nf_conntrack_proto_dccp.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * DCCP connection tracking protocol helper
  4. *
  5. * Copyright (c) 2005, 2006, 2008 Patrick McHardy <kaber@trash.net>
  6. */
  7. #include <linux/kernel.h>
  8. #include <linux/init.h>
  9. #include <linux/sysctl.h>
  10. #include <linux/spinlock.h>
  11. #include <linux/skbuff.h>
  12. #include <linux/dccp.h>
  13. #include <linux/slab.h>
  14. #include <net/net_namespace.h>
  15. #include <net/netns/generic.h>
  16. #include <linux/netfilter/nfnetlink_conntrack.h>
  17. #include <net/netfilter/nf_conntrack.h>
  18. #include <net/netfilter/nf_conntrack_l4proto.h>
  19. #include <net/netfilter/nf_conntrack_ecache.h>
  20. #include <net/netfilter/nf_conntrack_timeout.h>
  21. #include <net/netfilter/nf_log.h>
  22. /* Timeouts are based on values from RFC4340:
  23. *
  24. * - REQUEST:
  25. *
  26. * 8.1.2. Client Request
  27. *
  28. * A client MAY give up on its DCCP-Requests after some time
  29. * (3 minutes, for example).
  30. *
  31. * - RESPOND:
  32. *
  33. * 8.1.3. Server Response
  34. *
  35. * It MAY also leave the RESPOND state for CLOSED after a timeout of
  36. * not less than 4MSL (8 minutes);
  37. *
  38. * - PARTOPEN:
  39. *
  40. * 8.1.5. Handshake Completion
  41. *
  42. * If the client remains in PARTOPEN for more than 4MSL (8 minutes),
  43. * it SHOULD reset the connection with Reset Code 2, "Aborted".
  44. *
  45. * - OPEN:
  46. *
  47. * The DCCP timestamp overflows after 11.9 hours. If the connection
  48. * stays idle this long the sequence number won't be recognized
  49. * as valid anymore.
  50. *
  51. * - CLOSEREQ/CLOSING:
  52. *
  53. * 8.3. Termination
  54. *
  55. * The retransmission timer should initially be set to go off in two
  56. * round-trip times and should back off to not less than once every
  57. * 64 seconds ...
  58. *
  59. * - TIMEWAIT:
  60. *
  61. * 4.3. States
  62. *
  63. * A server or client socket remains in this state for 2MSL (4 minutes)
  64. * after the connection has been town down, ...
  65. */
  66. #define DCCP_MSL (2 * 60 * HZ)
  67. static const char * const dccp_state_names[] = {
  68. [CT_DCCP_NONE] = "NONE",
  69. [CT_DCCP_REQUEST] = "REQUEST",
  70. [CT_DCCP_RESPOND] = "RESPOND",
  71. [CT_DCCP_PARTOPEN] = "PARTOPEN",
  72. [CT_DCCP_OPEN] = "OPEN",
  73. [CT_DCCP_CLOSEREQ] = "CLOSEREQ",
  74. [CT_DCCP_CLOSING] = "CLOSING",
  75. [CT_DCCP_TIMEWAIT] = "TIMEWAIT",
  76. [CT_DCCP_IGNORE] = "IGNORE",
  77. [CT_DCCP_INVALID] = "INVALID",
  78. };
  79. #define sNO CT_DCCP_NONE
  80. #define sRQ CT_DCCP_REQUEST
  81. #define sRS CT_DCCP_RESPOND
  82. #define sPO CT_DCCP_PARTOPEN
  83. #define sOP CT_DCCP_OPEN
  84. #define sCR CT_DCCP_CLOSEREQ
  85. #define sCG CT_DCCP_CLOSING
  86. #define sTW CT_DCCP_TIMEWAIT
  87. #define sIG CT_DCCP_IGNORE
  88. #define sIV CT_DCCP_INVALID
  89. /*
  90. * DCCP state transition table
  91. *
  92. * The assumption is the same as for TCP tracking:
  93. *
  94. * We are the man in the middle. All the packets go through us but might
  95. * get lost in transit to the destination. It is assumed that the destination
  96. * can't receive segments we haven't seen.
