nf_conntrack_proto_sctp.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719
  1. /*
  2. * Connection tracking protocol helper module for SCTP.
  3. *
  4. * SCTP is defined in RFC 2960. References to various sections in this code
  5. * are to this RFC.
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License version 2 as
  9. * published by the Free Software Foundation.
  10. *
  11. * 17 Oct 2004: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
  12. * - enable working with L3 protocol independent connection tracking.
  13. *
  14. * Derived from net/ipv4/ip_conntrack_sctp.c
  15. */
  16. /*
  17. * Added support for proc manipulation of timeouts.
  18. */
  19. #include <linux/types.h>
  20. #include <linux/timer.h>
  21. #include <linux/netfilter.h>
  22. #include <linux/module.h>
  23. #include <linux/in.h>
  24. #include <linux/ip.h>
  25. #include <linux/sctp.h>
  26. #include <linux/string.h>
  27. #include <linux/seq_file.h>
  28. #include <linux/spinlock.h>
  29. #include <linux/interrupt.h>
  30. #include <net/netfilter/nf_conntrack.h>
  31. #include <net/netfilter/nf_conntrack_l4proto.h>
  32. #include <net/netfilter/nf_conntrack_ecache.h>
  33. #if 0
  34. #define DEBUGP(format, ...) printk(format, ## __VA_ARGS__)
  35. #else
  36. #define DEBUGP(format, args...)
  37. #endif
  38. /* Protects conntrack->proto.sctp */
  39. static DEFINE_RWLOCK(sctp_lock);
  40. /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
  41. closely. They're more complex. --RR
  42. And so for me for SCTP :D -Kiran */
  43. static const char *sctp_conntrack_names[] = {
  44. "NONE",
  45. "CLOSED",
  46. "COOKIE_WAIT",
  47. "COOKIE_ECHOED",
  48. "ESTABLISHED",
  49. "SHUTDOWN_SENT",
  50. "SHUTDOWN_RECD",
  51. "SHUTDOWN_ACK_SENT",
  52. };
  53. #define SECS * HZ
  54. #define MINS * 60 SECS
  55. #define HOURS * 60 MINS
  56. #define DAYS * 24 HOURS
  57. static unsigned int nf_ct_sctp_timeout_closed __read_mostly = 10 SECS;
  58. static unsigned int nf_ct_sctp_timeout_cookie_wait __read_mostly = 3 SECS;
  59. static unsigned int nf_ct_sctp_timeout_cookie_echoed __read_mostly = 3 SECS;
  60. static unsigned int nf_ct_sctp_timeout_established __read_mostly = 5 DAYS;
  61. static unsigned int nf_ct_sctp_timeout_shutdown_sent __read_mostly = 300 SECS / 1000;
  62. static unsigned int nf_ct_sctp_timeout_shutdown_recd __read_mostly = 300 SECS / 1000;
  63. static unsigned int nf_ct_sctp_timeout_shutdown_ack_sent __read_mostly = 3 SECS;
  64. static unsigned int * sctp_timeouts[]
  65. = { NULL, /* SCTP_CONNTRACK_NONE */
  66. &nf_ct_sctp_timeout_closed, /* SCTP_CONNTRACK_CLOSED */
  67. &nf_ct_sctp_timeout_cookie_wait, /* SCTP_CONNTRACK_COOKIE_WAIT */
  68. &nf_ct_sctp_timeout_cookie_echoed, /* SCTP_CONNTRACK_COOKIE_ECHOED */
  69. &nf_ct_sctp_timeout_established, /* SCTP_CONNTRACK_ESTABLISHED */
  70. &nf_ct_sctp_timeout_shutdown_sent, /* SCTP_CONNTRACK_SHUTDOWN_SENT */
  71. &nf_ct_sctp_timeout_shutdown_recd, /* SCTP_CONNTRACK_SHUTDOWN_RECD */
  72. &nf_ct_sctp_timeout_shutdown_ack_sent /* SCTP_CONNTRACK_SHUTDOWN_ACK_SENT */
  73. };
