2 * Connection tracking protocol helper module for SCTP.
4 * SCTP is defined in RFC 2960. References to various sections in this code
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
13 * Added support for proc manipulation of timeouts.
16 #include <linux/types.h>
17 #include <linux/sched.h>
18 #include <linux/timer.h>
19 #include <linux/netfilter.h>
20 #include <linux/module.h>
23 #include <linux/sctp.h>
24 #include <linux/string.h>
25 #include <linux/seq_file.h>
27 #include <linux/netfilter_ipv4/ip_conntrack.h>
28 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
29 #include <linux/netfilter_ipv4/lockhelp.h>
32 #define DEBUGP(format, ...) printk(format, ## __VA_ARGS__)
34 #define DEBUGP(format, args...)
37 /* Protects conntrack->proto.sctp */
38 static DECLARE_RWLOCK(sctp_lock);
40 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
41 closely. They're more complex. --RR
43 And so for me for SCTP :D -Kiran */
45 static const char *sctp_conntrack_names[] = {
57 #define MINS * 60 SECS
58 #define HOURS * 60 MINS
59 #define DAYS * 24 HOURS
61 static unsigned long ip_ct_sctp_timeout_closed = 10 SECS;
62 static unsigned long ip_ct_sctp_timeout_cookie_wait = 3 SECS;
63 static unsigned long ip_ct_sctp_timeout_cookie_echoed = 3 SECS;
65 static unsigned long ip_ct_sctp_timeout_established = 5U DAYS;
67 static unsigned long ip_ct_sctp_timeout_established = 2U DAYS;
69 static unsigned long ip_ct_sctp_timeout_shutdown_sent = 300 SECS / 1000;
70 static unsigned long ip_ct_sctp_timeout_shutdown_recd = 300 SECS / 1000;
71 static unsigned long ip_ct_sctp_timeout_shutdown_ack_sent = 3 SECS;
73 static unsigned long * sctp_timeouts[]
74 = { NULL, /* SCTP_CONNTRACK_NONE */
75 &ip_ct_sctp_timeout_closed, /* SCTP_CONNTRACK_CLOSED */
76 &ip_ct_sctp_timeout_cookie_wait, /* SCTP_CONNTRACK_COOKIE_WAIT */
77 &ip_ct_sctp_timeout_cookie_echoed, /* SCTP_CONNTRACK_COOKIE_ECHOED */
78 &ip_ct_sctp_timeout_established, /* SCTP_CONNTRACK_ESTABLISHED */
79 &ip_ct_sctp_timeout_shutdown_sent, /* SCTP_CONNTRACK_SHUTDOWN_SENT */
80 &ip_ct_sctp_timeout_shutdown_recd, /* SCTP_CONNTRACK_SHUTDOWN_RECD */
81 &ip_ct_sctp_timeout_shutdown_ack_sent /* SCTP_CONNTRACK_SHUTDOWN_ACK_SENT */
84 #define sNO SCTP_CONNTRACK_NONE
85 #define sCL SCTP_CONNTRACK_CLOSED
86 #define sCW SCTP_CONNTRACK_COOKIE_WAIT
87 #define sCE SCTP_CONNTRACK_COOKIE_ECHOED
88 #define sES SCTP_CONNTRACK_ESTABLISHED
89 #define sSS SCTP_CONNTRACK_SHUTDOWN_SENT
90 #define sSR SCTP_CONNTRACK_SHUTDOWN_RECD
91 #define sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
92 #define sIV SCTP_CONNTRACK_MAX
95 These are the descriptions of the states:
97 NOTE: These state names are tantalizingly similar to the states of an
98 SCTP endpoint. But the interpretation of the states is a little different,
99 considering that these are the states of the connection and not of an end
100 point. Please note the subtleties. -Kiran
102 NONE - Nothing so far.
103 COOKIE WAIT - We have seen an INIT chunk in the original direction, or also
104 an INIT_ACK chunk in the reply direction.