  97. *
  98. * The following states exist:
  99. *
  100. * NONE: Initial state, expecting Request
  101. * REQUEST: Request seen, waiting for Response from server
  102. * RESPOND: Response from server seen, waiting for Ack from client
  103. * PARTOPEN: Ack after Response seen, waiting for packet other than Response,
  104. * Reset or Sync from server
  105. * OPEN: Packet other than Response, Reset or Sync seen
  106. * CLOSEREQ: CloseReq from server seen, expecting Close from client
  107. * CLOSING: Close seen, expecting Reset
  108. * TIMEWAIT: Reset seen
  109. * IGNORE: Not determinable whether packet is valid
  110. *
  111. * Some states exist only on one side of the connection: REQUEST, RESPOND,
  112. * PARTOPEN, CLOSEREQ. For the other side these states are equivalent to
  113. * the one it was in before.
  114. *
  115. * Packets are marked as ignored (sIG) if we don't know if they're valid
  116. * (for example a reincarnation of a connection we didn't notice is dead
  117. * already) and the server may send back a connection closing Reset or a
  118. * Response. They're also used for Sync/SyncAck packets, which we don't
  119. * care about.
  120. */
  121. static const u_int8_t
  122. dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] = {
  123. [CT_DCCP_ROLE_CLIENT] = {
  124. [DCCP_PKT_REQUEST] = {
  125. /*
  126. * sNO -> sRQ Regular Request
  127. * sRQ -> sRQ Retransmitted Request or reincarnation
  128. * sRS -> sRS Retransmitted Request (apparently Response
  129. * got lost after we saw it) or reincarnation
  130. * sPO -> sIG Ignore, conntrack might be out of sync
  131. * sOP -> sIG Ignore, conntrack might be out of sync
  132. * sCR -> sIG Ignore, conntrack might be out of sync
  133. * sCG -> sIG Ignore, conntrack might be out of sync
  134. * sTW -> sRQ Reincarnation
  135. *
  136. * sNO, sRQ, sRS, sPO. sOP, sCR, sCG, sTW, */
  137. sRQ, sRQ, sRS, sIG, sIG, sIG, sIG, sRQ,
  138. },
  139. [DCCP_PKT_RESPONSE] = {
  140. /*
  141. * sNO -> sIV Invalid
  142. * sRQ -> sIG Ignore, might be response to ignored Request
  143. * sRS -> sIG Ignore, might be response to ignored Request
  144. * sPO -> sIG Ignore, might be response to ignored Request
  145. * sOP -> sIG Ignore, might be response to ignored Request
  146. * sCR -> sIG Ignore, might be response to ignored Request
  147. * sCG -> sIG Ignore, might be response to ignored Request
  148. * sTW -> sIV Invalid, reincarnation in reverse direction
  149. * goes through sRQ
  150. *
  151. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  152. sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIV,
  153. },
  154. [DCCP_PKT_ACK] = {
  155. /*
  156. * sNO -> sIV No connection
  157. * sRQ -> sIV No connection
  158. * sRS -> sPO Ack for Response, move to PARTOPEN (8.1.5.)
  159. * sPO -> sPO Retransmitted Ack for Response, remain in PARTOPEN
  160. * sOP -> sOP Regular ACK, remain in OPEN
  161. * sCR -> sCR Ack in CLOSEREQ MAY be processed (8.3.)
  162. * sCG -> sCG Ack in CLOSING MAY be processed (8.3.)
  163. * sTW -> sIV
  164. *
  165. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  166. sIV, sIV, sPO, sPO, sOP, sCR, sCG, sIV
  167. },
  168. [DCCP_PKT_DATA] = {
  169. /*
  170. * sNO -> sIV No connection
  171. * sRQ -> sIV No connection
  172. * sRS -> sIV No connection
  173. * sPO -> sIV MUST use DataAck in PARTOPEN state (8.1.5.)
  174. * sOP -> sOP Regular Data packet
  175. * sCR -> sCR Data in CLOSEREQ MAY be processed (8.3.)
  176. * sCG -> sCG Data in CLOSING MAY be processed (8.3.)
  177. * sTW -> sIV
  178. *
  179. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  180. sIV, sIV, sIV, sIV, sOP, sCR, sCG, sIV,
  181. },
  182. [DCCP_PKT_DATAACK] = {
  183. /*
  184. * sNO -> sIV No connection
  185. * sRQ -> sIV No connection
  186. * sRS -> sPO Ack for Response, move to PARTOPEN (8.1.5.)
