE_LIBERAL;
998 }
999 
1000 /* Returns verdict for packet, or -1 for invalid. */
nf_conntrack_tcp_packet(struct nf_conn * ct,struct sk_buff * skb,unsigned int dataoff,enum ip_conntrack_info ctinfo,const struct nf_hook_state * state)1001 int nf_conntrack_tcp_packet(struct nf_conn *ct,
1002 			    struct sk_buff *skb,
1003 			    unsigned int dataoff,
1004 			    enum ip_conntrack_info ctinfo,
1005 			    const struct nf_hook_state *state)
1006 {
1007 	struct net *net = nf_ct_net(ct);
1008 	struct nf_tcp_net *tn = nf_tcp_pernet(net);
1009 	enum tcp_conntrack new_state, old_state;
1010 	struct nf_tcp_invalid_log log = {};
1011 	unsigned int index, *timeouts;
1012 	bool lowered_timeout = false;
1013 	enum nf_ct_tcp_action res;
1014 	enum ip_conntrack_dir dir;
1015 	const struct tcphdr *th;
1016 	struct tcphdr _tcph;
1017 	unsigned long timeout;
1018 
1019 	th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
1020 	if (th == NULL)
1021 		return -NF_ACCEPT;
1022 
1023 	if (tcp_error(th, skb, dataoff, state))
1024 		return -NF_ACCEPT;
1025 
1026 	if (!nf_ct_is_confirmed(ct) && !tcp_new(ct, skb, dataoff, th, state))
1027 		return -NF_ACCEPT;
1028 
1029 	spin_lock_bh(&ct->lock);
1030 	old_state = ct->proto.tcp.state;
1031 	dir = CTINFO2DIR(ctinfo);
1032 	index = get_conntrack_index(th);
1033 	new_state = tcp_conntracks[dir][index][old_state];
1034 
1035 	switch (new_state) {
1036 	case TCP_CONNTRACK_SYN_SENT:
1037 		if (old_state < TCP_CONNTRACK_TIME_WAIT)
1038 			break;
1039 		/* RFC 1122: "When a connection is closed actively,
1040 		 * it MUST linger in TIME-WAIT state for a time 2xMSL
1041 		 * (Maximum Segment Lifetime). However, it MAY accept
1042 		 * a new SYN from the remote TCP to reopen the connection
1043 		 * directly from TIME-WAIT state, if..."
1044 		 * We ignore the conditions because we are in the
1045 		 * TIME-WAIT state anyway.
1046 		 *
1047 		 * Handle aborted connections: we and the server
1048 		 * think there is an existing connection but the client
1049 		 * aborts it and starts a new one.
1050 		 */
1051 		if (((ct->proto.tcp.seen[dir].flags
1052 		      | ct->proto.tcp.seen[!dir].flags)
1053 		     & IP_CT_TCP_FLAG_CLOSE_INIT)
1054 		    || (ct->proto.tcp.last_dir == dir
1055 		        && ct->proto.tcp.last_index == TCP_RST_SET)) {
1056 			/* Attempt to reopen a closed/aborted connection.
1057 			 * Delete this connection and look up again. */
1058 			spin_unlock_bh(&ct->lock);
1059 
1060 			/* Only repeat if we can actually remove the timer.
1061 			 * Destruction may already be in progress in process
1062 			 * context and we must give it a chance to terminate.
1063 			 */
1064 			if (nf_ct_kill(ct))
1065 				return -NF_REPEAT;
1066 			return NF_DROP;
1067 		}
1068 		fallthrough;
1069 	case TCP_CONNTRACK_IGNORE:
1070 		/* Ignored packets:
1071 		 *
1072 		 * Our connection entry may be out of sync, so ignore
1073 		 * packets which may signal the real connection between
1074 		 * the client and the server.
1075 		 *
1076 		 * a) SYN in ORIGINAL
1077 		 * b) SYN/ACK in REPLY
1078 		 * c) ACK in reply direction after initial SYN in original.
1079 		 *
1080 		 * If the ignored packet is invalid, the receiver will send
1081 		 * a RST we'll catch below.
