aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--net/netfilter/Kconfig10
-rw-r--r--net/netfilter/Makefile1
-rw-r--r--net/netfilter/nf_conntrack_proto_udplite.c266
3 files changed, 277 insertions, 0 deletions
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 9415b9a5dba6..3ac39f1ec775 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -102,6 +102,16 @@ config NF_CT_PROTO_SCTP
102 If you want to compile it as a module, say M here and read 102 If you want to compile it as a module, say M here and read
103 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 103 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
104 104
105config NF_CT_PROTO_UDPLITE
106 tristate 'UDP-Lite protocol connection tracking support (EXPERIMENTAL)'
107 depends on EXPERIMENTAL && NF_CONNTRACK
108 help
109 With this option enabled, the layer 3 independent connection
110 tracking code will be able to do state tracking on UDP-Lite
111 connections.
112
113 To compile it as a module, choose M here. If unsure, say N.
114
105config NF_CONNTRACK_AMANDA 115config NF_CONNTRACK_AMANDA
106 tristate "Amanda backup protocol support" 116 tristate "Amanda backup protocol support"
107 depends on NF_CONNTRACK 117 depends on NF_CONNTRACK
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 3e4a16aeb04e..0c054bf27973 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -16,6 +16,7 @@ obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o
16# SCTP protocol connection tracking 16# SCTP protocol connection tracking
17obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o 17obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o
18obj-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o 18obj-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
19obj-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o
19 20
20# netlink interface for nf_conntrack 21# netlink interface for nf_conntrack
21obj-$(CONFIG_NF_CT_NETLINK) += nf_conntrack_netlink.o 22obj-$(CONFIG_NF_CT_NETLINK) += nf_conntrack_netlink.o
diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
new file mode 100644
index 000000000000..93e747b5396e
--- /dev/null
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -0,0 +1,266 @@
1/* (C) 1999-2001 Paul `Rusty' Russell
2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
3 * (C) 2007 Patrick McHardy <kaber@trash.net>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 */
9
10#include <linux/types.h>
11#include <linux/timer.h>
12#include <linux/module.h>
13#include <linux/netfilter.h>
14#include <linux/udp.h>
15#include <linux/seq_file.h>
16#include <linux/skbuff.h>
17#include <linux/ipv6.h>
18#include <net/ip6_checksum.h>
19#include <net/checksum.h>
20
21#include <linux/netfilter.h>
22#include <linux/netfilter_ipv4.h>
23#include <linux/netfilter_ipv6.h>
24#include <net/netfilter/nf_conntrack_l4proto.h>
25#include <net/netfilter/nf_conntrack_ecache.h>
26
27static unsigned int nf_ct_udplite_timeout __read_mostly = 30*HZ;
28static unsigned int nf_ct_udplite_timeout_stream __read_mostly = 180*HZ;
29
30static int udplite_pkt_to_tuple(const struct sk_buff *skb,
31 unsigned int dataoff,
32 struct nf_conntrack_tuple *tuple)
33{
34 struct udphdr _hdr, *hp;
35
36 hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
37 if (hp == NULL)
38 return 0;
39
40 tuple->src.u.udp.port = hp->source;
41 tuple->dst.u.udp.port = hp->dest;
42 return 1;
43}
44
45static int udplite_invert_tuple(struct nf_conntrack_tuple *tuple,
46 const struct nf_conntrack_tuple *orig)
47{
48 tuple->src.u.udp.port = orig->dst.u.udp.port;
49 tuple->dst.u.udp.port = orig->src.u.udp.port;
50 return 1;
51}
52
53/* Print out the per-protocol part of the tuple. */
54static int udplite_print_tuple(struct seq_file *s,
55 const struct nf_conntrack_tuple *tuple)
56{
57 return seq_printf(s, "sport=%hu dport=%hu ",
58 ntohs(tuple->src.u.udp.port),
59 ntohs(tuple->dst.u.udp.port));
60}
61
62/* Print out the private part of the conntrack. */
63static int udplite_print_conntrack(struct seq_file *s,
64 const struct nf_conn *conntrack)
65{
66 return 0;
67}
68
69/* Returns verdict for packet, and may modify conntracktype */
70static int udplite_packet(struct nf_conn *conntrack,
71 const struct sk_buff *skb,
72 unsigned int dataoff,
73 enum ip_conntrack_info ctinfo,
74 int pf,
75 unsigned int hooknum)
76{
77 /* If we've seen traffic both ways, this is some kind of UDP
78 stream. Extend timeout. */
79 if (test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
80 nf_ct_refresh_acct(conntrack, ctinfo, skb,
81 nf_ct_udplite_timeout_stream);
82 /* Also, more likely to be important, and not a probe */
83 if (!test_and_set_bit(IPS_ASSURED_BIT, &conntrack->status))
84 nf_conntrack_event_cache(IPCT_STATUS, skb);
85 } else
86 nf_ct_refresh_acct(conntrack, ctinfo, skb,
87 nf_ct_udplite_timeout);
88
89 return NF_ACCEPT;
90}
91
92/* Called when a new connection for this protocol found. */
93static int udplite_new(struct nf_conn *conntrack, const struct sk_buff *skb,
94 unsigned int dataoff)
95{
96 return 1;
97}
98
99static int udplite_error(struct sk_buff *skb, unsigned int dataoff,