  187. * sPO -> sPO Remain in PARTOPEN state
  188. * sOP -> sOP Regular DataAck packet in OPEN state
  189. * sCR -> sCR DataAck in CLOSEREQ MAY be processed (8.3.)
  190. * sCG -> sCG DataAck in CLOSING MAY be processed (8.3.)
  191. * sTW -> sIV
  192. *
  193. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  194. sIV, sIV, sPO, sPO, sOP, sCR, sCG, sIV
  195. },
  196. [DCCP_PKT_CLOSEREQ] = {
  197. /*
  198. * CLOSEREQ may only be sent by the server.
  199. *
  200. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  201. sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV
  202. },
  203. [DCCP_PKT_CLOSE] = {
  204. /*
  205. * sNO -> sIV No connection
  206. * sRQ -> sIV No connection
  207. * sRS -> sIV No connection
  208. * sPO -> sCG Client-initiated close
  209. * sOP -> sCG Client-initiated close
  210. * sCR -> sCG Close in response to CloseReq (8.3.)
  211. * sCG -> sCG Retransmit
  212. * sTW -> sIV Late retransmit, already in TIME_WAIT
  213. *
  214. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  215. sIV, sIV, sIV, sCG, sCG, sCG, sIV, sIV
  216. },
  217. [DCCP_PKT_RESET] = {
  218. /*
  219. * sNO -> sIV No connection
  220. * sRQ -> sTW Sync received or timeout, SHOULD send Reset (8.1.1.)
  221. * sRS -> sTW Response received without Request
  222. * sPO -> sTW Timeout, SHOULD send Reset (8.1.5.)
  223. * sOP -> sTW Connection reset
  224. * sCR -> sTW Connection reset
  225. * sCG -> sTW Connection reset
  226. * sTW -> sIG Ignore (don't refresh timer)
  227. *
  228. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  229. sIV, sTW, sTW, sTW, sTW, sTW, sTW, sIG
  230. },
  231. [DCCP_PKT_SYNC] = {
  232. /*
  233. * We currently ignore Sync packets
  234. *
  235. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  236. sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
  237. },
  238. [DCCP_PKT_SYNCACK] = {
  239. /*
  240. * We currently ignore SyncAck packets
  241. *
  242. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  243. sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
  244. },
  245. },
  246. [CT_DCCP_ROLE_SERVER] = {
  247. [DCCP_PKT_REQUEST] = {
  248. /*
  249. * sNO -> sIV Invalid
  250. * sRQ -> sIG Ignore, conntrack might be out of sync
  251. * sRS -> sIG Ignore, conntrack might be out of sync
  252. * sPO -> sIG Ignore, conntrack might be out of sync
  253. * sOP -> sIG Ignore, conntrack might be out of sync
  254. * sCR -> sIG Ignore, conntrack might be out of sync
  255. * sCG -> sIG Ignore, conntrack might be out of sync
  256. * sTW -> sRQ Reincarnation, must reverse roles
  257. *
  258. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  259. sIV, sIG, sIG, sIG, sIG, sIG, sIG, sRQ
  260. },
  261. [DCCP_PKT_RESPONSE] = {
  262. /*
  263. * sNO -> sIV Response without Request
  264. * sRQ -> sRS Response to clients Request
  265. * sRS -> sRS Retransmitted Response (8.1.3. SHOULD NOT)
  266. * sPO -> sIG Response to an ignored Request or late retransmit
  267. * sOP -> sIG Ignore, might be response to ignored Request
  268. * sCR -> sIG Ignore, might be response to ignored Request
  269. * sCG -> sIG Ignore, might be response to ignored Request
  270. * sTW -> sIV Invalid, Request from client in sTW moves to sRQ
  271. *
  272. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  273. sIV, sRS, sRS, sIG, sIG, sIG, sIG, sIV
  274. },
  275. [DCCP_PKT_ACK] = {
  276. /*
  277. * sNO -> sIV No connection
  278. * sRQ -> sIV No connection
  279. * sRS -> sIV No connection
  280. * sPO -> sOP Enter OPEN state (8.1.5.)
  281. * sOP -> sOP Regular Ack in OPEN state
  282. * sCR -> sIV Waiting for Close from client
  283. * sCG -> sCG Ack in CLOSING MAY be processed (8.3.)