1082 		 */
1083 		if (index == TCP_SYNACK_SET
1084 		    && ct->proto.tcp.last_index == TCP_SYN_SET
1085 		    && ct->proto.tcp.last_dir != dir
1086 		    && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
1087 			/* b) This SYN/ACK acknowledges a SYN that we earlier
1088 			 * ignored as invalid. This means that the client and
1089 			 * the server are both in sync, while the firewall is
1090 			 * not. We get in sync from the previously annotated
1091 			 * values.
1092 			 */
1093 			old_state = TCP_CONNTRACK_SYN_SENT;
1094 			new_state = TCP_CONNTRACK_SYN_RECV;
1095 			ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_end =
1096 				ct->proto.tcp.last_end;
1097 			ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxend =
1098 				ct->proto.tcp.last_end;
1099 			ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxwin =
1100 				ct->proto.tcp.last_win == 0 ?
1101 					1 : ct->proto.tcp.last_win;
1102 			ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_scale =
1103 				ct->proto.tcp.last_wscale;
1104 			ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
1105 			ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
1106 				ct->proto.tcp.last_flags;
1107 			nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]);
1108 			break;
1109 		}
1110 		ct->proto.tcp.last_index = index;
1111 		ct->proto.tcp.last_dir = dir;
1112 		ct->proto.tcp.last_seq = ntohl(th->seq);
1113 		ct->proto.tcp.last_end =
1114 		    segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
1115 		ct->proto.tcp.last_win = ntohs(th->window);
1116 
1117 		/* a) This is a SYN in ORIGINAL. The client and the server
1118 		 * may be in sync but we are not. In that case, we annotate
1119 		 * the TCP options and let the packet go through. If it is a
1120 		 * valid SYN packet, the server will reply with a SYN/ACK, and
1121 		 * then we'll get in sync. Otherwise, the server potentially
1122 		 * responds with a challenge ACK if implementing RFC5961.
1123 		 */
1124 		if (index == TCP_SYN_SET && dir == IP_CT_DIR_ORIGINAL) {
1125 			struct ip_ct_tcp_state seen = {};
1126 
1127 			ct->proto.tcp.last_flags =
1128 			ct->proto.tcp.last_wscale = 0;
1129 			tcp_options(skb, dataoff, th, &seen);
1130 			if (seen.flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1131 				ct->proto.tcp.last_flags |=
1132 					IP_CT_TCP_FLAG_WINDOW_SCALE;
1133 				ct->proto.tcp.last_wscale = seen.td_scale;
1134 			}
1135 			if (seen.flags & IP_CT_TCP_FLAG_SACK_PERM) {
1136 				ct->proto.tcp.last_flags |=
1137 					IP_CT_TCP_FLAG_SACK_PERM;
1138 			}
1139 			/* Mark the potential for RFC5961 challenge ACK,
1140 			 * this pose a special problem for LAST_ACK state
1141 			 * as ACK is interpreted as ACKing last FIN.
1142 			 */
1143 			if (old_state == TCP_CONNTRACK_LAST_ACK)
1144 				ct->proto.tcp.last_flags |=
1145 					IP_CT_EXP_CHALLENGE_ACK;
1146 		}
1147 
1148 		/* possible challenge ack reply to syn */
1149 		if (old_state == TCP_CONNTRACK_SYN_SENT &&
1150 		    index == TCP_ACK_SET &&
1151 		    dir == IP_CT_DIR_REPLY)
1152 			ct->proto.tcp.last_ack = ntohl(th->ack_seq);
1153 
1154 		spin_unlock_bh(&ct->lock);
1155 		nf_ct_l4proto_log_invalid(skb, ct, state,
1156 					  "packet (index %d) in dir %d ignored, state %s",
1157 					  index, dir,
1158 					  tcp_conntrack_names[old_state]);
1159 		return NF_ACCEPT;
1160 	case TCP_CONNTRACK_MAX:
1161 		/* Special case for SYN proxy: when the SYN to the server or
1162 		 * the SYN/ACK from the server is lost, the client may transmit
1163 		 * a keep-alive packet while in SYN_SENT state. This needs to
1164 		 * be associated with the original conntrack entry in order to
1165 		 * generate a new SYN with the correct sequence number.