105 COOKIE ECHOED - We have seen a COOKIE_ECHO chunk in the original direction.
106 ESTABLISHED - We have seen a COOKIE_ACK in the reply direction.
107 SHUTDOWN_SENT - We have seen a SHUTDOWN chunk in the original direction.
108 SHUTDOWN_RECD - We have seen a SHUTDOWN chunk in the reply directoin.
109 SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
110 to that of the SHUTDOWN chunk.
111 CLOSED - We have seen a SHUTDOWN_COMPLETE chunk in the direction of
112 the SHUTDOWN chunk. Connection is closed.
116 - I have assumed that the first INIT is in the original direction.
117 This messes things when an INIT comes in the reply direction in CLOSED
119 - Check the error type in the reply dir before transitioning from
120 cookie echoed to closed.
121 - Sec 5.2.4 of RFC 2960
122 - Multi Homing support.
125 /* SCTP conntrack state transitions */
126 static enum sctp_conntrack sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
129 /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
130 /* init */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA},
131 /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},
132 /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
133 /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA},
134 /* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA},
135 /* error */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant have Stale cookie*/
136 /* cookie_echo */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA},/* 5.2.4 - Big TODO */
137 /* cookie_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in orig dir */
138 /* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL}
142 /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
143 /* init */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* INIT in sCL Big TODO */
144 /* init_ack */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},
145 /* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
146 /* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA},
147 /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA},
148 /* error */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA},
149 /* cookie_echo */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in reply dir */
150 /* cookie_ack */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA},
151 /* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL}
155 static int sctp_pkt_to_tuple(const struct sk_buff *skb,
156 unsigned int dataoff,
157 struct ip_conntrack_tuple *tuple)
159 sctp_sctphdr_t _hdr, *hp;
161 DEBUGP(__FUNCTION__);
164 /* Actually only need first 8 bytes. */
165 hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
169 tuple->src.u.sctp.port = hp->source;
170 tuple->dst.u.sctp.port = hp->dest;
174 static int sctp_invert_tuple(struct ip_conntrack_tuple *tuple,
175 const struct ip_conntrack_tuple *orig)
177 DEBUGP(__FUNCTION__);
180 tuple->src.u.sctp.port = orig->dst.u.sctp.port;
181 tuple->dst.u.sctp.port = orig->src.u.sctp.port;
185 /* Print out the per-protocol part of the tuple. */
186 static int sctp_print_tuple(struct seq_file *s,
187 const struct ip_conntrack_tuple *tuple)
189 DEBUGP(__FUNCTION__);
192 return seq_printf(s, "sport=%hu dport=%hu ",
193 ntohs(tuple->src.u.sctp.port),
194 ntohs(tuple->dst.u.sctp.port));
197 /* Print out the private part of the conntrack. */
198 static int sctp_print_conntrack(struct seq_file *s,
199 const struct ip_conntrack *conntrack)
201 enum sctp_conntrack state;
203 DEBUGP(__FUNCTION__);
206 READ_LOCK(&sctp_lock);
