xref: /netbsd-src/sys/net/npf/npf_state_tcp.c (revision b899bfd96fd2cbaf2befc9ce4aaed9b9c230837a)
1 /*-
2  * Copyright (c) 2010-2012 The NetBSD Foundation, Inc.
3  * All rights reserved.
4  *
5  * This material is based upon work partially supported by The
6  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
19  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
20  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
21  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
22  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
25  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27  * POSSIBILITY OF SUCH DAMAGE.
28  */
29 
30 /*
31  * NPF TCP state engine for connection tracking.
32  */
33 
34 #ifdef _KERNEL
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: npf_state_tcp.c,v 1.21 2020/05/30 14:16:56 rmind Exp $");
37 
38 #include <sys/param.h>
39 #include <sys/types.h>
40 
41 #include <netinet/in.h>
42 #include <netinet/tcp.h>
43 #endif
44 
45 #include "npf_impl.h"
46 
47 /*
48  * NPF TCP states.  Note: these states are different from the TCP FSM
49  * states of RFC 793.  The packet filter is a man-in-the-middle.
50  */
51 #define	NPF_TCPS_OK		255
52 #define	NPF_TCPS_CLOSED		0
53 #define	NPF_TCPS_SYN_SENT	1
54 #define	NPF_TCPS_SIMSYN_SENT	2
55 #define	NPF_TCPS_SYN_RECEIVED	3
56 #define	NPF_TCPS_ESTABLISHED	4
57 #define	NPF_TCPS_FIN_SENT	5
58 #define	NPF_TCPS_FIN_RECEIVED	6
59 #define	NPF_TCPS_CLOSE_WAIT	7
60 #define	NPF_TCPS_FIN_WAIT	8
61 #define	NPF_TCPS_CLOSING	9
62 #define	NPF_TCPS_LAST_ACK	10
63 #define	NPF_TCPS_TIME_WAIT	11
64 
65 #define	NPF_TCP_NSTATES		12
66 
67 /* Timeouts */
68 #define	NPF_TCPT_NEW		0
69 #define	NPF_TCPT_ESTABLISHED	1
70 #define	NPF_TCPT_HALFCLOSE	2
71 #define	NPF_TCPT_CLOSE		3
72 #define	NPF_TCPT_TIMEWAIT	4
73 #define	NPF_TCPT_COUNT		5
74 
75 /*
76  * Parameters.
77  */
78 typedef struct {
79 	int		max_ack_win;
80 	int		strict_order_rst;
81 	int		timeouts[NPF_TCPT_COUNT];
82 } npf_state_tcp_params_t;
83 
84 /*
85  * Helpers.
86  */
87 #define	SEQ_LT(a,b)		((int)((a)-(b)) < 0)
88 #define	SEQ_LEQ(a,b)		((int)((a)-(b)) <= 0)
89 #define	SEQ_GT(a,b)		((int)((a)-(b)) > 0)
90 #define	SEQ_GEQ(a,b)		((int)((a)-(b)) >= 0)
91 
92 /*
93  * List of TCP flag cases and conversion of flags to a case (index).
94  */
95 
96 #define	TCPFC_INVALID		0
97 #define	TCPFC_SYN		1
98 #define	TCPFC_SYNACK		2
99 #define	TCPFC_ACK		3
100 #define	TCPFC_FIN		4
101 #define	TCPFC_COUNT		5
102 
103 static inline unsigned
npf_tcpfl2case(const unsigned tcpfl)104 npf_tcpfl2case(const unsigned tcpfl)
105 {
106 	unsigned i, c;
107 
108 	CTASSERT(TH_FIN == 0x01);
109 	CTASSERT(TH_SYN == 0x02);
110 	CTASSERT(TH_ACK == 0x10);
111 
112 	/*
113 	 * Flags are shifted to use three least significant bits, thus each
114 	 * flag combination has a unique number ranging from 0 to 7, e.g.
115 	 * TH_SYN | TH_ACK has number 6, since (0x02 | (0x10 >> 2)) == 6.
116 	 * However, the requirement is to have number 0 for invalid cases,
117 	 * such as TH_SYN | TH_FIN, and to have the same number for TH_FIN
118 	 * and TH_FIN|TH_ACK cases.  Thus, we generate a mask assigning 3
119 	 * bits for each number, which contains the actual case numbers:
120 	 *
121 	 * TCPFC_SYNACK	<< (6 << 2) == 0x2000000 (6 - SYN,ACK)
122 	 * TCPFC_FIN	<< (5 << 2) == 0x0400000 (5 - FIN,ACK)
123 	 * ...
