自学教程：C++ tcp_flag_word函数代码示例

static voidsynproxy_send_server_ack(const struct synproxy_net *snet,			 const struct ip_ct_tcp *state,			 const struct sk_buff *skb, const struct tcphdr *th,			 const struct synproxy_options *opts){	struct sk_buff *nskb;	struct ipv6hdr *iph, *niph;	struct tcphdr *nth;	unsigned int tcp_hdr_size;	iph = ipv6_hdr(skb);	tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);	nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,			 GFP_ATOMIC);	if (nskb == NULL)		return;	skb_reserve(nskb, MAX_TCP_HEADER);	niph = synproxy_build_ip(nskb, &iph->daddr, &iph->saddr);	skb_reset_transport_header(nskb);	nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);	nth->source	= th->dest;	nth->dest	= th->source;	nth->seq	= htonl(ntohl(th->ack_seq));	nth->ack_seq	= htonl(ntohl(th->seq) + 1);	tcp_flag_word(nth) = TCP_FLAG_ACK;	nth->doff	= tcp_hdr_size / 4;	nth->window	= htons(state->seen[IP_CT_DIR_ORIGINAL].td_maxwin);	nth->check	= 0;	nth->urg_ptr	= 0;	synproxy_build_options(nth, opts);	synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);}

static voidsynproxy_send_client_ack(const struct synproxy_net *snet,			 const struct sk_buff *skb, const struct tcphdr *th,			 const struct synproxy_options *opts){	struct sk_buff *nskb;	struct iphdr *iph, *niph;	struct tcphdr *nth;	unsigned int tcp_hdr_size;	iph = ip_hdr(skb);	tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);	nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,			 GFP_ATOMIC);	if (nskb == NULL)		return;	skb_reserve(nskb, MAX_TCP_HEADER);	niph = synproxy_build_ip(nskb, iph->saddr, iph->daddr);	skb_reset_transport_header(nskb);	nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);	nth->source	= th->source;	nth->dest	= th->dest;	nth->seq	= htonl(ntohl(th->seq) + 1);	nth->ack_seq	= th->ack_seq;	tcp_flag_word(nth) = TCP_FLAG_ACK;	nth->doff	= tcp_hdr_size / 4;	nth->window	= htons(ntohs(th->window) >> opts->wscale);	nth->check	= 0;	nth->urg_ptr	= 0;	synproxy_build_options(nth, opts);	synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,			  niph, nth, tcp_hdr_size);}

static void__skb_flow_dissect_tcp(const struct sk_buff *skb,		       struct flow_dissector *flow_dissector,		       void *target_container, void *data, int thoff, int hlen){	struct flow_dissector_key_tcp *key_tcp;	struct tcphdr *th, _th;	if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_TCP))		return;	th = __skb_header_pointer(skb, thoff, sizeof(_th), data, hlen, &_th);	if (!th)		return;	if (unlikely(__tcp_hdrlen(th) < sizeof(_th)))		return;	key_tcp = skb_flow_dissector_target(flow_dissector,					    FLOW_DISSECTOR_KEY_TCP,					    target_container);	key_tcp->flags = (*(__be16 *) &tcp_flag_word(th) & htons(0x0FFF));}

//.........这里部分代码省略.........		currenthdr = hp->nexthdr;		ptr += hdrlen;	}	switch (currenthdr) {	case IPPROTO_TCP: {		struct tcphdr _tcph;		const struct tcphdr *th;		/* Max length: 10 "PROTO=TCP " */		printk("PROTO=TCP ");		if (fragment)			break;		/* Max length: 25 "INCOMPLETE [65535 bytes] " */		th = skb_header_pointer(skb, ptr, sizeof(_tcph), &_tcph);		if (th == NULL) {			printk("INCOMPLETE [%u bytes] ", skb->len - ptr);			return;		}		/* Max length: 20 "SPT=65535 DPT=65535 " */		printk("SPT=%u DPT=%u ",		       ntohs(th->source), ntohs(th->dest));		/* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */		if (logflags & IP6T_LOG_TCPSEQ)			printk("SEQ=%u ACK=%u ",			       ntohl(th->seq), ntohl(th->ack_seq));		/* Max length: 13 "WINDOW=65535 " */		printk("WINDOW=%u ", ntohs(th->window));		/* Max length: 9 "RES=0x3C " */		printk("RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(th) & TCP_RESERVED_BITS) >> 22));		/* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */		if (th->cwr)			printk("CWR ");		if (th->ece)			printk("ECE ");		if (th->urg)			printk("URG ");		if (th->ack)			printk("ACK ");		if (th->psh)			printk("PSH ");		if (th->rst)			printk("RST ");		if (th->syn)			printk("SYN ");		if (th->fin)			printk("FIN ");		/* Max length: 11 "URGP=65535 " */		printk("URGP=%u ", ntohs(th->urg_ptr));		if ((logflags & IP6T_LOG_TCPOPT) &&		    th->doff * 4 > sizeof(struct tcphdr)) {			u_int8_t _opt[60 - sizeof(struct tcphdr)];			const u_int8_t *op;			unsigned int i;			unsigned int optsize = th->doff * 4					       - sizeof(struct tcphdr);			op = skb_header_pointer(skb,						ptr + sizeof(struct tcphdr),						optsize, _opt);			if (op == NULL) {

