1 /*-
2 * Copyright (c) 2010-2012 The NetBSD Foundation, Inc.
3 * All rights reserved.
4 *
5 * This material is based upon work partially supported by The
6 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 */
29
30 /*
31 * NPF TCP state engine for connection tracking.
32 */
33
34 #ifdef _KERNEL
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: npf_state_tcp.c,v 1.21 2020/05/30 14:16:56 rmind Exp $");
37
38 #include <sys/param.h>
39 #include <sys/types.h>
40
41 #include <netinet/in.h>
42 #include <netinet/tcp.h>
43 #endif
44
45 #include "npf_impl.h"
46
47 /*
48 * NPF TCP states. Note: these states are different from the TCP FSM
49 * states of RFC 793. The packet filter is a man-in-the-middle.
50 */
51 #define NPF_TCPS_OK 255
52 #define NPF_TCPS_CLOSED 0
53 #define NPF_TCPS_SYN_SENT 1
54 #define NPF_TCPS_SIMSYN_SENT 2
55 #define NPF_TCPS_SYN_RECEIVED 3
56 #define NPF_TCPS_ESTABLISHED 4
57 #define NPF_TCPS_FIN_SENT 5
58 #define NPF_TCPS_FIN_RECEIVED 6
59 #define NPF_TCPS_CLOSE_WAIT 7
60 #define NPF_TCPS_FIN_WAIT 8
61 #define NPF_TCPS_CLOSING 9
62 #define NPF_TCPS_LAST_ACK 10
63 #define NPF_TCPS_TIME_WAIT 11
64
65 #define NPF_TCP_NSTATES 12
66
67 /* Timeouts */
68 #define NPF_TCPT_NEW 0
69 #define NPF_TCPT_ESTABLISHED 1
70 #define NPF_TCPT_HALFCLOSE 2
71 #define NPF_TCPT_CLOSE 3
72 #define NPF_TCPT_TIMEWAIT 4
73 #define NPF_TCPT_COUNT 5
74
75 /*
76 * Parameters.
77 */
78 typedef struct {
79 int max_ack_win;
80 int strict_order_rst;
81 int timeouts[NPF_TCPT_COUNT];
82 } npf_state_tcp_params_t;
83
84 /*
85 * Helpers.
86 */
87 #define SEQ_LT(a,b) ((int)((a)-(b)) < 0)
88 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0)
89 #define SEQ_GT(a,b) ((int)((a)-(b)) > 0)
90 #define SEQ_GEQ(a,b) ((int)((a)-(b)) >= 0)
91
92 /*
93 * List of TCP flag cases and conversion of flags to a case (index).
94 */
95
96 #define TCPFC_INVALID 0
97 #define TCPFC_SYN 1
98 #define TCPFC_SYNACK 2
99 #define TCPFC_ACK 3
100 #define TCPFC_FIN 4
101 #define TCPFC_COUNT 5
102
103 static inline unsigned
npf_tcpfl2case(const unsigned tcpfl)104 npf_tcpfl2case(const unsigned tcpfl)
105 {
106 unsigned i, c;
107
108 CTASSERT(TH_FIN == 0x01);
109 CTASSERT(TH_SYN == 0x02);
110 CTASSERT(TH_ACK == 0x10);
111
112 /*
113 * Flags are shifted to use three least significant bits, thus each
114 * flag combination has a unique number ranging from 0 to 7, e.g.
115 * TH_SYN | TH_ACK has number 6, since (0x02 | (0x10 >> 2)) == 6.
116 * However, the requirement is to have number 0 for invalid cases,
117 * such as TH_SYN | TH_FIN, and to have the same number for TH_FIN
118 * and TH_FIN|TH_ACK cases. Thus, we generate a mask assigning 3
119 * bits for each number, which contains the actual case numbers:
120 *
121 * TCPFC_SYNACK << (6 << 2) == 0x2000000 (6 - SYN,ACK)
122 * TCPFC_FIN << (5 << 2) == 0x0400000 (5 - FIN,ACK)
123 * ...