  74. #define sNO SCTP_CONNTRACK_NONE
  75. #define sCL SCTP_CONNTRACK_CLOSED
  76. #define sCW SCTP_CONNTRACK_COOKIE_WAIT
  77. #define sCE SCTP_CONNTRACK_COOKIE_ECHOED
  78. #define sES SCTP_CONNTRACK_ESTABLISHED
  79. #define sSS SCTP_CONNTRACK_SHUTDOWN_SENT
  80. #define sSR SCTP_CONNTRACK_SHUTDOWN_RECD
  81. #define sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
  82. #define sIV SCTP_CONNTRACK_MAX
  83. /*
  84. These are the descriptions of the states:
  85. NOTE: These state names are tantalizingly similar to the states of an
  86. SCTP endpoint. But the interpretation of the states is a little different,
  87. considering that these are the states of the connection and not of an end
  88. point. Please note the subtleties. -Kiran
  89. NONE - Nothing so far.
  90. COOKIE WAIT - We have seen an INIT chunk in the original direction, or also
  91. an INIT_ACK chunk in the reply direction.
  92. COOKIE ECHOED - We have seen a COOKIE_ECHO chunk in the original direction.
  93. ESTABLISHED - We have seen a COOKIE_ACK in the reply direction.
  94. SHUTDOWN_SENT - We have seen a SHUTDOWN chunk in the original direction.
  95. SHUTDOWN_RECD - We have seen a SHUTDOWN chunk in the reply directoin.
  96. SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
  97. to that of the SHUTDOWN chunk.
  98. CLOSED - We have seen a SHUTDOWN_COMPLETE chunk in the direction of
  99. the SHUTDOWN chunk. Connection is closed.
  100. */
  101. /* TODO
  102. - I have assumed that the first INIT is in the original direction.
  103. This messes things when an INIT comes in the reply direction in CLOSED
  104. state.
  105. - Check the error type in the reply dir before transitioning from
  106. cookie echoed to closed.
  107. - Sec 5.2.4 of RFC 2960
  108. - Multi Homing support.
  109. */
  110. /* SCTP conntrack state transitions */
  111. static enum sctp_conntrack sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
  112. {
  113. /* ORIGINAL */
  114. /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
  115. /* init */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA},
  116. /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},
  117. /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
  118. /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA},
  119. /* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA},
  120. /* error */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant have Stale cookie*/
  121. /* cookie_echo */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA},/* 5.2.4 - Big TODO */
  122. /* cookie_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in orig dir */
  123. /* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL}
  124. },
  125. {
  126. /* REPLY */
  127. /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
  128. /* init */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* INIT in sCL Big TODO */
  129. /* init_ack */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},
  130. /* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
  131. /* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA},
  132. /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA},
  133. /* error */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA},
  134. /* cookie_echo */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in reply dir */
  135. /* cookie_ack */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA},
  136. /* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL}
  137. }
  138. };
  139. static int sctp_pkt_to_tuple(const struct sk_buff *skb,
  140. unsigned int dataoff,
  141. struct nf_conntrack_tuple *tuple)