  284. * sTW -> sIV
  285. *
  286. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  287. sIV, sIV, sIV, sOP, sOP, sIV, sCG, sIV
  288. },
  289. [DCCP_PKT_DATA] = {
  290. /*
  291. * sNO -> sIV No connection
  292. * sRQ -> sIV No connection
  293. * sRS -> sIV No connection
  294. * sPO -> sOP Enter OPEN state (8.1.5.)
  295. * sOP -> sOP Regular Data packet in OPEN state
  296. * sCR -> sIV Waiting for Close from client
  297. * sCG -> sCG Data in CLOSING MAY be processed (8.3.)
  298. * sTW -> sIV
  299. *
  300. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  301. sIV, sIV, sIV, sOP, sOP, sIV, sCG, sIV
  302. },
  303. [DCCP_PKT_DATAACK] = {
  304. /*
  305. * sNO -> sIV No connection
  306. * sRQ -> sIV No connection
  307. * sRS -> sIV No connection
  308. * sPO -> sOP Enter OPEN state (8.1.5.)
  309. * sOP -> sOP Regular DataAck in OPEN state
  310. * sCR -> sIV Waiting for Close from client
  311. * sCG -> sCG Data in CLOSING MAY be processed (8.3.)
  312. * sTW -> sIV
  313. *
  314. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  315. sIV, sIV, sIV, sOP, sOP, sIV, sCG, sIV
  316. },
  317. [DCCP_PKT_CLOSEREQ] = {
  318. /*
  319. * sNO -> sIV No connection
  320. * sRQ -> sIV No connection
  321. * sRS -> sIV No connection
  322. * sPO -> sOP -> sCR Move directly to CLOSEREQ (8.1.5.)
  323. * sOP -> sCR CloseReq in OPEN state
  324. * sCR -> sCR Retransmit
  325. * sCG -> sCR Simultaneous close, client sends another Close
  326. * sTW -> sIV Already closed
  327. *
  328. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  329. sIV, sIV, sIV, sCR, sCR, sCR, sCR, sIV
  330. },
  331. [DCCP_PKT_CLOSE] = {
  332. /*
  333. * sNO -> sIV No connection
  334. * sRQ -> sIV No connection
  335. * sRS -> sIV No connection
  336. * sPO -> sOP -> sCG Move direcly to CLOSING
  337. * sOP -> sCG Move to CLOSING
  338. * sCR -> sIV Close after CloseReq is invalid
  339. * sCG -> sCG Retransmit
  340. * sTW -> sIV Already closed
  341. *
  342. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  343. sIV, sIV, sIV, sCG, sCG, sIV, sCG, sIV
  344. },
  345. [DCCP_PKT_RESET] = {
  346. /*
  347. * sNO -> sIV No connection
  348. * sRQ -> sTW Reset in response to Request
  349. * sRS -> sTW Timeout, SHOULD send Reset (8.1.3.)
  350. * sPO -> sTW Timeout, SHOULD send Reset (8.1.3.)