124 	 *
125 	 * Hence, OR'ed mask value is 0x2430140.
126 	 */
127 	i = (tcpfl & (TH_SYN | TH_FIN)) | ((tcpfl & TH_ACK) >> 2);
128 	c = (0x2430140 >> (i << 2)) & 7;
129 
130 	KASSERT(c < TCPFC_COUNT);
131 	return c;
132 }
133 
134 /*
135  * NPF transition table of a tracked TCP connection.
136  *
137  * There is a single state, which is changed in the following way:
138  *
139  * new_state = npf_tcp_fsm[old_state][direction][npf_tcpfl2case(tcp_flags)];
140  *
141  * Note that this state is different from the state in each end (host).
142  */
143 
144 static const uint8_t npf_tcp_fsm[NPF_TCP_NSTATES][2][TCPFC_COUNT] = {
145 	[NPF_TCPS_CLOSED] = {
146 		[NPF_FLOW_FORW] = {
147 			/* Handshake (1): initial SYN. */
148 			[TCPFC_SYN]	= NPF_TCPS_SYN_SENT,
149 		},
150 	},
151 	[NPF_TCPS_SYN_SENT] = {
152 		[NPF_FLOW_FORW] = {
153 			/* SYN may be retransmitted. */
154 			[TCPFC_SYN]	= NPF_TCPS_OK,
155 		},
156 		[NPF_FLOW_BACK] = {
157 			/* Handshake (2): SYN-ACK is expected. */
158 			[TCPFC_SYNACK]	= NPF_TCPS_SYN_RECEIVED,
159 			/* Simultaneous initiation - SYN. */
160 			[TCPFC_SYN]	= NPF_TCPS_SIMSYN_SENT,
161 		},
162 	},
163 	[NPF_TCPS_SIMSYN_SENT] = {
164 		[NPF_FLOW_FORW] = {
165 			/* Original SYN re-transmission. */
166 			[TCPFC_SYN]	= NPF_TCPS_OK,
167 			/* SYN-ACK response to simultaneous SYN. */
168 			[TCPFC_SYNACK]	= NPF_TCPS_SYN_RECEIVED,
169 		},
170 		[NPF_FLOW_BACK] = {
171 			/* Simultaneous SYN re-transmission.*/
172 			[TCPFC_SYN]	= NPF_TCPS_OK,
173 			/* SYN-ACK response to original SYN. */
174 			[TCPFC_SYNACK]	= NPF_TCPS_SYN_RECEIVED,
175 			/* FIN may occur early. */
176 			[TCPFC_FIN]	= NPF_TCPS_FIN_RECEIVED,
177 		},
178 	},
179 	[NPF_TCPS_SYN_RECEIVED] = {
180 		[NPF_FLOW_FORW] = {
181 			/* Handshake (3): ACK is expected. */
182 			[TCPFC_ACK]	= NPF_TCPS_ESTABLISHED,
183 			/* FIN may be sent early. */
184 			[TCPFC_FIN]	= NPF_TCPS_FIN_SENT,
185 			/* Late SYN re-transmission. */
186 			[TCPFC_SYN]	= NPF_TCPS_OK,
187 		},
188 		[NPF_FLOW_BACK] = {
189 			/* SYN-ACK may be retransmitted. */
190 			[TCPFC_SYNACK]	= NPF_TCPS_OK,
191 			/* XXX: ACK of late SYN in simultaneous case? */
192 			[TCPFC_ACK]	= NPF_TCPS_OK,
193 			/* FIN may occur early. */
194 			[TCPFC_FIN]	= NPF_TCPS_FIN_RECEIVED,
195 		},
196 	},
197 	[NPF_TCPS_ESTABLISHED] = {
198 		/*
199 		 * Regular ACKs (data exchange) or FIN.
200 		 * FIN packets may have ACK set.
