?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
memcg swap: use mem_cgroup_uncharge_swap fix
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / net / netfilter / nf_conntrack_proto_sctp.c
blob72b5088592dc8557b264c4b0f7de4e72fa3e3b76
1 /*
2 * Connection tracking protocol helper module for SCTP.
3 *
4 * SCTP is defined in RFC 2960. References to various sections in this code
5 * are to this RFC.
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
12 #include <linux/types.h>
13 #include <linux/timer.h>
14 #include <linux/netfilter.h>
15 #include <linux/module.h>
16 #include <linux/in.h>
17 #include <linux/ip.h>
18 #include <linux/sctp.h>
19 #include <linux/string.h>
20 #include <linux/seq_file.h>
21 #include <linux/spinlock.h>
22 #include <linux/interrupt.h>
23
24 #include <net/netfilter/nf_conntrack.h>
25 #include <net/netfilter/nf_conntrack_l4proto.h>
26 #include <net/netfilter/nf_conntrack_ecache.h>
27
28 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
29 closely. They're more complex. --RR
30
31 And so for me for SCTP :D -Kiran */
32
33 static const char *const sctp_conntrack_names[] = {
34 "NONE",
35 "CLOSED",
36 "COOKIE_WAIT",
37 "COOKIE_ECHOED",
38 "ESTABLISHED",
39 "SHUTDOWN_SENT",
40 "SHUTDOWN_RECD",
41 "SHUTDOWN_ACK_SENT",
42 };
43
44 #define SECS * HZ
45 #define MINS * 60 SECS
46 #define HOURS * 60 MINS
47 #define DAYS * 24 HOURS
48
49 static unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] __read_mostly = {
50 [SCTP_CONNTRACK_CLOSED] = 10 SECS,
51 [SCTP_CONNTRACK_COOKIE_WAIT] = 3 SECS,
52 [SCTP_CONNTRACK_COOKIE_ECHOED] = 3 SECS,
53 [SCTP_CONNTRACK_ESTABLISHED] = 5 DAYS,
54 [SCTP_CONNTRACK_SHUTDOWN_SENT] = 300 SECS / 1000,
55 [SCTP_CONNTRACK_SHUTDOWN_RECD] = 300 SECS / 1000,
56 [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = 3 SECS,
57 };
58
59 #define sNO SCTP_CONNTRACK_NONE
60 #define sCL SCTP_CONNTRACK_CLOSED
61 #define sCW SCTP_CONNTRACK_COOKIE_WAIT
62 #define sCE SCTP_CONNTRACK_COOKIE_ECHOED
63 #define sES SCTP_CONNTRACK_ESTABLISHED
64 #define sSS SCTP_CONNTRACK_SHUTDOWN_SENT
65 #define sSR SCTP_CONNTRACK_SHUTDOWN_RECD
66 #define sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
67 #define sIV SCTP_CONNTRACK_MAX
68
69 /*
70 These are the descriptions of the states:
71
72 NOTE: These state names are tantalizingly similar to the states of an
73 SCTP endpoint. But the interpretation of the states is a little different,
74 considering that these are the states of the connection and not of an end
75 point. Please note the subtleties. -Kiran
76
77 NONE - Nothing so far.
78 COOKIE WAIT - We have seen an INIT chunk in the original direction, or also
79 an INIT_ACK chunk in the reply direction.
80 COOKIE ECHOED - We have seen a COOKIE_ECHO chunk in the original direction.
81 ESTABLISHED - We have seen a COOKIE_ACK in the reply direction.
82 SHUTDOWN_SENT - We have seen a SHUTDOWN chunk in the original direction.
83 SHUTDOWN_RECD - We have seen a SHUTDOWN chunk in the reply directoin.
84 SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
85 to that of the SHUTDOWN chunk.
86 CLOSED - We have seen a SHUTDOWN_COMPLETE chunk in the direction of
87 the SHUTDOWN chunk. Connection is closed.