  351. * sOP -> sTW
  352. * sCR -> sTW
  353. * sCG -> sTW
  354. * sTW -> sIG Ignore (don't refresh timer)
  355. *
  356. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW, sTW */
  357. sIV, sTW, sTW, sTW, sTW, sTW, sTW, sTW, sIG
  358. },
  359. [DCCP_PKT_SYNC] = {
  360. /*
  361. * We currently ignore Sync packets
  362. *
  363. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  364. sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
  365. },
  366. [DCCP_PKT_SYNCACK] = {
  367. /*
  368. * We currently ignore SyncAck packets
  369. *
  370. * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
  371. sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
  372. },
  373. },
  374. };
  375. static noinline bool
  376. dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
  377. const struct dccp_hdr *dh)
  378. {
  379. struct net *net = nf_ct_net(ct);
  380. struct nf_dccp_net *dn;
  381. const char *msg;
  382. u_int8_t state;
  383. state = dccp_state_table[CT_DCCP_ROLE_CLIENT][dh->dccph_type][CT_DCCP_NONE];
  384. switch (state) {
  385. default:
  386. dn = nf_dccp_pernet(net);
  387. if (dn->dccp_loose == 0) {
  388. msg = "not picking up existing connection ";
  389. goto out_invalid;
  390. }
  391. break;
  392. case CT_DCCP_REQUEST:
  393. break;
  394. case CT_DCCP_INVALID:
  395. msg = "invalid state transition ";
  396. goto out_invalid;
  397. }
  398. ct->proto.dccp.role[IP_CT_DIR_ORIGINAL] = CT_DCCP_ROLE_CLIENT;
  399. ct->proto.dccp.role[IP_CT_DIR_REPLY] = CT_DCCP_ROLE_SERVER;
  400. ct->proto.dccp.state = CT_DCCP_NONE;
  401. ct->proto.dccp.last_pkt = DCCP_PKT_REQUEST;
  402. ct->proto.dccp.last_dir = IP_CT_DIR_ORIGINAL;
  403. ct->proto.dccp.handshake_seq = 0;
  404. return true;
  405. out_invalid:
  406. nf_ct_l4proto_log_invalid(skb, ct, "%s", msg);
  407. return false;
  408. }
  409. static u64 dccp_ack_seq(const struct dccp_hdr *dh)
  410. {
  411. const struct dccp_hdr_ack_bits *dhack;
  412. dhack = (void *)dh + __dccp_basic_hdr_len(dh);
  413. return ((u64)ntohs(dhack->dccph_ack_nr_high) << 32) +
  414. ntohl(dhack->dccph_ack_nr_low);
  415. }
  416. static bool dccp_error(const struct dccp_hdr *dh,
  417. struct sk_buff *skb, unsigned int dataoff,
  418. const struct nf_hook_state *state)
  419. {
  420. unsigned int dccp_len = skb->len - dataoff;
  421. unsigned int cscov;
  422. const char *msg;
  423. if (dh->dccph_doff * 4 < sizeof(struct dccp_hdr) ||
  424. dh->dccph_doff * 4 > dccp_len) {
  425. msg = "nf_ct_dccp: truncated/malformed packet ";
  426. goto out_invalid;
  427. }
  428. cscov = dccp_len;
  429. if (dh->dccph_cscov) {
  430. cscov = (dh->dccph_cscov - 1) * 4;
  431. if (cscov > dccp_len) {
  432. msg = "nf_ct_dccp: bad checksum coverage ";
  433. goto out_invalid;
  434. }
  435. }
  436. if (state->hook == NF_INET_PRE_ROUTING &&
  437. state->net->ct.sysctl_checksum &&
  438. nf_checksum_partial(skb, state->hook, dataoff, cscov,
  439. IPPROTO_DCCP, state->pf)) {
  440. msg = "nf_ct_dccp: bad checksum ";
  441. goto out_invalid;
  442. }
  443. if (dh->dccph_type >= DCCP_PKT_INVALID) {
  444. msg = "nf_ct_dccp: reserved packet type ";
  445. goto out_invalid;
  446. }
  447. return false;
  448. out_invalid:
  449. nf_l4proto_log_invalid(skb, state->net, state->pf,
  450. IPPROTO_DCCP, "%s", msg);
  451. return true;
  452. }
  453. int nf_conntrack_dccp_packet(struct nf_conn *ct, struct sk_buff *skb,
