1 // SPDX-License-Identifier: GPL-2.0-only 2 /* (C) 1999-2001 Paul `Rusty' Russell 3 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 4 * (C) 2002-2013 Jozsef Kadlecsik <kadlec@netfilter.org> 5 * (C) 2006-2012 Patrick McHardy <kaber@trash.net> 6 */ 7 8 #include <linux/types.h> 9 #include <linux/timer.h> 10 #include <linux/module.h> 11 #include <linux/in.h> 12 #include <linux/tcp.h> 13 #include <linux/spinlock.h> 14 #include <linux/skbuff.h> 15 #include <linux/ipv6.h> 16 #include <net/ip6_checksum.h> 17 #include <asm/unaligned.h> 18 19 #include <net/tcp.h> 20 21 #include <linux/netfilter.h> 22 #include <linux/netfilter_ipv4.h> 23 #include <linux/netfilter_ipv6.h> 24 #include <net/netfilter/nf_conntrack.h> 25 #include <net/netfilter/nf_conntrack_l4proto.h> 26 #include <net/netfilter/nf_conntrack_ecache.h> 27 #include <net/netfilter/nf_conntrack_seqadj.h> 28 #include <net/netfilter/nf_conntrack_synproxy.h> 29 #include <net/netfilter/nf_conntrack_timeout.h> 30 #include <net/netfilter/nf_log.h> 31 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h> 32 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h> 33 34 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more 35 closely. They're more complex. --RR */ 36 37 static const char *const tcp_conntrack_names[] = { 38 "NONE", 39 "SYN_SENT", 40 "SYN_RECV", 41 "ESTABLISHED", 42 "FIN_WAIT", 43 "CLOSE_WAIT", 44 "LAST_ACK", 45 "TIME_WAIT", 46 "CLOSE", 47 "SYN_SENT2", 48 }; 49 50 enum nf_ct_tcp_action { 51 NFCT_TCP_IGNORE, 52 NFCT_TCP_INVALID, 53 NFCT_TCP_ACCEPT, 54 }; 55 56 #define SECS * HZ 57 #define MINS * 60 SECS 58 #define HOURS * 60 MINS 59 #define DAYS * 24 HOURS 60 61 static const unsigned int tcp_timeouts[TCP_CONNTRACK_TIMEOUT_MAX] = { 62 [TCP_CONNTRACK_SYN_SENT] = 2 MINS, 63 [TCP_CONNTRACK_SYN_RECV] = 60 SECS, 64 [TCP_CONNTRACK_ESTABLISHED] = 5 DAYS, 65 [TCP_CONNTRACK_FIN_WAIT] = 2 MINS, 66 [TCP_CONNTRACK_CLOSE_WAIT] = 60 SECS, 67 [TCP_CONNTRACK_LAST_ACK] = 30 SECS, 68 [TCP_CONNTRACK_TIME_WAIT] = 2 MINS, 69 [TCP_CONNTRACK_CLOSE] = 10 SECS, 70 [TCP_CONNTRACK_SYN_SENT2] = 2 MINS, 71 /* RFC1122 says the R2 limit should be at least 100 seconds. 72 Linux uses 15 packets as limit, which corresponds 73 to ~13-30min depending on RTO. */ 74 [TCP_CONNTRACK_RETRANS] = 5 MINS, 75 [TCP_CONNTRACK_UNACK] = 5 MINS, 76 }; 77 78 #define sNO TCP_CONNTRACK_NONE 79 #define sSS TCP_CONNTRACK_SYN_SENT 80 #define sSR TCP_CONNTRACK_SYN_RECV 81 #define sES TCP_CONNTRACK_ESTABLISHED 82 #define sFW TCP_CONNTRACK_FIN_WAIT 83 #define sCW TCP_CONNTRACK_CLOSE_WAIT 84 #define sLA TCP_CONNTRACK_LAST_ACK 85 #define sTW TCP_CONNTRACK_TIME_WAIT 86 #define sCL TCP_CONNTRACK_CLOSE 87 #define sS2 TCP_CONNTRACK_SYN_SENT2 88 #define sIV TCP_CONNTRACK_MAX 89 #define sIG TCP_CONNTRACK_IGNORE 90 91 /* What TCP flags are set from RST/SYN/FIN/ACK. */ 92 enum tcp_bit_set { 93 TCP_SYN_SET, 94 TCP_SYNACK_SET, 95 TCP_FIN_SET, 96 TCP_ACK_SET, 97 TCP_RST_SET, 98 TCP_NONE_SET, 99 }; 100 101 /* 102 * The TCP state transition table needs a few words... 103 * 104 * We are the man in the middle. All the packets go through us 105 * but might get lost in transit to the destination. 106 * It is assumed that the destinations can't receive segments 107 * we haven't seen. 108 * 109 * The checked segment is in window, but our windows are *not* 110 * equivalent with the ones of the sender/receiver. We always 111 * try to guess the state of the current sender. 112 * 113 * The meaning of the states are: 114 * 115 * NONE: initial state 116 * SYN_SENT: SYN-only packet seen 117 * SYN_SENT2: SYN-only packet seen from reply dir, simultaneous open 118 * SYN_RECV: SYN-ACK packet seen 119 * ESTABLISHED: ACK packet seen 120 * FIN_WAIT: FIN packet seen 121 * CLOSE_WAIT: ACK seen (after FIN) 122 * LAST_ACK: FIN seen (after FIN) 123 * TIME_WAIT: last ACK seen 124 * CLOSE: closed connection (RST) 125 * 126 * Packets marked as IGNORED (sIG): 127 * if they may be either invalid or valid 128 * and the receiver may send back a connection 129 * closing RST or a SYN/ACK. 130 * 131 * Packets marked as INVALID (sIV): 132 * if we regard them as truly invalid packets 133 */ 134 static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = { 135 { 136 /* ORIGINAL */ 137 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ 138 /*syn*/ { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sS2 }, 139 /* 140 * sNO -> sSS Initialize a new connection 141 * sSS -> sSS Retransmitted SYN 142 * sS2 -> sS2 Late retransmitted SYN 143 * sSR -> sIG 144 * sES -> sIG Error: SYNs in window outside the SYN_SENT state 145 * are errors. Receiver will reply with RST 146 * and close the connection. 147 * Or we are not in sync and hold a dead connection. 148 * sFW -> sIG 149 * sCW -> sIG 150 * sLA -> sIG 151 * sTW -> sSS Reopened connection (RFC 1122). 152 * sCL -> sSS 153 */ 154 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ 155 /*synack*/ { sIV, sIV, sSR, sIV, sIV, sIV, sIV, sIV, sIV, sSR }, 156 /* 157 * sNO -> sIV Too late and no reason to do anything 158 * sSS -> sIV Client can't send SYN and then SYN/ACK 159 * sS2 -> sSR SYN/ACK sent to SYN2 in simultaneous open 160 * sSR -> sSR Late retransmitted SYN/ACK in simultaneous open 161 * sES -> sIV Invalid SYN/ACK packets sent by the client 162 * sFW -> sIV 163 * sCW -> sIV 164 * sLA -> sIV 165 * sTW -> sIV 166 * sCL -> sIV 167 */ 168 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ 169 /*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV }, 170 /* 171 * sNO -> sIV Too late and no reason to do anything... 172 * sSS -> sIV Client migth not send FIN in this state: 173 * we enforce waiting for a SYN/ACK reply first. 174 * sS2 -> sIV 175 * sSR -> sFW Close started. 176 * sES -> sFW 177 * sFW -> sLA FIN seen in both directions, waiting for 178 * the last ACK. 179 * Migth be a retransmitted FIN as well... 180 * sCW -> sLA 181 * sLA -> sLA Retransmitted FIN. Remain in the same state. 182 * sTW -> sTW 183 * sCL -> sCL 184 */ 185 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ 186 /*ack*/ { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV }, 187 /* 188 * sNO -> sES Assumed. 189 * sSS -> sIV ACK is invalid: we haven't seen a SYN/ACK yet. 190 * sS2 -> sIV 191 * sSR -> sES Established state is reached. 192 * sES -> sES :-) 193 * sFW -> sCW Normal close request answered by ACK. 194 * sCW -> sCW 195 * sLA -> sTW Last ACK detected (RFC5961 challenged) 196 * sTW -> sTW Retransmitted last ACK. Remain in the same state. 