set_bit(IPS_ASSURED_BIT, &conntrack->status); 
set_bit(IPS_ASSURED_BIT, &conntrack->status); ip_conntrack_event_cache(IPCT_STATUS, skb); 
static int tcp_packet(struct ip_conntrack *conntrack,		      const struct sk_buff *skb,		      enum ip_conntrack_info ctinfo){	enum tcp_conntrack new_state, old_state;	enum ip_conntrack_dir dir;	struct iphdr *iph = skb->nh.iph;	struct tcphdr *th, _tcph;	unsigned long timeout;	unsigned int index;		th = skb_header_pointer(skb, iph->ihl * 4,				sizeof(_tcph), &_tcph);	BUG_ON(th == NULL);		write_lock_bh(&tcp_lock);	old_state = conntrack->proto.tcp.state;	dir = CTINFO2DIR(ctinfo);	index = get_conntrack_index(th);	new_state = tcp_conntracks[dir][index][old_state];	switch (new_state) {	case TCP_CONNTRACK_IGNORE:		/* Either SYN in ORIGINAL		 * or SYN/ACK in REPLY. */		if (index == TCP_SYNACK_SET		    && conntrack->proto.tcp.last_index == TCP_SYN_SET		    && conntrack->proto.tcp.last_dir != dir		    && ntohl(th->ack_seq) ==		    	     conntrack->proto.tcp.last_end) {			/* This SYN/ACK acknowledges a SYN that we earlier 			 * ignored as invalid. This means that the client and			 * the server are both in sync, while the firewall is			 * not. We kill this session and block the SYN/ACK so			 * that the client cannot but retransmit its SYN and 			 * thus initiate a clean new session.			 */		    	write_unlock_bh(&tcp_lock);			if (LOG_INVALID(IPPROTO_TCP))				nf_log_packet(PF_INET, 0, skb, NULL, NULL,					      NULL, "ip_ct_tcp: "					      "killing out of sync session ");		    	if (del_timer(&conntrack->timeout))		    		conntrack->timeout.function((unsigned long)		    					    conntrack);		    	return -NF_DROP;		}		conntrack->proto.tcp.last_index = index;		conntrack->proto.tcp.last_dir = dir;		conntrack->proto.tcp.last_seq = ntohl(th->seq);		conntrack->proto.tcp.last_end = 		    segment_seq_plus_len(ntohl(th->seq), skb->len, iph, th);				write_unlock_bh(&tcp_lock);		if (LOG_INVALID(IPPROTO_TCP))			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,				  "ip_ct_tcp: invalid packet ignored ");		return NF_ACCEPT;	case TCP_CONNTRACK_MAX:		/* Invalid packet */		DEBUGP("ip_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",		       dir, get_conntrack_index(th),		       old_state);		write_unlock_bh(&tcp_lock);		if (LOG_INVALID(IPPROTO_TCP))			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,				  "ip_ct_tcp: invalid state ");		return -NF_ACCEPT;	case TCP_CONNTRACK_SYN_SENT:		if (old_state < TCP_CONNTRACK_TIME_WAIT)			break;		if ((conntrack->proto.tcp.seen[dir].flags &		         IP_CT_TCP_FLAG_CLOSE_INIT)		    || after(ntohl(th->seq),		    	     conntrack->proto.tcp.seen[dir].td_end)) {			    	/* Attempt to reopen a closed connection.		    	* Delete this connection and look up again. */		    	write_unlock_bh(&tcp_lock);		    	if (del_timer(&conntrack->timeout))		    		conntrack->timeout.function((unsigned long)		    					    conntrack);		    	return -NF_REPEAT;		} else {			write_unlock_bh(&tcp_lock);			if (LOG_INVALID(IPPROTO_TCP))				nf_log_packet(PF_INET, 0, skb, NULL, NULL,					      NULL, "ip_ct_tcp: invalid SYN");			return -NF_ACCEPT;		}	case TCP_CONNTRACK_CLOSE:		if (index == TCP_RST_SET		    && test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)		    && conntrack->proto.tcp.last_index == TCP_SYN_SET		    && ntohl(th->ack_seq) == conntrack->proto.tcp.last_end) {			/* RST sent to invalid SYN we had let trough			 * SYN was in window then, tear down connection.			 * We skip window checking, because packet might ACK			 * segments we ignored in the SYN. */			goto in_window;		}		/* Just fall trough */	default:		/* Keep compilers happy. */		break;	}	if (!tcp_in_window(&conntrack->proto.tcp, dir, index, 			   skb, iph, th)) {		write_unlock_bh(&tcp_lock);		return -NF_ACCEPT;	}    in_window:	/* From now on we have got in-window packets */		conntrack->proto.tcp.last_index = index;	DEBUGP("tcp_conntracks: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "	       "syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",		NIPQUAD(iph->saddr), ntohs(th->source),		NIPQUAD(iph->daddr), ntohs(th->dest),		(th->syn ? 1 : 0), (th->ack ? 1 : 0),		(th->fin ? 1 : 0), (th->rst ? 1 : 0),		old_state, new_state);	conntrack->proto.tcp.state = new_state;	if (old_state != new_state 	    && (new_state == TCP_CONNTRACK_FIN_WAIT	    	|| new_state == TCP_CONNTRACK_CLOSE))		conntrack->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;	timeout = conntrack->proto.tcp.retrans >= ip_ct_tcp_max_retrans		  && *tcp_timeouts[new_state] > ip_ct_tcp_timeout_max_retrans		  ? ip_ct_tcp_timeout_max_retrans : *tcp_timeouts[new_state];	write_unlock_bh(&tcp_lock);	ip_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);	if (new_state != old_state)		ip_conntrack_event_cache(IPCT_PROTOINFO, skb);	if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {		/* If only reply is a RST, we can consider ourselves not to		   have an established connection: this is a fairly common		   problem case, so we can delete the conntrack		   immediately.  --RR */		if (th->rst) {			if (del_timer(&conntrack->timeout))				conntrack->timeout.function((unsigned long)							    conntrack);			return NF_ACCEPT;		}	} else if (!test_bit(IPS_ASSURED_BIT, &conntrack->status)		   && (old_state == TCP_CONNTRACK_SYN_RECV		       || old_state == TCP_CONNTRACK_ESTABLISHED)		   && new_state == TCP_CONNTRACK_ESTABLISHED) {		/* Set ASSURED if we see see valid ack in ESTABLISHED 		   after SYN_RECV or a valid answer for a picked up 		   connection. */			set_bit(IPS_ASSURED_BIT, &conntrack->status);	}	ip_ct_refresh_acct(conntrack, ctinfo, skb, timeout);	return NF_ACCEPT;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/8ddec7460d2f5db3ac35812c03676b1473d1d668/ip_conntrack_proto_tcp.c/clean/net/ipv4/netfilter/ip_conntrack_proto_tcp.c