1166 		 */
1167 		if (nfct_synproxy(ct) && old_state == TCP_CONNTRACK_SYN_SENT &&
1168 		    index == TCP_ACK_SET && dir == IP_CT_DIR_ORIGINAL &&
1169 		    ct->proto.tcp.last_dir == IP_CT_DIR_ORIGINAL &&
1170 		    ct->proto.tcp.seen[dir].td_end - 1 == ntohl(th->seq)) {
1171 			pr_debug("nf_ct_tcp: SYN proxy client keep alive\n");
1172 			spin_unlock_bh(&ct->lock);
1173 			return NF_ACCEPT;
1174 		}
1175 
1176 		/* Invalid packet */
1177 		spin_unlock_bh(&ct->lock);
1178 		nf_ct_l4proto_log_invalid(skb, ct, state,
1179 					  "packet (index %d) in dir %d invalid, state %s",
1180 					  index, dir,
1181 					  tcp_conntrack_names[old_state]);
1182 		return -NF_ACCEPT;
1183 	case TCP_CONNTRACK_TIME_WAIT:
1184 		/* RFC5961 compliance cause stack to send "challenge-ACK"
1185 		 * e.g. in response to spurious SYNs.  Conntrack MUST
1186 		 * not believe this ACK is acking last FIN.
1187 		 */
1188 		if (old_state == TCP_CONNTRACK_LAST_ACK &&
1189 		    index == TCP_ACK_SET &&
1190 		    ct->proto.tcp.last_dir != dir &&
1191 		    ct->proto.tcp.last_index == TCP_SYN_SET &&
1192 		    (ct->proto.tcp.last_flags & IP_CT_EXP_CHALLENGE_ACK)) {
1193 			/* Detected RFC5961 challenge ACK */
1194 			ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
1195 			spin_unlock_bh(&ct->lock);
1196 			nf_ct_l4proto_log_invalid(skb, ct, state, "challenge-ack ignored");
1197 			return NF_ACCEPT; /* Don't change state */
1198 		}
1199 		break;
1200 	case TCP_CONNTRACK_SYN_SENT2:
1201 		/* tcp_conntracks table is not smart enough to handle
1202 		 * simultaneous open.
1203 		 */
1204 		ct->proto.tcp.last_flags |= IP_CT_TCP_SIMULTANEOUS_OPEN;
1205 		break;
1206 	case TCP_CONNTRACK_SYN_RECV:
1207 		if (dir == IP_CT_DIR_REPLY && index == TCP_ACK_SET &&
1208 		    ct->proto.tcp.last_flags & IP_CT_TCP_SIMULTANEOUS_OPEN)
1209 			new_state = TCP_CONNTRACK_ESTABLISHED;
1210 		break;
1211 	case TCP_CONNTRACK_CLOSE:
1212 		if (index != TCP_RST_SET)
1213 			break;
1214 
1215 		/* If we are closing, tuple might have been re-used already.
1216 		 * last_index, last_ack, and all other ct fields used for
1217 		 * sequence/window validation are outdated in that case.
1218 		 *
1219 		 * As the conntrack can already be expired by GC under pressure,
1220 		 * just skip validation checks.
1221 		 */
1222 		if (tcp_can_early_drop(ct))
1223 			goto in_window;
1224 
1225 		/* td_maxack might be outdated if we let a SYN through earlier */
1226 		if ((ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET) &&
1227 		    ct->proto.tcp.last_index != TCP_SYN_SET) {
1228 			u32 seq = ntohl(th->seq);
1229 
1230 			/* If we are not in established state and SEQ=0 this is most
1231 			 * likely an answer to a SYN we let go through above (last_index
1232 			 * can be updated due to out-of-order ACKs).
1233 			 */
1234 			if (seq == 0 && !nf_conntrack_tcp_established(ct))
1235 				break;
1236 
1237 			if (before(seq, ct->proto.tcp.seen[!dir].td_maxack) &&
1238 			    !tn->tcp_ignore_invalid_rst) {
1239 				/* Invalid RST  */
1240 				spin_unlock_bh(&ct->lock);
1241 				nf_ct_l4proto_log_invalid(skb, ct, state, "invalid rst");
1242 				return -NF_ACCEPT;
1243 			}
1244 
1245 			if (!nf_conntrack_tcp_established(ct) ||
1246 			    seq == ct->proto.tcp.seen[!dir].td_maxack)
1247 				break;
1248 
1249 			/* Check if rst is part of train, such as
1250 			 *   foo:80 > bar:4379: P, 235946583:235946602(19) ack 42
1251 			 *   foo:80 > bar:4379: R, 235946602:235946602(0)  ack 42
1252 			 */
1253 			if (ct->proto.tcp.last_index == TCP_ACK_SET &&
1254 			    ct->proto.tcp.last_dir == dir &&
1255 			    seq == ct->proto.tcp.last_end)
1256 				break;
1257 
1258 			/* ... RST sequence number doesn't match exactly, keep
1259 			 * established state to allow a possible challenge ACK.
