Blame view
net/netfilter/nf_conntrack_proto_udp.c
6.68 KB
9fb9cbb10 [NETFILTER]: Add ... |
1 2 3 4 5 6 |
/* (C) 1999-2001 Paul `Rusty' Russell * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. |
9fb9cbb10 [NETFILTER]: Add ... |
7 8 9 |
*/ #include <linux/types.h> |
9fb9cbb10 [NETFILTER]: Add ... |
10 11 |
#include <linux/timer.h> #include <linux/module.h> |
9fb9cbb10 [NETFILTER]: Add ... |
12 13 14 15 16 17 |
#include <linux/udp.h> #include <linux/seq_file.h> #include <linux/skbuff.h> #include <linux/ipv6.h> #include <net/ip6_checksum.h> #include <net/checksum.h> |
f61801218 [NETFILTER]: nf_c... |
18 |
|
9fb9cbb10 [NETFILTER]: Add ... |
19 20 21 |
#include <linux/netfilter.h> #include <linux/netfilter_ipv4.h> #include <linux/netfilter_ipv6.h> |
605dcad6c [NETFILTER]: nf_c... |
22 |
#include <net/netfilter/nf_conntrack_l4proto.h> |
f61801218 [NETFILTER]: nf_c... |
23 |
#include <net/netfilter/nf_conntrack_ecache.h> |
f01ffbd6e [NETFILTER]: nf_l... |
24 |
#include <net/netfilter/nf_log.h> |
9d2493f88 netfilter: remove... |
25 26 |
#include <net/netfilter/ipv4/nf_conntrack_ipv4.h> #include <net/netfilter/ipv6/nf_conntrack_ipv6.h> |
9fb9cbb10 [NETFILTER]: Add ... |
27 |
|
933a41e7e [NETFILTER]: nf_c... |
28 29 |
static unsigned int nf_ct_udp_timeout __read_mostly = 30*HZ; static unsigned int nf_ct_udp_timeout_stream __read_mostly = 180*HZ; |
9fb9cbb10 [NETFILTER]: Add ... |
30 |
|
09f263cd3 [NETFILTER]: nf_c... |
31 |
static bool udp_pkt_to_tuple(const struct sk_buff *skb, |
9fb9cbb10 [NETFILTER]: Add ... |
32 33 34 |
unsigned int dataoff, struct nf_conntrack_tuple *tuple) { |
da3f13c95 [NETFILTER]: nf_{... |
35 36 |
const struct udphdr *hp; struct udphdr _hdr; |
9fb9cbb10 [NETFILTER]: Add ... |
37 38 39 40 |
/* Actually only need first 8 bytes. */ hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr); if (hp == NULL) |
09f263cd3 [NETFILTER]: nf_c... |
41 |
return false; |
9fb9cbb10 [NETFILTER]: Add ... |
42 43 44 |
tuple->src.u.udp.port = hp->source; tuple->dst.u.udp.port = hp->dest; |
09f263cd3 [NETFILTER]: nf_c... |
45 |
return true; |
9fb9cbb10 [NETFILTER]: Add ... |
46 |
} |
09f263cd3 [NETFILTER]: nf_c... |
47 48 |
static bool udp_invert_tuple(struct nf_conntrack_tuple *tuple, const struct nf_conntrack_tuple *orig) |
9fb9cbb10 [NETFILTER]: Add ... |
49 50 51 |
{ tuple->src.u.udp.port = orig->dst.u.udp.port; tuple->dst.u.udp.port = orig->src.u.udp.port; |
09f263cd3 [NETFILTER]: nf_c... |
52 |
return true; |
9fb9cbb10 [NETFILTER]: Add ... |
53 54 55 56 57 58 59 60 61 62 |
} /* Print out the per-protocol part of the tuple. */ static int udp_print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple) { return seq_printf(s, "sport=%hu dport=%hu ", ntohs(tuple->src.u.udp.port), ntohs(tuple->dst.u.udp.port)); } |
9fb9cbb10 [NETFILTER]: Add ... |
63 |
/* Returns verdict for packet, and may modify conntracktype */ |
c88130bcd [NETFILTER]: nf_c... |
64 |
static int udp_packet(struct nf_conn *ct, |
9fb9cbb10 [NETFILTER]: Add ... |
65 66 67 |
const struct sk_buff *skb, unsigned int dataoff, enum ip_conntrack_info ctinfo, |
76108cea0 netfilter: Use un... |
68 |
u_int8_t pf, |
9fb9cbb10 [NETFILTER]: Add ... |
69 70 71 72 |
unsigned int hooknum) { /* If we've seen traffic both ways, this is some kind of UDP stream. Extend timeout. */ |
c88130bcd [NETFILTER]: nf_c... |
73 74 |
if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) { nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout_stream); |
9fb9cbb10 [NETFILTER]: Add ... |
75 |
/* Also, more likely to be important, and not a probe */ |
c88130bcd [NETFILTER]: nf_c... |
76 |
if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status)) |
a71996fcc netfilter: netns ... |