207 state = conntrack->proto.sctp.state;
208 READ_UNLOCK(&sctp_lock);
210 return seq_printf(s, "%s ", sctp_conntrack_names[state]);
213 #define for_each_sctp_chunk(skb, sch, _sch, offset, count) \
214 for (offset = skb->nh.iph->ihl * 4 + sizeof(sctp_sctphdr_t), count = 0; \
215 offset < skb->len && \
216 (sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch)); \
217 offset += (htons(sch->length) + 3) & ~3, count++)
219 /* Some validity checks to make sure the chunks are fine */
220 static int do_basic_checks(struct ip_conntrack *conntrack,
221 const struct sk_buff *skb,
224 u_int32_t offset, count;
225 sctp_chunkhdr_t _sch, *sch;
228 DEBUGP(__FUNCTION__);
233 for_each_sctp_chunk (skb, sch, _sch, offset, count) {
234 DEBUGP("Chunk Num: %d Type: %d\n", count, sch->type);
236 if (sch->type == SCTP_CID_INIT
237 || sch->type == SCTP_CID_INIT_ACK
238 || sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
242 /* Cookie Ack/Echo chunks not the first OR
243 Init / Init Ack / Shutdown compl chunks not the only chunks */
244 if ((sch->type == SCTP_CID_COOKIE_ACK
245 || sch->type == SCTP_CID_COOKIE_ECHO
248 DEBUGP("Basic checks failed\n");
253 set_bit(sch->type, (void *)map);
257 DEBUGP("Basic checks passed\n");
261 static int new_state(enum ip_conntrack_dir dir,
262 enum sctp_conntrack cur_state,
267 DEBUGP(__FUNCTION__);
270 DEBUGP("Chunk type: %d\n", chunk_type);
272 switch (chunk_type) {
274 DEBUGP("SCTP_CID_INIT\n");
276 case SCTP_CID_INIT_ACK:
277 DEBUGP("SCTP_CID_INIT_ACK\n");
280 DEBUGP("SCTP_CID_ABORT\n");
282 case SCTP_CID_SHUTDOWN:
283 DEBUGP("SCTP_CID_SHUTDOWN\n");
285 case SCTP_CID_SHUTDOWN_ACK:
286 DEBUGP("SCTP_CID_SHUTDOWN_ACK\n");
289 DEBUGP("SCTP_CID_ERROR\n");
291 case SCTP_CID_COOKIE_ECHO:
292 DEBUGP("SCTP_CID_COOKIE_ECHO\n");
294 case SCTP_CID_COOKIE_ACK:
295 DEBUGP("SCTP_CID_COOKIE_ACK\n");
297 case SCTP_CID_SHUTDOWN_COMPLETE:
298 DEBUGP("SCTP_CID_SHUTDOWN_COMPLETE\n");
301 /* Other chunks like DATA, SACK, HEARTBEAT and
302 its ACK do not cause a change in state */
303 DEBUGP("Unknown chunk type, Will stay in %s\n",
304 sctp_conntrack_names[cur_state]);
308 DEBUGP("dir: %d cur_state: %s chunk_type: %d new_state: %s\n",
309 dir, sctp_conntrack_names[cur_state], chunk_type,
310 sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);
312 return sctp_conntracks[dir][i][cur_state];
315 /* Returns verdict for packet, or -1 for invalid. */
316 static int sctp_packet(struct ip_conntrack *conntrack,
317 const struct sk_buff *skb,
318 enum ip_conntrack_info ctinfo)
320 enum sctp_conntrack newconntrack, oldsctpstate;
321 struct iphdr *iph = skb->nh.iph;
322 sctp_sctphdr_t _sctph, *sh;
323 sctp_chunkhdr_t _sch, *sch;
324 u_int32_t offset, count;
325 char map[256 / sizeof (char)] = {0};
327 DEBUGP(__FUNCTION__);
330 sh = skb_header_pointer(skb, iph->ihl * 4, sizeof(_sctph), &_sctph);
334 if (do_basic_checks(conntrack, skb, map) != 0)
337 /* Check the verification tag (Sec 8.5) */
338 if (!test_bit(SCTP_CID_INIT, (void *)map)
339 && !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, (void *)map)
340 && !test_bit(SCTP_CID_COOKIE_ECHO, (void *)map)
341 && !test_bit(SCTP_CID_ABORT, (void *)map)
342 && !test_bit(SCTP_CID_SHUTDOWN_ACK, (void *)map)
343 && (sh->vtag != conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
344 DEBUGP("Verification tag check failed\n");
348 oldsctpstate = newconntrack = SCTP_CONNTRACK_MAX;
349 for_each_sctp_chunk (skb, sch, _sch, offset, count) {
350 WRITE_LOCK(&sctp_lock);