88 */
89
90 /* TODO
91 - I have assumed that the first INIT is in the original direction.
92 This messes things when an INIT comes in the reply direction in CLOSED
93 state.
94 - Check the error type in the reply dir before transitioning from
95 cookie echoed to closed.
96 - Sec 5.2.4 of RFC 2960
97 - Multi Homing support.
98 */
99
100 /* SCTP conntrack state transitions */
101 static const u8 sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
102 {
103 /* ORIGINAL */
104 /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
105 /* init */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA},
106 /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},
107 /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
108 /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA},
109 /* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA},
110 /* error */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Can't have Stale cookie*/
111 /* cookie_echo */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA},/* 5.2.4 - Big TODO */
112 /* cookie_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Can't come in orig dir */
113 /* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL}
114 },
115 {
116 /* REPLY */
117 /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
118 /* init */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* INIT in sCL Big TODO */
119 /* init_ack */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},
120 /* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
121 /* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA},
122 /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA},
123 /* error */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA},
124 /* cookie_echo */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Can't come in reply dir */
125 /* cookie_ack */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA},
126 /* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL}
127 }
128 };
129
130 static bool sctp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
131 struct nf_conntrack_tuple *tuple)
132 {
133 const struct sctphdr *hp;
134 struct sctphdr _hdr;
135
136 /* Actually only need first 8 bytes. */
137 hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
138 if (hp == NULL)
139 return false;
140
141 tuple->src.u.sctp.port = hp->source;
142 tuple->dst.u.sctp.port = hp->dest;
143 return true;
144 }
145
146 static bool sctp_invert_tuple(struct nf_conntrack_tuple *tuple,
147 const struct nf_conntrack_tuple *orig)
148 {
149 tuple->src.u.sctp.port = orig->dst.u.sctp.port;
150 tuple->dst.u.sctp.port = orig->src.u.sctp.port;
151 return true;
152 }
153
154 /* Print out the per-protocol part of the tuple. */
155 static int sctp_print_tuple(struct seq_file *s,
156 const struct nf_conntrack_tuple *tuple)
157 {
158 return seq_printf(s, "sport=%hu dport=%hu ",
159 ntohs(tuple->src.u.sctp.port),
160 ntohs(tuple->dst.u.sctp.port));
161 }
162
163 /* Print out the private part of the conntrack. */
164 static int sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
165 {
166 enum sctp_conntrack state;
167
168 spin_lock_bh(&ct->lock);
169 state = ct->proto.sctp.state;
170 spin_unlock_bh(&ct->lock);
171
172 return seq_printf(s, "%s ", sctp_conntrack_names[state]);
173 }
174
175 #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count) \
176 for ((offset) = (dataoff) + sizeof(sctp_sctphdr_t), (count) = 0; \
177 (offset) < (skb)->len && \
178 ((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch))); \
179 (offset) += (ntohs((sch)->length) + 3) & ~3, (count)++)
180
181 /* Some validity checks to make sure the chunks are fine */
182 static int do_basic_checks(struct nf_conn *ct,
183 const struct sk_buff *skb,
184 unsigned int dataoff,
185 unsigned long *map)
186 {
187 u_int32_t offset, count;
188 sctp_chunkhdr_t _sch, *sch;
189 int flag;
190
191 flag = 0;
192
193 for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
194 pr_debug("Chunk Num: %d Type: %d\n", count, sch->type);
195
196 if (sch->type == SCTP_CID_INIT ||
197 sch->type == SCTP_CID_INIT_ACK ||
198 sch->type == SCTP_CID_SHUTDOWN_COMPLETE)
199 flag = 1;
200
201 /*
202 * Cookie Ack/Echo chunks not the first OR
203 * Init / Init Ack / Shutdown compl chunks not the only chunks
204 * OR zero-length.