124 *
125 * Hence, OR'ed mask value is 0x2430140.
126 */
127 i = (tcpfl & (TH_SYN | TH_FIN)) | ((tcpfl & TH_ACK) >> 2);
128 c = (0x2430140 >> (i << 2)) & 7;
129
130 KASSERT(c < TCPFC_COUNT);
131 return c;
132 }
133
134 /*
135 * NPF transition table of a tracked TCP connection.
136 *
137 * There is a single state, which is changed in the following way:
138 *
139 * new_state = npf_tcp_fsm[old_state][direction][npf_tcpfl2case(tcp_flags)];
140 *
141 * Note that this state is different from the state in each end (host).
142 */
143
144 static const uint8_t npf_tcp_fsm[NPF_TCP_NSTATES][2][TCPFC_COUNT] = {
145 [NPF_TCPS_CLOSED] = {
146 [NPF_FLOW_FORW] = {
147 /* Handshake (1): initial SYN. */
148 [TCPFC_SYN] = NPF_TCPS_SYN_SENT,
149 },
150 },
151 [NPF_TCPS_SYN_SENT] = {
152 [NPF_FLOW_FORW] = {
153 /* SYN may be retransmitted. */
154 [TCPFC_SYN] = NPF_TCPS_OK,
155 },
156 [NPF_FLOW_BACK] = {
157 /* Handshake (2): SYN-ACK is expected. */
158 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED,
159 /* Simultaneous initiation - SYN. */
160 [TCPFC_SYN] = NPF_TCPS_SIMSYN_SENT,
161 },
162 },
163 [NPF_TCPS_SIMSYN_SENT] = {
164 [NPF_FLOW_FORW] = {
165 /* Original SYN re-transmission. */
166 [TCPFC_SYN] = NPF_TCPS_OK,
167 /* SYN-ACK response to simultaneous SYN. */
168 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED,
169 },
170 [NPF_FLOW_BACK] = {
171 /* Simultaneous SYN re-transmission.*/
172 [TCPFC_SYN] = NPF_TCPS_OK,
173 /* SYN-ACK response to original SYN. */
174 [TCPFC_SYNACK] = NPF_TCPS_SYN_RECEIVED,
175 /* FIN may occur early. */
176 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED,
177 },
178 },
179 [NPF_TCPS_SYN_RECEIVED] = {
180 [NPF_FLOW_FORW] = {
181 /* Handshake (3): ACK is expected. */
182 [TCPFC_ACK] = NPF_TCPS_ESTABLISHED,
183 /* FIN may be sent early. */
184 [TCPFC_FIN] = NPF_TCPS_FIN_SENT,
185 /* Late SYN re-transmission. */
186 [TCPFC_SYN] = NPF_TCPS_OK,
187 },
188 [NPF_FLOW_BACK] = {
189 /* SYN-ACK may be retransmitted. */
190 [TCPFC_SYNACK] = NPF_TCPS_OK,
191 /* XXX: ACK of late SYN in simultaneous case? */
192 [TCPFC_ACK] = NPF_TCPS_OK,
193 /* FIN may occur early. */
194 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED,
195 },
196 },
197 [NPF_TCPS_ESTABLISHED] = {
198 /*
199 * Regular ACKs (data exchange) or FIN.
200 * FIN packets may have ACK set.