  454. unsigned int dataoff,
  455. enum ip_conntrack_info ctinfo,
  456. const struct nf_hook_state *state)
  457. {
  458. enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
  459. struct dccp_hdr _dh, *dh;
  460. u_int8_t type, old_state, new_state;
  461. enum ct_dccp_roles role;
  462. unsigned int *timeouts;
  463. dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
  464. if (!dh)
  465. return NF_DROP;
  466. if (dccp_error(dh, skb, dataoff, state))
  467. return -NF_ACCEPT;
  468. type = dh->dccph_type;
  469. if (!nf_ct_is_confirmed(ct) && !dccp_new(ct, skb, dh))
  470. return -NF_ACCEPT;
  471. if (type == DCCP_PKT_RESET &&
  472. !test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
  473. /* Tear down connection immediately if only reply is a RESET */
  474. nf_ct_kill_acct(ct, ctinfo, skb);
  475. return NF_ACCEPT;
  476. }
  477. spin_lock_bh(&ct->lock);
  478. role = ct->proto.dccp.role[dir];
  479. old_state = ct->proto.dccp.state;
  480. new_state = dccp_state_table[role][type][old_state];
  481. switch (new_state) {
  482. case CT_DCCP_REQUEST:
  483. if (old_state == CT_DCCP_TIMEWAIT &&
  484. role == CT_DCCP_ROLE_SERVER) {
  485. /* Reincarnation in the reverse direction: reopen and
  486. * reverse client/server roles. */
  487. ct->proto.dccp.role[dir] = CT_DCCP_ROLE_CLIENT;
  488. ct->proto.dccp.role[!dir] = CT_DCCP_ROLE_SERVER;
  489. }
  490. break;
  491. case CT_DCCP_RESPOND:
  492. if (old_state == CT_DCCP_REQUEST)
  493. ct->proto.dccp.handshake_seq = dccp_hdr_seq(dh);
  494. break;
  495. case CT_DCCP_PARTOPEN:
  496. if (old_state == CT_DCCP_RESPOND &&
  497. type == DCCP_PKT_ACK &&
  498. dccp_ack_seq(dh) == ct->proto.dccp.handshake_seq)
  499. set_bit(IPS_ASSURED_BIT, &ct->status);
  500. break;
  501. case CT_DCCP_IGNORE:
  502. /*
  503. * Connection tracking might be out of sync, so we ignore
  504. * packets that might establish a new connection and resync
  505. * if the server responds with a valid Response.
  506. */
  507. if (ct->proto.dccp.last_dir == !dir &&
  508. ct->proto.dccp.last_pkt == DCCP_PKT_REQUEST &&
  509. type == DCCP_PKT_RESPONSE) {
  510. ct->proto.dccp.role[!dir] = CT_DCCP_ROLE_CLIENT;
  511. ct->proto.dccp.role[dir] = CT_DCCP_ROLE_SERVER;
  512. ct->proto.dccp.handshake_seq = dccp_hdr_seq(dh);
  513. new_state = CT_DCCP_RESPOND;
  514. break;
  515. }
  516. ct->proto.dccp.last_dir = dir;
  517. ct->proto.dccp.last_pkt = type;
  518. spin_unlock_bh(&ct->lock);
  519. nf_ct_l4proto_log_invalid(skb, ct, "%s", "invalid packet");
  520. return NF_ACCEPT;
  521. case CT_DCCP_INVALID:
  522. spin_unlock_bh(&ct->lock);
  523. nf_ct_l4proto_log_invalid(skb, ct, "%s", "invalid state transition");
  524. return -NF_ACCEPT;
  525. }
  526. ct->proto.dccp.last_dir = dir;
  527. ct->proto.dccp.last_pkt = type;
  528. ct->proto.dccp.state = new_state;
  529. spin_unlock_bh(&ct->lock);
  530. if (new_state != old_state)
  531. nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
  532. timeouts = nf_ct_timeout_lookup(ct);
  533. if (!timeouts)
  534. timeouts = nf_dccp_pernet(nf_ct_net(ct))->dccp_timeout;
  535. nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]);
  536. return NF_ACCEPT;
  537. }
  538. static bool dccp_can_early_drop(const struct nf_conn *ct)
  539. {
  540. switch (ct->proto.dccp.state) {
  541. case CT_DCCP_CLOSEREQ:
  542. case CT_DCCP_CLOSING:
  543. case CT_DCCP_TIMEWAIT:
  544. return true;
