2 * Connection tracking protocol helper module for SCTP.
4 * SCTP is defined in RFC 2960. References to various sections in this code
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
13 * Added support for proc manipulation of timeouts.
16 #include <linux/types.h>
17 #include <linux/sched.h>
18 #include <linux/timer.h>
19 #include <linux/netfilter.h>
20 #include <linux/module.h>
23 #include <linux/sctp.h>
24 #include <linux/string.h>
25 #include <linux/seq_file.h>
27 #include <linux/netfilter_ipv4/ip_conntrack.h>
28 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
29 #include <linux/netfilter_ipv4/lockhelp.h>
32 #define DEBUGP(format, ...) printk(format, ## __VA_ARGS__)
34 #define DEBUGP(format, args...)
37 /* Protects conntrack->proto.sctp */
38 static DECLARE_RWLOCK(sctp_lock);
40 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
41 closely. They're more complex. --RR
43 And so for me for SCTP :D -Kiran */
45 static const char *sctp_conntrack_names[] = {
57 #define MINS * 60 SECS
58 #define HOURS * 60 MINS
59 #define DAYS * 24 HOURS
61 static unsigned long ip_ct_sctp_timeout_closed = 10 SECS;
62 static unsigned long ip_ct_sctp_timeout_cookie_wait = 3 SECS;
63 static unsigned long ip_ct_sctp_timeout_cookie_echoed = 3 SECS;
64 static unsigned long ip_ct_sctp_timeout_established = 5 DAYS;
65 static unsigned long ip_ct_sctp_timeout_shutdown_sent = 300 SECS / 1000;
66 static unsigned long ip_ct_sctp_timeout_shutdown_recd = 300 SECS / 1000;
67 static unsigned long ip_ct_sctp_timeout_shutdown_ack_sent = 3 SECS;
69 static unsigned long * sctp_timeouts[]
70 = { NULL, /* SCTP_CONNTRACK_NONE */
71 &ip_ct_sctp_timeout_closed, /* SCTP_CONNTRACK_CLOSED */
72 &ip_ct_sctp_timeout_cookie_wait, /* SCTP_CONNTRACK_COOKIE_WAIT */
73 &ip_ct_sctp_timeout_cookie_echoed, /* SCTP_CONNTRACK_COOKIE_ECHOED */
74 &ip_ct_sctp_timeout_established, /* SCTP_CONNTRACK_ESTABLISHED */
75 &ip_ct_sctp_timeout_shutdown_sent, /* SCTP_CONNTRACK_SHUTDOWN_SENT */
76 &ip_ct_sctp_timeout_shutdown_recd, /* SCTP_CONNTRACK_SHUTDOWN_RECD */
77 &ip_ct_sctp_timeout_shutdown_ack_sent /* SCTP_CONNTRACK_SHUTDOWN_ACK_SENT */
80 #define sNO SCTP_CONNTRACK_NONE
81 #define sCL SCTP_CONNTRACK_CLOSED
82 #define sCW SCTP_CONNTRACK_COOKIE_WAIT
83 #define sCE SCTP_CONNTRACK_COOKIE_ECHOED
84 #define sES SCTP_CONNTRACK_ESTABLISHED
85 #define sSS SCTP_CONNTRACK_SHUTDOWN_SENT
86 #define sSR SCTP_CONNTRACK_SHUTDOWN_RECD
87 #define sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
88 #define sIV SCTP_CONNTRACK_MAX
91 These are the descriptions of the states:
93 NOTE: These state names are tantalizingly similar to the states of an
94 SCTP endpoint. But the interpretation of the states is a little different,
95 considering that these are the states of the connection and not of an end
96 point. Please note the subtleties. -Kiran
98 NONE - Nothing so far.
99 COOKIE WAIT - We have seen an INIT chunk in the original direction, or also
100 an INIT_ACK chunk in the reply direction.
