5097846230
This patch adds the infrastructure to add fine timeout tuning over nfnetlink. Now you can use the NFNL_SUBSYS_CTNETLINK_TIMEOUT subsystem to create/delete/dump timeout objects that contain some specific timeout policy for one flow. The follow up patches will allow you attach timeout policy object to conntrack via the CT target and the conntrack extension infrastructure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
314 lines
8.8 KiB
C
314 lines
8.8 KiB
C
/* (C) 1999-2001 Paul `Rusty' Russell
|
|
* (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*/
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/timer.h>
|
|
#include <linux/module.h>
|
|
#include <linux/udp.h>
|
|
#include <linux/seq_file.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/ipv6.h>
|
|
#include <net/ip6_checksum.h>
|
|
#include <net/checksum.h>
|
|
|
|
#include <linux/netfilter.h>
|
|
#include <linux/netfilter_ipv4.h>
|
|
#include <linux/netfilter_ipv6.h>
|
|
#include <net/netfilter/nf_conntrack_l4proto.h>
|
|
#include <net/netfilter/nf_conntrack_ecache.h>
|
|
#include <net/netfilter/nf_log.h>
|
|
#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
|
|
#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
|
|
|
|
enum udp_conntrack {
|
|
UDP_CT_UNREPLIED,
|
|
UDP_CT_REPLIED,
|
|
UDP_CT_MAX
|
|
};
|
|
|
|
static unsigned int udp_timeouts[UDP_CT_MAX] = {
|
|
[UDP_CT_UNREPLIED] = 30*HZ,
|
|
[UDP_CT_REPLIED] = 180*HZ,
|
|
};
|
|
|
|
static bool udp_pkt_to_tuple(const struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
struct nf_conntrack_tuple *tuple)
|
|
{
|
|
const struct udphdr *hp;
|
|
struct udphdr _hdr;
|
|
|
|
/* Actually only need first 8 bytes. */
|
|
hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
|
|
if (hp == NULL)
|
|
return false;
|
|
|
|
tuple->src.u.udp.port = hp->source;
|
|
tuple->dst.u.udp.port = hp->dest;
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool udp_invert_tuple(struct nf_conntrack_tuple *tuple,
|
|
const struct nf_conntrack_tuple *orig)
|
|
{
|
|
tuple->src.u.udp.port = orig->dst.u.udp.port;
|
|
tuple->dst.u.udp.port = orig->src.u.udp.port;
|
|
return true;
|
|
}
|
|
|
|
/* Print out the per-protocol part of the tuple. */
|
|
static int udp_print_tuple(struct seq_file *s,
|
|
const struct nf_conntrack_tuple *tuple)
|
|
{
|
|
return seq_printf(s, "sport=%hu dport=%hu ",
|
|
ntohs(tuple->src.u.udp.port),
|
|
ntohs(tuple->dst.u.udp.port));
|
|
}
|
|
|
|
static unsigned int *udp_get_timeouts(struct net *net)
|
|
{
|
|
return udp_timeouts;
|
|
}
|
|
|
|
/* Returns verdict for packet, and may modify conntracktype */
|
|
static int udp_packet(struct nf_conn *ct,
|
|
const struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
enum ip_conntrack_info ctinfo,
|
|
u_int8_t pf,
|
|
unsigned int hooknum,
|
|
unsigned int *timeouts)
|
|
{
|
|
/* If we've seen traffic both ways, this is some kind of UDP
|
|
stream. Extend timeout. */
|
|
if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
|
|
nf_ct_refresh_acct(ct, ctinfo, skb,
|
|
timeouts[UDP_CT_REPLIED]);
|
|
/* Also, more likely to be important, and not a probe */
|
|
if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
|
|
nf_conntrack_event_cache(IPCT_ASSURED, ct);
|
|
} else {
|
|
nf_ct_refresh_acct(ct, ctinfo, skb,
|
|
timeouts[UDP_CT_UNREPLIED]);
|
|
}
|
|
return NF_ACCEPT;
|
|
}
|
|
|
|
/* Called when a new connection for this protocol found. */
|
|
static bool udp_new(struct nf_conn *ct, const struct sk_buff *skb,
|
|
unsigned int dataoff, unsigned int *timeouts)
|
|
{
|
|
return true;
|
|
}
|
|
|
|
static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
|
|
unsigned int dataoff, enum ip_conntrack_info *ctinfo,
|
|
u_int8_t pf,
|
|
unsigned int hooknum)
|
|
{
|
|
unsigned int udplen = skb->len - dataoff;
|
|
const struct udphdr *hdr;
|
|
struct udphdr _hdr;
|
|
|
|
/* Header is too small? */
|
|
hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
|
|
if (hdr == NULL) {
|
|
if (LOG_INVALID(net, IPPROTO_UDP))
|
|
nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
|
|
"nf_ct_udp: short packet ");
|
|
return -NF_ACCEPT;
|
|
}
|
|
|
|
/* Truncated/malformed packets */
|
|
if (ntohs(hdr->len) > udplen || ntohs(hdr->len) < sizeof(*hdr)) {
|
|
if (LOG_INVALID(net, IPPROTO_UDP))
|
|
nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
|
|
"nf_ct_udp: truncated/malformed packet ");
|
|
return -NF_ACCEPT;
|
|
}
|
|
|
|
/* Packet with no checksum */
|
|
if (!hdr->check)
|
|
return NF_ACCEPT;
|
|
|
|
/* Checksum invalid? Ignore.