  142. {
  143. sctp_sctphdr_t _hdr, *hp;
  144. DEBUGP(__FUNCTION__);
  145. DEBUGP("\n");
  146. /* Actually only need first 8 bytes. */
  147. hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
  148. if (hp == NULL)
  149. return 0;
  150. tuple->src.u.sctp.port = hp->source;
  151. tuple->dst.u.sctp.port = hp->dest;
  152. return 1;
  153. }
  154. static int sctp_invert_tuple(struct nf_conntrack_tuple *tuple,
  155. const struct nf_conntrack_tuple *orig)
  156. {
  157. DEBUGP(__FUNCTION__);
  158. DEBUGP("\n");
  159. tuple->src.u.sctp.port = orig->dst.u.sctp.port;
  160. tuple->dst.u.sctp.port = orig->src.u.sctp.port;
  161. return 1;
  162. }
  163. /* Print out the per-protocol part of the tuple. */
  164. static int sctp_print_tuple(struct seq_file *s,
  165. const struct nf_conntrack_tuple *tuple)
  166. {
  167. DEBUGP(__FUNCTION__);
  168. DEBUGP("\n");
  169. return seq_printf(s, "sport=%hu dport=%hu ",
  170. ntohs(tuple->src.u.sctp.port),
  171. ntohs(tuple->dst.u.sctp.port));
  172. }
  173. /* Print out the private part of the conntrack. */
  174. static int sctp_print_conntrack(struct seq_file *s,
  175. const struct nf_conn *conntrack)
  176. {
  177. enum sctp_conntrack state;
  178. DEBUGP(__FUNCTION__);
  179. DEBUGP("\n");
  180. read_lock_bh(&sctp_lock);
  181. state = conntrack->proto.sctp.state;
  182. read_unlock_bh(&sctp_lock);
  183. return seq_printf(s, "%s ", sctp_conntrack_names[state]);
  184. }
  185. #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count) \
  186. for (offset = dataoff + sizeof(sctp_sctphdr_t), count = 0; \
  187. offset < skb->len && \
  188. (sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch)); \
  189. offset += (ntohs(sch->length) + 3) & ~3, count++)
  190. /* Some validity checks to make sure the chunks are fine */
  191. static int do_basic_checks(struct nf_conn *conntrack,
  192. const struct sk_buff *skb,
  193. unsigned int dataoff,
  194. char *map)
  195. {
  196. u_int32_t offset, count;
  197. sctp_chunkhdr_t _sch, *sch;
  198. int flag;
  199. DEBUGP(__FUNCTION__);
  200. DEBUGP("\n");
  201. flag = 0;
  202. for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
  203. DEBUGP("Chunk Num: %d Type: %d\n", count, sch->type);
  204. if (sch->type == SCTP_CID_INIT
  205. || sch->type == SCTP_CID_INIT_ACK
  206. || sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
  207. flag = 1;
  208. }
  209. /*
  210. * Cookie Ack/Echo chunks not the first OR
  211. * Init / Init Ack / Shutdown compl chunks not the only chunks
  212. * OR zero-length.
  213. */
  214. if (((sch->type == SCTP_CID_COOKIE_ACK
  215. || sch->type == SCTP_CID_COOKIE_ECHO
  216. || flag)
  217. && count !=0) || !sch->length) {
  218. DEBUGP("Basic checks failed\n");
  219. return 1;
  220. }
  221. if (map) {
  222. set_bit(sch->type, (void *)map);
  223. }
  224. }
  225. DEBUGP("Basic checks passed\n");
  226. return count == 0;
  227. }
  228. static int new_state(enum ip_conntrack_dir dir,
  229. enum sctp_conntrack cur_state,
  230. int chunk_type)
  231. {
  232. int i;
  233. DEBUGP(__FUNCTION__);
  234. DEBUGP("\n");
  235. DEBUGP("Chunk type: %d\n", chunk_type);
  236. switch (chunk_type) {
  237. case SCTP_CID_INIT:
  238. DEBUGP("SCTP_CID_INIT\n");
  239. i = 0; break;
  240. case SCTP_CID_INIT_ACK:
  241. DEBUGP("SCTP_CID_INIT_ACK\n");
  242. i = 1; break;
  243. case SCTP_CID_ABORT:
  244. DEBUGP("SCTP_CID_ABORT\n");
  245. i = 2; break;
  246. case SCTP_CID_SHUTDOWN:
  247. DEBUGP("SCTP_CID_SHUTDOWN\n");
  248. i = 3; break;
  249. case SCTP_CID_SHUTDOWN_ACK:
  250. DEBUGP("SCTP_CID_SHUTDOWN_ACK\n");