101 COOKIE ECHOED - We have seen a COOKIE_ECHO chunk in the original direction.
102 ESTABLISHED - We have seen a COOKIE_ACK in the reply direction.
103 SHUTDOWN_SENT - We have seen a SHUTDOWN chunk in the original direction.
104 SHUTDOWN_RECD - We have seen a SHUTDOWN chunk in the reply directoin.
105 SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
106 to that of the SHUTDOWN chunk.
107 CLOSED - We have seen a SHUTDOWN_COMPLETE chunk in the direction of
108 the SHUTDOWN chunk. Connection is closed.
112 - I have assumed that the first INIT is in the original direction.
113 This messes things when an INIT comes in the reply direction in CLOSED
115 - Check the error type in the reply dir before transitioning from
116 cookie echoed to closed.
117 - Sec 5.2.4 of RFC 2960
118 - Multi Homing support.
121 /* SCTP conntrack state transitions */
122 static enum sctp_conntrack sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
125 /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
126 /* init */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA},
127 /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},
128 /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
129 /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA},
130 /* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA},
131 /* error */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant have Stale cookie*/
132 /* cookie_echo */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA},/* 5.2.4 - Big TODO */
133 /* cookie_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in orig dir */
134 /* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL}
138 /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
139 /* init */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* INIT in sCL Big TODO */
140 /* init_ack */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},
141 /* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
142 /* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA},
143 /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA},
144 /* error */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA},
145 /* cookie_echo */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in reply dir */
146 /* cookie_ack */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA},
147 /* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL}
151 static int sctp_pkt_to_tuple(const struct sk_buff *skb,
152 unsigned int dataoff,
153 struct ip_conntrack_tuple *tuple)
155 sctp_sctphdr_t _hdr, *hp;
157 DEBUGP(__FUNCTION__);
160 /* Actually only need first 8 bytes. */
161 hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
165 tuple->src.u.sctp.port = hp->source;
166 tuple->dst.u.sctp.port = hp->dest;
170 static int sctp_invert_tuple(struct ip_conntrack_tuple *tuple,
171 const struct ip_conntrack_tuple *orig)
173 DEBUGP(__FUNCTION__);
176 tuple->src.u.sctp.port = orig->dst.u.sctp.port;
177 tuple->dst.u.sctp.port = orig->src.u.sctp.port;
181 /* Print out the per-protocol part of the tuple. */
182 static int sctp_print_tuple(struct seq_file *s,
183 const struct ip_conntrack_tuple *tuple)
185 DEBUGP(__FUNCTION__);
188 return seq_printf(s, "sport=%hu dport=%hu ",
189 ntohs(tuple->src.u.sctp.port),
190 ntohs(tuple->dst.u.sctp.port));
193 /* Print out the private part of the conntrack. */
194 static int sctp_print_conntrack(struct seq_file *s,
195 const struct ip_conntrack *conntrack)
197 enum sctp_conntrack state;
199 DEBUGP(__FUNCTION__);
202 READ_LOCK(&sctp_lock);