197 * sCL -> sCL 198 */ 199 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ 200 /*rst*/ { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL }, 201 /*none*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV } 202 }, 203 { 204 /* REPLY */ 205 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ 206 /*syn*/ { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sSS, sIV, sS2 }, 207 /* 208 * sNO -> sIV Never reached. 209 * sSS -> sS2 Simultaneous open 210 * sS2 -> sS2 Retransmitted simultaneous SYN 211 * sSR -> sIV Invalid SYN packets sent by the server 212 * sES -> sIV 213 * sFW -> sIV 214 * sCW -> sIV 215 * sLA -> sIV 216 * sTW -> sSS Reopened connection, but server may have switched role 217 * sCL -> sIV 218 */ 219 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ 220 /*synack*/ { sIV, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR }, 221 /* 222 * sSS -> sSR Standard open. 223 * sS2 -> sSR Simultaneous open 224 * sSR -> sIG Retransmitted SYN/ACK, ignore it. 225 * sES -> sIG Late retransmitted SYN/ACK? 226 * sFW -> sIG Might be SYN/ACK answering ignored SYN 227 * sCW -> sIG 228 * sLA -> sIG 229 * sTW -> sIG 230 * sCL -> sIG 231 */ 232 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ 233 /*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV }, 234 /* 235 * sSS -> sIV Server might not send FIN in this state. 236 * sS2 -> sIV 237 * sSR -> sFW Close started. 238 * sES -> sFW 239 * sFW -> sLA FIN seen in both directions. 240 * sCW -> sLA 241 * sLA -> sLA Retransmitted FIN. 242 * sTW -> sTW 243 * sCL -> sCL 244 */ 245 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ 246 /*ack*/ { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIG }, 247 /* 248 * sSS -> sIG Might be a half-open connection. 249 * sS2 -> sIG 250 * sSR -> sSR Might answer late resent SYN. 251 * sES -> sES :-) 252 * sFW -> sCW Normal close request answered by ACK. 253 * sCW -> sCW 254 * sLA -> sTW Last ACK detected (RFC5961 challenged) 255 * sTW -> sTW Retransmitted last ACK. 256 * sCL -> sCL 257 */ 258 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ 259 /*rst*/ { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL }, 260 /*none*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV } 261 } 262 }; 263 264 #ifdef CONFIG_NF_CONNTRACK_PROCFS 265 /* Print out the private part of the conntrack. */ 266 static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct) 267 { 268 if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) 269 return; 270 271 seq_printf(s, "%s ", tcp_conntrack_names[ct->proto.tcp.state]); 272 } 273 #endif 274 275 static unsigned int get_conntrack_index(const struct tcphdr *tcph) 276 { 277 if (tcph->rst) return TCP_RST_SET; 278 else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET); 279 else if (tcph->fin) return TCP_FIN_SET; 280 else if (tcph->ack) return TCP_ACK_SET; 281 else return TCP_NONE_SET; 282 } 283 284 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering 285 in IP Filter' by Guido van Rooij. 286 287 http://www.sane.nl/events/sane2000/papers.html 288 http://www.darkart.com/mirrors/www.obfuscation.org/ipf/ 289 290 The boundaries and the conditions are changed according to RFC793: 291 the packet must intersect the window (i.e. segments may be 292 after the right or before the left edge) and thus receivers may ACK 293 segments after the right edge of the window. 294 295 td_maxend = max(sack + max(win,1)) seen in reply packets 296 td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets 297 td_maxwin += seq + len - sender.td_maxend 298 if seq + len > sender.td_maxend 299 td_end = max(seq + len) seen in sent packets 300 301 I. Upper bound for valid data: seq <= sender.td_maxend 302 II. Lower bound for valid data: seq + len >= sender.td_end - receiver.td_maxwin 303 III. Upper bound for valid (s)ack: sack <= receiver.td_end 304 IV. Lower bound for valid (s)ack: sack >= receiver.td_end - MAXACKWINDOW 305 306 where sack is the highest right edge of sack block found in the packet 307 or ack in the case of packet without SACK option. 308 309 The upper bound limit for a valid (s)ack is not ignored - 310 we doesn't have to deal with fragments. 311 */ 312 313 static inline __u32 segment_seq_plus_len(__u32 seq, 314 size_t len, 315 unsigned int dataoff, 316 const struct tcphdr *tcph) 317 { 318 /* XXX Should I use payload length field in IP/IPv6 header ? 319 * - YK */ 320 return (seq + len - dataoff - tcph->doff*4 321 + (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0)); 322 } 323 324 /* Fixme: what about big packets? */ 325 #define MAXACKWINCONST 66000 326 #define MAXACKWINDOW(sender) \ 327 ((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin \ 328 : MAXACKWINCONST) 329 330 /* 331 * Simplified tcp_parse_options routine from tcp_input.c 332 */ 333 static void tcp_options(const struct sk_buff *skb, 334 unsigned int dataoff, 335 const struct tcphdr *tcph, 336 struct ip_ct_tcp_state *state) 337 { 338 unsigned char buff[(15 * 4) - sizeof(struct tcphdr)]; 339 const unsigned char *ptr; 340 int length = (tcph->doff*4) - sizeof(struct tcphdr); 341 342 if (!length) 343 return; 344 345 ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr), 346 length, buff); 347 if (!ptr) 348 return; 349 350 state->td_scale = 0; 351 state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; 352 353 while (length > 0) { 354 int opcode=*ptr++; 355 int opsize; 356 357 switch (opcode) { 358 case TCPOPT_EOL: 359 return; 360 case TCPOPT_NOP: /* Ref: RFC 793 section 3.1 */ 361 length--; 362 continue; 363 default: 364 if (length < 2) 365 return; 366 opsize=*ptr++; 367 if (opsize < 2) /* "silly options" */ 368 return; 369 if (opsize > length) 370 return; /* don't parse partial options */ 371 372 if (opcode == TCPOPT_SACK_PERM 373 && opsize == TCPOLEN_SACK_PERM) 374 state->flags |= IP_CT_TCP_FLAG_SACK_PERM; 375 else if (opcode == TCPOPT_WINDOW 376 && opsize == TCPOLEN_WINDOW) { 377 state->td_scale = *(u_int8_t *)ptr; 378 379 if (state->td_scale > TCP_MAX_WSCALE) 380 state->td_scale = TCP_MAX_WSCALE; 381 382 state->flags |= 383 IP_CT_TCP_FLAG_WINDOW_SCALE; 384 } 385 ptr += opsize - 2; 386 length -= opsize; 387 } 388 } 389 } 390 391 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff, 392 const struct tcphdr *tcph, __u32 *sack) 393 { 394 unsigned char buff[(15 * 4) - sizeof(struct tcphdr)]; 395 const unsigned char *ptr; 396 int length = (tcph->doff*4) - sizeof(struct tcphdr); 397 __u32 tmp; 398 399 if (!length) 400 return; 401 402 ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr), 403 length, buff); 404 if (!ptr) 405 return; 406 407 /* Fast path for timestamp-only option */ 408 if (length == TCPOLEN_TSTAMP_ALIGNED 409 && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24) 410 | (TCPOPT_NOP << 16) 411 | (TCPOPT_TIMESTAMP << 8) 412 | TCPOLEN_TIMESTAMP)) 413 return; 414 415 while (length > 0) { 416 int opcode = *ptr++; 417 int opsize, i; 418 419 switch (opcode) { 420 case TCPOPT_EOL: 421 return; 422 case TCPOPT_NOP: /* Ref: RFC 793 section 3.1 */ 423 length--; 424 continue; 425 default: 426 if (length < 2) 427 return; 428 opsize = *ptr++; 429 if (opsize < 2) /* "silly options" */ 430 return; 431 if (opsize > length) 432 return; /* don't parse partial options */ 433 434 if (opcode == TCPOPT_SACK 435 && opsize >= (TCPOLEN_SACK_BASE 436 + TCPOLEN_SACK_PERBLOCK) 437 && !