201 		 */
202 		[NPF_FLOW_FORW] = {
203 			[TCPFC_ACK]	= NPF_TCPS_OK,
204 			/* FIN by the sender. */
205 			[TCPFC_FIN]	= NPF_TCPS_FIN_SENT,
206 		},
207 		[NPF_FLOW_BACK] = {
208 			[TCPFC_ACK]	= NPF_TCPS_OK,
209 			/* FIN by the receiver. */
210 			[TCPFC_FIN]	= NPF_TCPS_FIN_RECEIVED,
211 		},
212 	},
213 	[NPF_TCPS_FIN_SENT] = {
214 		[NPF_FLOW_FORW] = {
215 			/* FIN may be re-transmitted.  Late ACK as well. */
216 			[TCPFC_ACK]	= NPF_TCPS_OK,
217 			[TCPFC_FIN]	= NPF_TCPS_OK,
218 		},
219 		[NPF_FLOW_BACK] = {
220 			/* If ACK, connection is half-closed now. */
221 			[TCPFC_ACK]	= NPF_TCPS_FIN_WAIT,
222 			/* FIN or FIN-ACK race - immediate closing. */
223 			[TCPFC_FIN]	= NPF_TCPS_CLOSING,
224 		},
225 	},
226 	[NPF_TCPS_FIN_RECEIVED] = {
227 		/*
228 		 * FIN was received.  Equivalent scenario to sent FIN.
229 		 */
230 		[NPF_FLOW_FORW] = {
231 			[TCPFC_ACK]	= NPF_TCPS_CLOSE_WAIT,
232 			[TCPFC_FIN]	= NPF_TCPS_CLOSING,
233 		},
234 		[NPF_FLOW_BACK] = {
235 			[TCPFC_ACK]	= NPF_TCPS_OK,
236 			[TCPFC_FIN]	= NPF_TCPS_OK,
237 		},
238 	},
239 	[NPF_TCPS_CLOSE_WAIT] = {
240 		/* Sender has sent the FIN and closed its end. */
241 		[NPF_FLOW_FORW] = {
242 			[TCPFC_ACK]	= NPF_TCPS_OK,
243 			[TCPFC_FIN]	= NPF_TCPS_LAST_ACK,
244 		},
245 		[NPF_FLOW_BACK] = {
246 			[TCPFC_ACK]	= NPF_TCPS_OK,
247 			[TCPFC_FIN]	= NPF_TCPS_LAST_ACK,
248 		},
249 	},
250 	[NPF_TCPS_FIN_WAIT] = {
251 		/* Receiver has closed its end. */
252 		[NPF_FLOW_FORW] = {
253 			[TCPFC_ACK]	= NPF_TCPS_OK,
254 			[TCPFC_FIN]	= NPF_TCPS_LAST_ACK,
255 		},
256 		[NPF_FLOW_BACK] = {
257 			[TCPFC_ACK]	= NPF_TCPS_OK,
258 			[TCPFC_FIN]	= NPF_TCPS_LAST_ACK,
259 		},
260 	},
261 	[NPF_TCPS_CLOSING] = {
262 		/* Race of FINs - expecting ACK. */
263 		[NPF_FLOW_FORW] = {
264 			[TCPFC_ACK]	= NPF_TCPS_LAST_ACK,
265 		},
266 		[NPF_FLOW_BACK] = {
267 			[TCPFC_ACK]	= NPF_TCPS_LAST_ACK,
268 		},
269 	},
270 	[NPF_TCPS_LAST_ACK] = {
271 		/* FINs exchanged - expecting last ACK. */
272 		[NPF_FLOW_FORW] = {
273 			[TCPFC_ACK]	= NPF_TCPS_TIME_WAIT,
274 		},
275 		[NPF_FLOW_BACK] = {
276 			[TCPFC_ACK]	= NPF_TCPS_TIME_WAIT,
277 		},
278 	},
279 	[NPF_TCPS_TIME_WAIT] = {
280 		/* May re-open the connection as per RFC 1122. */
281 		[NPF_FLOW_FORW] = {
282 			[TCPFC_SYN]	= NPF_TCPS_SYN_SENT,
283 		},
284 	},
285 };
286 
287 /*
288  * npf_tcp_inwindow: determine whether the packet is in the TCP window
289  * and thus part of the connection we are tracking.