203 state = conntrack->proto.sctp.state;
204 READ_UNLOCK(&sctp_lock);
206 return seq_printf(s, "%s ", sctp_conntrack_names[state]);
209 #define for_each_sctp_chunk(skb, sch, _sch, offset, count) \
210 for (offset = skb->nh.iph->ihl * 4 + sizeof(sctp_sctphdr_t), count = 0; \
211 offset < skb->len && \
212 (sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch)); \
213 offset += (htons(sch->length) + 3) & ~3, count++)
215 /* Some validity checks to make sure the chunks are fine */
216 static int do_basic_checks(struct ip_conntrack *conntrack,
217 const struct sk_buff *skb,
220 u_int32_t offset, count;
221 sctp_chunkhdr_t _sch, *sch;
224 DEBUGP(__FUNCTION__);
229 for_each_sctp_chunk (skb, sch, _sch, offset, count) {
230 DEBUGP("Chunk Num: %d Type: %d\n", count, sch->type);
232 if (sch->type == SCTP_CID_INIT
233 || sch->type == SCTP_CID_INIT_ACK
234 || sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
238 /* Cookie Ack/Echo chunks not the first OR
239 Init / Init Ack / Shutdown compl chunks not the only chunks */
240 if ((sch->type == SCTP_CID_COOKIE_ACK
241 || sch->type == SCTP_CID_COOKIE_ECHO
244 DEBUGP("Basic checks failed\n");
249 set_bit(sch->type, (void *)map);
253 DEBUGP("Basic checks passed\n");
257 static int new_state(enum ip_conntrack_dir dir,
258 enum sctp_conntrack cur_state,
263 DEBUGP(__FUNCTION__);
266 DEBUGP("Chunk type: %d\n", chunk_type);
268 switch (chunk_type) {
270 DEBUGP("SCTP_CID_INIT\n");
272 case SCTP_CID_INIT_ACK:
273 DEBUGP("SCTP_CID_INIT_ACK\n");
276 DEBUGP("SCTP_CID_ABORT\n");
278 case SCTP_CID_SHUTDOWN:
279 DEBUGP("SCTP_CID_SHUTDOWN\n");
281 case SCTP_CID_SHUTDOWN_ACK:
282 DEBUGP("SCTP_CID_SHUTDOWN_ACK\n");
285 DEBUGP("SCTP_CID_ERROR\n");
287 case SCTP_CID_COOKIE_ECHO:
288 DEBUGP("SCTP_CID_COOKIE_ECHO\n");
290 case SCTP_CID_COOKIE_ACK:
291 DEBUGP("SCTP_CID_COOKIE_ACK\n");
293 case SCTP_CID_SHUTDOWN_COMPLETE:
294 DEBUGP("SCTP_CID_SHUTDOWN_COMPLETE\n");
297 /* Other chunks like DATA, SACK, HEARTBEAT and
298 its ACK do not cause a change in state */
299 DEBUGP("Unknown chunk type, Will stay in %s\n",
300 sctp_conntrack_names[cur_state]);
304 DEBUGP("dir: %d cur_state: %s chunk_type: %d new_state: %s\n",
305 dir, sctp_conntrack_names[cur_state], chunk_type,
306 sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);
308 return sctp_conntracks[dir][i][cur_state];
311 /* Returns verdict for packet, or -1 for invalid. */
312 static int sctp_packet(struct ip_conntrack *conntrack,
313 const struct sk_buff *skb,
314 enum ip_conntrack_info ctinfo)
316 enum sctp_conntrack newconntrack, oldsctpstate;
317 struct iphdr *iph = skb->nh.iph;
318 sctp_sctphdr_t _sctph, *sh;
319 sctp_chunkhdr_t _sch, *sch;
320 u_int32_t offset, count;
321 char map[256 / sizeof (char)] = {0};
323 DEBUGP(__FUNCTION__);
326 sh = skb_header_pointer(skb, iph->ihl * 4, sizeof(_sctph), &_sctph);
330 if (do_basic_checks(conntrack, skb, map) != 0)
333 /* Check the verification tag (Sec 8.5) */
334 if (!test_bit(SCTP_CID_INIT, (void *)map)
335 && !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, (void *)map)
336 && !test_bit(SCTP_CID_COOKIE_ECHO, (void *)map)
337 && !test_bit(SCTP_CID_ABORT, (void *)map)
338 && !test_bit(SCTP_CID_SHUTDOWN_ACK, (void *)map)
339 && (sh->vtag != conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
340 DEBUGP("Verification tag check failed\n");
344 oldsctpstate = newconntrack = SCTP_CONNTRACK_MAX;
345 for_each_sctp_chunk (skb, sch, _sch, offset, count) {
346 WRITE_LOCK(&sctp_lock);