((opsize - TCPOLEN_SACK_BASE) 438 % TCPOLEN_SACK_PERBLOCK)) { 439 for (i = 0; 440 i < (opsize - TCPOLEN_SACK_BASE); 441 i += TCPOLEN_SACK_PERBLOCK) { 442 tmp = get_unaligned_be32((__be32 *)(ptr+i)+1); 443 444 if (after(tmp, *sack)) 445 *sack = tmp; 446 } 447 return; 448 } 449 ptr += opsize - 2; 450 length -= opsize; 451 } 452 } 453 } 454 455 static void tcp_init_sender(struct ip_ct_tcp_state *sender, 456 struct ip_ct_tcp_state *receiver, 457 const struct sk_buff *skb, 458 unsigned int dataoff, 459 const struct tcphdr *tcph, 460 u32 end, u32 win) 461 { 462 /* SYN-ACK in reply to a SYN 463 * or SYN from reply direction in simultaneous open. 464 */ 465 sender->td_end = 466 sender->td_maxend = end; 467 sender->td_maxwin = (win == 0 ? 1 : win); 468 469 tcp_options(skb, dataoff, tcph, sender); 470 /* RFC 1323: 471 * Both sides must send the Window Scale option 472 * to enable window scaling in either direction. 473 */ 474 if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE && 475 receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE)) { 476 sender->td_scale = 0; 477 receiver->td_scale = 0; 478 } 479 } 480 481 __printf(6, 7) 482 static enum nf_ct_tcp_action nf_tcp_log_invalid(const struct sk_buff *skb, 483 const struct nf_conn *ct, 484 const struct nf_hook_state *state, 485 const struct ip_ct_tcp_state *sender, 486 enum nf_ct_tcp_action ret, 487 const char *fmt, ...) 488 { 489 const struct nf_tcp_net *tn = nf_tcp_pernet(nf_ct_net(ct)); 490 struct va_format vaf; 491 va_list args; 492 bool be_liberal; 493 494 be_liberal = sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL || tn->tcp_be_liberal; 495 if (be_liberal) 496 return NFCT_TCP_ACCEPT; 497 498 va_start(args, fmt); 499 vaf.fmt = fmt; 500 vaf.va = &args; 501 nf_ct_l4proto_log_invalid(skb, ct, state, "%pV", &vaf); 502 va_end(args); 503 504 return ret; 505 } 506 507 static enum nf_ct_tcp_action 508 tcp_in_window(struct nf_conn *ct, enum ip_conntrack_dir dir, 509 unsigned int index, const struct sk_buff *skb, 510 unsigned int dataoff, const struct tcphdr *tcph, 511 const struct nf_hook_state *hook_state) 512 { 513 struct ip_ct_tcp *state = &ct->proto.tcp; 514 struct ip_ct_tcp_state *sender = &state->seen[dir]; 515 struct ip_ct_tcp_state *receiver = &state->seen[!dir]; 516 __u32 seq, ack, sack, end, win, swin; 517 bool in_recv_win, seq_ok; 518 s32 receiver_offset; 519 u16 win_raw; 520 521 /* 522 * Get the required data from the packet. 523 */ 524 seq = ntohl(tcph->seq); 525 ack = sack = ntohl(tcph->ack_seq); 526 win_raw = ntohs(tcph->window); 527 win = win_raw; 528 end = segment_seq_plus_len(seq, skb->len, dataoff, tcph); 529 530 if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM) 531 tcp_sack(skb, dataoff, tcph, &sack); 532 533 /* Take into account NAT sequence number mangling */ 534 receiver_offset = nf_ct_seq_offset(ct, !dir, ack - 1); 535 ack -= receiver_offset; 536 sack -= receiver_offset; 537 538 if (sender->td_maxwin == 0) { 539 /* 540 * Initialize sender data. 541 */ 542 if (tcph->syn) { 543 tcp_init_sender(sender, receiver, 544 skb, dataoff, tcph, 545 end, win); 546 if (!tcph->ack) 547 /* Simultaneous open */ 548 return NFCT_TCP_ACCEPT; 549 } else { 550 /* 551 * We are in the middle of a connection, 552 * its history is lost for us. 553 * Let's try to use the data from the packet. 554 */ 555 sender->td_end = end; 556 swin = win << sender->td_scale; 557 sender->td_maxwin = (swin == 0 ? 1 : swin); 558 sender->td_maxend = end + sender->td_maxwin; 559 if (receiver->td_maxwin == 0) { 560 /* We haven't seen traffic in the other 561 * direction yet but we have to tweak window 562 * tracking to pass III and IV until that 563 * happens. 564 */ 565 receiver->td_end = receiver->td_maxend = sack; 566 } else if (sack == receiver->td_end + 1) { 567 /* Likely a reply to a keepalive. 568 * Needed for III. 569 */ 570 receiver->td_end++; 571 } 572 573 } 574 } else if (tcph->syn && 575 after(end, sender->td_end) && 576 (state->state == TCP_CONNTRACK_SYN_SENT || 577 state->state == TCP_CONNTRACK_SYN_RECV)) { 578 /* 579 * RFC 793: "if a TCP is reinitialized ... then it need 580 * not wait at all; it must only be sure to use sequence 581 * numbers larger than those recently used." 582 * 583 * Re-init state for this direction, just like for the first 584 * syn(-ack) reply, it might differ in seq, ack or tcp options. 585 */ 586 tcp_init_sender(sender, receiver, 587 skb, dataoff, tcph, 588 end, win); 589 590 if (dir == IP_CT_DIR_REPLY && !tcph->ack) 591 return NFCT_TCP_ACCEPT; 592 } 593 594 if (!(tcph->ack)) { 595 /* 596 * If there is no ACK, just pretend it was set and OK. 597 */ 598 ack = sack = receiver->td_end; 599 } else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) == 600 (TCP_FLAG_ACK|TCP_FLAG_RST)) 601 && (ack == 0)) { 602 /* 603 * Broken TCP stacks, that set ACK in RST packets as well 604 * with zero ack value. 605 */ 606 ack = sack = receiver->td_end; 607 } 608 609 if (tcph->rst && seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT) 610 /* 611 * RST sent answering SYN. 612 */ 613 seq = end = sender->td_end; 614 615 seq_ok = before(seq, sender->td_maxend + 1); 616 if (!seq_ok) { 617 u32 overshot = end - sender->td_maxend + 1; 618 bool ack_ok; 619 620 ack_ok = after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1); 621 in_recv_win = receiver->td_maxwin && 622 after(end, sender->td_end - receiver->td_maxwin - 1); 623 624 if (in_recv_win && 625 ack_ok && 626 overshot <= receiver->td_maxwin && 627 before(sack, receiver->td_end + 1)) { 628 /* Work around TCPs that send more bytes than allowed by 629 * the receive window. 630 * 631 * If the (marked as invalid) packet is allowed to pass by 632 * the ruleset and the peer acks this data, then its possible 633 * all future packets will trigger 'ACK is over upper bound' check. 634 * 635 * Thus if only the sequence check fails then do update td_end so 636 * possible ACK for this data can update internal state. 