201 */
202 [NPF_FLOW_FORW] = {
203 [TCPFC_ACK] = NPF_TCPS_OK,
204 /* FIN by the sender. */
205 [TCPFC_FIN] = NPF_TCPS_FIN_SENT,
206 },
207 [NPF_FLOW_BACK] = {
208 [TCPFC_ACK] = NPF_TCPS_OK,
209 /* FIN by the receiver. */
210 [TCPFC_FIN] = NPF_TCPS_FIN_RECEIVED,
211 },
212 },
213 [NPF_TCPS_FIN_SENT] = {
214 [NPF_FLOW_FORW] = {
215 /* FIN may be re-transmitted. Late ACK as well. */
216 [TCPFC_ACK] = NPF_TCPS_OK,
217 [TCPFC_FIN] = NPF_TCPS_OK,
218 },
219 [NPF_FLOW_BACK] = {
220 /* If ACK, connection is half-closed now. */
221 [TCPFC_ACK] = NPF_TCPS_FIN_WAIT,
222 /* FIN or FIN-ACK race - immediate closing. */
223 [TCPFC_FIN] = NPF_TCPS_CLOSING,
224 },
225 },
226 [NPF_TCPS_FIN_RECEIVED] = {
227 /*
228 * FIN was received. Equivalent scenario to sent FIN.
229 */
230 [NPF_FLOW_FORW] = {
231 [TCPFC_ACK] = NPF_TCPS_CLOSE_WAIT,
232 [TCPFC_FIN] = NPF_TCPS_CLOSING,
233 },
234 [NPF_FLOW_BACK] = {
235 [TCPFC_ACK] = NPF_TCPS_OK,
236 [TCPFC_FIN] = NPF_TCPS_OK,
237 },
238 },
239 [NPF_TCPS_CLOSE_WAIT] = {
240 /* Sender has sent the FIN and closed its end. */
241 [NPF_FLOW_FORW] = {
242 [TCPFC_ACK] = NPF_TCPS_OK,
243 [TCPFC_FIN] = NPF_TCPS_LAST_ACK,
244 },
245 [NPF_FLOW_BACK] = {
246 [TCPFC_ACK] = NPF_TCPS_OK,
247 [TCPFC_FIN] = NPF_TCPS_LAST_ACK,
248 },
249 },
250 [NPF_TCPS_FIN_WAIT] = {
251 /* Receiver has closed its end. */
252 [NPF_FLOW_FORW] = {
253 [TCPFC_ACK] = NPF_TCPS_OK,
254 [TCPFC_FIN] = NPF_TCPS_LAST_ACK,
255 },
256 [NPF_FLOW_BACK] = {
257 [TCPFC_ACK] = NPF_TCPS_OK,
258 [TCPFC_FIN] = NPF_TCPS_LAST_ACK,
259 },
260 },
261 [NPF_TCPS_CLOSING] = {
262 /* Race of FINs - expecting ACK. */
263 [NPF_FLOW_FORW] = {
264 [TCPFC_ACK] = NPF_TCPS_LAST_ACK,
265 },
266 [NPF_FLOW_BACK] = {
267 [TCPFC_ACK] = NPF_TCPS_LAST_ACK,
268 },
269 },
270 [NPF_TCPS_LAST_ACK] = {
271 /* FINs exchanged - expecting last ACK. */
272 [NPF_FLOW_FORW] = {
273 [TCPFC_ACK] = NPF_TCPS_TIME_WAIT,
274 },
275 [NPF_FLOW_BACK] = {
276 [TCPFC_ACK] = NPF_TCPS_TIME_WAIT,
277 },
278 },
279 [NPF_TCPS_TIME_WAIT] = {
280 /* May re-open the connection as per RFC 1122. */
281 [NPF_FLOW_FORW] = {
282 [TCPFC_SYN] = NPF_TCPS_SYN_SENT,
283 },
284 },
285 };
286
287 /*
288 * npf_tcp_inwindow: determine whether the packet is in the TCP window
289 * and thus part of the connection we are tracking.