77 |
nf_conntrack_event_cache(IPCT_STATUS, ct); |
9fb9cbb10 [NETFILTER]: Add ... |
78 |
} else |
c88130bcd [NETFILTER]: nf_c... |
79 |
nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout); |
9fb9cbb10 [NETFILTER]: Add ... |
80 81 82 83 84 |
return NF_ACCEPT; } /* Called when a new connection for this protocol found. */ |
09f263cd3 [NETFILTER]: nf_c... |
85 86 |
static bool udp_new(struct nf_conn *ct, const struct sk_buff *skb, unsigned int dataoff) |
9fb9cbb10 [NETFILTER]: Add ... |
87 |
{ |
09f263cd3 [NETFILTER]: nf_c... |
88 |
return true; |
9fb9cbb10 [NETFILTER]: Add ... |
89 |
} |
74c51a149 netfilter: netns ... |
90 |
static int udp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff, |
9fb9cbb10 [NETFILTER]: Add ... |
91 |
enum ip_conntrack_info *ctinfo, |
76108cea0 netfilter: Use un... |
92 |
u_int8_t pf, |
96f6bf82e [NETFILTER]: Conv... |
93 |
unsigned int hooknum) |
9fb9cbb10 [NETFILTER]: Add ... |
94 95 |
{ unsigned int udplen = skb->len - dataoff; |
da3f13c95 [NETFILTER]: nf_{... |
96 97 |
const struct udphdr *hdr; struct udphdr _hdr; |
9fb9cbb10 [NETFILTER]: Add ... |
98 99 100 101 |
/* Header is too small? */ hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr); if (hdr == NULL) { |
c2a2c7e0c netfilter: netns ... |
102 |
if (LOG_INVALID(net, IPPROTO_UDP)) |
9fb9cbb10 [NETFILTER]: Add ... |
103 104 105 106 107 108 109 |
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, "nf_ct_udp: short packet "); return -NF_ACCEPT; } /* Truncated/malformed packets */ if (ntohs(hdr->len) > udplen || ntohs(hdr->len) < sizeof(*hdr)) { |
c2a2c7e0c netfilter: netns ... |
110 |
if (LOG_INVALID(net, IPPROTO_UDP)) |
9fb9cbb10 [NETFILTER]: Add ... |
111 112 113 114 115 116 117 118 119 120 121 |
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, "nf_ct_udp: truncated/malformed packet "); return -NF_ACCEPT; } /* Packet with no checksum */ if (!hdr->check) return NF_ACCEPT; /* Checksum invalid? Ignore. * We skip checking packets on the outgoing path |
84fa7933a [NET]: Replace CH... |
122 |
* because the checksum is assumed to be correct. |
9fb9cbb10 [NETFILTER]: Add ... |
123 |
* FIXME: Source route IP option packets --RR */ |
c04d05529 netfilter: netns ... |
124 |
if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING && |
96f6bf82e [NETFILTER]: Conv... |
125 |
nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) { |
c2a2c7e0c netfilter: netns ... |
126 |
if (LOG_INVALID(net, IPPROTO_UDP)) |
9fb9cbb10 [NETFILTER]: Add ... |
127 128 129 130 131 132 133 |
nf_log_packet(pf, 0, skb, NULL, NULL, NULL, "nf_ct_udp: bad UDP checksum "); return -NF_ACCEPT; } return NF_ACCEPT; } |
933a41e7e [NETFILTER]: nf_c... |
134 135 136 137 138 |
#ifdef CONFIG_SYSCTL static unsigned int udp_sysctl_table_users; static struct ctl_table_header *udp_sysctl_header; static struct ctl_table udp_sysctl_table[] = { { |
933a41e7e [NETFILTER]: nf_c... |
139 140 141 142 |
.procname = "nf_conntrack_udp_timeout", .data = &nf_ct_udp_timeout, .maxlen = sizeof(unsigned int), .mode = 0644, |
6d9f239a1 net: '&' redux |
143 |
.proc_handler = proc_dointvec_jiffies, |
933a41e7e [NETFILTER]: nf_c... |
144 145 |
}, { |
933a41e7e [NETFILTER]: nf_c... |
146 147 148 149 |
.procname = "nf_conntrack_udp_timeout_stream", .data = &nf_ct_udp_timeout_stream, .maxlen = sizeof(unsigned int), .mode = 0644, |
6d9f239a1 net: '&' redux |
150 |
.proc_handler = proc_dointvec_jiffies, |
933a41e7e [NETFILTER]: nf_c... |
151 152 153 154 155 |
}, { .ctl_name = 0 } }; |
a999e6837 [NETFILTER]: nf_c... |
156 157 158 |
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT static struct ctl_table udp_compat_sysctl_table[] = { { |
a999e6837 [NETFILTER]: nf_c... |
159 160 161 162 |