637 */ 638 sender->td_end = end; 639 sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED; 640 641 return nf_tcp_log_invalid(skb, ct, hook_state, sender, NFCT_TCP_IGNORE, 642 "%u bytes more than expected", overshot); 643 } 644 645 return nf_tcp_log_invalid(skb, ct, hook_state, sender, NFCT_TCP_INVALID, 646 "SEQ is over upper bound %u (over the window of the receiver)", 647 sender->td_maxend + 1); 648 } 649 650 if (!before(sack, receiver->td_end + 1)) 651 return nf_tcp_log_invalid(skb, ct, hook_state, sender, NFCT_TCP_INVALID, 652 "ACK is over upper bound %u (ACKed data not seen yet)", 653 receiver->td_end + 1); 654 655 /* Is the ending sequence in the receive window (if available)? */ 656 in_recv_win = !receiver->td_maxwin || 657 after(end, sender->td_end - receiver->td_maxwin - 1); 658 if (!in_recv_win) 659 return nf_tcp_log_invalid(skb, ct, hook_state, sender, NFCT_TCP_IGNORE, 660 "SEQ is under lower bound %u (already ACKed data retransmitted)", 661 sender->td_end - receiver->td_maxwin - 1); 662 if (!after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) 663 return nf_tcp_log_invalid(skb, ct, hook_state, sender, NFCT_TCP_IGNORE, 664 "ignored ACK under lower bound %u (possible overly delayed)", 665 receiver->td_end - MAXACKWINDOW(sender) - 1); 666 667 /* Take into account window scaling (RFC 1323). */ 668 if (!tcph->syn) 669 win <<= sender->td_scale; 670 671 /* Update sender data. */ 672 swin = win + (sack - ack); 673 if (sender->td_maxwin < swin) 674 sender->td_maxwin = swin; 675 if (after(end, sender->td_end)) { 676 sender->td_end = end; 677 sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED; 678 } 679 if (tcph->ack) { 680 if (!(sender->flags & IP_CT_TCP_FLAG_MAXACK_SET)) { 681 sender->td_maxack = ack; 682 sender->flags |= IP_CT_TCP_FLAG_MAXACK_SET; 683 } else if (after(ack, sender->td_maxack)) { 684 sender->td_maxack = ack; 685 } 686 } 687 688 /* Update receiver data. */ 689 if (receiver->td_maxwin != 0 && after(end, sender->td_maxend)) 690 receiver->td_maxwin += end - sender->td_maxend; 691 if (after(sack + win, receiver->td_maxend - 1)) { 692 receiver->td_maxend = sack + win; 693 if (win == 0) 694 receiver->td_maxend++; 695 } 696 if (ack == receiver->td_end) 697 receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED; 698 699 /* Check retransmissions. */ 700 if (index == TCP_ACK_SET) { 701 if (state->last_dir == dir && 702 state->last_seq == seq && 703 state->last_ack == ack && 704 state->last_end == end && 705 state->last_win == win_raw) { 706 state->retrans++; 707 } else { 708 state->last_dir = dir; 709 state->last_seq = seq; 710 state->last_ack = ack; 711 state->last_end = end; 712 state->last_win = win_raw; 713 state->retrans = 0; 714 } 715 } 716 717 return NFCT_TCP_ACCEPT; 718 } 719 720 static void __cold nf_tcp_handle_invalid(struct nf_conn *ct, 721 enum ip_conntrack_dir dir, 722 int index, 723 const struct sk_buff *skb, 724 const struct nf_hook_state *hook_state) 725 { 726 const unsigned int *timeouts; 727 const struct nf_tcp_net *tn; 728 unsigned int timeout; 729 u32 expires; 730 731 if (!test_bit(IPS_ASSURED_BIT, &ct->status) || 732 test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) 733 return; 734 735 /* We don't want to have connections hanging around in ESTABLISHED 736 * state for long time 'just because' conntrack deemed a FIN/RST 737 * out-of-window. 738 * 739 * Shrink the timeout just like when there is unacked data. 740 * This speeds up eviction of 'dead' connections where the 741 * connection and conntracks internal state are out of sync. 742 */ 743 switch (index) { 744 case TCP_RST_SET: 745 case TCP_FIN_SET: 746 break; 747 default: 748 return; 749 } 750 751 if (ct->proto.tcp.last_dir != dir && 752 (ct->proto.tcp.last_index == TCP_FIN_SET || 753 ct->proto.tcp.last_index == TCP_RST_SET)) { 754 expires = nf_ct_expires(ct); 755 if (expires < 120 * HZ) 756 return; 757 758 tn = nf_tcp_pernet(nf_ct_net(ct)); 759 timeouts = nf_ct_timeout_lookup(ct); 760 if (!timeouts) 761 timeouts = tn->timeouts; 762 763 timeout = READ_ONCE(timeouts[TCP_CONNTRACK_UNACK]); 764 if (expires > timeout) { 765 nf_ct_l4proto_log_invalid(skb, ct, hook_state, 766 "packet (index %d, dir %d) response for index %d lower timeout to %u", 767 index, dir, ct->proto.tcp.last_index, timeout); 768 769 WRITE_ONCE(ct->timeout, timeout + nfct_time_stamp); 770 } 771 } else { 772 ct->proto.tcp.last_index = index; 773 ct->proto.tcp.last_dir = dir; 774 } 775 } 776 777 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */ 778 static const u8 tcp_valid_flags[(TCPHDR_FIN|TCPHDR_SYN|TCPHDR_RST|TCPHDR_ACK| 779 TCPHDR_URG) + 1] = 780 { 781 [TCPHDR_SYN] = 1, 782 [TCPHDR_SYN|TCPHDR_URG] = 1, 783 [TCPHDR_SYN|TCPHDR_ACK] = 1, 784 [TCPHDR_RST] = 1, 785 [TCPHDR_RST|TCPHDR_ACK] = 1, 786 [TCPHDR_FIN|TCPHDR_ACK] = 1, 787 [TCPHDR_FIN|TCPHDR_ACK|TCPHDR_URG] = 1, 788 [TCPHDR_ACK] = 1, 789 [TCPHDR_ACK|TCPHDR_URG] = 1, 790 }; 791 792 static void tcp_error_log(const struct sk_buff *skb, 793 const struct nf_hook_state *state, 794 const char *msg) 795 { 796 nf_l4proto_log_invalid(skb, state, IPPROTO_TCP, "%s", msg); 797 } 798 799 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c. */ 800 static bool tcp_error(const struct tcphdr *th, 801 struct sk_buff *skb, 802 unsigned int dataoff, 803 const struct nf_hook_state *state) 804 { 805 unsigned int tcplen = skb->len - dataoff; 806 u8 tcpflags; 807 808 /* Not whole TCP header or malformed packet */ 809 if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) { 810 tcp_error_log(skb, state, "truncated packet"); 811 return true; 812 } 813 814 /* Checksum invalid? Ignore. 815 * We skip checking packets on the outgoing path 816 * because the checksum is assumed to be correct. 817 */ 818 /* FIXME: Source route IP option packets --RR */ 819 if (state->net->ct.sysctl_checksum && 820 state->hook == NF_INET_PRE_ROUTING && 821 nf_checksum(skb, state->hook, dataoff, IPPROTO_TCP, state->pf)) { 822 tcp_error_log(skb, state, "bad checksum"); 823 return true; 824 } 825 826 /* Check TCP flags. */ 827 tcpflags = (tcp_flag_byte(th) & ~(TCPHDR_ECE|TCPHDR_CWR|TCPHDR_PSH)); 828 if (!tcp_valid_flags[tcpflags]) { 829 tcp_error_log(skb, state, "invalid tcp flag combination"); 830 return true; 831 } 832 833 return false; 834 } 835 836 static noinline bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb, 837 unsigned int dataoff, 838 const struct tcphdr *th) 839 { 840 enum tcp_conntrack new_state; 841 struct net *net = nf_ct_net(ct); 842 const struct nf_tcp_net *tn = nf_tcp_pernet(net); 843 844 /* Don't need lock here: this conntrack not in circulation yet */ 845 new_state = tcp_conntracks[0][get_conntrack_index(th)][TCP_CONNTRACK_NONE]; 846 847 /* Invalid: delete conntrack */ 848 if (new_state >= TCP_CONNTRACK_MAX) { 849 pr_debug("nf_ct_tcp: invalid new deleting.