  251. i = 4; break;
  252. case SCTP_CID_ERROR:
  253. DEBUGP("SCTP_CID_ERROR\n");
  254. i = 5; break;
  255. case SCTP_CID_COOKIE_ECHO:
  256. DEBUGP("SCTP_CID_COOKIE_ECHO\n");
  257. i = 6; break;
  258. case SCTP_CID_COOKIE_ACK:
  259. DEBUGP("SCTP_CID_COOKIE_ACK\n");
  260. i = 7; break;
  261. case SCTP_CID_SHUTDOWN_COMPLETE:
  262. DEBUGP("SCTP_CID_SHUTDOWN_COMPLETE\n");
  263. i = 8; break;
  264. default:
  265. /* Other chunks like DATA, SACK, HEARTBEAT and
  266. its ACK do not cause a change in state */
  267. DEBUGP("Unknown chunk type, Will stay in %s\n",
  268. sctp_conntrack_names[cur_state]);
  269. return cur_state;
  270. }
  271. DEBUGP("dir: %d cur_state: %s chunk_type: %d new_state: %s\n",
  272. dir, sctp_conntrack_names[cur_state], chunk_type,
  273. sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);
  274. return sctp_conntracks[dir][i][cur_state];
  275. }
  276. /* Returns verdict for packet, or -1 for invalid. */
  277. static int sctp_packet(struct nf_conn *conntrack,
  278. const struct sk_buff *skb,
  279. unsigned int dataoff,
  280. enum ip_conntrack_info ctinfo,
  281. int pf,
  282. unsigned int hooknum)
  283. {
  284. enum sctp_conntrack newconntrack, oldsctpstate;
  285. sctp_sctphdr_t _sctph, *sh;
  286. sctp_chunkhdr_t _sch, *sch;
  287. u_int32_t offset, count;
  288. char map[256 / sizeof (char)] = {0};
  289. DEBUGP(__FUNCTION__);
  290. DEBUGP("\n");
  291. sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
  292. if (sh == NULL)
  293. return -1;
  294. if (do_basic_checks(conntrack, skb, dataoff, map) != 0)
  295. return -1;
  296. /* Check the verification tag (Sec 8.5) */
  297. if (!test_bit(SCTP_CID_INIT, (void *)map)
  298. && !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, (void *)map)
  299. && !test_bit(SCTP_CID_COOKIE_ECHO, (void *)map)
  300. && !test_bit(SCTP_CID_ABORT, (void *)map)
  301. && !test_bit(SCTP_CID_SHUTDOWN_ACK, (void *)map)
  302. && (sh->vtag != conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
  303. DEBUGP("Verification tag check failed\n");
  304. return -1;
  305. }
  306. oldsctpstate = newconntrack = SCTP_CONNTRACK_MAX;
  307. for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
  308. write_lock_bh(&sctp_lock);
  309. /* Special cases of Verification tag check (Sec 8.5.1) */
  310. if (sch->type == SCTP_CID_INIT) {
  311. /* Sec 8.5.1 (A) */
  312. if (sh->vtag != 0) {
  313. write_unlock_bh(&sctp_lock);
  314. return -1;
  315. }
  316. } else if (sch->type == SCTP_CID_ABORT) {
  317. /* Sec 8.5.1 (B) */
  318. if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
  319. && !(sh->vtag == conntrack->proto.sctp.vtag
  320. [1 - CTINFO2DIR(ctinfo)])) {
  321. write_unlock_bh(&sctp_lock);
  322. return -1;
  323. }
  324. } else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
  325. /* Sec 8.5.1 (C) */
  326. if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
  327. && !(sh->vtag == conntrack->proto.sctp.vtag
  328. [1 - CTINFO2DIR(ctinfo)]
  329. && (sch->flags & 1))) {
  330. write_unlock_bh(&sctp_lock);
  331. return -1;
  332. }
  333. } else if (sch->type == SCTP_CID_COOKIE_ECHO) {
  334. /* Sec 8.5.1 (D) */
  335. if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
  336. write_unlock_bh(&sctp_lock);
  337. return -1;
  338. }
  339. }
  340. oldsctpstate = conntrack->proto.sctp.state;
  341. newconntrack = new_state(CTINFO2DIR(ctinfo), oldsctpstate, sch->type);
  342. /* Invalid */
  343. if (newconntrack == SCTP_CONNTRACK_MAX) {
  344. DEBUGP("nf_conntrack_sctp: Invalid dir=%i ctype=%u conntrack=%u\n",
  345. CTINFO2DIR(ctinfo), sch->type, oldsctpstate);