205 */
206 if (((sch->type == SCTP_CID_COOKIE_ACK ||
207 sch->type == SCTP_CID_COOKIE_ECHO ||
208 flag) &&
209 count != 0) || !sch->length) {
210 pr_debug("Basic checks failed\n");
211 return 1;
212 }
213
214 if (map)
215 set_bit(sch->type, map);
216 }
217
218 pr_debug("Basic checks passed\n");
219 return count == 0;
220 }
221
222 static int sctp_new_state(enum ip_conntrack_dir dir,
223 enum sctp_conntrack cur_state,
224 int chunk_type)
225 {
226 int i;
227
228 pr_debug("Chunk type: %d\n", chunk_type);
229
230 switch (chunk_type) {
231 case SCTP_CID_INIT:
232 pr_debug("SCTP_CID_INIT\n");
233 i = 0;
234 break;
235 case SCTP_CID_INIT_ACK:
236 pr_debug("SCTP_CID_INIT_ACK\n");
237 i = 1;
238 break;
239 case SCTP_CID_ABORT:
240 pr_debug("SCTP_CID_ABORT\n");
241 i = 2;
242 break;
243 case SCTP_CID_SHUTDOWN:
244 pr_debug("SCTP_CID_SHUTDOWN\n");
245 i = 3;
246 break;
247 case SCTP_CID_SHUTDOWN_ACK:
248 pr_debug("SCTP_CID_SHUTDOWN_ACK\n");
249 i = 4;
250 break;
251 case SCTP_CID_ERROR:
252 pr_debug("SCTP_CID_ERROR\n");
253 i = 5;
254 break;
255 case SCTP_CID_COOKIE_ECHO:
256 pr_debug("SCTP_CID_COOKIE_ECHO\n");
257 i = 6;
258 break;
259 case SCTP_CID_COOKIE_ACK:
260 pr_debug("SCTP_CID_COOKIE_ACK\n");
261 i = 7;
262 break;
263 case SCTP_CID_SHUTDOWN_COMPLETE:
264 pr_debug("SCTP_CID_SHUTDOWN_COMPLETE\n");
265 i = 8;
266 break;
267 default:
268 /* Other chunks like DATA, SACK, HEARTBEAT and
269 its ACK do not cause a change in state */
270 pr_debug("Unknown chunk type, Will stay in %s\n",
271 sctp_conntrack_names[cur_state]);
272 return cur_state;
273 }
274
275 pr_debug("dir: %d cur_state: %s chunk_type: %d new_state: %s\n",
276 dir, sctp_conntrack_names[cur_state], chunk_type,
277 sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);
278
279 return sctp_conntracks[dir][i][cur_state];
280 }
281
282 static unsigned int *sctp_get_timeouts(struct net *net)
283 {
284 return sctp_timeouts;
285 }
286
287 /* Returns verdict for packet, or -NF_ACCEPT for invalid. */
288 static int sctp_packet(struct nf_conn *ct,
289 const struct sk_buff *skb,
290 unsigned int dataoff,
291 enum ip_conntrack_info ctinfo,
292 u_int8_t pf,
293 unsigned int hooknum,
294 unsigned int *timeouts)
295 {
296 enum sctp_conntrack new_state, old_state;
297 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
298 const struct sctphdr *sh;
299 struct sctphdr _sctph;
300 const struct sctp_chunkhdr *sch;
301 struct sctp_chunkhdr _sch;
302 u_int32_t offset, count;
303 unsigned long map[256 / sizeof(unsigned long)] = { 0 };
304
305 sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
306 if (sh == NULL)
307 goto out;
308
309 if (do_basic_checks(ct, skb, dataoff, map) != 0)
310 goto out;
311
312 /* Check the verification tag (Sec 8.5) */
313 if (!test_bit(SCTP_CID_INIT, map) &&
314 !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) &&
315 !test_bit(SCTP_CID_COOKIE_ECHO, map) &&
316 !test_bit(SCTP_CID_ABORT, map) &&
317 !test_bit(SCTP_CID_SHUTDOWN_ACK, map) &&
318 sh->vtag != ct->proto.sctp.vtag[dir]) {
319 pr_debug("Verification tag check failed\n");
320 goto out;
321 }
322
323 old_state = new_state = SCTP_CONNTRACK_NONE;
324 spin_lock_bh(&ct->lock);
