1 /*- 2 * Copyright (c) 2010-2012 The NetBSD Foundation, Inc. 3 * All rights reserved. 4 * 5 * This material is based upon work partially supported by The 6 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 /* 31 * NPF TCP state engine for connection tracking. 32 */ 33 34 #ifdef _KERNEL 35 #include <sys/cdefs.h> 36 __KERNEL_RCSID(0, "$NetBSD: npf_state_tcp.c,v 1.21 2020/05/30 14:16:56 rmind Exp $"); 37 38 #include <sys/param.h> 39 #include <sys/types.h> 40 41 #include <netinet/in.h> 42 #include <netinet/tcp.h> 43 #endif 44 45 #include "npf_impl.h" 46 47 /* 48 * NPF TCP states. Note: these states are different from the TCP FSM 49 * states of RFC 793. The packet filter is a man-in-the-middle. 50 */ 51 #define NPF_TCPS_OK 255 52 #define NPF_TCPS_CLOSED 0 53 #define NPF_TCPS_SYN_SENT 1 54 #define NPF_TCPS_SIMSYN_SENT 2 55 #define NPF_TCPS_SYN_RECEIVED 3 56 #define NPF_TCPS_ESTABLISHED 4 57 #define NPF_TCPS_FIN_SENT 5 58 #define NPF_TCPS_FIN_RECEIVED 6 59 #define NPF_TCPS_CLOSE_WAIT 7 60 #define NPF_TCPS_FIN_WAIT 8 61 #define NPF_TCPS_CLOSING 9 62 #define NPF_TCPS_LAST_ACK 10 63 #define NPF_TCPS_TIME_WAIT 11 64 65 #define NPF_TCP_NSTATES 12 66 67 /* Timeouts */ 68 #define NPF_TCPT_NEW 0 69 #define NPF_TCPT_ESTABLISHED 1 70 #define NPF_TCPT_HALFCLOSE 2 71 #define NPF_TCPT_CLOSE 3 72 #define NPF_TCPT_TIMEWAIT 4 73 #define NPF_TCPT_COUNT 5 74 75 /* 76 * Parameters. 77 */ 78 typedef struct { 79 int max_ack_win; 80 int strict_order_rst; 81 int timeouts[NPF_TCPT_COUNT]; 82 } npf_state_tcp_params_t; 83 84 /* 85 * Helpers. 86 */ 87 #define SEQ_LT(a,b) ((int)((a)-(b)) < 0) 88 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0) 89 #define SEQ_GT(a,b) ((int)((a)-(b)) > 0) 90 #define SEQ_GEQ(a,b) ((int)((a)-(b)) >= 0) 91 92 /* 93 * List of TCP flag cases and conversion of flags to a case (index). 94 */ 95 96 #define TCPFC_INVALID 0 97 #define TCPFC_SYN 1 98 #define TCPFC_SYNACK 2 99 #define TCPFC_ACK 3 100 #define TCPFC_FIN 4 101 #define TCPFC_COUNT 5 102 103 static inline unsigned 104 npf_tcpfl2case(const unsigned tcpfl) 105 { 106 unsigned i, c; 107 108 CTASSERT(TH_FIN == 0x01); 109 CTASSERT(TH_SYN == 0x02); 110 CTASSERT(TH_ACK == 0x10); 111 112 /* 113 * Flags are shifted to use three least significant bits, thus each 114 * flag combination has a unique number ranging from 0 to 7, e.g. 115 * TH_SYN | TH_ACK has number 6, since (0x02 | (0x10 >> 2)) == 6. 116 * However, the requirement is to have number 0 for invalid cases, 117 * such as TH_SYN | TH_FIN, and to have the same number for TH_FIN 118 * and TH_FIN|TH_ACK cases. Thus, we generate a mask assigning 3 119 * bits for each number, which contains the actual case numbers: 120 * 121 * TCPFC_SYNACK << (6 << 2) == 0x2000000 (6 - SYN,ACK) 122 * TCPFC_FIN << (5 << 2) == 0x0400000 (5 - FIN,ACK) 123 * ... 