static int tcp_in_window(struct ip_ct_tcp *state,			 enum ip_conntrack_dir dir,			 unsigned int index,			 const struct sk_buff *skb,			 unsigned int dataoff,			 struct tcphdr *tcph,			 int pf){	struct ip_ct_tcp_state *sender = &state->seen[dir];	struct ip_ct_tcp_state *receiver = &state->seen[!dir];	__u32 seq, ack, sack, end, win;#if defined (CONFIG_RA_NAT_NONE)	__u32 swin;#endif	int res;	/*	 * Get the required data from the packet.	 */	seq = ntohl(tcph->seq);	ack = sack = ntohl(tcph->ack_seq);	win = ntohs(tcph->window);	end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);	if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)		tcp_sack(skb, dataoff, tcph, &sack);	DEBUGP("tcp_in_window: START/n");	DEBUGP("tcp_in_window: src=%u.%u.%u.%u:%hu dst=%u.%u.%u.%u:%hu "	       "seq=%u ack=%u sack=%u win=%u end=%u/n",		NIPQUAD(iph->saddr), ntohs(tcph->source),		NIPQUAD(iph->daddr), ntohs(tcph->dest),		seq, ack, sack, win, end);	DEBUGP("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "	       "receiver end=%u maxend=%u maxwin=%u scale=%i/n",		sender->td_end, sender->td_maxend, sender->td_maxwin,		sender->td_scale,		receiver->td_end, receiver->td_maxend, receiver->td_maxwin,		receiver->td_scale);	if (sender->td_end == 0) {		/*		 * Initialize sender data.		 */		if (tcph->syn && tcph->ack) {			/*			 * Outgoing SYN-ACK in reply to a SYN.			 */			sender->td_end =			sender->td_maxend = end;			sender->td_maxwin = (win == 0 ? 1 : win);			tcp_options(skb, dataoff, tcph, sender);			/*			 * RFC 1323:			 * Both sides must send the Window Scale option			 * to enable window scaling in either direction.			 */			if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE			      && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))				sender->td_scale =				receiver->td_scale = 0;		} else {			/*			 * We are in the middle of a connection,			 * its history is lost for us.			 * Let's try to use the data from the packet.			 */			sender->td_end = end;			sender->td_maxwin = (win == 0 ? 1 : win);			sender->td_maxend = end + sender->td_maxwin;		}	} else if (((state->state == TCP_CONNTRACK_SYN_SENT		     && dir == IP_CT_DIR_ORIGINAL)		   || (state->state == TCP_CONNTRACK_SYN_RECV		     && dir == IP_CT_DIR_REPLY))		   && after(end, sender->td_end)) {		/*		 * RFC 793: "if a TCP is reinitialized ... then it need		 * not wait at all; it must only be sure to use sequence		 * numbers larger than those recently used."		 */		sender->td_end =		sender->td_maxend = end;		sender->td_maxwin = (win == 0 ? 1 : win);		tcp_options(skb, dataoff, tcph, sender);	}	if (!(tcph->ack)) {		/*		 * If there is no ACK, just pretend it was set and OK.		 */		ack = sack = receiver->td_end;	} else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==		    (TCP_FLAG_ACK|TCP_FLAG_RST))		   && (ack == 0)) {		/*		 * Broken TCP stacks, that set ACK in RST packets as well		 * with zero ack value.//.........这里部分代码省略.........