290 */
291 static bool
npf_tcp_inwindow(npf_cache_t * npc,npf_state_t * nst,const npf_flow_t flow)292 npf_tcp_inwindow(npf_cache_t *npc, npf_state_t *nst, const npf_flow_t flow)
293 {
294 const npf_state_tcp_params_t *params;
295 const struct tcphdr * const th = npc->npc_l4.tcp;
296 const int tcpfl = th->th_flags;
297 npf_tcpstate_t *fstate, *tstate;
298 int tcpdlen, ackskew;
299 tcp_seq seq, ack, end;
300 uint32_t win;
301
302 params = npc->npc_ctx->params[NPF_PARAMS_TCP_STATE];
303 KASSERT(npf_iscached(npc, NPC_TCP));
304
305 /*
306 * Perform SEQ/ACK numbers check against boundaries. Reference:
307 *
308 * Rooij G., "Real stateful TCP packet filtering in IP Filter",
309 * 10th USENIX Security Symposium invited talk, Aug. 2001.
310 *
311 * There are four boundaries defined as following:
312 * I) SEQ + LEN <= MAX { SND.ACK + MAX(SND.WIN, 1) }
313 * II) SEQ >= MAX { SND.SEQ + SND.LEN - MAX(RCV.WIN, 1) }
314 * III) ACK <= MAX { RCV.SEQ + RCV.LEN }
315 * IV) ACK >= MAX { RCV.SEQ + RCV.LEN } - MAXACKWIN
316 *
317 * Let these members of npf_tcpstate_t be the maximum seen values of:
318 * nst_end - SEQ + LEN
319 * nst_maxend - ACK + MAX(WIN, 1)
320 * nst_maxwin - MAX(WIN, 1)
321 */
322
323 tcpdlen = npf_tcpsaw(__UNCONST(npc), &seq, &ack, &win);
324 end = seq + tcpdlen;
325 if (tcpfl & TH_SYN) {
326 end++;
327 }
328 if (tcpfl & TH_FIN) {
329 end++;
330 }
331
332 fstate = &nst->nst_tcpst[flow];
333 tstate = &nst->nst_tcpst[!flow];
334 win = win ? (win << fstate->nst_wscale) : 1;
335
336 /*
337 * Initialise if the first packet.
338 * Note: only case when nst_maxwin is zero.
339 */
340 if (__predict_false(fstate->nst_maxwin == 0)) {
341 /*
342 * Normally, it should be the first SYN or a re-transmission
343 * of SYN. The state of the other side will get set with a
344 * SYN-ACK reply (see below).
345 */
346 fstate->nst_end = end;
347 fstate->nst_maxend = end;
348 fstate->nst_maxwin = win;
349 tstate->nst_end = 0;
350 tstate->nst_maxend = 0;
351 tstate->nst_maxwin = 1;
352
353 /*
354 * Handle TCP Window Scaling (RFC 1323). Both sides may
355 * send this option in their SYN packets.
356 */
357 fstate->nst_wscale = 0;
358 (void)npf_fetch_tcpopts(npc, NULL, &fstate->nst_wscale);
359
360 tstate->nst_wscale = 0;
361
362 /* Done. */
363 return true;
364 }
365
366 if (fstate->nst_end == 0) {
367 /*
368 * Should be a SYN-ACK reply to SYN. If SYN is not set,
369 * then we are in the middle of connection and lost tracking.
370 */
371 fstate->nst_end = end;
372 fstate->nst_maxend = end + 1;
373 fstate->nst_maxwin = win;
374 fstate->nst_wscale = 0;
375
376 /* Handle TCP Window Scaling (must be ignored if no SYN). */
377 if (tcpfl & TH_SYN) {
378 (void)npf_fetch_tcpopts(npc, NULL, &fstate->nst_wscale);
379 }
380 }
381
382 if ((tcpfl & TH_ACK) == 0) {
383 /* Pretend that an ACK was sent. */
384 ack = tstate->nst_end;
385 } else if ((tcpfl & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST) && ack == 0) {
386 /* Workaround for some TCP stacks. */
387 ack = tstate->nst_end;
388 }
389
390 if (__predict_false(tcpfl & TH_RST)) {
391 /* RST to the initial SYN may have zero SEQ - fix it up. */
392 if (seq == 0 && nst->nst_state == NPF_TCPS_SYN_SENT) {
393 end = fstate->nst_end;
394 seq = end;
395 }
396
397 /* Strict in-order sequence for RST packets (RFC 5961). */
398 if (params->strict_order_rst && (fstate->nst_end - seq) > 1) {
399 return false;
400 }
401 }
402
403 /*
404 * Determine whether the data is within previously noted window,
405 * that is, upper boundary for valid data (I).