.procname = "ip_conntrack_udp_timeout", .data = &nf_ct_udp_timeout, .maxlen = sizeof(unsigned int), .mode = 0644, |
6d9f239a1 net: '&' redux |
163 |
.proc_handler = proc_dointvec_jiffies, |
a999e6837 [NETFILTER]: nf_c... |
164 165 |
}, { |
a999e6837 [NETFILTER]: nf_c... |
166 167 168 169 |
.procname = "ip_conntrack_udp_timeout_stream", .data = &nf_ct_udp_timeout_stream, .maxlen = sizeof(unsigned int), .mode = 0644, |
6d9f239a1 net: '&' redux |
170 |
.proc_handler = proc_dointvec_jiffies, |
a999e6837 [NETFILTER]: nf_c... |
171 172 173 174 175 176 |
}, { .ctl_name = 0 } }; #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */ |
933a41e7e [NETFILTER]: nf_c... |
177 |
#endif /* CONFIG_SYSCTL */ |
61075af51 [NETFILTER]: nf_c... |
178 |
struct nf_conntrack_l4proto nf_conntrack_l4proto_udp4 __read_mostly = |
9fb9cbb10 [NETFILTER]: Add ... |
179 180 |
{ .l3proto = PF_INET, |
605dcad6c [NETFILTER]: nf_c... |
181 |
.l4proto = IPPROTO_UDP, |
9fb9cbb10 [NETFILTER]: Add ... |
182 183 184 185 |
.name = "udp", .pkt_to_tuple = udp_pkt_to_tuple, .invert_tuple = udp_invert_tuple, .print_tuple = udp_print_tuple, |
9fb9cbb10 [NETFILTER]: Add ... |
186 187 |
.packet = udp_packet, .new = udp_new, |
96f6bf82e [NETFILTER]: Conv... |
188 |
.error = udp_error, |
e281db5cd [NETFILTER]: nf_c... |
189 |
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE) |
fdf708322 [NETFILTER]: nfne... |
190 191 |
.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr, .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple, |
a400c30ed netfilter: nf_con... |
192 |
.nlattr_tuple_size = nf_ct_port_nlattr_tuple_size, |
f73e924cd [NETFILTER]: ctne... |
193 |
.nla_policy = nf_ct_port_nla_policy, |
c1d10adb4 [NETFILTER]: Add ... |
194 |
#endif |
933a41e7e [NETFILTER]: nf_c... |
195 196 197 198 |
#ifdef CONFIG_SYSCTL .ctl_table_users = &udp_sysctl_table_users, .ctl_table_header = &udp_sysctl_header, .ctl_table = udp_sysctl_table, |
a999e6837 [NETFILTER]: nf_c... |
199 200 201 |
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT .ctl_compat_table = udp_compat_sysctl_table, #endif |
933a41e7e [NETFILTER]: nf_c... |
202 |
#endif |
9fb9cbb10 [NETFILTER]: Add ... |
203 |
}; |
13b183391 [NETFILTER]: nf_c... |
204 |
EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_udp4); |
9fb9cbb10 [NETFILTER]: Add ... |
205 |
|
61075af51 [NETFILTER]: nf_c... |
206 |
struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6 __read_mostly = |
9fb9cbb10 [NETFILTER]: Add ... |
207 208 |
{ .l3proto = PF_INET6, |
605dcad6c [NETFILTER]: nf_c... |
209 |
.l4proto = IPPROTO_UDP, |
9fb9cbb10 [NETFILTER]: Add ... |
210 211 212 213 |
.name = "udp", .pkt_to_tuple = udp_pkt_to_tuple, .invert_tuple = udp_invert_tuple, .print_tuple = udp_print_tuple, |
9fb9cbb10 [NETFILTER]: Add ... |
214 215 |
.packet = udp_packet, .new = udp_new, |
96f6bf82e [NETFILTER]: Conv... |
216 |
.error = udp_error, |
e281db5cd [NETFILTER]: nf_c... |
217 |
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE) |
fdf708322 [NETFILTER]: nfne... |
218 219 |
.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr, .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple, |
a400c30ed netfilter: nf_con... |
220 |
.nlattr_tuple_size = nf_ct_port_nlattr_tuple_size, |
f73e924cd [NETFILTER]: ctne... |
221 |
.nla_policy = nf_ct_port_nla_policy, |
c1d10adb4 [NETFILTER]: Add ... |
222 |
#endif |
933a41e7e [NETFILTER]: nf_c... |
223 224 225 226 227 |
#ifdef CONFIG_SYSCTL .ctl_table_users = &udp_sysctl_table_users, .ctl_table_header = &udp_sysctl_header, .ctl_table = udp_sysctl_table, #endif |
9fb9cbb10 [NETFILTER]: Add ... |
228 |
}; |
13b183391 [NETFILTER]: nf_c... |
229 |
EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_udp6); |