/* after ipt_filter */static unsigned int ezp_nat_pre_hook(unsigned int hooknum,         struct sk_buff *skb, const struct net_device *indev,        const struct net_device *outdev,         int (*okfn)(struct sk_buff *)){    struct nf_conn *ct;    enum ip_conntrack_info ctinfo;    int ret = NF_ACCEPT;    enum ip_conntrack_dir dir;    __u32 dnat_addr = 0, snat_addr = 0;        int* nat_flag;    struct dst_entry** dst_to_use = NULL;    struct iphdr *iph = ip_hdr(skb);    struct icmphdr *hdr = icmp_hdr(skb);    struct tcphdr *tcph = tcp_hdr(skb);    /* EZP: enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum); */    if(!ezp_nat_enable_flag){        return NF_ACCEPT;    }    ct = nf_ct_get(skb, &ctinfo);    if (!ct) {        if (iph->protocol == IPPROTO_ICMP                && hdr->type == ICMP_REDIRECT)            return NF_DROP;        return NF_ACCEPT;    }        /* TCP or UDP. */    if ((iph->protocol != IPPROTO_TCP) &&            (iph->protocol != IPPROTO_UDP) ) {        return NF_ACCEPT;    }    if ((iph->protocol == IPPROTO_TCP) &&             ((tcp_flag_word(tcph) & (TCP_FLAG_RST | TCP_FLAG_SYN)) ==              TCP_FLAG_SYN)) {        return NF_ACCEPT;    }    /* Make sure it is confirmed. */    if (!nf_ct_is_confirmed(ct)) {        return NF_ACCEPT;    }     /* We comment out this part since    ((tcp_flag_word((*pskb)->h.th) == TCP_FLAG_SYN) ||     * 1. conntrack establishing is a 2 way process, but after routing, we have     * established routing entry and address resolution table, so we don't     * need to check ESTABLISH state.     * 2. With establishing state, we need to go through forward state and      * routing several times. It may occur that our holded entry may be     * replaced. */    /*    if ((ctinfo != IP_CT_ESTABLISHED) &&        (ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY)) {        return NF_ACCEPT;    }    */    dir = CTINFO2DIR(ctinfo);    if (dir == IP_CT_DIR_ORIGINAL) {        if (!ct->orgdir_dst) {            return NF_ACCEPT;        } else {            nat_flag = &ct->orgdir_rid;            if (!(*nat_flag & ((1 << IP_NAT_MANIP_DST) | 			(1 << IP_NAT_MANIP_SRC) |			(1 << EZP_IP_LOCAL_IN)))) {                return NF_ACCEPT;            }            /* Check only in forward case and ignore input case */            if (!(*nat_flag & (1 << EZP_IP_LOCAL_IN))) {                if ((!ct->orgdir_dst->hh) && (!ct->orgdir_dst->neighbour)) {                    printk("%s:orig dst and neighbour null dir/n",__FUNCTION__);                    return NF_ACCEPT;                }            }            if (skb->dst) {                /* skb might has its own dst already.                  * e.g. output to local input */                dst_release(skb->dst);            }             skb->protocol = htons(ETH_P_IP);            skb->dst = ct->orgdir_dst;            /* XXX: */            skb->dev = ct->orgdir_dst->dev;            /* skb uses this dst_entry */            dst_use(skb->dst, jiffies);            dst_to_use = &ct->orgdir_dst;        }    } else {        /* IP_CT_DIR_REPLY */        if (!ct->replydir_dst) {            return NF_ACCEPT;        } else {            nat_flag = &ct->replydir_rid;            if (!(*nat_flag & ((1 << IP_NAT_MANIP_DST) | 			(1 << IP_NAT_MANIP_SRC) |			(1 << EZP_IP_LOCAL_IN)))) {                return NF_ACCEPT;            }            /* Check only in forward case and ignore input case *///.........这里部分代码省略.........