\n"); 850 return false; 851 } 852 853 if (new_state == TCP_CONNTRACK_SYN_SENT) { 854 memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp)); 855 /* SYN packet */ 856 ct->proto.tcp.seen[0].td_end = 857 segment_seq_plus_len(ntohl(th->seq), skb->len, 858 dataoff, th); 859 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window); 860 if (ct->proto.tcp.seen[0].td_maxwin == 0) 861 ct->proto.tcp.seen[0].td_maxwin = 1; 862 ct->proto.tcp.seen[0].td_maxend = 863 ct->proto.tcp.seen[0].td_end; 864 865 tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]); 866 } else if (tn->tcp_loose == 0) { 867 /* Don't try to pick up connections. */ 868 return false; 869 } else { 870 memset(&ct->proto.tcp, 0, sizeof(ct->proto.tcp)); 871 /* 872 * We are in the middle of a connection, 873 * its history is lost for us. 874 * Let's try to use the data from the packet. 875 */ 876 ct->proto.tcp.seen[0].td_end = 877 segment_seq_plus_len(ntohl(th->seq), skb->len, 878 dataoff, th); 879 ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window); 880 if (ct->proto.tcp.seen[0].td_maxwin == 0) 881 ct->proto.tcp.seen[0].td_maxwin = 1; 882 ct->proto.tcp.seen[0].td_maxend = 883 ct->proto.tcp.seen[0].td_end + 884 ct->proto.tcp.seen[0].td_maxwin; 885 886 /* We assume SACK and liberal window checking to handle 887 * window scaling */ 888 ct->proto.tcp.seen[0].flags = 889 ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM | 890 IP_CT_TCP_FLAG_BE_LIBERAL; 891 } 892 893 /* tcp_packet will set them */ 894 ct->proto.tcp.last_index = TCP_NONE_SET; 895 return true; 896 } 897 898 static bool tcp_can_early_drop(const struct nf_conn *ct) 899 { 900 switch (ct->proto.tcp.state) { 901 case TCP_CONNTRACK_FIN_WAIT: 902 case TCP_CONNTRACK_LAST_ACK: 903 case TCP_CONNTRACK_TIME_WAIT: 904 case TCP_CONNTRACK_CLOSE: 905 case TCP_CONNTRACK_CLOSE_WAIT: 906 return true; 907 default: 908 break; 909 } 910 911 return false; 912 } 913 914 static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state) 915 { 916 state->td_end = 0; 917 state->td_maxend = 0; 918 state->td_maxwin = 0; 919 state->td_maxack = 0; 920 state->td_scale = 0; 921 state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; 922 } 923 924 /* Returns verdict for packet, or -1 for invalid. */ 925 int nf_conntrack_tcp_packet(struct nf_conn *ct, 926 struct sk_buff *skb, 927 unsigned int dataoff, 928 enum ip_conntrack_info ctinfo, 929 const struct nf_hook_state *state) 930 { 931 struct net *net = nf_ct_net(ct); 932 struct nf_tcp_net *tn = nf_tcp_pernet(net); 933 struct nf_conntrack_tuple *tuple; 934 enum tcp_conntrack new_state, old_state; 935 unsigned int index, *timeouts; 936 enum nf_ct_tcp_action res; 937 enum ip_conntrack_dir dir; 938 const struct tcphdr *th; 939 struct tcphdr _tcph; 940 unsigned long timeout; 941 942 th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph); 943 if (th == NULL) 944 return -NF_ACCEPT; 945 946 if (tcp_error(th, skb, dataoff, state)) 947 return -NF_ACCEPT; 948 949 if (!nf_ct_is_confirmed(ct) && !tcp_new(ct, skb, dataoff, th)) 950 return -NF_ACCEPT; 951 952 spin_lock_bh(&ct->lock); 953 old_state = ct->proto.tcp.state; 954 dir = CTINFO2DIR(ctinfo); 955 index = get_conntrack_index(th); 956 new_state = tcp_conntracks[dir][index][old_state]; 957 tuple = &ct->tuplehash[dir].tuple; 958 959 switch (new_state) { 960 case TCP_CONNTRACK_SYN_SENT: 961 if (old_state < TCP_CONNTRACK_TIME_WAIT) 962 break; 963 /* RFC 1122: "When a connection is closed actively, 964 * it MUST linger in TIME-WAIT state for a time 2xMSL 965 * (Maximum Segment Lifetime). However, it MAY accept 966 * a new SYN from the remote TCP to reopen the connection 967 * directly from TIME-WAIT state, if..." 968 * We ignore the conditions because we are in the 969 * TIME-WAIT state anyway. 970 * 971 * Handle aborted connections: we and the server 972 * think there is an existing connection but the client 973 * aborts it and starts a new one. 974 */ 975 if (((ct->proto.tcp.seen[dir].flags 976 | ct->proto.tcp.seen[!dir].flags) 977 & IP_CT_TCP_FLAG_CLOSE_INIT) 978 || (ct->proto.tcp.last_dir == dir 979 && ct->proto.tcp.last_index == TCP_RST_SET)) { 980 /* Attempt to reopen a closed/aborted connection. 981 * Delete this connection and look up again. */ 982 spin_unlock_bh(&ct->lock); 983 984 /* Only repeat if we can actually remove the timer. 985 * Destruction may already be in progress in process 986 * context and we must give it a chance to terminate. 987 */ 988 if (nf_ct_kill(ct)) 989 return -NF_REPEAT; 990 return NF_DROP; 991 } 992 fallthrough; 993 case TCP_CONNTRACK_IGNORE: 994 /* Ignored packets: 995 * 996 * Our connection entry may be out of sync, so ignore 997 * packets which may signal the real connection between 998 * the client and the server. 999 * 1000 * a) SYN in ORIGINAL 1001 * b) SYN/ACK in REPLY 1002 * c) ACK in reply direction after initial SYN in original. 1003 * 1004 * If the ignored packet is invalid, the receiver will send 1005 * a RST we'll catch below. 1006 */ 1007 if (index == TCP_SYNACK_SET 1008 && ct->proto.tcp.last_index == TCP_SYN_SET 1009 && ct->proto.tcp.last_dir != dir 1010 && ntohl(th->ack_seq) == ct->proto.tcp.last_end) { 1011 /* b) This SYN/ACK acknowledges a SYN that we earlier 1012 * ignored as invalid. This means that the client and 1013 * the server are both in sync, while the firewall is 1014 * not. We get in sync from the previously annotated 1015 * values. 1016 */ 1017 old_state = TCP_CONNTRACK_SYN_SENT; 1018 new_state = TCP_CONNTRACK_SYN_RECV; 1019 ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_end = 1020 ct->proto.tcp.last_end; 1021 ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxend = 1022 ct->proto.tcp.last_end; 1023 ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_maxwin = 1024 ct->proto.tcp.last_win == 0 ? 1025 1 : ct->proto.tcp.last_win; 1026 ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_scale = 1027 ct->proto.tcp.last_wscale; 1028 ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK; 1029 ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags = 1030 ct->proto.tcp.last_flags; 1031 nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]); 1032 break; 1033 } 1034 ct->proto.tcp.last_index = index; 1035 ct->proto.tcp.last_dir = dir; 1036 ct->proto.tcp.last_seq = ntohl(th->seq); 1037 ct->proto.tcp.last_end = 1038 segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th); 1039 ct->proto.tcp.last_win = ntohs(th->window); 1040 1041 /* a) This is a SYN in ORIGINAL. The client and the server 1042 * may be in sync but we are not. In that case, we annotate 1043 * the TCP options and let the packet go through. If it is a 1044 * valid SYN packet, the server will reply with a SYN/ACK, and 1045 * then we'll get in sync. Otherwise, the server potentially 1046 * responds with a challenge ACK if implementing RFC5961. 