124 * 125 * Hence, OR'ed mask value is 0x2430140. 126 */ 127 i = (tcpfl & (TH_SYN | TH_FIN)) | ((tcpfl & TH_ACK) >> 2); 128 c = (0x2430140 >> (i << 2)) & 7; 129 130 KASSERT(c < TCPFC_COUNT); 131 return c; 132 } 133 134 /* 135 * NPF transition table of a tracked TCP connection. 136 * 137 * There is a single state, which is changed in the following way: 138 * 139 * new_state = npf_tcp_fsm[old_state][direction][npf_tcpfl2case(tcp_flags)]; 140 * 141 * Note that this state is different from the state in each end (host). 142 */ 143 144 static const uint8_t npf_tcp_fsm[NPF_TCP_NSTATES][2][TCPFC_COUNT] = { 145 [NPF_TCPS_CLOSED] = { 146 [NPF_FLOW_FORW] = { 147 /* Handshake (1): initial SYN. */ 148 [TCPFC_SYN] = NPF_TCPS_SYN_SENT, 149 }, 150 }, 151 [NPF_TCPS_SYN_SENT] = { 152 [NPF_FLOW_FORW] = { 153 /* SYN may be retransmitted. */ 154 [TCPFC_SYN] = NPF_TCPS_OK, 155 }, 156 [NPF_FLOW_BACK] = { 157 /* Handshake (2): SYN-ACK is expected. */ 158 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED, 159 /* Simultaneous initiation - SYN. */ 160 [TCPFC_SYN] = NPF_TCPS_SIMSYN_SENT, 161 }, 162 }, 163 [NPF_TCPS_SIMSYN_SENT] = { 164 [NPF_FLOW_FORW] = { 165 /* Original SYN re-transmission. */ 166 [TCPFC_SYN] = NPF_TCPS_OK, 167 /* SYN-ACK response to simultaneous SYN. */ 168 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED, 169 }, 170 [NPF_FLOW_BACK] = { 171 /* Simultaneous SYN re-transmission.*/ 172 [TCPFC_SYN] = NPF_TCPS_OK, 173 /* SYN-ACK response to original SYN. */ 174 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED, 175 /* FIN may occur early. */ 176 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED, 177 }, 178 }, 179 [NPF_TCPS_SYN_RECEIVED] = { 180 [NPF_FLOW_FORW] = { 181 /* Handshake (3): ACK is expected. */ 182 [TCPFC_ACK] = NPF_TCPS_ESTABLISHED, 183 /* FIN may be sent early. */ 184 [TCPFC_FIN] = NPF_TCPS_FIN_SENT, 185 /* Late SYN re-transmission. */ 186 [TCPFC_SYN] = NPF_TCPS_OK, 187 }, 188 [NPF_FLOW_BACK] = { 189 /* SYN-ACK may be retransmitted. */ 190 [TCPFC_SYNACK] = NPF_TCPS_OK, 191 /* XXX: ACK of late SYN in simultaneous case? */ 192 [TCPFC_ACK] = NPF_TCPS_OK, 193 /* FIN may occur early. */ 194 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED, 195 }, 196 }, 197 [NPF_TCPS_ESTABLISHED] = { 198 /* 199 * Regular ACKs (data exchange) or FIN. 200 * FIN packets may have ACK set. 201 */ 202 [NPF_FLOW_FORW] = { 203 [TCPFC_ACK] = NPF_TCPS_OK, 204 /* FIN by the sender. */ 205 [TCPFC_FIN] = NPF_TCPS_FIN_SENT, 206 }, 207 [NPF_FLOW_BACK] = { 208 [TCPFC_ACK] = NPF_TCPS_OK, 209 /* FIN by the receiver. */ 210 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED, 