325 for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
326 /* Special cases of Verification tag check (Sec 8.5.1) */
327 if (sch->type == SCTP_CID_INIT) {
328 /* Sec 8.5.1 (A) */
329 if (sh->vtag != 0)
330 goto out_unlock;
331 } else if (sch->type == SCTP_CID_ABORT) {
332 /* Sec 8.5.1 (B) */
333 if (sh->vtag != ct->proto.sctp.vtag[dir] &&
334 sh->vtag != ct->proto.sctp.vtag[!dir])
335 goto out_unlock;
336 } else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
337 /* Sec 8.5.1 (C) */
338 if (sh->vtag != ct->proto.sctp.vtag[dir] &&
339 sh->vtag != ct->proto.sctp.vtag[!dir] &&
340 sch->flags & SCTP_CHUNK_FLAG_T)
341 goto out_unlock;
342 } else if (sch->type == SCTP_CID_COOKIE_ECHO) {
343 /* Sec 8.5.1 (D) */
344 if (sh->vtag != ct->proto.sctp.vtag[dir])
345 goto out_unlock;
346 }
347
348 old_state = ct->proto.sctp.state;
349 new_state = sctp_new_state(dir, old_state, sch->type);
350
351 /* Invalid */
352 if (new_state == SCTP_CONNTRACK_MAX) {
353 pr_debug("nf_conntrack_sctp: Invalid dir=%i ctype=%u "
354 "conntrack=%u\n",
355 dir, sch->type, old_state);
356 goto out_unlock;
357 }
358
359 /* If it is an INIT or an INIT ACK note down the vtag */
360 if (sch->type == SCTP_CID_INIT ||
361 sch->type == SCTP_CID_INIT_ACK) {
362 sctp_inithdr_t _inithdr, *ih;
363
364 ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
365 sizeof(_inithdr), &_inithdr);
366 if (ih == NULL)
367 goto out_unlock;
368 pr_debug("Setting vtag %x for dir %d\n",
369 ih->init_tag, !dir);
370 ct->proto.sctp.vtag[!dir] = ih->init_tag;
371 }
372
373 ct->proto.sctp.state = new_state;
374 if (old_state != new_state)
375 nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
376 }
377 spin_unlock_bh(&ct->lock);
378
379 nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]);
380
381 if (old_state == SCTP_CONNTRACK_COOKIE_ECHOED &&
382 dir == IP_CT_DIR_REPLY &&
383 new_state == SCTP_CONNTRACK_ESTABLISHED) {
384 pr_debug("Setting assured bit\n");
385 set_bit(IPS_ASSURED_BIT, &ct->status);
386 nf_conntrack_event_cache(IPCT_ASSURED, ct);
387 }
388
389 return NF_ACCEPT;
390
391 out_unlock:
392 spin_unlock_bh(&ct->lock);
393 out:
394 return -NF_ACCEPT;
395 }
396
397 /* Called when a new connection for this protocol found. */
398 static bool sctp_new(struct nf_conn *ct, const struct sk_buff *skb,
399 unsigned int dataoff, unsigned int *timeouts)
400 {
401 enum sctp_conntrack new_state;
402 const struct sctphdr *sh;
403 struct sctphdr _sctph;
404 const struct sctp_chunkhdr *sch;
405 struct sctp_chunkhdr _sch;
406 u_int32_t offset, count;
407 unsigned long map[256 / sizeof(unsigned long)] = { 0 };
408
409 sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
410 if (sh == NULL)
411 return false;
412
413 if (do_basic_checks(ct, skb, dataoff, map) != 0)
414 return false;
415
416 /* If an OOTB packet has any of these chunks discard (Sec 8.4) */
417 if (test_bit(SCTP_CID_ABORT, map) ||
418 test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) ||
419 test_bit(SCTP_CID_COOKIE_ACK, map))
420 return false;
421
422 memset(&ct->proto.sctp, 0, sizeof(ct->proto.sctp));
423 new_state = SCTP_CONNTRACK_MAX;
424 for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