1047 */ 1048 if (index == TCP_SYN_SET && dir == IP_CT_DIR_ORIGINAL) { 1049 struct ip_ct_tcp_state seen = {}; 1050 1051 ct->proto.tcp.last_flags = 1052 ct->proto.tcp.last_wscale = 0; 1053 tcp_options(skb, dataoff, th, &seen); 1054 if (seen.flags & IP_CT_TCP_FLAG_WINDOW_SCALE) { 1055 ct->proto.tcp.last_flags |= 1056 IP_CT_TCP_FLAG_WINDOW_SCALE; 1057 ct->proto.tcp.last_wscale = seen.td_scale; 1058 } 1059 if (seen.flags & IP_CT_TCP_FLAG_SACK_PERM) { 1060 ct->proto.tcp.last_flags |= 1061 IP_CT_TCP_FLAG_SACK_PERM; 1062 } 1063 /* Mark the potential for RFC5961 challenge ACK, 1064 * this pose a special problem for LAST_ACK state 1065 * as ACK is intrepretated as ACKing last FIN. 1066 */ 1067 if (old_state == TCP_CONNTRACK_LAST_ACK) 1068 ct->proto.tcp.last_flags |= 1069 IP_CT_EXP_CHALLENGE_ACK; 1070 } 1071 spin_unlock_bh(&ct->lock); 1072 nf_ct_l4proto_log_invalid(skb, ct, state, 1073 "packet (index %d) in dir %d ignored, state %s", 1074 index, dir, 1075 tcp_conntrack_names[old_state]); 1076 return NF_ACCEPT; 1077 case TCP_CONNTRACK_MAX: 1078 /* Special case for SYN proxy: when the SYN to the server or 1079 * the SYN/ACK from the server is lost, the client may transmit 1080 * a keep-alive packet while in SYN_SENT state. This needs to 1081 * be associated with the original conntrack entry in order to 1082 * generate a new SYN with the correct sequence number. 1083 */ 1084 if (nfct_synproxy(ct) && old_state == TCP_CONNTRACK_SYN_SENT && 1085 index == TCP_ACK_SET && dir == IP_CT_DIR_ORIGINAL && 1086 ct->proto.tcp.last_dir == IP_CT_DIR_ORIGINAL && 1087 ct->proto.tcp.seen[dir].td_end - 1 == ntohl(th->seq)) { 1088 pr_debug("nf_ct_tcp: SYN proxy client keep alive\n"); 1089 spin_unlock_bh(&ct->lock); 1090 return NF_ACCEPT; 1091 } 1092 1093 /* Invalid packet */ 1094 spin_unlock_bh(&ct->lock); 1095 nf_ct_l4proto_log_invalid(skb, ct, state, 1096 "packet (index %d) in dir %d invalid, state %s", 1097 index, dir, 1098 tcp_conntrack_names[old_state]); 1099 return -NF_ACCEPT; 1100 case TCP_CONNTRACK_TIME_WAIT: 1101 /* RFC5961 compliance cause stack to send "challenge-ACK" 1102 * e.g. in response to spurious SYNs. Conntrack MUST 1103 * not believe this ACK is acking last FIN. 1104 */ 1105 if (old_state == TCP_CONNTRACK_LAST_ACK && 1106 index == TCP_ACK_SET && 1107 ct->proto.tcp.last_dir != dir && 1108 ct->proto.tcp.last_index == TCP_SYN_SET && 1109 (ct->proto.tcp.last_flags & IP_CT_EXP_CHALLENGE_ACK)) { 1110 /* Detected RFC5961 challenge ACK */ 1111 ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK; 1112 spin_unlock_bh(&ct->lock); 1113 nf_ct_l4proto_log_invalid(skb, ct, state, "challenge-ack ignored"); 1114 return NF_ACCEPT; /* Don't change state */ 1115 } 1116 break; 1117 case TCP_CONNTRACK_SYN_SENT2: 1118 /* tcp_conntracks table is not smart enough to handle 1119 * simultaneous open. 1120 */ 1121 ct->proto.tcp.last_flags |= IP_CT_TCP_SIMULTANEOUS_OPEN; 1122 break; 1123 case TCP_CONNTRACK_SYN_RECV: 1124 if (dir == IP_CT_DIR_REPLY && index == TCP_ACK_SET && 1125 ct->proto.tcp.last_flags & IP_CT_TCP_SIMULTANEOUS_OPEN) 1126 new_state = TCP_CONNTRACK_ESTABLISHED; 1127 break; 1128 case TCP_CONNTRACK_CLOSE: 1129 if (index != TCP_RST_SET) 1130 break; 1131 1132 /* If we are closing, tuple might have been re-used already. 1133 * last_index, last_ack, and all other ct fields used for 1134 * sequence/window validation are outdated in that case. 1135 * 1136 * As the conntrack can already be expired by GC under pressure, 1137 * just skip validation checks. 1138 */ 1139 if (tcp_can_early_drop(ct)) 1140 goto in_window; 1141 1142 /* td_maxack might be outdated if we let a SYN through earlier */ 1143 if ((ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET) && 1144 ct->proto.tcp.last_index != TCP_SYN_SET) { 1145 u32 seq = ntohl(th->seq); 1146 1147 /* If we are not in established state and SEQ=0 this is most 1148 * likely an answer to a SYN we let go through above (last_index 1149 * can be updated due to out-of-order ACKs). 1150 */ 1151 if (seq == 0 && !nf_conntrack_tcp_established(ct)) 1152 break; 1153 1154 if (before(seq, ct->proto.tcp.seen[!dir].td_maxack) && 1155 !tn->tcp_ignore_invalid_rst) { 1156 /* Invalid RST */ 1157 spin_unlock_bh(&ct->lock); 1158 nf_ct_l4proto_log_invalid(skb, ct, state, "invalid rst"); 1159 return -NF_ACCEPT; 1160 } 1161 1162 if (!nf_conntrack_tcp_established(ct) || 1163 seq == ct->proto.tcp.seen[!dir].td_maxack) 1164 break; 1165 1166 /* Check if rst is part of train, such as 1167 * foo:80 > bar:4379: P, 235946583:235946602(19) ack 42 1168 * foo:80 > bar:4379: R, 235946602:235946602(0) ack 42 1169 */ 1170 if (ct->proto.tcp.last_index == TCP_ACK_SET && 1171 ct->proto.tcp.last_dir == dir && 1172 seq == ct->proto.tcp.last_end) 1173 break; 1174 1175 /* ... RST sequence number doesn't match exactly, keep 1176 * established state to allow a possible challenge ACK. 1177 */ 1178 new_state = old_state; 1179 } 1180 if (((test_bit(IPS_SEEN_REPLY_BIT, &ct->status) 1181 && ct->proto.tcp.last_index == TCP_SYN_SET) 1182 || (!test_bit(IPS_ASSURED_BIT, &ct->status) 1183 && ct->proto.tcp.last_index == TCP_ACK_SET)) 1184 && ntohl(th->ack_seq) == ct->proto.tcp.last_end) { 1185 /* RST sent to invalid SYN or ACK we had let through 1186 * at a) and c) above: 1187 * 1188 * a) SYN was in window then 1189 * c) we hold a half-open connection. 1190 * 1191 * Delete our connection entry. 1192 * We skip window checking, because packet might ACK 1193 * segments we ignored. */ 1194 goto in_window; 1195 } 1196 break; 1197 default: 1198 /* Keep compilers happy. */ 1199 break; 1200 } 1201 1202 res = tcp_in_window(ct, dir, index, 1203 skb, dataoff, th, state); 1204 switch (res) { 1205 case NFCT_TCP_IGNORE: 1206 spin_unlock_bh(&ct->lock); 1207 return NF_ACCEPT; 1208 case NFCT_TCP_INVALID: 1209 nf_tcp_handle_invalid(ct, dir, index, skb, state); 1210 spin_unlock_bh(&ct->lock); 1211 return -NF_ACCEPT; 1212 case NFCT_TCP_ACCEPT: 1213 break; 1214 } 1215 in_window: 1216 /* From now on we have got in-window packets */ 1217 ct->proto.tcp.last_index = index; 1218 ct->proto.tcp.last_dir = dir; 1219 1220 pr_debug("tcp_conntracks: "); 1221 nf_ct_dump_tuple(tuple); 1222 pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n", 1223 (th->syn ? 1 : 0), (th->ack ? 1 : 0), 1224 (th->fin ? 1 : 0), (th->rst ? 