211 }, 212 }, 213 [NPF_TCPS_FIN_SENT] = { 214 [NPF_FLOW_FORW] = { 215 /* FIN may be re-transmitted. Late ACK as well. */ 216 [TCPFC_ACK] = NPF_TCPS_OK, 217 [TCPFC_FIN] = NPF_TCPS_OK, 218 }, 219 [NPF_FLOW_BACK] = { 220 /* If ACK, connection is half-closed now. */ 221 [TCPFC_ACK] = NPF_TCPS_FIN_WAIT, 222 /* FIN or FIN-ACK race - immediate closing. */ 223 [TCPFC_FIN] = NPF_TCPS_CLOSING, 224 }, 225 }, 226 [NPF_TCPS_FIN_RECEIVED] = { 227 /* 228 * FIN was received. Equivalent scenario to sent FIN. 229 */ 230 [NPF_FLOW_FORW] = { 231 [TCPFC_ACK] = NPF_TCPS_CLOSE_WAIT, 232 [TCPFC_FIN] = NPF_TCPS_CLOSING, 233 }, 234 [NPF_FLOW_BACK] = { 235 [TCPFC_ACK] = NPF_TCPS_OK, 236 [TCPFC_FIN] = NPF_TCPS_OK, 237 }, 238 }, 239 [NPF_TCPS_CLOSE_WAIT] = { 240 /* Sender has sent the FIN and closed its end. */ 241 [NPF_FLOW_FORW] = { 242 [TCPFC_ACK] = NPF_TCPS_OK, 243 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 244 }, 245 [NPF_FLOW_BACK] = { 246 [TCPFC_ACK] = NPF_TCPS_OK, 247 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 248 }, 249 }, 250 [NPF_TCPS_FIN_WAIT] = { 251 /* Receiver has closed its end. */ 252 [NPF_FLOW_FORW] = { 253 [TCPFC_ACK] = NPF_TCPS_OK, 254 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 255 }, 256 [NPF_FLOW_BACK] = { 257 [TCPFC_ACK] = NPF_TCPS_OK, 258 [TCPFC_FIN] = NPF_TCPS_LAST_ACK, 259 }, 260 }, 261 [NPF_TCPS_CLOSING] = { 262 /* Race of FINs - expecting ACK. */ 263 [NPF_FLOW_FORW] = { 264 [TCPFC_ACK] = NPF_TCPS_LAST_ACK, 265 }, 266 [NPF_FLOW_BACK] = { 267 [TCPFC_ACK] = NPF_TCPS_LAST_ACK, 268 }, 269 }, 270 [NPF_TCPS_LAST_ACK] = { 271 /* FINs exchanged - expecting last ACK. */ 272 [NPF_FLOW_FORW] = { 273 [TCPFC_ACK] = NPF_TCPS_TIME_WAIT, 274 }, 275 [NPF_FLOW_BACK] = { 276 [TCPFC_ACK] = NPF_TCPS_TIME_WAIT, 277 }, 278 }, 279 [NPF_TCPS_TIME_WAIT] = { 280 /* May re-open the connection as per RFC 1122. */ 281 [NPF_FLOW_FORW] = { 282 [TCPFC_SYN] = NPF_TCPS_SYN_SENT, 283 }, 284 }, 285 }; 286 287 /* 288 * npf_tcp_inwindow: determine whether the packet is in the TCP window 289 * and thus part of the connection we are tracking. 290 */ 291 static bool 292 npf_tcp_inwindow(npf_cache_t *npc, npf_state_t *nst, const npf_flow_t flow) 293 { 294 const npf_state_tcp_params_t *params; 295 const struct tcphdr * const th = npc->npc_l4.tcp; 296 const int tcpfl = th->th_flags; 297 npf_tcpstate_t *fstate, *tstate; 298 int tcpdlen, ackskew; 299 tcp_seq seq, ack, end; 300 uint32_t win; 301 302 params = npc->npc_ctx->params[NPF_PARAMS_TCP_STATE]; 303 KASSERT(npf_iscached(npc, NPC_TCP)); 304 305 /* 306 * Perform SEQ/ACK numbers check against boundaries. Reference: 307 * 308 * Rooij G., "Real stateful TCP packet filtering in IP Filter", 309 * 10th USENIX Security Symposium invited talk, Aug. 2001. 