425 /* Don't need lock here: this conntrack not in circulation yet */
426 new_state = sctp_new_state(IP_CT_DIR_ORIGINAL,
427 SCTP_CONNTRACK_NONE, sch->type);
428
429 /* Invalid: delete conntrack */
430 if (new_state == SCTP_CONNTRACK_NONE ||
431 new_state == SCTP_CONNTRACK_MAX) {
432 pr_debug("nf_conntrack_sctp: invalid new deleting.\n");
433 return false;
434 }
435
436 /* Copy the vtag into the state info */
437 if (sch->type == SCTP_CID_INIT) {
438 if (sh->vtag == 0) {
439 sctp_inithdr_t _inithdr, *ih;
440
441 ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
442 sizeof(_inithdr), &_inithdr);
443 if (ih == NULL)
444 return false;
445
446 pr_debug("Setting vtag %x for new conn\n",
447 ih->init_tag);
448
449 ct->proto.sctp.vtag[IP_CT_DIR_REPLY] =
450 ih->init_tag;
451 } else {
452 /* Sec 8.5.1 (A) */
453 return false;
454 }
455 }
456 /* If it is a shutdown ack OOTB packet, we expect a return
457 shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
458 else {
459 pr_debug("Setting vtag %x for new conn OOTB\n",
460 sh->vtag);
461 ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
462 }
463
464 ct->proto.sctp.state = new_state;
465 }
466
467 return true;
468 }
469
470 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
471
472 #include <linux/netfilter/nfnetlink.h>
473 #include <linux/netfilter/nfnetlink_conntrack.h>
474
475 static int sctp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
476 struct nf_conn *ct)
477 {
478 struct nlattr *nest_parms;
479
480 spin_lock_bh(&ct->lock);
481 nest_parms = nla_nest_start(skb, CTA_PROTOINFO_SCTP | NLA_F_NESTED);
482 if (!nest_parms)
483 goto nla_put_failure;
484
485 NLA_PUT_U8(skb, CTA_PROTOINFO_SCTP_STATE, ct->proto.sctp.state);
486
487 NLA_PUT_BE32(skb,
488 CTA_PROTOINFO_SCTP_VTAG_ORIGINAL,
489 ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL]);
490
491 NLA_PUT_BE32(skb,
492 CTA_PROTOINFO_SCTP_VTAG_REPLY,
493 ct->proto.sctp.vtag[IP_CT_DIR_REPLY]);
494
495 spin_unlock_bh(&ct->lock);
496
497 nla_nest_end(skb, nest_parms);
498
499 return 0;
500
501 nla_put_failure:
502 spin_unlock_bh(&ct->lock);
503 return -1;
504 }
505
506 static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX+1] = {
507 [CTA_PROTOINFO_SCTP_STATE] = { .type = NLA_U8 },
508 [CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] = { .type = NLA_U32 },
509 [CTA_PROTOINFO_SCTP_VTAG_REPLY] = { .type = NLA_U32 },
510 };
511
512 static int nlattr_to_sctp(struct nlattr *cda[], struct nf_conn *ct)
513 {
514 struct nlattr *attr = cda[CTA_PROTOINFO_SCTP];
515 struct nlattr *tb[CTA_PROTOINFO_SCTP_MAX+1];
516 int err;
517
518 /* updates may not contain the internal protocol info, skip parsing */
519 if (!attr)
520 return 0;
521
522 err = nla_parse_nested(tb,
523 CTA_PROTOINFO_SCTP_MAX,
524 attr,
525 sctp_nla_policy);
526 if (err < 0)
527 return err;
528
529 if (!tb[CTA_PROTOINFO_SCTP_STATE] ||
530 !tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] ||
531 !tb[CTA_PROTOINFO_SCTP_VTAG_REPLY])
532 return -EINVAL;
533
534 spin_lock_bh(&ct->lock);
535 ct->proto.sctp.state = nla_get_u8(tb[CTA_PROTOINFO_SCTP_STATE]);
536 ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] =