  545. default:
  546. break;
  547. }
  548. return false;
  549. }
  550. #ifdef CONFIG_NF_CONNTRACK_PROCFS
  551. static void dccp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
  552. {
  553. seq_printf(s, "%s ", dccp_state_names[ct->proto.dccp.state]);
  554. }
  555. #endif
  556. #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
  557. static int dccp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
  558. struct nf_conn *ct)
  559. {
  560. struct nlattr *nest_parms;
  561. spin_lock_bh(&ct->lock);
  562. nest_parms = nla_nest_start(skb, CTA_PROTOINFO_DCCP);
  563. if (!nest_parms)
  564. goto nla_put_failure;
  565. if (nla_put_u8(skb, CTA_PROTOINFO_DCCP_STATE, ct->proto.dccp.state) ||
  566. nla_put_u8(skb, CTA_PROTOINFO_DCCP_ROLE,
  567. ct->proto.dccp.role[IP_CT_DIR_ORIGINAL]) ||
  568. nla_put_be64(skb, CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ,
  569. cpu_to_be64(ct->proto.dccp.handshake_seq),
  570. CTA_PROTOINFO_DCCP_PAD))
  571. goto nla_put_failure;
  572. nla_nest_end(skb, nest_parms);
  573. spin_unlock_bh(&ct->lock);
  574. return 0;
  575. nla_put_failure:
  576. spin_unlock_bh(&ct->lock);
  577. return -1;
  578. }
  579. static const struct nla_policy dccp_nla_policy[CTA_PROTOINFO_DCCP_MAX + 1] = {
  580. [CTA_PROTOINFO_DCCP_STATE] = { .type = NLA_U8 },
  581. [CTA_PROTOINFO_DCCP_ROLE] = { .type = NLA_U8 },
  582. [CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ] = { .type = NLA_U64 },
  583. [CTA_PROTOINFO_DCCP_PAD] = { .type = NLA_UNSPEC },
  584. };
  585. #define DCCP_NLATTR_SIZE ( \
  586. NLA_ALIGN(NLA_HDRLEN + 1) + \
  587. NLA_ALIGN(NLA_HDRLEN + 1) + \
  588. NLA_ALIGN(NLA_HDRLEN + sizeof(u64)) + \
  589. NLA_ALIGN(NLA_HDRLEN + 0))
  590. static int nlattr_to_dccp(struct nlattr *cda[], struct nf_conn *ct)
  591. {
  592. struct nlattr *attr = cda[CTA_PROTOINFO_DCCP];
  593. struct nlattr *tb[CTA_PROTOINFO_DCCP_MAX + 1];
  594. int err;
  595. if (!attr)
  596. return 0;
  597. err = nla_parse_nested_deprecated(tb, CTA_PROTOINFO_DCCP_MAX, attr,
  598. dccp_nla_policy, NULL);
  599. if (err < 0)
  600. return err;
  601. if (!tb[CTA_PROTOINFO_DCCP_STATE] ||
  602. !tb[CTA_PROTOINFO_DCCP_ROLE] ||
  603. nla_get_u8(tb[CTA_PROTOINFO_DCCP_ROLE]) > CT_DCCP_ROLE_MAX ||
  604. nla_get_u8(tb[CTA_PROTOINFO_DCCP_STATE]) >= CT_DCCP_IGNORE) {
  605. return -EINVAL;
  606. }
  607. spin_lock_bh(&ct->lock);
  608. ct->proto.dccp.state = nla_get_u8(tb[CTA_PROTOINFO_DCCP_STATE]);
  609. if (nla_get_u8(tb[CTA_PROTOINFO_DCCP_ROLE]) == CT_DCCP_ROLE_CLIENT) {
  610. ct->proto.dccp.role[IP_CT_DIR_ORIGINAL] = CT_DCCP_ROLE_CLIENT;
  611. ct->proto.dccp.role[IP_CT_DIR_REPLY] = CT_DCCP_ROLE_SERVER;
  612. } else {
  613. ct->proto.dccp.role[IP_CT_DIR_ORIGINAL] = CT_DCCP_ROLE_SERVER;
  614. ct->proto.dccp.role[IP_CT_DIR_REPLY] = CT_DCCP_ROLE_CLIENT;
  615. }
  616. if (tb[CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ]) {
  617. ct->proto.dccp.handshake_seq =
  618. be64_to_cpu(nla_get_be64(tb[CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ]));
  619. }
  620. spin_unlock_bh(&ct->lock);
  621. return 0;
  622. }
  623. #endif
  624. #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
  625. #include <linux/netfilter/nfnetlink.h>
  626. #include <linux/netfilter/nfnetlink_cttimeout.h>
  627. static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[],
  628. struct net *net, void *data)
  629. {