406 */
407 if (!SEQ_LEQ(end, fstate->nst_maxend)) {
408 npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP1);
409 return false;
410 }
411
412 /* Lower boundary (II), which is no more than one window back. */
413 if (!SEQ_GEQ(seq, fstate->nst_end - tstate->nst_maxwin)) {
414 npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP2);
415 return false;
416 }
417
418 /*
419 * Boundaries for valid acknowledgments (III, IV) - one predicted
420 * window up or down, since packets may be fragmented.
421 */
422 ackskew = tstate->nst_end - ack;
423 if (ackskew < -(int)params->max_ack_win ||
424 ackskew > ((int)params->max_ack_win << fstate->nst_wscale)) {
425 npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE_TCP3);
426 return false;
427 }
428
429 /*
430 * Packet has been passed.
431 *
432 * Negative ackskew might be due to fragmented packets. Since the
433 * total length of the packet is unknown - bump the boundary.
434 */
435
436 if (ackskew < 0) {
437 tstate->nst_end = ack;
438 }
439 /* Keep track of the maximum window seen. */
440 if (fstate->nst_maxwin < win) {
441 fstate->nst_maxwin = win;
442 }
443 if (SEQ_GT(end, fstate->nst_end)) {
444 fstate->nst_end = end;
445 }
446 /* Note the window for upper boundary. */
447 if (SEQ_GEQ(ack + win, tstate->nst_maxend)) {
448 tstate->nst_maxend = ack + win;
449 }
450 return true;
451 }
452
453 /*
454 * npf_state_tcp: inspect TCP segment, determine whether it belongs to
455 * the connection and track its state.
456 */
457 bool
npf_state_tcp(npf_cache_t * npc,npf_state_t * nst,npf_flow_t flow)458 npf_state_tcp(npf_cache_t *npc, npf_state_t *nst, npf_flow_t flow)
459 {
460 const struct tcphdr * const th = npc->npc_l4.tcp;
461 const unsigned tcpfl = th->th_flags, state = nst->nst_state;
462 unsigned nstate;
463
464 KASSERT(nst->nst_state < NPF_TCP_NSTATES);
465
466 /* Look for a transition to a new state. */
467 if (__predict_true((tcpfl & TH_RST) == 0)) {
468 const u_int flagcase = npf_tcpfl2case(tcpfl);
469 nstate = npf_tcp_fsm[state][flow][flagcase];
470 } else if (state == NPF_TCPS_TIME_WAIT) {
471 /* Prevent TIME-WAIT assassination (RFC 1337). */
472 nstate = NPF_TCPS_OK;
473 } else {
474 nstate = NPF_TCPS_CLOSED;
475 }
476
477 /* Determine whether TCP packet really belongs to this connection. */
478 if (!npf_tcp_inwindow(npc, nst, flow)) {
479 return false;
480 }
481 if (__predict_true(nstate == NPF_TCPS_OK)) {
482 return true;
483 }
484
485 nst->nst_state = nstate;
486 return true;
487 }
488
489 int
npf_state_tcp_timeout(npf_t * npf,const npf_state_t * nst)490 npf_state_tcp_timeout(npf_t *npf, const npf_state_t *nst)
491 {
492 static const uint8_t state_timeout_idx[NPF_TCP_NSTATES] = {
493 [NPF_TCPS_CLOSED] = NPF_TCPT_CLOSE,