537 nla_get_be32(tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL]);
538 ct->proto.sctp.vtag[IP_CT_DIR_REPLY] =
539 nla_get_be32(tb[CTA_PROTOINFO_SCTP_VTAG_REPLY]);
540 spin_unlock_bh(&ct->lock);
541
542 return 0;
543 }
544
545 static int sctp_nlattr_size(void)
546 {
547 return nla_total_size(0) /* CTA_PROTOINFO_SCTP */
548 + nla_policy_len(sctp_nla_policy, CTA_PROTOINFO_SCTP_MAX + 1);
549 }
550 #endif
551
552 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
553
554 #include <linux/netfilter/nfnetlink.h>
555 #include <linux/netfilter/nfnetlink_cttimeout.h>
556
557 static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data)
558 {
559 unsigned int *timeouts = data;
560 int i;
561
562 /* set default SCTP timeouts. */
563 for (i=0; i<SCTP_CONNTRACK_MAX; i++)
564 timeouts[i] = sctp_timeouts[i];
565
566 /* there's a 1:1 mapping between attributes and protocol states. */
567 for (i=CTA_TIMEOUT_SCTP_UNSPEC+1; i<CTA_TIMEOUT_SCTP_MAX+1; i++) {
568 if (tb[i]) {
569 timeouts[i] = ntohl(nla_get_be32(tb[i])) * HZ;
570 }
571 }
572 return 0;
573 }
574
575 static int
576 sctp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
577 {
578 const unsigned int *timeouts = data;
579 int i;
580
581 for (i=CTA_TIMEOUT_SCTP_UNSPEC+1; i<CTA_TIMEOUT_SCTP_MAX+1; i++)
582 NLA_PUT_BE32(skb, i, htonl(timeouts[i] / HZ));
583
584 return 0;
585
586 nla_put_failure:
587 return -ENOSPC;
588 }
589
590 static const struct nla_policy
591 sctp_timeout_nla_policy[CTA_TIMEOUT_SCTP_MAX+1] = {
592 [CTA_TIMEOUT_SCTP_CLOSED] = { .type = NLA_U32 },
593 [CTA_TIMEOUT_SCTP_COOKIE_WAIT] = { .type = NLA_U32 },
594 [CTA_TIMEOUT_SCTP_COOKIE_ECHOED] = { .type = NLA_U32 },
595 [CTA_TIMEOUT_SCTP_ESTABLISHED] = { .type = NLA_U32 },
596 [CTA_TIMEOUT_SCTP_SHUTDOWN_SENT] = { .type = NLA_U32 },
597 [CTA_TIMEOUT_SCTP_SHUTDOWN_RECD] = { .type = NLA_U32 },
598 [CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT] = { .type = NLA_U32 },
599 };
600 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
601
602
603 #ifdef CONFIG_SYSCTL
604 static unsigned int sctp_sysctl_table_users;
605 static struct ctl_table_header *sctp_sysctl_header;
606 static struct ctl_table sctp_sysctl_table[] = {
607 {
608 .procname = "nf_conntrack_sctp_timeout_closed",
609 .data = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
610 .maxlen = sizeof(unsigned int),
611 .mode = 0644,
612 .proc_handler = proc_dointvec_jiffies,
613 },
614 {
615 .procname = "nf_conntrack_sctp_timeout_cookie_wait",
616 .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
617 .maxlen = sizeof(unsigned int),
618 .mode = 0644,
619 .proc_handler = proc_dointvec_jiffies,
620 },
621 {
622 .procname = "nf_conntrack_sctp_timeout_cookie_echoed",
623 .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
624 .maxlen = sizeof(unsigned int),
625 .mode = 0644,
626 .proc_handler = proc_dointvec_jiffies,
627 },
628 {
629 .procname = "nf_conntrack_sctp_timeout_established",
630 .data = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
631 .maxlen = sizeof(unsigned int),
632 .mode = 0644,
633 .proc_handler = proc_dointvec_jiffies,
634 },
635 {
636 .procname = "nf_conntrack_sctp_timeout_shutdown_sent",
637 .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