348 /* Special cases of Verification tag check (Sec 8.5.1) */
349 if (sch->type == SCTP_CID_INIT) {
352 WRITE_UNLOCK(&sctp_lock);
355 } else if (sch->type == SCTP_CID_ABORT) {
357 if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
358 && !(sh->vtag == conntrack->proto.sctp.vtag
359 [1 - CTINFO2DIR(ctinfo)])) {
360 WRITE_UNLOCK(&sctp_lock);
363 } else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
365 if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
366 && !(sh->vtag == conntrack->proto.sctp.vtag
367 [1 - CTINFO2DIR(ctinfo)]
368 && (sch->flags & 1))) {
369 WRITE_UNLOCK(&sctp_lock);
372 } else if (sch->type == SCTP_CID_COOKIE_ECHO) {
374 if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
375 WRITE_UNLOCK(&sctp_lock);
380 oldsctpstate = conntrack->proto.sctp.state;
381 newconntrack = new_state(CTINFO2DIR(ctinfo), oldsctpstate, sch->type);
384 if (newconntrack == SCTP_CONNTRACK_MAX) {
385 DEBUGP("ip_conntrack_sctp: Invalid dir=%i ctype=%u conntrack=%u\n",
386 CTINFO2DIR(ctinfo), sch->type, oldsctpstate);
387 WRITE_UNLOCK(&sctp_lock);
391 /* If it is an INIT or an INIT ACK note down the vtag */
392 if (sch->type == SCTP_CID_INIT
393 || sch->type == SCTP_CID_INIT_ACK) {
394 sctp_inithdr_t _inithdr, *ih;
396 ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
397 sizeof(_inithdr), &_inithdr);
399 WRITE_UNLOCK(&sctp_lock);
402 DEBUGP("Setting vtag %x for dir %d\n",
403 ih->init_tag, !CTINFO2DIR(ctinfo));
404 conntrack->proto.sctp.vtag[!CTINFO2DIR(ctinfo)] = ih->init_tag;
407 conntrack->proto.sctp.state = newconntrack;
408 WRITE_UNLOCK(&sctp_lock);
411 ip_ct_refresh_acct(conntrack, ctinfo, skb, *sctp_timeouts[newconntrack]);
413 if (oldsctpstate == SCTP_CONNTRACK_COOKIE_ECHOED
414 && CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY
415 && newconntrack == SCTP_CONNTRACK_ESTABLISHED) {
416 DEBUGP("Setting assured bit\n");
417 set_bit(IPS_ASSURED_BIT, &conntrack->status);
423 /* Called when a new connection for this protocol found. */
424 static int sctp_new(struct ip_conntrack *conntrack,
425 const struct sk_buff *skb)
427 enum sctp_conntrack newconntrack;
428 struct iphdr *iph = skb->nh.iph;
429 sctp_sctphdr_t _sctph, *sh;
430 sctp_chunkhdr_t _sch, *sch;
431 u_int32_t offset, count;
432 char map[256 / sizeof (char)] = {0};
434 DEBUGP(__FUNCTION__);
437 sh = skb_header_pointer(skb, iph->ihl * 4, sizeof(_sctph), &_sctph);
441 if (do_basic_checks(conntrack, skb, map) != 0)
444 /* If an OOTB packet has any of these chunks discard (Sec 8.4) */
445 if ((test_bit (SCTP_CID_ABORT, (void *)map))
446 || (test_bit (SCTP_CID_SHUTDOWN_COMPLETE, (void *)map))
447 || (test_bit (SCTP_CID_COOKIE_ACK, (void *)map))) {
451 newconntrack = SCTP_CONNTRACK_MAX;
452 for_each_sctp_chunk (skb, sch, _sch, offset, count) {
453 /* Don't need lock here: this conntrack not in circulation yet */
454 newconntrack = new_state (IP_CT_DIR_ORIGINAL,
455 SCTP_CONNTRACK_NONE, sch->type);
457 /* Invalid: delete conntrack */
458 if (newconntrack == SCTP_CONNTRACK_MAX) {
459 DEBUGP("ip_conntrack_sctp: invalid new deleting.\n");
463 /* Copy the vtag into the state info */
464 if (sch->type == SCTP_CID_INIT) {
466 sctp_inithdr_t _inithdr, *ih;
468 ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
469 sizeof(_inithdr), &_inithdr);
473 DEBUGP("Setting vtag %x for new conn\n",
476 conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] =
483 /* If it is a shutdown ack OOTB packet, we expect a return
484 shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
