The TCP state transition table needs a few words

/*
 * The TCP state transition table needs a few words...
 *
 * We are the man in the middle. All the packets go through us
 * but might get lost in transit to the destination.
 * It is assumed that the destinations can't receive segments
 * we haven't seen.
 *
 * The checked segment is in window, but our windows are *not*
 * equivalent with the ones of the sender/receiver. We always
 * try to guess the state of the current sender.
 *
 * The meaning of the states are:
 *
 * NONE:        initial state
 * SYN_SENT:    SYN-only packet seen
 * SYN_RECV:    SYN-ACK packet seen
 * ESTABLISHED: ACK packet seen
 * FIN_WAIT:    FIN packet seen
 * CLOSE_WAIT:  ACK seen (after FIN)
 * LAST_ACK:    FIN seen (after FIN)
 * TIME_WAIT:   last ACK seen
 * CLOSE:       closed connection
 *
 * LISTEN state is not used.
 *
 * Packets marked as IGNORED (sIG):
 *      if they may be either invalid or valid
 *      and the receiver may send back a connection
 *      closing RST or a SYN/ACK.
 *
 * Packets marked as INVALID (sIV):
 *      if they are invalid
 *      or we do not support the request (simultaneous open)
 */

static enum tcp_conntrack tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
        {
/* ORIGINAL */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
/*syn*/ { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sIV },
/*
 * sNO -> sSS Initialize a new connection
 * sSS -> sSS Retransmitted SYN
 * sSR -> sIG Late retransmitted SYN?
 * sES -> sIG Error: SYNs in window outside the SYN_SENT state
 * are errors. Receiver will reply with RST
 * and close the connection.
 * Or we are not in sync and hold a dead connection.
 * sFW -> sIG
 * sCW -> sIG
 * sLA -> sIG
 * sTW -> sSS Reopened connection (RFC 1122).
 * sCL -> sSS
 */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
/*synack*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
/*
 * A SYN/ACK from the client is always invalid:
 * - either it tries to set up a simultaneous open, which is
 * not supported;
 * - or the firewall has just been inserted between the two hosts
 * during the session set-up. The SYN will be retransmitted
 * by the true client (or it'll time out).
 */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
/*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
/*
 * sNO -> sIV Too late and no reason to do anything...
 * sSS -> sIV Client migth not send FIN in this state:
 * we enforce waiting for a SYN/ACK reply first.
 * sSR -> sFW Close started.
 * sES -> sFW
 * sFW -> sLA FIN seen in both directions, waiting for
 * the last ACK.
 * Migth be a retransmitted FIN as well...
 * sCW -> sLA
 * sLA -> sLA Retransmitted FIN. Remain in the same state.
 * sTW -> sTW
 * sCL -> sCL
 */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
/*ack*/ { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
/*
 * sNO -> sES Assumed.
 * sSS -> sIV ACK is invalid: we haven't seen a SYN/ACK yet.
 * sSR -> sES Established state is reached.
 * sES -> sES :-)
 * sFW -> sCW Normal close request answered by ACK.
 * sCW -> sCW
 * sLA -> sTW Last ACK detected.
 * sTW -> sTW Retransmitted last ACK. Remain in the same state.
 * sCL -> sCL
 */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
/*rst*/ { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
/*none*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
        },
        {
/* REPLY */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
/*syn*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV },
/*
 * sNO -> sIV Never reached.
 * sSS -> sIV Simultaneous open, not supported
 * sSR -> sIV Simultaneous open, not supported.
 * sES -> sIV Server may not initiate a connection.
 * sFW -> sIV
 * sCW -> sIV
 * sLA -> sIV
 * sTW -> sIV Reopened connection, but server may not do it.
 * sCL -> sIV
 */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
/*synack*/ { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sIV },
/*
 * sSS -> sSR Standard open.
 * sSR -> sSR Retransmitted SYN/ACK.
 * sES -> sIG Late retransmitted SYN/ACK?
 * sFW -> sIG Might be SYN/ACK answering ignored SYN
 * sCW -> sIG
 * sLA -> sIG
 * sTW -> sIG
 * sCL -> sIG
 */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
/*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
/*
 * sSS -> sIV Server might not send FIN in this state.
 * sSR -> sFW Close started.
 * sES -> sFW
 * sFW -> sLA FIN seen in both directions.
 * sCW -> sLA
 * sLA -> sLA Retransmitted FIN.
 * sTW -> sTW
 * sCL -> sCL
 */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
/*ack*/ { sIV, sIV, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
/*
 * sSS -> sIV Might be a half-open connection.
 * sSR -> sSR Might answer late resent SYN.
 * sES -> sES :-)
 * sFW -> sCW Normal close request answered by ACK.
 * sCW -> sCW
 * sLA -> sTW Last ACK detected.
 * sTW -> sTW Retransmitted last ACK.
 * sCL -> sCL
 */
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI */
/*rst*/ { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV },
/*none*/ { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
        }
};