290  */
291 static bool
npf_tcp_inwindow(npf_cache_t * npc,npf_state_t * nst,const npf_flow_t flow)292 npf_tcp_inwindow(npf_cache_t *npc, npf_state_t *nst, const npf_flow_t flow)
293 {
294 	const npf_state_tcp_params_t *params;
295 	const struct tcphdr * const th = npc->npc_l4.tcp;
296 	const int tcpfl = th->th_flags;
297 	npf_tcpstate_t *fstate, *tstate;
298 	int tcpdlen, ackskew;
299 	tcp_seq seq, ack, end;
300 	uint32_t win;
301 
302 	params = npc->npc_ctx->params[NPF_PARAMS_TCP_STATE];
303 	KASSERT(npf_iscached(npc, NPC_TCP));
304 
305 	/*
306 	 * Perform SEQ/ACK numbers check against boundaries.  Reference:
307 	 *
308 	 *	Rooij G., "Real stateful TCP packet filtering in IP Filter",
309 	 *	10th USENIX Security Symposium invited talk, Aug. 2001.
310 	 *
311 	 * There are four boundaries defined as following:
312 	 *	I)   SEQ + LEN	<= MAX { SND.ACK + MAX(SND.WIN, 1) }
313 	 *	II)  SEQ	>= MAX { SND.SEQ + SND.LEN - MAX(RCV.WIN, 1) }
314 	 *	III) ACK	<= MAX { RCV.SEQ + RCV.LEN }
315 	 *	IV)  ACK	>= MAX { RCV.SEQ + RCV.LEN } - MAXACKWIN
316 	 *
317 	 * Let these members of npf_tcpstate_t be the maximum seen values of:
318 	 *	nst_end		- SEQ + LEN
319 	 *	nst_maxend	- ACK + MAX(WIN, 1)
320 	 *	nst_maxwin	- MAX(WIN, 1)
321 	 */
322 
323 	tcpdlen = npf_tcpsaw(__UNCONST(npc), &seq, &ack, &win);
324 	end = seq + tcpdlen;
325 	if (tcpfl & TH_SYN) {
326 		end++;
327 	}
328 	if (tcpfl & TH_FIN) {
329 		end++;
330 	}
331 
332 	fstate = &nst->nst_tcpst[flow];
333 	tstate = &nst->nst_tcpst[!flow];
334 	win = win ? (win << fstate->nst_wscale) : 1;
335 
336 	/*
337 	 * Initialise if the first packet.
338 	 * Note: only case when nst_maxwin is zero.
339 	 */
340 	if (__predict_false(fstate->nst_maxwin == 0)) {
341 		/*
342 		 * Normally, it should be the first SYN or a re-transmission
343 		 * of SYN.  The state of the other side will get set with a
344 		 * SYN-ACK reply (see below).
345 		 */
346 		fstate->nst_end = end;
347 		fstate->nst_maxend = end;
348 		fstate->nst_maxwin = win;
349 		tstate->nst_end = 0;
350 		tstate->nst_maxend = 0;
351 		tstate->nst_maxwin = 1;
352 
353 		/*
354 		 * Handle TCP Window Scaling (RFC 1323).  Both sides may
355 		 * send this option in their SYN packets.
356 		 */
357 		fstate->nst_wscale = 0;
358 		(void)npf_fetch_tcpopts(npc, NULL, &fstate->nst_wscale);
359 
360 		tstate->nst_wscale = 0;
361 
362 		/* Done. */
363 		return true;
364 	}
365 
366 	if (fstate->nst_end == 0) {
367 		/*
368 		 * Should be a SYN-ACK reply to SYN.  If SYN is not set,
369 		 * then we are in the middle of connection and lost tracking.
370 		 */
371 		fstate->nst_end = end;
372 		fstate->nst_maxend = end + 1;
373 		fstate->nst_maxwin = win;
374 		fstate->nst_wscale = 0;
375 
376 		/* Handle TCP Window Scaling (must be ignored if no SYN). */
377 		if (tcpfl & TH_SYN) {
378 			(void)npf_fetch_tcpopts(npc, NULL, &fstate->nst_wscale);
379 		}
380 	}
381 
382 	if ((tcpfl & TH_ACK) == 0) {
383 		/* Pretend that an ACK was sent. */
384 		ack = tstate->nst_end;
385 	} else if ((tcpfl & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST) && ack == 0) {
386 		/* Workaround for some TCP stacks. */
387 		ack = tstate->nst_end;
388 	}
389 
390 	if (__predict_false(tcpfl & TH_RST)) {
391 		/* RST to the initial SYN may have zero SEQ - fix it up. */
392 		if (seq == 0 && nst->nst_state == NPF_TCPS_SYN_SENT) {
393 			end = fstate->nst_end;
394 			seq = end;
395 		}
396 
397 		/* Strict in-order sequence for RST packets (RFC 5961). */
398 		if (params->strict_order_rst && (fstate->nst_end - seq) > 1) {
399 			return false;
400 		}
401 	}
402 
403 	/*
404 	 * Determine whether the data is within previously noted window,
405 	 * that is, upper boundary for valid data (I).