486 DEBUGP("Setting vtag %x for new conn OOTB\n",
488 conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
491 conntrack->proto.sctp.state = newconntrack;
497 static struct ip_conntrack_protocol ip_conntrack_protocol_sctp = {
498 .proto = IPPROTO_SCTP,
500 .pkt_to_tuple = sctp_pkt_to_tuple,
501 .invert_tuple = sctp_invert_tuple,
502 .print_tuple = sctp_print_tuple,
503 .print_conntrack = sctp_print_conntrack,
504 .packet = sctp_packet,
511 static ctl_table ip_ct_sysctl_table[] = {
513 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_CLOSED,
514 .procname = "ip_conntrack_sctp_timeout_closed",
515 .data = &ip_ct_sctp_timeout_closed,
516 .maxlen = sizeof(unsigned int),
518 .proc_handler = &proc_dointvec_jiffies,
521 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_WAIT,
522 .procname = "ip_conntrack_sctp_timeout_cookie_wait",
523 .data = &ip_ct_sctp_timeout_cookie_wait,
524 .maxlen = sizeof(unsigned int),
526 .proc_handler = &proc_dointvec_jiffies,
529 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_ECHOED,
530 .procname = "ip_conntrack_sctp_timeout_cookie_echoed",
531 .data = &ip_ct_sctp_timeout_cookie_echoed,
532 .maxlen = sizeof(unsigned int),
534 .proc_handler = &proc_dointvec_jiffies,
537 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_ESTABLISHED,
538 .procname = "ip_conntrack_sctp_timeout_established",
539 .data = &ip_ct_sctp_timeout_established,
540 .maxlen = sizeof(unsigned int),
542 .proc_handler = &proc_dointvec_jiffies,
545 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_SENT,
546 .procname = "ip_conntrack_sctp_timeout_shutdown_sent",
547 .data = &ip_ct_sctp_timeout_shutdown_sent,
548 .maxlen = sizeof(unsigned int),
550 .proc_handler = &proc_dointvec_jiffies,
553 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_RECD,
554 .procname = "ip_conntrack_sctp_timeout_shutdown_recd",
555 .data = &ip_ct_sctp_timeout_shutdown_recd,
556 .maxlen = sizeof(unsigned int),
558 .proc_handler = &proc_dointvec_jiffies,
561 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_ACK_SENT,
562 .procname = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
563 .data = &ip_ct_sctp_timeout_shutdown_ack_sent,
564 .maxlen = sizeof(unsigned int),
566 .proc_handler = &proc_dointvec_jiffies,
571 static ctl_table ip_ct_netfilter_table[] = {
573 .ctl_name = NET_IPV4_NETFILTER,
574 .procname = "netfilter",
576 .child = ip_ct_sysctl_table,
581 static ctl_table ip_ct_ipv4_table[] = {
583 .ctl_name = NET_IPV4,
586 .child = ip_ct_netfilter_table,
591 static ctl_table ip_ct_net_table[] = {
596 .child = ip_ct_ipv4_table,
601 static struct ctl_table_header *ip_ct_sysctl_header;
604 static int __init init(void)
608 ret = ip_conntrack_protocol_register(&ip_conntrack_protocol_sctp);
610 printk("ip_conntrack_proto_sctp: protocol register failed\n");
615 ip_ct_sysctl_header = register_sysctl_table(ip_ct_net_table, 0);
616 if (ip_ct_sysctl_header == NULL) {
618 printk("ip_conntrack_proto_sctp: can't register to sysctl.\n");
627 ip_conntrack_protocol_unregister(&ip_conntrack_protocol_sctp);
630 DEBUGP("SCTP conntrack module loading %s\n",
631 ret ? "failed": "succeeded");
635 static void __exit fini(void)
637 ip_conntrack_protocol_unregister(&ip_conntrack_protocol_sctp);
639 unregister_sysctl_table(ip_ct_sysctl_header);
641 DEBUGP("SCTP conntrack module unloaded\n");
647 MODULE_LICENSE("GPL");
648 MODULE_AUTHOR("Kiran Kumar Immidi");
649 MODULE_DESCRIPTION("Netfilter connection tracking protocol helper for SCTP");