352 /* Special cases of Verification tag check (Sec 8.5.1) */
353 if (sch->type == SCTP_CID_INIT) {
356 WRITE_UNLOCK(&sctp_lock);
359 } else if (sch->type == SCTP_CID_ABORT) {
361 if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
362 && !(sh->vtag == conntrack->proto.sctp.vtag
363 [1 - CTINFO2DIR(ctinfo)])) {
364 WRITE_UNLOCK(&sctp_lock);
367 } else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
369 if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
370 && !(sh->vtag == conntrack->proto.sctp.vtag
371 [1 - CTINFO2DIR(ctinfo)]
372 && (sch->flags & 1))) {
373 WRITE_UNLOCK(&sctp_lock);
376 } else if (sch->type == SCTP_CID_COOKIE_ECHO) {
378 if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
379 WRITE_UNLOCK(&sctp_lock);
384 oldsctpstate = conntrack->proto.sctp.state;
385 newconntrack = new_state(CTINFO2DIR(ctinfo), oldsctpstate, sch->type);
388 if (newconntrack == SCTP_CONNTRACK_MAX) {
389 DEBUGP("ip_conntrack_sctp: Invalid dir=%i ctype=%u conntrack=%u\n",
390 CTINFO2DIR(ctinfo), sch->type, oldsctpstate);
391 WRITE_UNLOCK(&sctp_lock);
395 /* If it is an INIT or an INIT ACK note down the vtag */
396 if (sch->type == SCTP_CID_INIT
397 || sch->type == SCTP_CID_INIT_ACK) {
398 sctp_inithdr_t _inithdr, *ih;
400 ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
401 sizeof(_inithdr), &_inithdr);
403 WRITE_UNLOCK(&sctp_lock);
406 DEBUGP("Setting vtag %x for dir %d\n",
407 ih->init_tag, CTINFO2DIR(ctinfo));
408 conntrack->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] = ih->init_tag;
411 conntrack->proto.sctp.state = newconntrack;
412 WRITE_UNLOCK(&sctp_lock);
415 ip_ct_refresh_acct(conntrack, ctinfo, skb, *sctp_timeouts[newconntrack]);
417 if (oldsctpstate == SCTP_CONNTRACK_COOKIE_ECHOED
418 && CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY
419 && newconntrack == SCTP_CONNTRACK_ESTABLISHED) {
420 DEBUGP("Setting assured bit\n");
421 set_bit(IPS_ASSURED_BIT, &conntrack->status);
427 /* Called when a new connection for this protocol found. */
428 static int sctp_new(struct ip_conntrack *conntrack,
429 const struct sk_buff *skb)
431 enum sctp_conntrack newconntrack;
432 struct iphdr *iph = skb->nh.iph;
433 sctp_sctphdr_t _sctph, *sh;
434 sctp_chunkhdr_t _sch, *sch;
435 u_int32_t offset, count;
436 char map[256 / sizeof (char)] = {0};
438 DEBUGP(__FUNCTION__);
441 sh = skb_header_pointer(skb, iph->ihl * 4, sizeof(_sctph), &_sctph);
445 if (do_basic_checks(conntrack, skb, map) != 0)
448 /* If an OOTB packet has any of these chunks discard (Sec 8.4) */
449 if ((test_bit (SCTP_CID_ABORT, (void *)map))
450 || (test_bit (SCTP_CID_SHUTDOWN_COMPLETE, (void *)map))
451 || (test_bit (SCTP_CID_COOKIE_ACK, (void *)map))) {
455 newconntrack = SCTP_CONNTRACK_MAX;
456 for_each_sctp_chunk (skb, sch, _sch, offset, count) {
457 /* Don't need lock here: this conntrack not in circulation yet */
458 newconntrack = new_state (IP_CT_DIR_ORIGINAL,
459 SCTP_CONNTRACK_NONE, sch->type);
461 /* Invalid: delete conntrack */
462 if (newconntrack == SCTP_CONNTRACK_MAX) {
463 DEBUGP("ip_conntrack_sctp: invalid new deleting.\n");
467 /* Copy the vtag into the state info */
468 if (sch->type == SCTP_CID_INIT) {
470 sctp_inithdr_t _inithdr, *ih;
472 ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
473 sizeof(_inithdr), &_inithdr);
477 DEBUGP("Setting vtag %x for new conn\n",
480 conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] =
487 /* If it is a shutdown ack OOTB packet, we expect a return
488 shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