/* One level of recursion won't kill us */static void dump_packet(const struct nf_loginfo *info,			const struct sk_buff *skb,			unsigned int iphoff){	struct iphdr _iph;	const struct iphdr *ih;	unsigned int logflags;	if (info->type == NF_LOG_TYPE_LOG)		logflags = info->u.log.logflags;	else		logflags = NF_LOG_MASK;	ih = skb_header_pointer(skb, iphoff, sizeof(_iph), &_iph);	if (ih == NULL) {		printk("TRUNCATED");		return;	}	/* Important fields:	 * TOS, len, DF/MF, fragment offset, TTL, src, dst, options. */	/* Max length: 40 "SRC=255.255.255.255 DST=255.255.255.255 " */	printk("SRC=%pI4 DST=%pI4 ",	       &ih->saddr, &ih->daddr);	/* Max length: 46 "LEN=65535 TOS=0xFF PREC=0xFF TTL=255 ID=65535 " */	printk("LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",	       ntohs(ih->tot_len), ih->tos & IPTOS_TOS_MASK,	       ih->tos & IPTOS_PREC_MASK, ih->ttl, ntohs(ih->id));	/* Max length: 6 "CE DF MF " */	if (ntohs(ih->frag_off) & IP_CE)		printk("CE ");	if (ntohs(ih->frag_off) & IP_DF)		printk("DF ");	if (ntohs(ih->frag_off) & IP_MF)		printk("MF ");	/* Max length: 11 "FRAG:65535 " */	if (ntohs(ih->frag_off) & IP_OFFSET)		printk("FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);	if ((logflags & IPT_LOG_IPOPT) &&	    ih->ihl * 4 > sizeof(struct iphdr)) {		const unsigned char *op;		unsigned char _opt[4 * 15 - sizeof(struct iphdr)];		unsigned int i, optsize;		optsize = ih->ihl * 4 - sizeof(struct iphdr);		op = skb_header_pointer(skb, iphoff+sizeof(_iph),					optsize, _opt);		if (op == NULL) {			printk("TRUNCATED");			return;		}		/* Max length: 127 "OPT (" 15*4*2chars ") " */		printk("OPT (");		for (i = 0; i < optsize; i++)			printk("%02X", op[i]);		printk(") ");	}	switch (ih->protocol) {	case IPPROTO_TCP: {		struct tcphdr _tcph;		const struct tcphdr *th;		/* Max length: 10 "PROTO=TCP " */		printk("PROTO=TCP ");		if (ntohs(ih->frag_off) & IP_OFFSET)			break;		/* Max length: 25 "INCOMPLETE [65535 bytes] " */		th = skb_header_pointer(skb, iphoff + ih->ihl * 4,					sizeof(_tcph), &_tcph);		if (th == NULL) {			printk("INCOMPLETE [%u bytes] ",			       skb->len - iphoff - ih->ihl*4);			break;		}		/* Max length: 20 "SPT=65535 DPT=65535 " */		printk("SPT=%u DPT=%u ",		       ntohs(th->source), ntohs(th->dest));		/* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */		if (logflags & IPT_LOG_TCPSEQ)			printk("SEQ=%u ACK=%u ",			       ntohl(th->seq), ntohl(th->ack_seq));		/* Max length: 13 "WINDOW=65535 " */		printk("WINDOW=%u ", ntohs(th->window));		/* Max length: 9 "RES=0x3F " */		printk("RES=0x%02x ", (u8)(ntohl(tcp_flag_word(th) & TCP_RESERVED_BITS) >> 22));		/* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */		if (th->cwr)			printk("CWR ");		if (th->ece)			printk("ECE ");//.........这里部分代码省略.........