1260 			 */
1261 			new_state = old_state;
1262 		}
1263 		if (((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
1264 			 && ct->proto.tcp.last_index == TCP_SYN_SET
1265 			 && ct->proto.tcp.last_dir != dir)
1266 			|| (!test_bit(IPS_ASSURED_BIT, &ct->status)
1267 			    && ct->proto.tcp.last_index == TCP_ACK_SET))
1268 		    && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
1269 			/* RST sent to invalid SYN or ACK we had let through
1270 			 * at a) and c) above:
1271 			 *
1272 			 * a) SYN was in window then
1273 			 * c) we hold a half-open connection.
1274 			 *
1275 			 * Delete our connection entry.
1276 			 * We skip window checking, because packet might ACK
1277 			 * segments we ignored. */
1278 			goto in_window;
1279 		}
1280 
1281 		/* Reset in response to a challenge-ack we let through earlier */
1282 		if (old_state == TCP_CONNTRACK_SYN_SENT &&
1283 		    ct->proto.tcp.last_index == TCP_ACK_SET &&
1284 		    ct->proto.tcp.last_dir == IP_CT_DIR_REPLY &&
1285 		    ntohl(th->seq) == ct->proto.tcp.last_ack)
1286 			goto in_window;
1287 
1288 		break;
1289 	default:
1290 		/* Keep compilers happy. */
1291 		break;
1292 	}
1293 
1294 	res = tcp_in_window(ct, dir, index,
1295 			    skb, dataoff, th, &log);
1296 	switch (res) {
1297 	case NFCT_TCP_IGNORE:
1298 		spin_unlock_bh(&ct->lock);
1299 		nf_tcp_log_invalid(skb, ct, state, &log);
1300 		return NF_ACCEPT;
1301 	case NFCT_TCP_INVALID:
1302 		lowered_timeout = nf_tcp_handle_invalid(ct, dir, index);
1303 		spin_unlock_bh(&ct->lock);
1304 		nf_tcp_log_invalid(skb, ct, state, &log);
1305 		if (lowered_timeout)
1306 			nf_ct_l4proto_log_invalid(skb, ct, state, "lowered timeout to UNACK");
1307 		return -NF_ACCEPT;
1308 	case NFCT_TCP_ACCEPT:
1309 		break;
1310 	}
1311      in_window:
1312 	/* From now on we have got in-window packets */
1313 	ct->proto.tcp.last_index = index;
1314 	ct->proto.tcp.last_dir = dir;
1315 
1316 	ct->proto.tcp.state = new_state;
1317 	if (old_state != new_state
1318 	    && new_state == TCP_CONNTRACK_FIN_WAIT)
1319 		ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
1320 
1321 	timeouts = nf_ct_timeout_lookup(ct);
1322 	if (!timeouts)
1323 		timeouts = tn->timeouts;
1324 
1325 	if (ct->proto.tcp.retrans >= tn->tcp_max_retrans &&
1326 	    timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
1327 		timeout = timeouts[TCP_CONNTRACK_RETRANS];
1328 	else if (unlikely(index == TCP_RST_SET &&
1329 			  new_state == TCP_CONNTRACK_ESTABLISHED) &&
1330 		 timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
1331 		timeout = timeouts[TCP_CONNTRACK_UNACK];
1332 	else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
1333 		 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
1334 		 timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
1335 		timeout = timeouts[TCP_CONNTRACK_UNACK];
1336 	else if (ct->proto.tcp.last_win == 0 &&
1337 		 timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
1338 		timeout = timeouts[TCP_CONNTRACK_RETRANS];
1339 	else
1340 		timeout = timeouts[new_state];
1341 	spin_unlock_bh(&ct->lock);
1342 
1343 	if (new_state != old_state)
1344 		nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
1345 
1346 	if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
1347 		/* If only reply is a RST, we can consider ourselves not to
1348 		   have an established connection: this is a fairly common
1349 		   problem case, so we can delete the conntrack
1350 		   immediately.  --RR */
1351 		if (th->rst) {
1352 			nf_ct_kill_acct(ct, ctinfo, skb);
1353 			return NF_ACCEPT;
1354 		}
1355 
1356 		if (index == TCP_SYN_SET && old_state == TCP_CONNTRACK_SYN_SENT) {
1357 			/* do not renew timeout on SYN retransmit.