  346. write_unlock_bh(&sctp_lock);
  347. return -1;
  348. }
  349. /* If it is an INIT or an INIT ACK note down the vtag */
  350. if (sch->type == SCTP_CID_INIT
  351. || sch->type == SCTP_CID_INIT_ACK) {
  352. sctp_inithdr_t _inithdr, *ih;
  353. ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
  354. sizeof(_inithdr), &_inithdr);
  355. if (ih == NULL) {
  356. write_unlock_bh(&sctp_lock);
  357. return -1;
  358. }
  359. DEBUGP("Setting vtag %x for dir %d\n",
  360. ih->init_tag, !CTINFO2DIR(ctinfo));
  361. conntrack->proto.sctp.vtag[!CTINFO2DIR(ctinfo)] = ih->init_tag;
  362. }
  363. conntrack->proto.sctp.state = newconntrack;
  364. if (oldsctpstate != newconntrack)
  365. nf_conntrack_event_cache(IPCT_PROTOINFO, skb);
  366. write_unlock_bh(&sctp_lock);
  367. }
  368. nf_ct_refresh_acct(conntrack, ctinfo, skb, *sctp_timeouts[newconntrack]);
  369. if (oldsctpstate == SCTP_CONNTRACK_COOKIE_ECHOED
  370. && CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY
  371. && newconntrack == SCTP_CONNTRACK_ESTABLISHED) {
  372. DEBUGP("Setting assured bit\n");
  373. set_bit(IPS_ASSURED_BIT, &conntrack->status);
  374. nf_conntrack_event_cache(IPCT_STATUS, skb);
  375. }
  376. return NF_ACCEPT;
  377. }
  378. /* Called when a new connection for this protocol found. */
  379. static int sctp_new(struct nf_conn *conntrack, const struct sk_buff *skb,
  380. unsigned int dataoff)
  381. {
  382. enum sctp_conntrack newconntrack;
  383. sctp_sctphdr_t _sctph, *sh;
  384. sctp_chunkhdr_t _sch, *sch;
  385. u_int32_t offset, count;
  386. char map[256 / sizeof (char)] = {0};
  387. DEBUGP(__FUNCTION__);
  388. DEBUGP("\n");
  389. sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
  390. if (sh == NULL)
  391. return 0;
  392. if (do_basic_checks(conntrack, skb, dataoff, map) != 0)
  393. return 0;
  394. /* If an OOTB packet has any of these chunks discard (Sec 8.4) */
  395. if ((test_bit (SCTP_CID_ABORT, (void *)map))
  396. || (test_bit (SCTP_CID_SHUTDOWN_COMPLETE, (void *)map))
  397. || (test_bit (SCTP_CID_COOKIE_ACK, (void *)map))) {
  398. return 0;
  399. }
  400. newconntrack = SCTP_CONNTRACK_MAX;
  401. for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
  402. /* Don't need lock here: this conntrack not in circulation yet */
  403. newconntrack = new_state(IP_CT_DIR_ORIGINAL,
  404. SCTP_CONNTRACK_NONE, sch->type);
  405. /* Invalid: delete conntrack */
  406. if (newconntrack == SCTP_CONNTRACK_NONE ||
  407. newconntrack == SCTP_CONNTRACK_MAX) {
  408. DEBUGP("nf_conntrack_sctp: invalid new deleting.\n");
  409. return 0;
  410. }
  411. /* Copy the vtag into the state info */
  412. if (sch->type == SCTP_CID_INIT) {
  413. if (sh->vtag == 0) {
  414. sctp_inithdr_t _inithdr, *ih;
  415. ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
  416. sizeof(_inithdr), &_inithdr);
  417. if (ih == NULL)
  418. return 0;
  419. DEBUGP("Setting vtag %x for new conn\n",
  420. ih->init_tag);
  421. conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] =
  422. ih->init_tag;
  423. } else {
  424. /* Sec 8.5.1 (A) */
  425. return 0;
  426. }
  427. }
  428. /* If it is a shutdown ack OOTB packet, we expect a return
  429. shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
  430. else {
  431. DEBUGP("Setting vtag %x for new conn OOTB\n",
  432. sh->vtag);
  433. conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
  434. }
  435. conntrack->proto.sctp.state = newconntrack;
  436. }
  437. return 1;
  438. }
  439. #ifdef CONFIG_SYSCTL
  440. static unsigned int sctp_sysctl_table_users;
  441. static struct ctl_table_header *sctp_sysctl_header;