1 : 0), 1225 old_state, new_state); 1226 1227 ct->proto.tcp.state = new_state; 1228 if (old_state != new_state 1229 && new_state == TCP_CONNTRACK_FIN_WAIT) 1230 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT; 1231 1232 timeouts = nf_ct_timeout_lookup(ct); 1233 if (!timeouts) 1234 timeouts = tn->timeouts; 1235 1236 if (ct->proto.tcp.retrans >= tn->tcp_max_retrans && 1237 timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS]) 1238 timeout = timeouts[TCP_CONNTRACK_RETRANS]; 1239 else if (unlikely(index == TCP_RST_SET)) 1240 timeout = timeouts[TCP_CONNTRACK_CLOSE]; 1241 else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) & 1242 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED && 1243 timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK]) 1244 timeout = timeouts[TCP_CONNTRACK_UNACK]; 1245 else if (ct->proto.tcp.last_win == 0 && 1246 timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS]) 1247 timeout = timeouts[TCP_CONNTRACK_RETRANS]; 1248 else 1249 timeout = timeouts[new_state]; 1250 spin_unlock_bh(&ct->lock); 1251 1252 if (new_state != old_state) 1253 nf_conntrack_event_cache(IPCT_PROTOINFO, ct); 1254 1255 if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) { 1256 /* If only reply is a RST, we can consider ourselves not to 1257 have an established connection: this is a fairly common 1258 problem case, so we can delete the conntrack 1259 immediately. --RR */ 1260 if (th->rst) { 1261 nf_ct_kill_acct(ct, ctinfo, skb); 1262 return NF_ACCEPT; 1263 } 1264 1265 if (index == TCP_SYN_SET && old_state == TCP_CONNTRACK_SYN_SENT) { 1266 /* do not renew timeout on SYN retransmit. 1267 * 1268 * Else port reuse by client or NAT middlebox can keep 1269 * entry alive indefinitely (including nat info). 1270 */ 1271 return NF_ACCEPT; 1272 } 1273 1274 /* ESTABLISHED without SEEN_REPLY, i.e. mid-connection 1275 * pickup with loose=1. Avoid large ESTABLISHED timeout. 1276 */ 1277 if (new_state == TCP_CONNTRACK_ESTABLISHED && 1278 timeout > timeouts[TCP_CONNTRACK_UNACK]) 1279 timeout = timeouts[TCP_CONNTRACK_UNACK]; 1280 } else if (!test_bit(IPS_ASSURED_BIT, &ct->status) 1281 && (old_state == TCP_CONNTRACK_SYN_RECV 1282 || old_state == TCP_CONNTRACK_ESTABLISHED) 1283 && new_state == TCP_CONNTRACK_ESTABLISHED) { 1284 /* Set ASSURED if we see valid ack in ESTABLISHED 1285 after SYN_RECV or a valid answer for a picked up 1286 connection. */ 1287 set_bit(IPS_ASSURED_BIT, &ct->status); 1288 nf_conntrack_event_cache(IPCT_ASSURED, ct); 1289 } 1290 nf_ct_refresh_acct(ct, ctinfo, skb, timeout); 1291 1292 return NF_ACCEPT; 1293 } 1294 1295 #if IS_ENABLED(CONFIG_NF_CT_NETLINK) 1296 1297 #include <linux/netfilter/nfnetlink.h> 1298 #include <linux/netfilter/nfnetlink_conntrack.h> 1299 1300 static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla, 1301 struct nf_conn *ct, bool destroy) 1302 { 1303 struct nlattr *nest_parms; 1304 struct nf_ct_tcp_flags tmp = {}; 1305 1306 spin_lock_bh(&ct->lock); 1307 nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP); 1308 if (!nest_parms) 1309 goto nla_put_failure; 1310 1311 if (nla_put_u8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state)) 1312 goto nla_put_failure; 1313 1314 if (destroy) 1315 goto skip_state; 1316 1317 if (nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL, 1318 ct->proto.tcp.seen[0].td_scale) || 1319 nla_put_u8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY, 1320 ct->proto.tcp.seen[1].td_scale)) 1321 goto nla_put_failure; 1322 1323 tmp.flags = ct->proto.tcp.seen[0].flags; 1324 if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL, 1325 sizeof(struct nf_ct_tcp_flags), &tmp)) 1326 goto nla_put_failure; 1327 1328 tmp.flags = ct->proto.tcp.seen[1].flags; 1329 if (nla_put(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY, 1330 sizeof(struct nf_ct_tcp_flags), &tmp)) 1331 goto nla_put_failure; 1332 skip_state: 1333 spin_unlock_bh(&ct->lock); 1334 nla_nest_end(skb, nest_parms); 1335 1336 return 0; 1337 1338 nla_put_failure: 1339 spin_unlock_bh(&ct->lock); 1340 return -1; 1341 } 1342 1343 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = { 1344 [CTA_PROTOINFO_TCP_STATE] = { .type = NLA_U8 }, 1345 [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 }, 1346 [CTA_PROTOINFO_TCP_WSCALE_REPLY] = { .type = NLA_U8 }, 1347 [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL] = { .len = sizeof(struct nf_ct_tcp_flags) }, 1348 [CTA_PROTOINFO_TCP_FLAGS_REPLY] = { .len = sizeof(struct nf_ct_tcp_flags) }, 1349 }; 1350 1351 #define TCP_NLATTR_SIZE ( \ 1352 NLA_ALIGN(NLA_HDRLEN + 1) + \ 1353 NLA_ALIGN(NLA_HDRLEN + 1) + \ 1354 NLA_ALIGN(NLA_HDRLEN + sizeof(struct nf_ct_tcp_flags)) + \ 1355 NLA_ALIGN(NLA_HDRLEN + sizeof(struct nf_ct_tcp_flags))) 1356 1357 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct) 1358 { 1359 struct nlattr *pattr = cda[CTA_PROTOINFO_TCP]; 1360 struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1]; 1361 int err; 1362 1363 /* updates could not contain anything about the private 1364 * protocol info, in that case skip the parsing */ 1365 if (!pattr) 1366 return 0; 1367 1368 err = nla_parse_nested_deprecated(tb, CTA_PROTOINFO_TCP_MAX, pattr, 1369 tcp_nla_policy, NULL); 1370 if (err < 0) 1371 return err; 1372 1373 if (tb[CTA_PROTOINFO_TCP_STATE] && 1374 nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX) 1375 return -EINVAL; 1376 1377 spin_lock_bh(&ct->lock); 1378 if (tb[CTA_PROTOINFO_TCP_STATE]) 1379 ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]); 1380 1381 if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) { 1382 struct nf_ct_tcp_flags *attr = 1383 nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]); 1384 ct->proto.tcp.seen[0].flags &= ~attr->mask; 1385 ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask; 1386 } 1387 1388 if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) { 1389 struct nf_ct_tcp_flags *attr = 1390 nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]); 1391 ct->proto.tcp.seen[1].flags &= ~attr->mask; 1392 ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask; 1393 } 1394 1395 if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] && 1396 tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] && 1397 ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE && 1398 ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) { 1399 ct->proto.tcp.seen[0].td_scale = 1400 nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]); 1401 ct->proto.tcp.seen[1].td_scale = 1402 nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]); 1403 } 1404 spin_unlock_bh(&ct->lock); 1405 1406 return 0; 1407 } 1408 1409 static unsigned int tcp_nlattr_tuple_size(void) 1410 { 1411 static unsigned int size __read_mostly; 1412 1413 if (!size) 1414 size = nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1); 1415 1416 return size; 1417 } 1418 #endif 1419 1420 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1421 1422 #include <linux/netfilter/nfnetlink.h> 1423 #include <linux/netfilter/nfnetlink_cttimeout.h> 1424 1425 static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[], 