/* One level of recursion won't kill us */static void dump_packet(const struct ip6t_log_info *info,			struct ipv6hdr *ipv6h, int recurse){	u_int8_t currenthdr = ipv6h->nexthdr;	u_int8_t *hdrptr;	int fragment;	/* Max length: 88 "SRC=0000.0000.0000.0000.0000.0000.0000.0000 DST=0000.0000.0000.0000.0000.0000.0000.0000" */	printk("SRC=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(ipv6h->saddr));	printk("DST=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(ipv6h->daddr));	/* Max length: 44 "LEN=65535 TC=255 HOPLIMIT=255 FLOWLBL=FFFFF " */	printk("LEN=%Zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",	       ntohs(ipv6h->payload_len) + sizeof(struct ipv6hdr),	       (ntohl(*(u_int32_t *)ipv6h) & 0x0ff00000) >> 20,	       ipv6h->hop_limit,	       (ntohl(*(u_int32_t *)ipv6h) & 0x000fffff));	fragment = 0;	hdrptr = (u_int8_t *)(ipv6h + 1);	while (currenthdr != IPPROTO_NONE) {		if ((currenthdr == IPPROTO_TCP) ||		    (currenthdr == IPPROTO_UDP) ||		    (currenthdr == IPPROTO_ICMPV6))			break;		/* Max length: 48 "OPT (...) " */		printk("OPT ( ");		switch (currenthdr) {		case IPPROTO_FRAGMENT: {			struct frag_hdr *fhdr = (struct frag_hdr *)hdrptr;			/* Max length: 11 "FRAG:65535 " */			printk("FRAG:%u ", ntohs(fhdr->frag_off) & 0xFFF8);			/* Max length: 11 "INCOMPLETE " */			if (fhdr->frag_off & htons(0x0001))				printk("INCOMPLETE ");			printk("ID:%08x ", fhdr->identification);			if (ntohs(fhdr->frag_off) & 0xFFF8)				fragment = 1;			break;		}		case IPPROTO_DSTOPTS:		case IPPROTO_ROUTING:		case IPPROTO_HOPOPTS:			break;		/* Max Length */		case IPPROTO_AH:		case IPPROTO_ESP:			if (info->logflags & IP6T_LOG_IPOPT) {				struct esphdr *esph = (struct esphdr *)hdrptr;				int esp = (currenthdr == IPPROTO_ESP);				/* Max length: 4 "ESP " */				printk("%s ",esp ? "ESP" : "AH");				/* Length: 15 "SPI=0xF1234567 " */				printk("SPI=0x%x ", ntohl(esph->spi) );				break;			}		default:			break;		}		printk(") ");		currenthdr = ip6_nexthdr(currenthdr, &hdrptr);	}	switch (currenthdr) {	case IPPROTO_TCP: {		struct tcphdr *tcph = (struct tcphdr *)hdrptr;		/* Max length: 10 "PROTO=TCP " */		printk("PROTO=TCP ");		if (fragment)			break;		/* Max length: 20 "SPT=65535 DPT=65535 " */		printk("SPT=%u DPT=%u ",		       ntohs(tcph->source), ntohs(tcph->dest));		/* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */		if (info->logflags & IP6T_LOG_TCPSEQ)			printk("SEQ=%u ACK=%u ",			       ntohl(tcph->seq), ntohl(tcph->ack_seq));		/* Max length: 13 "WINDOW=65535 " */		printk("WINDOW=%u ", ntohs(tcph->window));		/* Max length: 9 "RES=0x3F " */		printk("RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(tcph) & TCP_RESERVED_BITS) >> 22));		/* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */		if (tcph->cwr)			printk("CWR ");		if (tcph->ece)			printk("ECE ");		if (tcph->urg)			printk("URG ");		if (tcph->ack)//.........这里部分代码省略.........

static inline bool tflg_synack(const struct tcphdr *th){	return (tcp_flag_word(th) & TCP_FLAGS_ALL4) ==	       (TCP_FLAG_SYN | TCP_FLAG_ACK);}

static inline bool tflg_syn(const struct tcphdr *th){	return (tcp_flag_word(th) & TCP_FLAGS_ALL4) == TCP_FLAG_SYN;}

static inline bool tflg_rst(const struct tcphdr *th){	return (tcp_flag_word(th) & TCP_FLAGS_ALL3) == TCP_FLAG_RST;}

static inline bool tflg_ack6(const struct tcphdr *th){	return (tcp_flag_word(th) & TCP_FLAGS_ALL6) == TCP_FLAG_ACK;}