  442. static struct ctl_table sctp_sysctl_table[] = {
  443. {
  444. .ctl_name = NET_NF_CONNTRACK_SCTP_TIMEOUT_CLOSED,
  445. .procname = "nf_conntrack_sctp_timeout_closed",
  446. .data = &nf_ct_sctp_timeout_closed,
  447. .maxlen = sizeof(unsigned int),
  448. .mode = 0644,
  449. .proc_handler = &proc_dointvec_jiffies,
  450. },
  451. {
  452. .ctl_name = NET_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_WAIT,
  453. .procname = "nf_conntrack_sctp_timeout_cookie_wait",
  454. .data = &nf_ct_sctp_timeout_cookie_wait,
  455. .maxlen = sizeof(unsigned int),
  456. .mode = 0644,
  457. .proc_handler = &proc_dointvec_jiffies,
  458. },
  459. {
  460. .ctl_name = NET_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_ECHOED,
  461. .procname = "nf_conntrack_sctp_timeout_cookie_echoed",
  462. .data = &nf_ct_sctp_timeout_cookie_echoed,
  463. .maxlen = sizeof(unsigned int),
  464. .mode = 0644,
  465. .proc_handler = &proc_dointvec_jiffies,
  466. },
  467. {
  468. .ctl_name = NET_NF_CONNTRACK_SCTP_TIMEOUT_ESTABLISHED,
  469. .procname = "nf_conntrack_sctp_timeout_established",
  470. .data = &nf_ct_sctp_timeout_established,
  471. .maxlen = sizeof(unsigned int),
  472. .mode = 0644,
  473. .proc_handler = &proc_dointvec_jiffies,
  474. },
  475. {
  476. .ctl_name = NET_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_SENT,
  477. .procname = "nf_conntrack_sctp_timeout_shutdown_sent",
  478. .data = &nf_ct_sctp_timeout_shutdown_sent,
  479. .maxlen = sizeof(unsigned int),
  480. .mode = 0644,
  481. .proc_handler = &proc_dointvec_jiffies,
  482. },
  483. {
  484. .ctl_name = NET_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_RECD,
  485. .procname = "nf_conntrack_sctp_timeout_shutdown_recd",
  486. .data = &nf_ct_sctp_timeout_shutdown_recd,
  487. .maxlen = sizeof(unsigned int),
  488. .mode = 0644,
  489. .proc_handler = &proc_dointvec_jiffies,
  490. },
  491. {
  492. .ctl_name = NET_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_ACK_SENT,
  493. .procname = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
  494. .data = &nf_ct_sctp_timeout_shutdown_ack_sent,
  495. .maxlen = sizeof(unsigned int),
  496. .mode = 0644,
  497. .proc_handler = &proc_dointvec_jiffies,
  498. },
  499. {
  500. .ctl_name = 0
  501. }
  502. };
  503. #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
  504. static struct ctl_table sctp_compat_sysctl_table[] = {
  505. {
  506. .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_CLOSED,
  507. .procname = "ip_conntrack_sctp_timeout_closed",
  508. .data = &nf_ct_sctp_timeout_closed,
  509. .maxlen = sizeof(unsigned int),
  510. .mode = 0644,
  511. .proc_handler = &proc_dointvec_jiffies,
  512. },
  513. {
  514. .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_WAIT,
  515. .procname = "ip_conntrack_sctp_timeout_cookie_wait",
  516. .data = &nf_ct_sctp_timeout_cookie_wait,
  517. .maxlen = sizeof(unsigned int),
  518. .mode = 0644,
  519. .proc_handler = &proc_dointvec_jiffies,
  520. },
  521. {
  522. .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_ECHOED,
  523. .procname = "ip_conntrack_sctp_timeout_cookie_echoed",
  524. .data = &nf_ct_sctp_timeout_cookie_echoed,
  525. .maxlen = sizeof(unsigned int),
  526. .mode = 0644,
  527. .proc_handler = &proc_dointvec_jiffies,
  528. },
  529. {
  530. .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_ESTABLISHED,
  531. .procname = "ip_conntrack_sctp_timeout_established",
  532. .data = &nf_ct_sctp_timeout_established,
  533. .maxlen = sizeof(unsigned int),
  534. .mode = 0644,
  535. .proc_handler = &proc_dointvec_jiffies,