|
|
* We skip checking packets on the outgoing path
|
|
* because the checksum is assumed to be correct.
|
|
* FIXME: Source route IP option packets --RR */
|
|
if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
|
|
nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) {
|
|
if (LOG_INVALID(net, IPPROTO_UDP))
|
|
nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
|
|
"nf_ct_udp: bad UDP checksum ");
|
|
return -NF_ACCEPT;
|
|
}
|
|
|
|
return NF_ACCEPT;
|
|
}
|
|
|
|
#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
|
|
|
|
#include <linux/netfilter/nfnetlink.h>
|
|
#include <linux/netfilter/nfnetlink_cttimeout.h>
|
|
|
|
static int udp_timeout_nlattr_to_obj(struct nlattr *tb[], void *data)
|
|
{
|
|
unsigned int *timeouts = data;
|
|
|
|
/* set default timeouts for UDP. */
|
|
timeouts[UDP_CT_UNREPLIED] = udp_timeouts[UDP_CT_UNREPLIED];
|
|
timeouts[UDP_CT_REPLIED] = udp_timeouts[UDP_CT_REPLIED];
|
|
|
|
if (tb[CTA_TIMEOUT_UDP_UNREPLIED]) {
|
|
timeouts[UDP_CT_UNREPLIED] =
|
|
ntohl(nla_get_be32(tb[CTA_TIMEOUT_UDP_UNREPLIED])) * HZ;
|
|
}
|
|
if (tb[CTA_TIMEOUT_UDP_REPLIED]) {
|
|
timeouts[UDP_CT_REPLIED] =
|
|
ntohl(nla_get_be32(tb[CTA_TIMEOUT_UDP_REPLIED])) * HZ;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static int
|
|
udp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
|
|
{
|
|
const unsigned int *timeouts = data;
|
|
|
|
NLA_PUT_BE32(skb, CTA_TIMEOUT_UDP_UNREPLIED,
|
|
htonl(timeouts[UDP_CT_UNREPLIED] / HZ));
|
|
NLA_PUT_BE32(skb, CTA_TIMEOUT_UDP_REPLIED,
|
|
htonl(timeouts[UDP_CT_REPLIED] / HZ));
|
|
return 0;
|
|
|
|
nla_put_failure:
|
|
return -ENOSPC;
|
|
}
|
|
|
|
static const struct nla_policy
|
|
udp_timeout_nla_policy[CTA_TIMEOUT_UDP_MAX+1] = {
|
|
[CTA_TIMEOUT_UDP_UNREPLIED] = { .type = NLA_U32 },
|
|
[CTA_TIMEOUT_UDP_REPLIED] = { .type = NLA_U32 },
|
|
};
|
|
#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
|
|
|
|
#ifdef CONFIG_SYSCTL
|
|
static unsigned int udp_sysctl_table_users;
|
|
static struct ctl_table_header *udp_sysctl_header;
|
|
static struct ctl_table udp_sysctl_table[] = {
|
|
{
|
|
.procname = "nf_conntrack_udp_timeout",
|
|
.data = &udp_timeouts[UDP_CT_UNREPLIED],
|
|
.maxlen = sizeof(unsigned int),
|
|
.mode = 0644,
|
|
.proc_handler = proc_dointvec_jiffies,
|
|
},
|
|
{
|
|
.procname = "nf_conntrack_udp_timeout_stream",
|
|
.data = &udp_timeouts[UDP_CT_REPLIED],
|
|
.maxlen = sizeof(unsigned int),
|
|
.mode = 0644,
|
|
.proc_handler = proc_dointvec_jiffies,
|
|
},
|
|
{ }
|
|
};
|
|
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
|
|
static struct ctl_table udp_compat_sysctl_table[] = {
|
|
{
|
|
.procname = "ip_conntrack_udp_timeout",
|
|
.data = &udp_timeouts[UDP_CT_UNREPLIED],
|
|
.maxlen = sizeof(unsigned int),
|
|
.mode = 0644,
|
|
.proc_handler = proc_dointvec_jiffies,
|
|
},
|
|
{
|
|
.procname = "ip_conntrack_udp_timeout_stream",
|
|
.data = &udp_timeouts[UDP_CT_REPLIED],
|