1358 			 *
1359 			 * Else port reuse by client or NAT middlebox can keep
1360 			 * entry alive indefinitely (including nat info).
1361 			 */
1362 			return NF_ACCEPT;
1363 		}
1364 
1365 		/* ESTABLISHED without SEEN_REPLY, i.e. mid-connection
1366 		 * pickup with loose=1. Avoid large ESTABLISHED timeout.
1367 		 */
1368 		if (new_state == TCP_CONNTRACK_ESTABLISHED &&
1369 		    timeout > timeouts[TCP_CONNTRACK_UNACK])
1370 			timeout = timeouts[TCP_CONNTRACK_UNACK];
1371 	} else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
1372 		   && (old_state == TCP_CONNTRACK_SYN_RECV
1373 		       || old_state == TCP_CONNTRACK_ESTABLISHED)
1374 		   && new_state == TCP_CONNTRACK_ESTABLISHED) {
1375 		/* Set ASSURED if we see valid ack in ESTABLISHED
1376 		   after SYN_RECV or a valid answer for a picked up
1377 		   connection. */
1378 		set_bit(IPS_ASSURED_BIT, &ct->status);
1379 		nf_conntrack_event_cache(IPCT_ASSURED, ct);
1380 	}
1381 	nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
1382 
1383 	return NF_ACCEPT;
1384 }
1385 
1386 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
1387 
1388 #include <linux/netfilter/nfnetlink.h>
1389 #include <linux/netfilter/nfnetlink_conntrack.h>
1390 
tcp_to_nlattr(struct sk_buff * skb,struct nlattr * nla,struct nf_conn * ct,bool destroy)1391 static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
1392 			 struct nf_conn *ct, bool destroy)
1393 {
1394 	struct nlattr *nest_parms;
1395 	struct nf_ct_tcp_flags tmp = {};
1396 
1397 	spin_lock_bh(&ct->lock);
1398 	nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP);
1399 	if (!nest_parms)
1400 		goto nla_put_failure;
1401 
1402 	if (nla_put_u8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state))
1403 		goto nla_put_failure;
1404 
1405 	if (destroy)
1406 		goto skip_state;
1407 
1408 	if (nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
1409 		       ct->proto.tcp.seen[0].td_scale) ||
1410 	    nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
1411 		       ct->proto.tcp.seen[1].td_scale))
1412 		goto nla_put_failure;
1413 
1414 	tmp.flags = ct->proto.tcp.seen[0].flags;
1415 	if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
1416 		    sizeof(struct nf_ct_tcp_flags), &tmp))
1417 		goto nla_put_failure;
1418 
1419 	tmp.flags = ct->proto.tcp.seen[1].flags;
1420 	if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
1421 		    sizeof(struct nf_ct_tcp_flags), &tmp))
1422 		goto nla_put_failure;
1423 skip_state:
1424 	spin_unlock_bh(&ct->lock);
1425 	nla_nest_end(skb, nest_parms);
1426 
1427 	return 0;
1428 
1429 nla_put_failure:
1430 	spin_unlock_bh(&ct->lock);
1431 	return -1;
1432 }
1433 
1434 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
1435 	[CTA_PROTOINFO_TCP_STATE]	    = NLA_POLICY_MAX(NLA_U8, TCP_CONNTRACK_SYN_SENT2),
1436 	[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = NLA_POLICY_MAX(NLA_U8, TCP_MAX_WSCALE),
1437 	[CTA_PROTOINFO_TCP_WSCALE_REPLY]    = NLA_POLICY_MAX(NLA_U8, TCP_MAX_WSCALE),
1438 	[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
1439 	[CTA_PROTOINFO_TCP_FLAGS_REPLY]	    = { .len = sizeof(struct nf_ct_tcp_flags) },
1440 };
1441 
1442 #define TCP_NLATTR_SIZE	( \
1443 	NLA_ALIGN(NLA_HDRLEN + 1) + \