638 .maxlen = sizeof(unsigned int),
639 .mode = 0644,
640 .proc_handler = proc_dointvec_jiffies,
641 },
642 {
643 .procname = "nf_conntrack_sctp_timeout_shutdown_recd",
644 .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
645 .maxlen = sizeof(unsigned int),
646 .mode = 0644,
647 .proc_handler = proc_dointvec_jiffies,
648 },
649 {
650 .procname = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
651 .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
652 .maxlen = sizeof(unsigned int),
653 .mode = 0644,
654 .proc_handler = proc_dointvec_jiffies,
655 },
656 { }
657 };
658
659 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
660 static struct ctl_table sctp_compat_sysctl_table[] = {
661 {
662 .procname = "ip_conntrack_sctp_timeout_closed",
663 .data = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
664 .maxlen = sizeof(unsigned int),
665 .mode = 0644,
666 .proc_handler = proc_dointvec_jiffies,
667 },
668 {
669 .procname = "ip_conntrack_sctp_timeout_cookie_wait",
670 .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
671 .maxlen = sizeof(unsigned int),
672 .mode = 0644,
673 .proc_handler = proc_dointvec_jiffies,
674 },
675 {
676 .procname = "ip_conntrack_sctp_timeout_cookie_echoed",
677 .data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
678 .maxlen = sizeof(unsigned int),
679 .mode = 0644,
680 .proc_handler = proc_dointvec_jiffies,
681 },
682 {
683 .procname = "ip_conntrack_sctp_timeout_established",
684 .data = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
685 .maxlen = sizeof(unsigned int),
686 .mode = 0644,
687 .proc_handler = proc_dointvec_jiffies,
688 },
689 {
690 .procname = "ip_conntrack_sctp_timeout_shutdown_sent",
691 .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
692 .maxlen = sizeof(unsigned int),
693 .mode = 0644,
694 .proc_handler = proc_dointvec_jiffies,
695 },
696 {
697 .procname = "ip_conntrack_sctp_timeout_shutdown_recd",
698 .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
699 .maxlen = sizeof(unsigned int),
700 .mode = 0644,
701 .proc_handler = proc_dointvec_jiffies,
702 },
703 {
704 .procname = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
705 .data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
706 .maxlen = sizeof(unsigned int),
707 .mode = 0644,
708 .proc_handler = proc_dointvec_jiffies,
709 },
710 { }
711 };
712 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
713 #endif
714
715 static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
716 .l3proto = PF_INET,
717 .l4proto = IPPROTO_SCTP,
718 .name = "sctp",
719 .pkt_to_tuple = sctp_pkt_to_tuple,
720 .invert_tuple = sctp_invert_tuple,
721 .print_tuple = sctp_print_tuple,
722 .print_conntrack = sctp_print_conntrack,
723 .packet = sctp_packet,
724 .get_timeouts = sctp_get_timeouts,
725 .new = sctp_new,
726 .me = THIS_MODULE,
727 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
728 .to_nlattr = sctp_to_nlattr,
729 .nlattr_size = sctp_nlattr_size,
730 .from_nlattr = nlattr_to_sctp,
731 .tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
732 .nlattr_tuple_size = nf_ct_port_nlattr_tuple_size,
733 .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