406 	 */
407 	if (!SEQ_LEQ(end, fstate->nst_maxend)) {
408 		npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP1);
409 		return false;
410 	}
411 
412 	/* Lower boundary (II), which is no more than one window back. */
413 	if (!SEQ_GEQ(seq, fstate->nst_end - tstate->nst_maxwin)) {
414 		npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP2);
415 		return false;
416 	}
417 
418 	/*
419 	 * Boundaries for valid acknowledgments (III, IV) - one predicted
420 	 * window up or down, since packets may be fragmented.
421 	 */
422 	ackskew = tstate->nst_end - ack;
423 	if (ackskew < -(int)params->max_ack_win ||
424 	    ackskew > ((int)params->max_ack_win << fstate->nst_wscale)) {
425 		npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP3);
426 		return false;
427 	}
428 
429 	/*
430 	 * Packet has been passed.
431 	 *
432 	 * Negative ackskew might be due to fragmented packets.  Since the
433 	 * total length of the packet is unknown - bump the boundary.
434 	 */
435 
436 	if (ackskew < 0) {
437 		tstate->nst_end = ack;
438 	}
439 	/* Keep track of the maximum window seen. */
440 	if (fstate->nst_maxwin < win) {
441 		fstate->nst_maxwin = win;
442 	}
443 	if (SEQ_GT(end, fstate->nst_end)) {
444 		fstate->nst_end = end;
445 	}
446 	/* Note the window for upper boundary. */
447 	if (SEQ_GEQ(ack + win, tstate->nst_maxend)) {
448 		tstate->nst_maxend = ack + win;
449 	}
450 	return true;
451 }
452 
453 /*
454  * npf_state_tcp: inspect TCP segment, determine whether it belongs to
455  * the connection and track its state.
456  */
457 bool
npf_state_tcp(npf_cache_t * npc,npf_state_t * nst,npf_flow_t flow)458 npf_state_tcp(npf_cache_t *npc, npf_state_t *nst, npf_flow_t flow)
459 {
460 	const struct tcphdr * const th = npc->npc_l4.tcp;
461 	const unsigned tcpfl = th->th_flags, state = nst->nst_state;
462 	unsigned nstate;
463 
464 	KASSERT(nst->nst_state < NPF_TCP_NSTATES);
465 
466 	/* Look for a transition to a new state. */
467 	if (__predict_true((tcpfl & TH_RST) == 0)) {
468 		const u_int flagcase = npf_tcpfl2case(tcpfl);
469 		nstate = npf_tcp_fsm[state][flow][flagcase];
470 	} else if (state == NPF_TCPS_TIME_WAIT) {
471 		/* Prevent TIME-WAIT assassination (RFC 1337). */
472 		nstate = NPF_TCPS_OK;
473 	} else {
474 		nstate = NPF_TCPS_CLOSED;
475 	}
476 
477 	/* Determine whether TCP packet really belongs to this connection. */
478 	if (!npf_tcp_inwindow(npc, nst, flow)) {
479 		return false;
480 	}
481 	if (__predict_true(nstate == NPF_TCPS_OK)) {
482 		return true;
483 	}
484 
485 	nst->nst_state = nstate;
486 	return true;
487 }
488 
489 int
npf_state_tcp_timeout(npf_t * npf,const npf_state_t * nst)490 npf_state_tcp_timeout(npf_t *npf, const npf_state_t *nst)
491 {
492 	static const uint8_t state_timeout_idx[NPF_TCP_NSTATES] = {
493 		[NPF_TCPS_CLOSED]	= NPF_TCPT_CLOSE,
494 		/* Unsynchronised states. */