1444 	NLA_ALIGN(NLA_HDRLEN + 1) + \
1445 	NLA_ALIGN(NLA_HDRLEN + sizeof(struct nf_ct_tcp_flags)) + \
1446 	NLA_ALIGN(NLA_HDRLEN + sizeof(struct nf_ct_tcp_flags)))
1447 
nlattr_to_tcp(struct nlattr * cda[],struct nf_conn * ct)1448 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
1449 {
1450 	struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
1451 	struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
1452 	int err;
1453 
1454 	/* updates could not contain anything about the private
1455 	 * protocol info, in that case skip the parsing */
1456 	if (!pattr)
1457 		return 0;
1458 
1459 	err = nla_parse_nested_deprecated(tb, CTA_PROTOINFO_TCP_MAX, pattr,
1460 					  tcp_nla_policy, NULL);
1461 	if (err < 0)
1462 		return err;
1463 
1464 	spin_lock_bh(&ct->lock);
1465 	if (tb[CTA_PROTOINFO_TCP_STATE])
1466 		ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
1467 
1468 	if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
1469 		struct nf_ct_tcp_flags *attr =
1470 			nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
1471 		ct->proto.tcp.seen[0].flags &= ~attr->mask;
1472 		ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
1473 	}
1474 
1475 	if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
1476 		struct nf_ct_tcp_flags *attr =
1477 			nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
1478 		ct->proto.tcp.seen[1].flags &= ~attr->mask;
1479 		ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
1480 	}
1481 
1482 	if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
1483 	    tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
1484 	    ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
1485 	    ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
1486 		ct->proto.tcp.seen[0].td_scale =
1487 			nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
1488 		ct->proto.tcp.seen[1].td_scale =
1489 			nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
1490 	}
1491 	spin_unlock_bh(&ct->lock);
1492 
1493 	return 0;
1494 }
1495 
tcp_nlattr_tuple_size(void)1496 static unsigned int tcp_nlattr_tuple_size(void)
1497 {
1498 	static unsigned int size __read_mostly;
1499 
1500 	if (!size)
1501 		size = nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
1502 
1503 	return size;
1504 }
1505 #endif
1506 
1507 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1508 
1509 #include <linux/netfilter/nfnetlink.h>
1510 #include <linux/netfilter/nfnetlink_cttimeout.h>
1511 
tcp_timeout_nlattr_to_obj(struct nlattr * tb[],struct net * net,void * data)1512 static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[],
1513 				     struct net *net, void *data)
1514 {
1515 	struct nf_tcp_net *tn = nf_tcp_pernet(net);
1516 	unsigned int *timeouts = data;
1517 	int i;
1518 
1519 	if (!timeouts)
1520 		timeouts = tn->timeouts;
1521 	/* set default TCP timeouts. */
1522 	for (i=0; i<TCP_CONNTRACK_TIMEOUT_MAX; i++)
1523 		timeouts[i] = tn->timeouts[i];
1524 
1525 	if (tb[CTA_TIMEOUT_TCP_SYN_SENT]) {
1526 		timeouts[TCP_CONNTRACK_SYN_SENT] =
1527 			ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT]))*HZ;
1528 	}
1529 
1530 	if (tb[CTA_TIMEOUT_TCP_SYN_RECV]) {
1531 		timeouts[TCP_CONNTRACK_SYN_RECV] =
1532 			ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_RECV]))*HZ;