494 /* Unsynchronised states. */
495 [NPF_TCPS_SYN_SENT] = NPF_TCPT_NEW,
496 [NPF_TCPS_SIMSYN_SENT] = NPF_TCPT_NEW,
497 [NPF_TCPS_SYN_RECEIVED] = NPF_TCPT_NEW,
498 /* Established (synchronised state). */
499 [NPF_TCPS_ESTABLISHED] = NPF_TCPT_ESTABLISHED,
500 /* Half-closed cases. */
501 [NPF_TCPS_FIN_SENT] = NPF_TCPT_HALFCLOSE,
502 [NPF_TCPS_FIN_RECEIVED] = NPF_TCPT_HALFCLOSE,
503 [NPF_TCPS_CLOSE_WAIT] = NPF_TCPT_HALFCLOSE,
504 [NPF_TCPS_FIN_WAIT] = NPF_TCPT_HALFCLOSE,
505 /* Full close cases. */
506 [NPF_TCPS_CLOSING] = NPF_TCPT_CLOSE,
507 [NPF_TCPS_LAST_ACK] = NPF_TCPT_CLOSE,
508 [NPF_TCPS_TIME_WAIT] = NPF_TCPT_TIMEWAIT,
509 };
510 const npf_state_tcp_params_t *params;
511 const unsigned state = nst->nst_state;
512
513 KASSERT(state < NPF_TCP_NSTATES);
514 params = npf->params[NPF_PARAMS_TCP_STATE];
515 return params->timeouts[state_timeout_idx[state]];
516 }
517
518 void
npf_state_tcp_sysinit(npf_t * npf)519 npf_state_tcp_sysinit(npf_t *npf)
520 {
521 npf_state_tcp_params_t *params = npf_param_allocgroup(npf,
522 NPF_PARAMS_TCP_STATE, sizeof(npf_state_tcp_params_t));
523 npf_param_t param_map[] = {
524 /*
525 * TCP connection timeout table (in seconds).
526 */
527
528 /* Unsynchronised states. */
529 {
530 "state.tcp.timeout.new",
531 ¶ms->timeouts[NPF_TCPT_NEW],
532 .default_val = 30,
533 .min = 0, .max = INT_MAX
534 },
535 /* Established. */
536 {
537 "state.tcp.timeout.established",
538 ¶ms->timeouts[NPF_TCPT_ESTABLISHED],
539 .default_val = 60 * 60 * 24,
540 .min = 0, .max = INT_MAX
541 },
542 /* Half-closed cases. */
543 {
544 "state.tcp.timeout.half_close",
545 ¶ms->timeouts[NPF_TCPT_HALFCLOSE],
546 .default_val = 60 * 60 * 6,
547 .min = 0, .max = INT_MAX
548 },
549 /* Full close cases. */
550 {
551 "state.tcp.timeout.close",
552 ¶ms->timeouts[NPF_TCPT_CLOSE],
553 .default_val = 10,
554 .min = 0, .max = INT_MAX
555 },
556 /* TCP time-wait (2 * MSL). */
557 {
558 "state.tcp.timeout.time_wait",
559 ¶ms->timeouts[NPF_TCPT_TIMEWAIT],
560 .default_val = 60 * 2 * 2,
561 .min = 0, .max = INT_MAX
562 },
563
564 /*
565 * Enforce strict order RST.
566 */
567 {
568 "state.tcp.strict_order_rst",
569 ¶ms->strict_order_rst,
570 .default_val = 1, // true
571 .min = 0, .max = 1
572 },
573
574 /*
575 * TCP state tracking: maximum allowed ACK window.
576 */
577 {
578 "state.tcp.max_ack_win",
579 ¶ms->max_ack_win,
580 .default_val = 66000,
581 .min = 0, .max = INT_MAX
582 },
583 };
584 npf_param_register(npf, param_map, __arraycount(param_map));
585 }
586
587 void
npf_state_tcp_sysfini(npf_t * npf)588 npf_state_tcp_sysfini(npf_t *npf)
589 {
590 const size_t len = sizeof(npf_state_tcp_params_t);
591 npf_param_freegroup(npf, NPF_PARAMS_TCP_STATE, len);
592 }
593