|
.maxlen = sizeof(unsigned int),
|
|
.mode = 0644,
|
|
.proc_handler = proc_dointvec_jiffies,
|
|
},
|
|
{ }
|
|
};
|
|
#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
|
|
#endif /* CONFIG_SYSCTL */
|
|
|
|
struct nf_conntrack_l4proto nf_conntrack_l4proto_udp4 __read_mostly =
|
|
{
|
|
.l3proto = PF_INET,
|
|
.l4proto = IPPROTO_UDP,
|
|
.name = "udp",
|
|
.pkt_to_tuple = udp_pkt_to_tuple,
|
|
.invert_tuple = udp_invert_tuple,
|
|
.print_tuple = udp_print_tuple,
|
|
.packet = udp_packet,
|
|
.get_timeouts = udp_get_timeouts,
|
|
.new = udp_new,
|
|
.error = udp_error,
|
|
#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
|
|
.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
|
|
.nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
|
|
.nlattr_tuple_size = nf_ct_port_nlattr_tuple_size,
|
|
.nla_policy = nf_ct_port_nla_policy,
|
|
#endif
|
|
#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
|
|
.ctnl_timeout = {
|
|
.nlattr_to_obj = udp_timeout_nlattr_to_obj,
|
|
.obj_to_nlattr = udp_timeout_obj_to_nlattr,
|
|
.nlattr_max = CTA_TIMEOUT_UDP_MAX,
|
|
.obj_size = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
|
|
.nla_policy = udp_timeout_nla_policy,
|
|
},
|
|
#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
|
|
#ifdef CONFIG_SYSCTL
|
|
.ctl_table_users = &udp_sysctl_table_users,
|
|
.ctl_table_header = &udp_sysctl_header,
|
|
.ctl_table = udp_sysctl_table,
|
|
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
|
|
.ctl_compat_table = udp_compat_sysctl_table,
|
|
#endif
|
|
#endif
|
|
};
|
|
EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_udp4);
|
|
|
|
struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6 __read_mostly =
|
|
{
|
|
.l3proto = PF_INET6,
|
|
.l4proto = IPPROTO_UDP,
|
|
.name = "udp",
|
|
.pkt_to_tuple = udp_pkt_to_tuple,
|
|
.invert_tuple = udp_invert_tuple,
|
|
.print_tuple = udp_print_tuple,
|
|
.packet = udp_packet,
|
|
.get_timeouts = udp_get_timeouts,
|
|
.new = udp_new,
|
|
.error = udp_error,
|
|
#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
|
|
.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
|
|
.nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
|
|
.nlattr_tuple_size = nf_ct_port_nlattr_tuple_size,
|
|
.nla_policy = nf_ct_port_nla_policy,
|
|
#endif
|
|
#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
|
|
.ctnl_timeout = {
|
|
.nlattr_to_obj = udp_timeout_nlattr_to_obj,
|
|
.obj_to_nlattr = udp_timeout_obj_to_nlattr,
|
|
.nlattr_max = CTA_TIMEOUT_UDP_MAX,
|
|
.obj_size = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
|
|
.nla_policy = udp_timeout_nla_policy,
|
|
},
|
|
#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
|
|
#ifdef CONFIG_SYSCTL
|
|
.ctl_table_users = &udp_sysctl_table_users,
|
|
.ctl_table_header = &udp_sysctl_header,
|
|
.ctl_table = udp_sysctl_table,
|
|
#endif
|
|
};
|
|
EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_udp6);
|