100 enum ip_conntrack_info *ctinfo,
101 int pf,
102 unsigned int hooknum)
103{
104 unsigned int udplen = skb->len - dataoff;
105 struct udphdr _hdr, *hdr;
106 unsigned int cscov;
107
108 /* Header is too small? */
109 hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
110 if (hdr == NULL) {
111 if (LOG_INVALID(IPPROTO_UDPLITE))
112 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
113 "nf_ct_udplite: short packet ");
114 return -NF_ACCEPT;
115 }
116
117 cscov = ntohs(hdr->len);
118 if (cscov == 0)
119 cscov = udplen;
120 else if (cscov < sizeof(*hdr) || cscov > udplen) {
121 if (LOG_INVALID(IPPROTO_UDPLITE))
122 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
123 "nf_ct_udplite: invalid checksum coverage ");
124 return -NF_ACCEPT;
125 }
126
127 /* UDPLITE mandates checksums */
128 if (!hdr->check) {
129 if (LOG_INVALID(IPPROTO_UDPLITE))
130 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
131 "nf_ct_udplite: checksum missing ");
132 return -NF_ACCEPT;
133 }
134
135 /* Checksum invalid? Ignore. */
136 if (nf_conntrack_checksum && !skb_csum_unnecessary(skb) &&
137 ((pf == PF_INET && hooknum == NF_IP_PRE_ROUTING) ||
138 (pf == PF_INET6 && hooknum == NF_IP6_PRE_ROUTING))) {
139 if (pf == PF_INET) {
140 struct iphdr *iph = ip_hdr(skb);
141
142 skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
143 udplen, IPPROTO_UDPLITE, 0);
144 } else {
145 struct ipv6hdr *ipv6h = ipv6_hdr(skb);
146 __wsum hsum = skb_checksum(skb, 0, dataoff, 0);
147
148 skb->csum = ~csum_unfold(
149 csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
150 udplen, IPPROTO_UDPLITE,
151 csum_sub(0, hsum)));
152 }
153
154 skb->ip_summed = CHECKSUM_NONE;
155 if (__skb_checksum_complete_head(skb, dataoff + cscov)) {
156 if (LOG_INVALID(IPPROTO_UDPLITE))
157 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
158 "nf_ct_udplite: bad UDPLite "
159 "checksum ");
160 return -NF_ACCEPT;
161 }
162 skb->ip_summed = CHECKSUM_UNNECESSARY;
163 }
164
165 return NF_ACCEPT;
166}
167
168#ifdef CONFIG_SYSCTL
169static unsigned int udplite_sysctl_table_users;
170static struct ctl_table_header *udplite_sysctl_header;
171static struct ctl_table udplite_sysctl_table[] = {
172 {
173 .ctl_name = CTL_UNNUMBERED,
174 .procname = "nf_conntrack_udplite_timeout",
175 .data = &nf_ct_udplite_timeout,
176 .maxlen = sizeof(unsigned int),
177 .mode = 0644,
178 .proc_handler = &proc_dointvec_jiffies,
179 },
180 {
181 .ctl_name = CTL_UNNUMBERED,
182 .procname = "nf_conntrack_udplite_timeout_stream",
183 .data = &nf_ct_udplite_timeout_stream,
184 .maxlen = sizeof(unsigned int),
185 .mode = 0644,
186 .proc_handler = &proc_dointvec_jiffies,
187 },
188 {
189 .ctl_name = 0
190 }
191};
192#endif /* CONFIG_SYSCTL */
193
194static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 __read_mostly =
195{
196 .l3proto = PF_INET,
197 .l4proto = IPPROTO_UDPLITE,
198 .name = "udplite",
199 .pkt_to_tuple = udplite_pkt_to_tuple,
200 .invert_tuple = udplite_invert_tuple,
201 .print_tuple = udplite_print_tuple,
202 .print_conntrack = udplite_print_conntrack,
203 .packet = udplite_packet,
204 .new = udplite_new,
205 .error = udplite_error,
206#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
207 .tuple_to_nfattr = nf_ct_port_tuple_to_nfattr,
208 .nfattr_to_tuple = nf_ct_port_nfattr_to_tuple,
209#endif
210#ifdef CONFIG_SYSCTL
211 .ctl_table_users = &udplite_sysctl_table_users,
212 .ctl_table_header = &udplite_sysctl_header,
213 .ctl_table = udplite_sysctl_table,
214#endif
215};
216
217static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 __read_mostly =
218{
219 .l3proto = PF_INET6,
220 .l4proto = IPPROTO_UDPLITE,
221 .name = "udplite",
222 .pkt_to_tuple = udplite_pkt_to_tuple,
223 .invert_tuple = udplite_invert_tuple,
224 .print_tuple = udplite_print_tuple,
225 .print_conntrack = udplite_print_conntrack,
226 .packet = udplite_packet,
227 .new = udplite_new,
228 .error = udplite_error,
229#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
230 .tuple_to_nfattr = nf_ct_port_tuple_to_nfattr,
231 .nfattr_to_tuple = nf_ct_port_nfattr_to_tuple,
232#endif
233#ifdef CONFIG_SYSCTL
234 .ctl_table_users = &udplite_sysctl_table_users,
235 .ctl_table_header = &udplite_sysctl_header,
236 .ctl_table = udplite_sysctl_table,
237#endif
238};
239
240static int __init nf_conntrack_proto_udplite_init(void)
241{
242 int err;
243
244 err = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udplite4);
245 if (err < 0)
246 goto err1;
247 err = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udplite6);
248 if (err < 0)
249 goto err2;
250 return 0;
251err2:
252 nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udplite4);
253err1:
254 return err;
255}
256
257static void __exit nf_conntrack_proto_udplite_exit(void)
258{
259 nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udplite6);
260 nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udplite4);
261}
262
263module_init(nf_conntrack_proto_udplite_init);
264module_exit(nf_conntrack_proto_udplite_exit);
265
266MODULE_LICENSE("GPL");
generated by cgit v1.2.2 (git 2.25.0) at 2026-01-09 09:56:52 -0500