490 DEBUGP("Setting vtag %x for new conn OOTB\n",
492 conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
495 conntrack->proto.sctp.state = newconntrack;
501 static struct ip_conntrack_protocol ip_conntrack_protocol_sctp = {
502 .proto = IPPROTO_SCTP,
504 .pkt_to_tuple = sctp_pkt_to_tuple,
505 .invert_tuple = sctp_invert_tuple,
506 .print_tuple = sctp_print_tuple,
507 .print_conntrack = sctp_print_conntrack,
508 .packet = sctp_packet,
515 static ctl_table ip_ct_sysctl_table[] = {
517 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_CLOSED,
518 .procname = "ip_conntrack_sctp_timeout_closed",
519 .data = &ip_ct_sctp_timeout_closed,
520 .maxlen = sizeof(unsigned int),
522 .proc_handler = &proc_dointvec_jiffies,
525 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_WAIT,
526 .procname = "ip_conntrack_sctp_timeout_cookie_wait",
527 .data = &ip_ct_sctp_timeout_cookie_wait,
528 .maxlen = sizeof(unsigned int),
530 .proc_handler = &proc_dointvec_jiffies,
533 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_ECHOED,
534 .procname = "ip_conntrack_sctp_timeout_cookie_echoed",
535 .data = &ip_ct_sctp_timeout_cookie_echoed,
536 .maxlen = sizeof(unsigned int),
538 .proc_handler = &proc_dointvec_jiffies,
541 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_ESTABLISHED,
542 .procname = "ip_conntrack_sctp_timeout_established",
543 .data = &ip_ct_sctp_timeout_established,
544 .maxlen = sizeof(unsigned int),
546 .proc_handler = &proc_dointvec_jiffies,
549 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_SENT,
550 .procname = "ip_conntrack_sctp_timeout_shutdown_sent",
551 .data = &ip_ct_sctp_timeout_shutdown_sent,
552 .maxlen = sizeof(unsigned int),
554 .proc_handler = &proc_dointvec_jiffies,
557 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_RECD,
558 .procname = "ip_conntrack_sctp_timeout_shutdown_recd",
559 .data = &ip_ct_sctp_timeout_shutdown_recd,
560 .maxlen = sizeof(unsigned int),
562 .proc_handler = &proc_dointvec_jiffies,
565 .ctl_name = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_ACK_SENT,
566 .procname = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
567 .data = &ip_ct_sctp_timeout_shutdown_ack_sent,
568 .maxlen = sizeof(unsigned int),
570 .proc_handler = &proc_dointvec_jiffies,
575 static ctl_table ip_ct_netfilter_table[] = {
577 .ctl_name = NET_IPV4_NETFILTER,
578 .procname = "netfilter",
580 .child = ip_ct_sysctl_table,
585 static ctl_table ip_ct_ipv4_table[] = {
587 .ctl_name = NET_IPV4,
590 .child = ip_ct_netfilter_table,
595 static ctl_table ip_ct_net_table[] = {
600 .child = ip_ct_ipv4_table,
605 static struct ctl_table_header *ip_ct_sysctl_header;
608 static int __init init(void)
612 ret = ip_conntrack_protocol_register(&ip_conntrack_protocol_sctp);
614 printk("ip_conntrack_proto_sctp: protocol register failed\n");
619 ip_ct_sysctl_header = register_sysctl_table(ip_ct_net_table, 0);
620 if (ip_ct_sysctl_header == NULL) {
622 printk("ip_conntrack_proto_sctp: can't register to sysctl.\n");
631 ip_conntrack_protocol_unregister(&ip_conntrack_protocol_sctp);
634 DEBUGP("SCTP conntrack module loading %s\n",
635 ret ? "failed": "succeeded");
639 static void __exit fini(void)
641 ip_conntrack_protocol_unregister(&ip_conntrack_protocol_sctp);
643 unregister_sysctl_table(ip_ct_sysctl_header);
645 DEBUGP("SCTP conntrack module unloaded\n");
651 MODULE_LICENSE("GPL");
652 MODULE_AUTHOR("Kiran Kumar Immidi");
653 MODULE_DESCRIPTION("Netfilter connection tracking protocol helper for SCTP");