734 .nla_policy = nf_ct_port_nla_policy,
735 #endif
736 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
737 .ctnl_timeout = {
738 .nlattr_to_obj = sctp_timeout_nlattr_to_obj,
739 .obj_to_nlattr = sctp_timeout_obj_to_nlattr,
740 .nlattr_max = CTA_TIMEOUT_SCTP_MAX,
741 .obj_size = sizeof(unsigned int) * SCTP_CONNTRACK_MAX,
742 .nla_policy = sctp_timeout_nla_policy,
743 },
744 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
745 #ifdef CONFIG_SYSCTL
746 .ctl_table_users = &sctp_sysctl_table_users,
747 .ctl_table_header = &sctp_sysctl_header,
748 .ctl_table = sctp_sysctl_table,
749 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
750 .ctl_compat_table = sctp_compat_sysctl_table,
751 #endif
752 #endif
753 };
754
755 static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
756 .l3proto = PF_INET6,
757 .l4proto = IPPROTO_SCTP,
758 .name = "sctp",
759 .pkt_to_tuple = sctp_pkt_to_tuple,
760 .invert_tuple = sctp_invert_tuple,
761 .print_tuple = sctp_print_tuple,
762 .print_conntrack = sctp_print_conntrack,
763 .packet = sctp_packet,
764 .get_timeouts = sctp_get_timeouts,
765 .new = sctp_new,
766 .me = THIS_MODULE,
767 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
768 .to_nlattr = sctp_to_nlattr,
769 .nlattr_size = sctp_nlattr_size,
770 .from_nlattr = nlattr_to_sctp,
771 .tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
772 .nlattr_tuple_size = nf_ct_port_nlattr_tuple_size,
773 .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
774 .nla_policy = nf_ct_port_nla_policy,
775 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
776 .ctnl_timeout = {
777 .nlattr_to_obj = sctp_timeout_nlattr_to_obj,
778 .obj_to_nlattr = sctp_timeout_obj_to_nlattr,
779 .nlattr_max = CTA_TIMEOUT_SCTP_MAX,
780 .obj_size = sizeof(unsigned int) * SCTP_CONNTRACK_MAX,
781 .nla_policy = sctp_timeout_nla_policy,
782 },
783 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
784 #endif
785 #ifdef CONFIG_SYSCTL
786 .ctl_table_users = &sctp_sysctl_table_users,
787 .ctl_table_header = &sctp_sysctl_header,
788 .ctl_table = sctp_sysctl_table,
789 #endif
790 };
791
792 static int __init nf_conntrack_proto_sctp_init(void)
793 {
794 int ret;
795
796 ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp4);
797 if (ret) {
798 pr_err("nf_conntrack_l4proto_sctp4: protocol register failed\n");
799 goto out;
800 }
801 ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp6);
802 if (ret) {
803 pr_err("nf_conntrack_l4proto_sctp6: protocol register failed\n");
804 goto cleanup_sctp4;
805 }
806
807 return ret;
808
809 cleanup_sctp4:
810 nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
811 out:
812 return ret;
813 }
814
815 static void __exit nf_conntrack_proto_sctp_fini(void)
816 {
817 nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
818 nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
819 }
820
821 module_init(nf_conntrack_proto_sctp_init);
822 module_exit(nf_conntrack_proto_sctp_fini);
823
824 MODULE_LICENSE("GPL");
825 MODULE_AUTHOR("Kiran Kumar Immidi");
826 MODULE_DESCRIPTION("Netfilter connection tracking protocol helper for SCTP");
827 MODULE_ALIAS("ip_conntrack_proto_sctp");
Linux 2.6 ibm-acpi/thinkpad-acpi driver git tree