static bool tcp_in_window(const struct nf_conn *ct,			  struct ip_ct_tcp *state,			  enum ip_conntrack_dir dir,			  unsigned int index,			  const struct sk_buff *skb,			  unsigned int dataoff,			  const struct tcphdr *tcph,			  u_int8_t pf){	struct net *net = nf_ct_net(ct);	struct ip_ct_tcp_state *sender = &state->seen[dir];	struct ip_ct_tcp_state *receiver = &state->seen[!dir];	const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;	__u32 seq, ack, sack, end, win, swin;	s16 receiver_offset;	bool res;	seq = ntohl(tcph->seq);	ack = sack = ntohl(tcph->ack_seq);	win = ntohs(tcph->window);	end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);	if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)		tcp_sack(skb, dataoff, tcph, &sack);		receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);	ack -= receiver_offset;	sack -= receiver_offset;	pr_debug("tcp_in_window: START/n");	pr_debug("tcp_in_window: ");	nf_ct_dump_tuple(tuple);	pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u/n",		 seq, ack, receiver_offset, sack, receiver_offset, win, end);	pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "		 "receiver end=%u maxend=%u maxwin=%u scale=%i/n",		 sender->td_end, sender->td_maxend, sender->td_maxwin,		 sender->td_scale,		 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,		 receiver->td_scale);	if (sender->td_maxwin == 0) {		if (tcph->syn) {			sender->td_end =			sender->td_maxend = end;			sender->td_maxwin = (win == 0 ? 1 : win);			tcp_options(skb, dataoff, tcph, sender);			if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE			      && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))				sender->td_scale =				receiver->td_scale = 0;			if (!tcph->ack)								return true;		} else {			sender->td_end = end;			swin = win << sender->td_scale;			sender->td_maxwin = (swin == 0 ? 1 : swin);			sender->td_maxend = end + sender->td_maxwin;			if (receiver->td_maxwin == 0)				receiver->td_end = receiver->td_maxend = sack;		}	} else if (((state->state == TCP_CONNTRACK_SYN_SENT		     && dir == IP_CT_DIR_ORIGINAL)		   || (state->state == TCP_CONNTRACK_SYN_RECV		     && dir == IP_CT_DIR_REPLY))		   && after(end, sender->td_end)) {		sender->td_end =		sender->td_maxend = end;		sender->td_maxwin = (win == 0 ? 1 : win);		tcp_options(skb, dataoff, tcph, sender);	}	if (!(tcph->ack)) {		ack = sack = receiver->td_end;	} else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==		    (TCP_FLAG_ACK|TCP_FLAG_RST))		   && (ack == 0)) {		ack = sack = receiver->td_end;	}	if (seq == end	    && (!tcph->rst		|| (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))		seq = end = sender->td_end;	pr_debug("tcp_in_window: ");	nf_ct_dump_tuple(tuple);	pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u/n",		 seq, ack, receiver_offset, sack, receiver_offset, win, end);	pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "		 "receiver end=%u maxend=%u maxwin=%u scale=%i/n",		 sender->td_end, sender->td_maxend, sender->td_maxwin,		 sender->td_scale,		 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,		 receiver->td_scale);//.........这里部分代码省略.........

int nf_log_dump_tcp_header(struct nf_log_buf *m, const struct sk_buff *skb,			   u8 proto, int fragment, unsigned int offset,			   unsigned int logflags){	struct tcphdr _tcph;	const struct tcphdr *th;	/* Max length: 10 "PROTO=TCP " */	nf_log_buf_add(m, "PROTO=TCP ");	if (fragment)		return 0;	/* Max length: 25 "INCOMPLETE [65535 bytes] " */	th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);	if (th == NULL) {		nf_log_buf_add(m, "INCOMPLETE [%u bytes] ", skb->len - offset);		return 1;	}	/* Max length: 20 "SPT=65535 DPT=65535 " */	nf_log_buf_add(m, "SPT=%u DPT=%u ",		       ntohs(th->source), ntohs(th->dest));	/* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */	if (logflags & XT_LOG_TCPSEQ) {		nf_log_buf_add(m, "SEQ=%u ACK=%u ",			       ntohl(th->seq), ntohl(th->ack_seq));	}	/* Max length: 13 "WINDOW=65535 " */	nf_log_buf_add(m, "WINDOW=%u ", ntohs(th->window));	/* Max length: 9 "RES=0x3C " */	nf_log_buf_add(m, "RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(th) &					    TCP_RESERVED_BITS) >> 22));	/* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */	if (th->cwr)		nf_log_buf_add(m, "CWR ");	if (th->ece)		nf_log_buf_add(m, "ECE ");	if (th->urg)		nf_log_buf_add(m, "URG ");	if (th->ack)		nf_log_buf_add(m, "ACK ");	if (th->psh)		nf_log_buf_add(m, "PSH ");	if (th->rst)		nf_log_buf_add(m, "RST ");	if (th->syn)		nf_log_buf_add(m, "SYN ");	if (th->fin)		nf_log_buf_add(m, "FIN ");	/* Max length: 11 "URGP=65535 " */	nf_log_buf_add(m, "URGP=%u ", ntohs(th->urg_ptr));	if ((logflags & XT_LOG_TCPOPT) && th->doff*4 > sizeof(struct tcphdr)) {		u_int8_t _opt[60 - sizeof(struct tcphdr)];		const u_int8_t *op;		unsigned int i;		unsigned int optsize = th->doff*4 - sizeof(struct tcphdr);		op = skb_header_pointer(skb, offset + sizeof(struct tcphdr),					optsize, _opt);		if (op == NULL) {			nf_log_buf_add(m, "OPT (TRUNCATED)");			return 1;		}		/* Max length: 127 "OPT (" 15*4*2chars ") " */		nf_log_buf_add(m, "OPT (");		for (i = 0; i < optsize; i++)			nf_log_buf_add(m, "%02X", op[i]);		nf_log_buf_add(m, ") ");	}	return 0;}