  630. struct nf_dccp_net *dn = nf_dccp_pernet(net);
  631. unsigned int *timeouts = data;
  632. int i;
  633. if (!timeouts)
  634. timeouts = dn->dccp_timeout;
  635. /* set default DCCP timeouts. */
  636. for (i=0; i<CT_DCCP_MAX; i++)
  637. timeouts[i] = dn->dccp_timeout[i];
  638. /* there's a 1:1 mapping between attributes and protocol states. */
  639. for (i=CTA_TIMEOUT_DCCP_UNSPEC+1; i<CTA_TIMEOUT_DCCP_MAX+1; i++) {
  640. if (tb[i]) {
  641. timeouts[i] = ntohl(nla_get_be32(tb[i])) * HZ;
  642. }
  643. }
  644. timeouts[CTA_TIMEOUT_DCCP_UNSPEC] = timeouts[CTA_TIMEOUT_DCCP_REQUEST];
  645. return 0;
  646. }
  647. static int
  648. dccp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
  649. {
  650. const unsigned int *timeouts = data;
  651. int i;
  652. for (i=CTA_TIMEOUT_DCCP_UNSPEC+1; i<CTA_TIMEOUT_DCCP_MAX+1; i++) {
  653. if (nla_put_be32(skb, i, htonl(timeouts[i] / HZ)))
  654. goto nla_put_failure;
  655. }
  656. return 0;
  657. nla_put_failure:
  658. return -ENOSPC;
  659. }
  660. static const struct nla_policy
  661. dccp_timeout_nla_policy[CTA_TIMEOUT_DCCP_MAX+1] = {
  662. [CTA_TIMEOUT_DCCP_REQUEST] = { .type = NLA_U32 },
  663. [CTA_TIMEOUT_DCCP_RESPOND] = { .type = NLA_U32 },
  664. [CTA_TIMEOUT_DCCP_PARTOPEN] = { .type = NLA_U32 },
  665. [CTA_TIMEOUT_DCCP_OPEN] = { .type = NLA_U32 },
  666. [CTA_TIMEOUT_DCCP_CLOSEREQ] = { .type = NLA_U32 },
  667. [CTA_TIMEOUT_DCCP_CLOSING] = { .type = NLA_U32 },
  668. [CTA_TIMEOUT_DCCP_TIMEWAIT] = { .type = NLA_U32 },
  669. };
  670. #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
  671. void nf_conntrack_dccp_init_net(struct net *net)
  672. {
  673. struct nf_dccp_net *dn = nf_dccp_pernet(net);
  674. /* default values */
  675. dn->dccp_loose = 1;
  676. dn->dccp_timeout[CT_DCCP_REQUEST] = 2 * DCCP_MSL;
  677. dn->dccp_timeout[CT_DCCP_RESPOND] = 4 * DCCP_MSL;
  678. dn->dccp_timeout[CT_DCCP_PARTOPEN] = 4 * DCCP_MSL;
  679. dn->dccp_timeout[CT_DCCP_OPEN] = 12 * 3600 * HZ;
  680. dn->dccp_timeout[CT_DCCP_CLOSEREQ] = 64 * HZ;
  681. dn->dccp_timeout[CT_DCCP_CLOSING] = 64 * HZ;
  682. dn->dccp_timeout[CT_DCCP_TIMEWAIT] = 2 * DCCP_MSL;
  683. /* timeouts[0] is unused, make it same as SYN_SENT so
  684. * ->timeouts[0] contains 'new' timeout, like udp or icmp.
  685. */
  686. dn->dccp_timeout[CT_DCCP_NONE] = dn->dccp_timeout[CT_DCCP_REQUEST];
  687. }
  688. const struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp = {
  689. .l4proto = IPPROTO_DCCP,
  690. .can_early_drop = dccp_can_early_drop,
  691. #ifdef CONFIG_NF_CONNTRACK_PROCFS
  692. .print_conntrack = dccp_print_conntrack,
  693. #endif
  694. #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
  695. .nlattr_size = DCCP_NLATTR_SIZE,
  696. .to_nlattr = dccp_to_nlattr,
  697. .from_nlattr = nlattr_to_dccp,
  698. .tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
  699. .nlattr_tuple_size = nf_ct_port_nlattr_tuple_size,
  700. .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
  701. .nla_policy = nf_ct_port_nla_policy,
  702. #endif
  703. #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
  704. .ctnl_timeout = {
  705. .nlattr_to_obj = dccp_timeout_nlattr_to_obj,
  706. .obj_to_nlattr = dccp_timeout_obj_to_nlattr,
  707. .nlattr_max = CTA_TIMEOUT_DCCP_MAX,
  708. .obj_size = sizeof(unsigned int) * CT_DCCP_MAX,
  709. .nla_policy = dccp_timeout_nla_policy,
  710. },
  711. #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
  712. };