310 * 311 * There are four boundaries defined as following: 312 * I) SEQ + LEN <= MAX { SND.ACK + MAX(SND.WIN, 1) } 313 * II) SEQ >= MAX { SND.SEQ + SND.LEN - MAX(RCV.WIN, 1) } 314 * III) ACK <= MAX { RCV.SEQ + RCV.LEN } 315 * IV) ACK >= MAX { RCV.SEQ + RCV.LEN } - MAXACKWIN 316 * 317 * Let these members of npf_tcpstate_t be the maximum seen values of: 318 * nst_end - SEQ + LEN 319 * nst_maxend - ACK + MAX(WIN, 1) 320 * nst_maxwin - MAX(WIN, 1) 321 */ 322 323 tcpdlen = npf_tcpsaw(__UNCONST(npc), &seq, &ack, &win); 324 end = seq + tcpdlen; 325 if (tcpfl & TH_SYN) { 326 end++; 327 } 328 if (tcpfl & TH_FIN) { 329 end++; 330 } 331 332 fstate = &nst->nst_tcpst[flow]; 333 tstate = &nst->nst_tcpst[!flow]; 334 win = win ? (win << fstate->nst_wscale) : 1; 335 336 /* 337 * Initialise if the first packet. 338 * Note: only case when nst_maxwin is zero. 339 */ 340 if (__predict_false(fstate->nst_maxwin == 0)) { 341 /* 342 * Normally, it should be the first SYN or a re-transmission 343 * of SYN. The state of the other side will get set with a 344 * SYN-ACK reply (see below). 345 */ 346 fstate->nst_end = end; 347 fstate->nst_maxend = end; 348 fstate->nst_maxwin = win; 349 tstate->nst_end = 0; 350 tstate->nst_maxend = 0; 351 tstate->nst_maxwin = 1; 352 353 /* 354 * Handle TCP Window Scaling (RFC 1323). Both sides may 355 * send this option in their SYN packets. 356 */ 357 fstate->nst_wscale = 0; 358 (void)npf_fetch_tcpopts(npc, NULL, &fstate->nst_wscale); 359 360 tstate->nst_wscale = 0; 361 362 /* Done. */ 363 return true; 364 } 365 366 if (fstate->nst_end == 0) { 367 /* 368 * Should be a SYN-ACK reply to SYN. If SYN is not set, 369 * then we are in the middle of connection and lost tracking. 370 */ 371 fstate->nst_end = end; 372 fstate->nst_maxend = end + 1; 373 fstate->nst_maxwin = win; 374 fstate->nst_wscale = 0; 375 376 /* Handle TCP Window Scaling (must be ignored if no SYN). */ 377 if (tcpfl & TH_SYN) { 378 (void)npf_fetch_tcpopts(npc, NULL, &fstate->nst_wscale); 379 } 380 } 381 382 if ((tcpfl & TH_ACK) == 0) { 383 /* Pretend that an ACK was sent. */ 384 ack = tstate->nst_end; 385 } else if ((tcpfl & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST) && ack == 0) { 386 /* Workaround for some TCP stacks. */ 387 ack = tstate->nst_end; 388 } 389 390 if (__predict_false(tcpfl & TH_RST)) { 391 /* RST to the initial SYN may have zero SEQ - fix it up. */ 392 if (seq == 0 && nst->nst_state == NPF_TCPS_SYN_SENT) { 393 end = fstate->nst_end; 394 seq = end; 395 } 396 397 /* Strict in-order sequence for RST packets (RFC 5961). */ 398 if (params->strict_order_rst && (fstate->nst_end - seq) > 1) { 399 return false; 400 } 401 } 402 403 /* 404 * Determine whether the data is within previously noted window, 405 * that is, upper boundary for valid data (I). 