/* One level of recursion won't kill us */static void dump_packet(const struct ipt_log_info *info,                        const struct sk_buff *skb,                        unsigned int iphoff){    struct iphdr iph;    if (skb_copy_bits(skb, iphoff, &iph, sizeof(iph)) < 0) {        printk("TRUNCATED");        return;    }    /* Important fields:     * TOS, len, DF/MF, fragment offset, TTL, src, dst, options. */    /* Max length: 40 "SRC=255.255.255.255 DST=255.255.255.255 " */    printk("SRC=%u.%u.%u.%u DST=%u.%u.%u.%u ",           NIPQUAD(iph.saddr), NIPQUAD(iph.daddr));    /* Max length: 46 "LEN=65535 TOS=0xFF PREC=0xFF TTL=255 ID=65535 " */    printk("LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",           ntohs(iph.tot_len), iph.tos & IPTOS_TOS_MASK,           iph.tos & IPTOS_PREC_MASK, iph.ttl, ntohs(iph.id));    /* Max length: 6 "CE DF MF " */    if (ntohs(iph.frag_off) & IP_CE)        printk("CE ");    if (ntohs(iph.frag_off) & IP_DF)        printk("DF ");    if (ntohs(iph.frag_off) & IP_MF)        printk("MF ");    /* Max length: 11 "FRAG:65535 " */    if (ntohs(iph.frag_off) & IP_OFFSET)        printk("FRAG:%u ", ntohs(iph.frag_off) & IP_OFFSET);    if ((info->logflags & IPT_LOG_IPOPT)            && iph.ihl * 4 != sizeof(struct iphdr)) {        unsigned char opt[4 * 15 - sizeof(struct iphdr)];        unsigned int i, optsize;        optsize = iph.ihl * 4 - sizeof(struct iphdr);        if (skb_copy_bits(skb, iphoff+sizeof(iph), opt, optsize) < 0) {            printk("TRUNCATED");            return;        }        /* Max length: 127 "OPT (" 15*4*2chars ") " */        printk("OPT (");        for (i = 0; i < optsize; i++)            printk("%02X", opt[i]);        printk(") ");    }    switch (iph.protocol) {    case IPPROTO_TCP: {        struct tcphdr tcph;        /* Max length: 10 "PROTO=TCP " */        printk("PROTO=TCP ");        if (ntohs(iph.frag_off) & IP_OFFSET)            break;        /* Max length: 25 "INCOMPLETE [65535 bytes] " */        if (skb_copy_bits(skb, iphoff+iph.ihl*4, &tcph, sizeof(tcph))                < 0) {            printk("INCOMPLETE [%u bytes] ",                   skb->len - iphoff - iph.ihl*4);            break;        }        /* Max length: 20 "SPT=65535 DPT=65535 " */        printk("SPT=%u DPT=%u ",               ntohs(tcph.source), ntohs(tcph.dest));        /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */        if (info->logflags & IPT_LOG_TCPSEQ)            printk("SEQ=%u ACK=%u ",                   ntohl(tcph.seq), ntohl(tcph.ack_seq));        /* Max length: 13 "WINDOW=65535 " */        printk("WINDOW=%u ", ntohs(tcph.window));        /* Max length: 9 "RES=0x3F " */        printk("RES=0x%02x ", (u8)(ntohl(tcp_flag_word(&tcph) & TCP_RESERVED_BITS) >> 22));        /* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */        if (tcph.cwr)            printk("CWR ");        if (tcph.ece)            printk("ECE ");        if (tcph.urg)            printk("URG ");        if (tcph.ack)            printk("ACK ");        if (tcph.psh)            printk("PSH ");        if (tcph.rst)            printk("RST ");        if (tcph.syn)            printk("SYN ");        if (tcph.fin)            printk("FIN ");        /* Max length: 11 "URGP=65535 " *///.........这里部分代码省略.........