1533 	}
1534 	if (tb[CTA_TIMEOUT_TCP_ESTABLISHED]) {
1535 		timeouts[TCP_CONNTRACK_ESTABLISHED] =
1536 			ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_ESTABLISHED]))*HZ;
1537 	}
1538 	if (tb[CTA_TIMEOUT_TCP_FIN_WAIT]) {
1539 		timeouts[TCP_CONNTRACK_FIN_WAIT] =
1540 			ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_FIN_WAIT]))*HZ;
1541 	}
1542 	if (tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]) {
1543 		timeouts[TCP_CONNTRACK_CLOSE_WAIT] =
1544 			ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]))*HZ;
1545 	}
1546 	if (tb[CTA_TIMEOUT_TCP_LAST_ACK]) {
1547 		timeouts[TCP_CONNTRACK_LAST_ACK] =
1548 			ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_LAST_ACK]))*HZ;
1549 	}
1550 	if (tb[CTA_TIMEOUT_TCP_TIME_WAIT]) {
1551 		timeouts[TCP_CONNTRACK_TIME_WAIT] =
1552 			ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_TIME_WAIT]))*HZ;
1553 	}
1554 	if (tb[CTA_TIMEOUT_TCP_CLOSE]) {
1555 		timeouts[TCP_CONNTRACK_CLOSE] =
1556 			ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE]))*HZ;
1557 	}
1558 	if (tb[CTA_TIMEOUT_TCP_SYN_SENT2]) {
1559 		timeouts[TCP_CONNTRACK_SYN_SENT2] =
1560 			ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT2]))*HZ;
1561 	}
1562 	if (tb[CTA_TIMEOUT_TCP_RETRANS]) {
1563 		timeouts[TCP_CONNTRACK_RETRANS] =
1564 			ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_RETRANS]))*HZ;
1565 	}
1566 	if (tb[CTA_TIMEOUT_TCP_UNACK]) {
1567 		timeouts[TCP_CONNTRACK_UNACK] =
1568 			ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_UNACK]))*HZ;
1569 	}
1570 
1571 	timeouts[CTA_TIMEOUT_TCP_UNSPEC] = timeouts[CTA_TIMEOUT_TCP_SYN_SENT];
1572 	return 0;
1573 }
1574 
1575 static int
tcp_timeout_obj_to_nlattr(struct sk_buff * skb,const void * data)1576 tcp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
1577 {
1578 	const unsigned int *timeouts = data;
1579 
1580 	if (nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT,
1581 			htonl(timeouts[TCP_CONNTRACK_SYN_SENT] / HZ)) ||
1582 	    nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_RECV,
1583 			 htonl(timeouts[TCP_CONNTRACK_SYN_RECV] / HZ)) ||
1584 	    nla_put_be32(skb, CTA_TIMEOUT_TCP_ESTABLISHED,
1585 			 htonl(timeouts[TCP_CONNTRACK_ESTABLISHED] / HZ)) ||
1586 	    nla_put_be32(skb, CTA_TIMEOUT_TCP_FIN_WAIT,
1587 			 htonl(timeouts[TCP_CONNTRACK_FIN_WAIT] / HZ)) ||
1588 	    nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE_WAIT,
1589 			 htonl(timeouts[TCP_CONNTRACK_CLOSE_WAIT] / HZ)) ||
1590 	    nla_put_be32(skb, CTA_TIMEOUT_TCP_LAST_ACK,
1591 			 htonl(timeouts[TCP_CONNTRACK_LAST_ACK] / HZ)) ||
1592 	    nla_put_be32(skb, CTA_TIMEOUT_TCP_TIME_WAIT,
1593 			 htonl(timeouts[TCP_CONNTRACK_TIME_WAIT] / HZ)) ||
1594 	    nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE,
1595 			 htonl(timeouts[TCP_CONNTRACK_CLOSE] / HZ)) ||
1596 	    nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT2,
1597 			 htonl(timeouts[TCP_CONNTRACK_SYN_SENT2] / HZ)) ||
1598 	    nla_put_be32(skb, CTA_TIMEOUT_TCP_RETRANS,
1599 			 htonl(timeouts[TCP_CONNTRACK_RETRANS] / HZ)) ||
1600 	    nla_put_be32(skb, CTA_TIMEOUT_TCP_UNACK,
1601 			 htonl(timeouts[TCP_CONNTRACK_UNACK] / HZ)))
1602 		goto nla_put_failure;