495 		[NPF_TCPS_SYN_SENT]	= NPF_TCPT_NEW,
496 		[NPF_TCPS_SIMSYN_SENT]	= NPF_TCPT_NEW,
497 		[NPF_TCPS_SYN_RECEIVED]	= NPF_TCPT_NEW,
498 		/* Established (synchronised state). */
499 		[NPF_TCPS_ESTABLISHED]	= NPF_TCPT_ESTABLISHED,
500 		/* Half-closed cases. */
501 		[NPF_TCPS_FIN_SENT]	= NPF_TCPT_HALFCLOSE,
502 		[NPF_TCPS_FIN_RECEIVED]	= NPF_TCPT_HALFCLOSE,
503 		[NPF_TCPS_CLOSE_WAIT]	= NPF_TCPT_HALFCLOSE,
504 		[NPF_TCPS_FIN_WAIT]	= NPF_TCPT_HALFCLOSE,
505 		/* Full close cases. */
506 		[NPF_TCPS_CLOSING]	= NPF_TCPT_CLOSE,
507 		[NPF_TCPS_LAST_ACK]	= NPF_TCPT_CLOSE,
508 		[NPF_TCPS_TIME_WAIT]	= NPF_TCPT_TIMEWAIT,
509 	};
510 	const npf_state_tcp_params_t *params;
511 	const unsigned state = nst->nst_state;
512 
513 	KASSERT(state < NPF_TCP_NSTATES);
514 	params = npf->params[NPF_PARAMS_TCP_STATE];
515 	return params->timeouts[state_timeout_idx[state]];
516 }
517 
518 void
npf_state_tcp_sysinit(npf_t * npf)519 npf_state_tcp_sysinit(npf_t *npf)
520 {
521 	npf_state_tcp_params_t *params = npf_param_allocgroup(npf,
522 	    NPF_PARAMS_TCP_STATE, sizeof(npf_state_tcp_params_t));
523 	npf_param_t param_map[] = {
524 		/*
525 		 * TCP connection timeout table (in seconds).
526 		 */
527 
528 		/* Unsynchronised states. */
529 		{
530 			"state.tcp.timeout.new",
531 			&params->timeouts[NPF_TCPT_NEW],
532 			.default_val = 30,
533 			.min = 0, .max = INT_MAX
534 		},
535 		/* Established. */
536 		{
537 			"state.tcp.timeout.established",
538 			&params->timeouts[NPF_TCPT_ESTABLISHED],
539 			.default_val = 60 * 60 * 24,
540 			.min = 0, .max = INT_MAX
541 		},
542 		/* Half-closed cases. */
543 		{
544 			"state.tcp.timeout.half_close",
545 			&params->timeouts[NPF_TCPT_HALFCLOSE],
546 			.default_val = 60 * 60 * 6,
547 			.min = 0, .max = INT_MAX
548 		},
549 		/* Full close cases. */
550 		{
551 			"state.tcp.timeout.close",
552 			&params->timeouts[NPF_TCPT_CLOSE],
553 			.default_val = 10,
554 			.min = 0, .max = INT_MAX
555 		},
556 		/* TCP time-wait (2 * MSL). */
557 		{
558 			"state.tcp.timeout.time_wait",
559 			&params->timeouts[NPF_TCPT_TIMEWAIT],
560 			.default_val = 60 * 2 * 2,
561 			.min = 0, .max = INT_MAX
562 		},
563 
564 		/*
565 		 * Enforce strict order RST.
566 		 */
567 		{
568 			"state.tcp.strict_order_rst",
569 			&params->strict_order_rst,
570 			.default_val = 1, // true
571 			.min = 0, .max = 1
572 		},
573 
574 		/*
575 		 * TCP state tracking: maximum allowed ACK window.
576 		 */
577 		{
578 			"state.tcp.max_ack_win",
579 			&params->max_ack_win,
580 			.default_val = 66000,
581 			.min = 0, .max = INT_MAX
582 		},
583 	};
584 	npf_param_register(npf, param_map, __arraycount(param_map));
585 }
586 
587 void
npf_state_tcp_sysfini(npf_t * npf)588 npf_state_tcp_sysfini(npf_t *npf)
589 {
590 	const size_t len = sizeof(npf_state_tcp_params_t);
591 	npf_param_freegroup(npf, NPF_PARAMS_TCP_STATE, len);
592 }
593