//.........这里部分代码省略.........				return true;		} else {			/*			 * We are in the middle of a connection,			 * its history is lost for us.			 * Let's try to use the data from the packet.			 */			sender->td_end = end;			sender->td_maxwin = (win == 0 ? 1 : win);			sender->td_maxend = end + sender->td_maxwin;		}	} else if (((state->state == TCP_CONNTRACK_SYN_SENT		     && dir == IP_CT_DIR_ORIGINAL)		   || (state->state == TCP_CONNTRACK_SYN_RECV		     && dir == IP_CT_DIR_REPLY))		   && after(end, sender->td_end)) {		/*		 * RFC 793: "if a TCP is reinitialized ... then it need		 * not wait at all; it must only be sure to use sequence		 * numbers larger than those recently used."		 */		sender->td_end =		sender->td_maxend = end;		sender->td_maxwin = (win == 0 ? 1 : win);		tcp_options(skb, dataoff, tcph, sender);	}	if (!(tcph->ack)) {		/*		 * If there is no ACK, just pretend it was set and OK.		 */		ack = sack = receiver->td_end;	} else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==		    (TCP_FLAG_ACK|TCP_FLAG_RST))		   && (ack == 0)) {		/*		 * Broken TCP stacks, that set ACK in RST packets as well		 * with zero ack value.		 */		ack = sack = receiver->td_end;	}	if (seq == end	    && (!tcph->rst		|| (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))		/*		 * Packets contains no data: we assume it is valid		 * and check the ack value only.		 * However RST segments are always validated by their		 * SEQ number, except when seq == 0 (reset sent answering		 * SYN.		 */		seq = end = sender->td_end;	pr_debug("tcp_in_window: ");	nf_ct_dump_tuple(tuple);	pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u/n",		 seq, ack, receiver_offset, sack, receiver_offset, win, end);	pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "		 "receiver end=%u maxend=%u maxwin=%u scale=%i/n",		 sender->td_end, sender->td_maxend, sender->td_maxwin,		 sender->td_scale,		 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,		 receiver->td_scale);

//.........这里部分代码省略.........			break;		}		/* Max length: 20 "SPT=65535 DPT=65535 " */#if defined(AEI_LOG_FIREWALL_DROP)					snprintf(_tmpstr, sizeof(_tmpstr), "SPT=%u DPT=%u ",		       ntohs(th->source), ntohs(th->dest));					strcat(_logstr, _tmpstr);	#else		printk("SPT=%u DPT=%u ",		       ntohs(th->source), ntohs(th->dest));#endif		/* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */		if (logflags & IPT_LOG_TCPSEQ)#if defined(AEI_LOG_FIREWALL_DROP)		{			snprintf(_tmpstr, sizeof(_tmpstr), "SEQ=%u ACK=%u ",			       ntohl(th->seq), ntohl(th->ack_seq));			strcat(_logstr, _tmpstr);			}#else			printk("SEQ=%u ACK=%u ",			       ntohl(th->seq), ntohl(th->ack_seq));#endif		/* Max length: 13 "WINDOW=65535 " */#if defined(AEI_LOG_FIREWALL_DROP)		snprintf(_tmpstr, sizeof(_tmpstr), "WINDOW=%u ", ntohs(th->window));		strcat(_logstr, _tmpstr);	#else		printk("WINDOW=%u ", ntohs(th->window));#endif		/* Max length: 9 "RES=0x3F " */#if defined(AEI_LOG_FIREWALL_DROP)				snprintf(_tmpstr, sizeof(_tmpstr), "RES=0x%02x ", (u8)(ntohl(tcp_flag_word(th) & TCP_RESERVED_BITS) >> 22));		strcat(_logstr, _tmpstr);	#else		printk("RES=0x%02x ", (u8)(ntohl(tcp_flag_word(th) & TCP_RESERVED_BITS) >> 22));#endif		/* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */		if (th->cwr)#if defined(AEI_LOG_FIREWALL_DROP)			strcat(_logstr,"CWR ");#else			printk("CWR ");#endif		if (th->ece)#if defined(AEI_LOG_FIREWALL_DROP)			strcat(_logstr,"ECE ");#else			printk("ECE ");#endif		if (th->urg)#if defined(AEI_LOG_FIREWALL_DROP)			strcat(_logstr,"URG ");#else			printk("URG ");#endif		if (th->ack)#if defined(AEI_LOG_FIREWALL_DROP)			strcat(_logstr,"ACK ");#else			printk("ACK ");#endif		if (th->psh)#if defined(AEI_LOG_FIREWALL_DROP)			strcat(_logstr,"PSH ");