406 */ 407 if (!SEQ_LEQ(end, fstate->nst_maxend)) { 408 npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP1); 409 return false; 410 } 411 412 /* Lower boundary (II), which is no more than one window back. */ 413 if (!SEQ_GEQ(seq, fstate->nst_end - tstate->nst_maxwin)) { 414 npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP2); 415 return false; 416 } 417 418 /* 419 * Boundaries for valid acknowledgments (III, IV) - one predicted 420 * window up or down, since packets may be fragmented. 421 */ 422 ackskew = tstate->nst_end - ack; 423 if (ackskew < -(int)params->max_ack_win || 424 ackskew > ((int)params->max_ack_win << fstate->nst_wscale)) { 425 npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP3); 426 return false; 427 } 428 429 /* 430 * Packet has been passed. 431 * 432 * Negative ackskew might be due to fragmented packets. Since the 433 * total length of the packet is unknown - bump the boundary. 434 */ 435 436 if (ackskew < 0) { 437 tstate->nst_end = ack; 438 } 439 /* Keep track of the maximum window seen. */ 440 if (fstate->nst_maxwin < win) { 441 fstate->nst_maxwin = win; 442 } 443 if (SEQ_GT(end, fstate->nst_end)) { 444 fstate->nst_end = end; 445 } 446 /* Note the window for upper boundary. */ 447 if (SEQ_GEQ(ack + win, tstate->nst_maxend)) { 448 tstate->nst_maxend = ack + win; 449 } 450 return true; 451 } 452 453 /* 454 * npf_state_tcp: inspect TCP segment, determine whether it belongs to 455 * the connection and track its state. 456 */ 457 bool 458 npf_state_tcp(npf_cache_t *npc, npf_state_t *nst, npf_flow_t flow) 459 { 460 const struct tcphdr * const th = npc->npc_l4.tcp; 461 const unsigned tcpfl = th->th_flags, state = nst->nst_state; 462 unsigned nstate; 463 464 KASSERT(nst->nst_state < NPF_TCP_NSTATES); 465 466 /* Look for a transition to a new state. */ 467 if (__predict_true((tcpfl & TH_RST) == 0)) { 468 const u_int flagcase = npf_tcpfl2case(tcpfl); 469 nstate = npf_tcp_fsm[state][flow][flagcase]; 470 } else if (state == NPF_TCPS_TIME_WAIT) { 471 /* Prevent TIME-WAIT assassination (RFC 1337). */ 472 nstate = NPF_TCPS_OK; 473 } else { 474 nstate = NPF_TCPS_CLOSED; 475 } 476 477 /* Determine whether TCP packet really belongs to this connection. */ 478 if (!npf_tcp_inwindow(npc, nst, flow)) { 479 return false; 480 } 481 if (__predict_true(nstate == NPF_TCPS_OK)) { 482 return true; 483 } 484 485 nst->nst_state = nstate; 486 return true; 487 } 488 489 int 490 npf_state_tcp_timeout(npf_t *npf, const npf_state_t *nst) 491 { 492 static const uint8_t state_timeout_idx[NPF_TCP_NSTATES] = { 493 [NPF_TCPS_CLOSED] = NPF_TCPT_CLOSE, 494 /* Unsynchronised states. */ 495 [NPF_TCPS_SYN_SENT] = NPF_TCPT_NEW, 496 [NPF_TCPS_SIMSYN_SENT] = NPF_TCPT_NEW, 497 [NPF_TCPS_SYN_RECEIVED] = NPF_TCPT_NEW, 498 /* Established (synchronised state). */ 499 [NPF_TCPS_ESTABLISHED] = NPF_TCPT_ESTABLISHED, 500 /* Half-closed cases. */ 501 [NPF_TCPS_FIN_SENT] = NPF_TCPT_HALFCLOSE, 502 [NPF_TCPS_FIN_RECEIVED] = NPF_TCPT_HALFCLOSE, 503 [NPF_TCPS_CLOSE_WAIT] = NPF_TCPT_HALFCLOSE, 504 [NPF_TCPS_FIN_WAIT] = NPF_TCPT_HALFCLOSE, 505 /* Full close cases. */ 506 [NPF_TCPS_CLOSING] = NPF_TCPT_CLOSE, 507 [NPF_TCPS_LAST_ACK] = NPF_TCPT_CLOSE, 508 [NPF_TCPS_TIME_WAIT] = NPF_TCPT_TIMEWAIT, 509 }; 510 const npf_state_tcp_params_t *params; 511 const unsigned state = nst->nst_state; 512 513 KASSERT(state < NPF_TCP_NSTATES); 514 params = npf->params[NPF_PARAMS_TCP_STATE]; 515 return params->timeouts[state_timeout_idx[state]]; 516 } 517 518 void 519 npf_state_tcp_sysinit(npf_t *npf) 520 { 521 npf_state_tcp_params_t *params = npf_param_allocgroup(npf, 522 NPF_PARAMS_TCP_STATE, sizeof(npf_state_tcp_params_t)); 523 npf_param_t param_map[] = { 524 /* 525 * TCP connection timeout table (in seconds). 526 */ 527 528 /* Unsynchronised states. */ 529 { 530 "state.tcp.timeout.new", 531 ¶ms->timeouts[NPF_TCPT_NEW], 532 .default_val = 30, 533 .min = 0, .max = INT_MAX 534 }, 535 /* Established. */ 536 { 537 "state.tcp.timeout.established", 538 ¶ms->timeouts[NPF_TCPT_ESTABLISHED], 539 .default_val = 60 * 60 * 24, 540 .min = 0, .max = INT_MAX 541 }, 542 /* Half-closed cases. */ 543 { 544 "state.tcp.timeout.half_close", 545 ¶ms->timeouts[NPF_TCPT_HALFCLOSE], 546 .default_val = 60 * 60 * 6, 547 .min = 0, .max = INT_MAX 548 }, 549 /* Full close cases. */ 550 { 551 "state.tcp.timeout.close", 552 ¶ms->timeouts[NPF_TCPT_CLOSE], 553 .default_val = 10, 554 .min = 0, .max = INT_MAX 555 }, 556 /* TCP time-wait (2 * MSL). */ 557 { 558 "state.tcp.timeout.time_wait", 559 ¶ms->timeouts[NPF_TCPT_TIMEWAIT], 560 .default_val = 60 * 2 * 2, 561 .min = 0, .max = INT_MAX 562 }, 563 564 /* 565 * Enforce strict order RST. 566 */ 567 { 568 "state.tcp.strict_order_rst", 569 ¶ms->strict_order_rst, 570 .default_val = 1, // true 571 .min = 0, .max = 1 572 }, 573 574 /* 575 * TCP state tracking: maximum allowed ACK window. 576 */ 577 { 578 "state.tcp.max_ack_win", 579 ¶ms->max_ack_win, 580 .default_val = 66000, 581 .min = 0, .max = INT_MAX 582 }, 583 }; 584 npf_param_register(npf, param_map, __arraycount(param_map)); 585 } 586 587 void 588 npf_state_tcp_sysfini(npf_t *npf) 589 { 590 const size_t len = sizeof(npf_state_tcp_params_t); 591 npf_param_freegroup(npf, NPF_PARAMS_TCP_STATE, len); 592 } 593
Indexes created Sat Sep 20 22:09:52 GMT 2025