1426 struct net *net, void *data) 1427 { 1428 struct nf_tcp_net *tn = nf_tcp_pernet(net); 1429 unsigned int *timeouts = data; 1430 int i; 1431 1432 if (!timeouts) 1433 timeouts = tn->timeouts; 1434 /* set default TCP timeouts. */ 1435 for (i=0; i<TCP_CONNTRACK_TIMEOUT_MAX; i++) 1436 timeouts[i] = tn->timeouts[i]; 1437 1438 if (tb[CTA_TIMEOUT_TCP_SYN_SENT]) { 1439 timeouts[TCP_CONNTRACK_SYN_SENT] = 1440 ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT]))*HZ; 1441 } 1442 1443 if (tb[CTA_TIMEOUT_TCP_SYN_RECV]) { 1444 timeouts[TCP_CONNTRACK_SYN_RECV] = 1445 ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_RECV]))*HZ; 1446 } 1447 if (tb[CTA_TIMEOUT_TCP_ESTABLISHED]) { 1448 timeouts[TCP_CONNTRACK_ESTABLISHED] = 1449 ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_ESTABLISHED]))*HZ; 1450 } 1451 if (tb[CTA_TIMEOUT_TCP_FIN_WAIT]) { 1452 timeouts[TCP_CONNTRACK_FIN_WAIT] = 1453 ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_FIN_WAIT]))*HZ; 1454 } 1455 if (tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]) { 1456 timeouts[TCP_CONNTRACK_CLOSE_WAIT] = 1457 ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE_WAIT]))*HZ; 1458 } 1459 if (tb[CTA_TIMEOUT_TCP_LAST_ACK]) { 1460 timeouts[TCP_CONNTRACK_LAST_ACK] = 1461 ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_LAST_ACK]))*HZ; 1462 } 1463 if (tb[CTA_TIMEOUT_TCP_TIME_WAIT]) { 1464 timeouts[TCP_CONNTRACK_TIME_WAIT] = 1465 ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_TIME_WAIT]))*HZ; 1466 } 1467 if (tb[CTA_TIMEOUT_TCP_CLOSE]) { 1468 timeouts[TCP_CONNTRACK_CLOSE] = 1469 ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_CLOSE]))*HZ; 1470 } 1471 if (tb[CTA_TIMEOUT_TCP_SYN_SENT2]) { 1472 timeouts[TCP_CONNTRACK_SYN_SENT2] = 1473 ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT2]))*HZ; 1474 } 1475 if (tb[CTA_TIMEOUT_TCP_RETRANS]) { 1476 timeouts[TCP_CONNTRACK_RETRANS] = 1477 ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_RETRANS]))*HZ; 1478 } 1479 if (tb[CTA_TIMEOUT_TCP_UNACK]) { 1480 timeouts[TCP_CONNTRACK_UNACK] = 1481 ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_UNACK]))*HZ; 1482 } 1483 1484 timeouts[CTA_TIMEOUT_TCP_UNSPEC] = timeouts[CTA_TIMEOUT_TCP_SYN_SENT]; 1485 return 0; 1486 } 1487 1488 static int 1489 tcp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data) 1490 { 1491 const unsigned int *timeouts = data; 1492 1493 if (nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT, 1494 htonl(timeouts[TCP_CONNTRACK_SYN_SENT] / HZ)) || 1495 nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_RECV, 1496 htonl(timeouts[TCP_CONNTRACK_SYN_RECV] / HZ)) || 1497 nla_put_be32(skb, CTA_TIMEOUT_TCP_ESTABLISHED, 1498 htonl(timeouts[TCP_CONNTRACK_ESTABLISHED] / HZ)) || 1499 nla_put_be32(skb, CTA_TIMEOUT_TCP_FIN_WAIT, 1500 htonl(timeouts[TCP_CONNTRACK_FIN_WAIT] / HZ)) || 1501 nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE_WAIT, 1502 htonl(timeouts[TCP_CONNTRACK_CLOSE_WAIT] / HZ)) || 1503 nla_put_be32(skb, CTA_TIMEOUT_TCP_LAST_ACK, 1504 htonl(timeouts[TCP_CONNTRACK_LAST_ACK] / HZ)) || 1505 nla_put_be32(skb, CTA_TIMEOUT_TCP_TIME_WAIT, 1506 htonl(timeouts[TCP_CONNTRACK_TIME_WAIT] / HZ)) || 1507 nla_put_be32(skb, CTA_TIMEOUT_TCP_CLOSE, 1508 htonl(timeouts[TCP_CONNTRACK_CLOSE] / HZ)) || 1509 nla_put_be32(skb, CTA_TIMEOUT_TCP_SYN_SENT2, 1510 htonl(timeouts[TCP_CONNTRACK_SYN_SENT2] / HZ)) || 1511 nla_put_be32(skb, CTA_TIMEOUT_TCP_RETRANS, 1512 htonl(timeouts[TCP_CONNTRACK_RETRANS] / HZ)) || 1513 nla_put_be32(skb, CTA_TIMEOUT_TCP_UNACK, 1514 htonl(timeouts[TCP_CONNTRACK_UNACK] / HZ))) 1515 goto nla_put_failure; 1516 return 0; 1517 1518 nla_put_failure: 1519 return -ENOSPC; 1520 } 1521 1522 static const struct nla_policy tcp_timeout_nla_policy[CTA_TIMEOUT_TCP_MAX+1] = { 1523 [CTA_TIMEOUT_TCP_SYN_SENT] = { .type = NLA_U32 }, 1524 [CTA_TIMEOUT_TCP_SYN_RECV] = { .type = NLA_U32 }, 1525 [CTA_TIMEOUT_TCP_ESTABLISHED] = { .type = NLA_U32 }, 1526 [CTA_TIMEOUT_TCP_FIN_WAIT] = { .type = NLA_U32 }, 1527 [CTA_TIMEOUT_TCP_CLOSE_WAIT] = { .type = NLA_U32 }, 1528 [CTA_TIMEOUT_TCP_LAST_ACK] = { .type = NLA_U32 }, 1529 [CTA_TIMEOUT_TCP_TIME_WAIT] = { .type = NLA_U32 }, 1530 [CTA_TIMEOUT_TCP_CLOSE] = { .type = NLA_U32 }, 1531 [CTA_TIMEOUT_TCP_SYN_SENT2] = { .type = NLA_U32 }, 1532 [CTA_TIMEOUT_TCP_RETRANS] = { .type = NLA_U32 }, 1533 [CTA_TIMEOUT_TCP_UNACK] = { .type = NLA_U32 }, 1534 }; 1535 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */ 1536 1537 void nf_conntrack_tcp_init_net(struct net *net) 1538 { 1539 struct nf_tcp_net *tn = nf_tcp_pernet(net); 1540 int i; 1541 1542 for (i = 0; i < TCP_CONNTRACK_TIMEOUT_MAX; i++) 1543 tn->timeouts[i] = tcp_timeouts[i]; 1544 1545 /* timeouts[0] is unused, make it same as SYN_SENT so 1546 * ->timeouts[0] contains 'new' timeout, like udp or icmp. 1547 */ 1548 tn->timeouts[0] = tcp_timeouts[TCP_CONNTRACK_SYN_SENT]; 1549 1550 /* If it is set to zero, we disable picking up already established 1551 * connections. 1552 */ 1553 tn->tcp_loose = 1; 1554 1555 /* "Be conservative in what you do, 1556 * be liberal in what you accept from others." 1557 * If it's non-zero, we mark only out of window RST segments as INVALID. 1558 */ 1559 tn->tcp_be_liberal = 0; 1560 1561 /* If it's non-zero, we turn off RST sequence number check */ 1562 tn->tcp_ignore_invalid_rst = 0; 1563 1564 /* Max number of the retransmitted packets without receiving an (acceptable) 1565 * ACK from the destination. If this number is reached, a shorter timer 1566 * will be started. 1567 */ 1568 tn->tcp_max_retrans = 3; 1569 1570 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE) 1571 tn->offload_timeout = 30 * HZ; 1572 #endif 1573 } 1574 1575 const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp = 1576 { 1577 .l4proto = IPPROTO_TCP, 1578 #ifdef CONFIG_NF_CONNTRACK_PROCFS 1579 .print_conntrack = tcp_print_conntrack, 1580 #endif 1581 .can_early_drop = tcp_can_early_drop, 1582 #if IS_ENABLED(CONFIG_NF_CT_NETLINK) 1583 .to_nlattr = tcp_to_nlattr, 1584 .from_nlattr = nlattr_to_tcp, 1585 .tuple_to_nlattr = nf_ct_port_tuple_to_nlattr, 1586 .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple, 1587 .nlattr_tuple_size = tcp_nlattr_tuple_size, 1588 .nlattr_size = TCP_NLATTR_SIZE, 1589 .nla_policy = nf_ct_port_nla_policy, 1590 #endif 1591 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1592 .ctnl_timeout = { 1593 .nlattr_to_obj = tcp_timeout_nlattr_to_obj, 1594 .obj_to_nlattr = tcp_timeout_obj_to_nlattr, 1595 .nlattr_max = CTA_TIMEOUT_TCP_MAX, 1596 .obj_size = sizeof(unsigned int) * 1597 TCP_CONNTRACK_TIMEOUT_MAX, 1598 .nla_policy = tcp_timeout_nla_policy, 1599 }, 1600 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */ 1601 }; 1602