1603 	return 0;
1604 
1605 nla_put_failure:
1606 	return -ENOSPC;
1607 }
1608 
1609 static const struct nla_policy tcp_timeout_nla_policy[CTA_TIMEOUT_TCP_MAX+1] = {
1610 	[CTA_TIMEOUT_TCP_SYN_SENT]	= { .type = NLA_U32 },
1611 	[CTA_TIMEOUT_TCP_SYN_RECV]	= { .type = NLA_U32 },
1612 	[CTA_TIMEOUT_TCP_ESTABLISHED]	= { .type = NLA_U32 },
1613 	[CTA_TIMEOUT_TCP_FIN_WAIT]	= { .type = NLA_U32 },
1614 	[CTA_TIMEOUT_TCP_CLOSE_WAIT]	= { .type = NLA_U32 },
1615 	[CTA_TIMEOUT_TCP_LAST_ACK]	= { .type = NLA_U32 },
1616 	[CTA_TIMEOUT_TCP_TIME_WAIT]	= { .type = NLA_U32 },
1617 	[CTA_TIMEOUT_TCP_CLOSE]		= { .type = NLA_U32 },
1618 	[CTA_TIMEOUT_TCP_SYN_SENT2]	= { .type = NLA_U32 },
1619 	[CTA_TIMEOUT_TCP_RETRANS]	= { .type = NLA_U32 },
1620 	[CTA_TIMEOUT_TCP_UNACK]		= { .type = NLA_U32 },
1621 };
1622 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1623 
nf_conntrack_tcp_init_net(struct net * net)1624 void nf_conntrack_tcp_init_net(struct net *net)
1625 {
1626 	struct nf_tcp_net *tn = nf_tcp_pernet(net);
1627 	int i;
1628 
1629 	for (i = 0; i < TCP_CONNTRACK_TIMEOUT_MAX; i++)
1630 		tn->timeouts[i] = tcp_timeouts[i];
1631 
1632 	/* timeouts[0] is unused, make it same as SYN_SENT so
1633 	 * ->timeouts[0] contains 'new' timeout, like udp or icmp.
1634 	 */
1635 	tn->timeouts[0] = tcp_timeouts[TCP_CONNTRACK_SYN_SENT];
1636 
1637 	/* If it is set to zero, we disable picking up already established
1638 	 * connections.
1639 	 */
1640 	tn->tcp_loose = 1;
1641 
1642 	/* "Be conservative in what you do,
1643 	 *  be liberal in what you accept from others."
1644 	 * If it's non-zero, we mark only out of window RST segments as INVALID.
1645 	 */
1646 	tn->tcp_be_liberal = 0;
1647 
1648 	/* If it's non-zero, we turn off RST sequence number check */
1649 	tn->tcp_ignore_invalid_rst = 0;
1650 
1651 	/* Max number of the retransmitted packets without receiving an (acceptable)
1652 	 * ACK from the destination. If this number is reached, a shorter timer
1653 	 * will be started.
1654 	 */
1655 	tn->tcp_max_retrans = 3;
1656 
1657 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
1658 	tn->offload_timeout = 30 * HZ;
1659 #endif
1660 }
1661 
1662 const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp =
1663 {
1664 	.l4proto 		= IPPROTO_TCP,
1665 #ifdef CONFIG_NF_CONNTRACK_PROCFS
1666 	.print_conntrack 	= tcp_print_conntrack,
1667 #endif
1668 	.can_early_drop		= tcp_can_early_drop,
1669 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
1670 	.to_nlattr		= tcp_to_nlattr,
1671 	.from_nlattr		= nlattr_to_tcp,
1672 	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
1673 	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
1674 	.nlattr_tuple_size	= tcp_nlattr_tuple_size,
1675 	.nlattr_size		= TCP_NLATTR_SIZE,
1676 	.nla_policy		= nf_ct_port_nla_policy,
1677 #endif
1678 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1679 	.ctnl_timeout		= {
1680 		.nlattr_to_obj	= tcp_timeout_nlattr_to_obj,
1681 		.obj_to_nlattr	= tcp_timeout_obj_to_nlattr,
1682 		.nlattr_max	= CTA_TIMEOUT_TCP_MAX,
1683 		.obj_size	= sizeof(unsigned int) *
1684 					TCP_CONNTRACK_TIMEOUT_MAX,
1685 		.nla_policy	= tcp_timeout_nla_policy,
1686 	},
1687 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1688 };
1689