  536. },
  537. {
  538. .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_SENT,
  539. .procname = "ip_conntrack_sctp_timeout_shutdown_sent",
  540. .data = &nf_ct_sctp_timeout_shutdown_sent,
  541. .maxlen = sizeof(unsigned int),
  542. .mode = 0644,
  543. .proc_handler = &proc_dointvec_jiffies,
  544. },
  545. {
  546. .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_RECD,
  547. .procname = "ip_conntrack_sctp_timeout_shutdown_recd",
  548. .data = &nf_ct_sctp_timeout_shutdown_recd,
  549. .maxlen = sizeof(unsigned int),
  550. .mode = 0644,
  551. .proc_handler = &proc_dointvec_jiffies,
  552. },
  553. {
  554. .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_ACK_SENT,
  555. .procname = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
  556. .data = &nf_ct_sctp_timeout_shutdown_ack_sent,
  557. .maxlen = sizeof(unsigned int),
  558. .mode = 0644,
  559. .proc_handler = &proc_dointvec_jiffies,
  560. },
  561. {
  562. .ctl_name = 0
  563. }
  564. };
  565. #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
  566. #endif
  567. struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 = {
  568. .l3proto = PF_INET,
  569. .l4proto = IPPROTO_SCTP,
  570. .name = "sctp",
  571. .pkt_to_tuple = sctp_pkt_to_tuple,
  572. .invert_tuple = sctp_invert_tuple,
  573. .print_tuple = sctp_print_tuple,
  574. .print_conntrack = sctp_print_conntrack,
  575. .packet = sctp_packet,
  576. .new = sctp_new,
  577. .me = THIS_MODULE,
  578. #ifdef CONFIG_SYSCTL
  579. .ctl_table_users = &sctp_sysctl_table_users,
  580. .ctl_table_header = &sctp_sysctl_header,
  581. .ctl_table = sctp_sysctl_table,
  582. #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
  583. .ctl_compat_table = sctp_compat_sysctl_table,
  584. #endif
  585. #endif
  586. };
  587. struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 = {
  588. .l3proto = PF_INET6,
  589. .l4proto = IPPROTO_SCTP,
  590. .name = "sctp",
  591. .pkt_to_tuple = sctp_pkt_to_tuple,
  592. .invert_tuple = sctp_invert_tuple,
  593. .print_tuple = sctp_print_tuple,
  594. .print_conntrack = sctp_print_conntrack,
  595. .packet = sctp_packet,
  596. .new = sctp_new,
  597. .me = THIS_MODULE,
  598. #ifdef CONFIG_SYSCTL
  599. .ctl_table_users = &sctp_sysctl_table_users,
  600. .ctl_table_header = &sctp_sysctl_header,
  601. .ctl_table = sctp_sysctl_table,
  602. #endif
  603. };
  604. int __init nf_conntrack_proto_sctp_init(void)
  605. {
  606. int ret;
  607. ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp4);
  608. if (ret) {
  609. printk("nf_conntrack_l4proto_sctp4: protocol register failed\n");
  610. goto out;
  611. }
  612. ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp6);
  613. if (ret) {
  614. printk("nf_conntrack_l4proto_sctp6: protocol register failed\n");
  615. goto cleanup_sctp4;
  616. }
  617. return ret;
  618. cleanup_sctp4:
  619. nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
  620. out:
  621. DEBUGP("SCTP conntrack module loading %s\n",
  622. ret ? "failed": "succeeded");
  623. return ret;
  624. }
  625. void __exit nf_conntrack_proto_sctp_fini(void)
  626. {
  627. nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
  628. nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
  629. DEBUGP("SCTP conntrack module unloaded\n");
  630. }
  631. module_init(nf_conntrack_proto_sctp_init);
  632. module_exit(nf_conntrack_proto_sctp_fini);
  633. MODULE_LICENSE("GPL");
  634. MODULE_AUTHOR("Kiran Kumar Immidi");
  635. MODULE_DESCRIPTION("Netfilter connection tracking protocol helper for SCTP");
  636. MODULE_ALIAS("ip_conntrack_proto_sctp");