2006-12-03 06:09:41 +00:00
|
|
|
/*
|
|
|
|
* ip_conntrack_proto_gre.c - Version 3.0
|
|
|
|
*
|
|
|
|
* Connection tracking protocol helper module for GRE.
|
|
|
|
*
|
|
|
|
* GRE is a generic encapsulation protocol, which is generally not very
|
|
|
|
* suited for NAT, as it has no protocol-specific part as port numbers.
|
|
|
|
*
|
|
|
|
* It has an optional key field, which may help us distinguishing two
|
|
|
|
* connections between the same two hosts.
|
|
|
|
*
|
|
|
|
* GRE is defined in RFC 1701 and RFC 1702, as well as RFC 2784
|
|
|
|
*
|
|
|
|
* PPTP is built on top of a modified version of GRE, and has a mandatory
|
|
|
|
* field called "CallID", which serves us for the same purpose as the key
|
|
|
|
* field in plain GRE.
|
|
|
|
*
|
|
|
|
* Documentation about PPTP can be found in RFC 2637
|
|
|
|
*
|
|
|
|
* (C) 2000-2005 by Harald Welte <laforge@gnumonks.org>
|
|
|
|
*
|
|
|
|
* Development of this code funded by Astaro AG (http://www.astaro.com/)
|
|
|
|
*
|
2013-04-06 13:24:29 +00:00
|
|
|
* (C) 2006-2012 Patrick McHardy <kaber@trash.net>
|
2006-12-03 06:09:41 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/types.h>
|
|
|
|
#include <linux/timer.h>
|
|
|
|
#include <linux/list.h>
|
|
|
|
#include <linux/seq_file.h>
|
|
|
|
#include <linux/in.h>
|
2008-10-08 09:35:10 +00:00
|
|
|
#include <linux/netdevice.h>
|
2006-12-03 06:09:41 +00:00
|
|
|
#include <linux/skbuff.h>
|
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 08:04:11 +00:00
|
|
|
#include <linux/slab.h>
|
2008-10-08 09:35:10 +00:00
|
|
|
#include <net/dst.h>
|
|
|
|
#include <net/net_namespace.h>
|
|
|
|
#include <net/netns/generic.h>
|
2006-12-03 06:09:41 +00:00
|
|
|
#include <net/netfilter/nf_conntrack_l4proto.h>
|
|
|
|
#include <net/netfilter/nf_conntrack_helper.h>
|
|
|
|
#include <net/netfilter/nf_conntrack_core.h>
|
|
|
|
#include <linux/netfilter/nf_conntrack_proto_gre.h>
|
|
|
|
#include <linux/netfilter/nf_conntrack_pptp.h>
|
|
|
|
|
2012-02-28 17:56:39 +00:00
|
|
|
enum grep_conntrack {
|
|
|
|
GRE_CT_UNREPLIED,
|
|
|
|
GRE_CT_REPLIED,
|
|
|
|
GRE_CT_MAX
|
|
|
|
};
|
|
|
|
|
|
|
|
static unsigned int gre_timeouts[GRE_CT_MAX] = {
|
|
|
|
[GRE_CT_UNREPLIED] = 30*HZ,
|
|
|
|
[GRE_CT_REPLIED] = 180*HZ,
|
|
|
|
};
|
2006-12-03 06:09:41 +00:00
|
|
|
|
netns: make struct pernet_operations::id unsigned int
Make struct pernet_operations::id unsigned.
There are 2 reasons to do so:
1)
This field is really an index into an zero based array and
thus is unsigned entity. Using negative value is out-of-bound
access by definition.
2)
On x86_64 unsigned 32-bit data which are mixed with pointers
via array indexing or offsets added or subtracted to pointers
are preffered to signed 32-bit data.
"int" being used as an array index needs to be sign-extended
to 64-bit before being used.
void f(long *p, int i)
{
g(p[i]);
}
roughly translates to
movsx rsi, esi
mov rdi, [rsi+...]
call g
MOVSX is 3 byte instruction which isn't necessary if the variable is
unsigned because x86_64 is zero extending by default.
Now, there is net_generic() function which, you guessed it right, uses
"int" as an array index:
static inline void *net_generic(const struct net *net, int id)
{
...
ptr = ng->ptr[id - 1];
...
}
And this function is used a lot, so those sign extensions add up.
Patch snipes ~1730 bytes on allyesconfig kernel (without all junk
messing with code generation):
add/remove: 0/0 grow/shrink: 70/598 up/down: 396/-2126 (-1730)
Unfortunately some functions actually grow bigger.
This is a semmingly random artefact of code generation with register
allocator being used differently. gcc decides that some variable
needs to live in new r8+ registers and every access now requires REX
prefix. Or it is shifted into r12, so [r12+0] addressing mode has to be
used which is longer than [r8]
However, overall balance is in negative direction:
add/remove: 0/0 grow/shrink: 70/598 up/down: 396/-2126 (-1730)
function old new delta
nfsd4_lock 3886 3959 +73
tipc_link_build_proto_msg 1096 1140 +44
mac80211_hwsim_new_radio 2776 2808 +32
tipc_mon_rcv 1032 1058 +26
svcauth_gss_legacy_init 1413 1429 +16
tipc_bcbase_select_primary 379 392 +13
nfsd4_exchange_id 1247 1260 +13
nfsd4_setclientid_confirm 782 793 +11
...
put_client_renew_locked 494 480 -14
ip_set_sockfn_get 730 716 -14
geneve_sock_add 829 813 -16
nfsd4_sequence_done 721 703 -18
nlmclnt_lookup_host 708 686 -22
nfsd4_lockt 1085 1063 -22
nfs_get_client 1077 1050 -27
tcf_bpf_init 1106 1076 -30
nfsd4_encode_fattr 5997 5930 -67
Total: Before=154856051, After=154854321, chg -0.00%
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-17 01:58:21 +00:00
|
|
|
static unsigned int proto_gre_net_id __read_mostly;
|
2008-10-08 09:35:10 +00:00
|
|
|
struct netns_proto_gre {
|
2012-05-28 21:04:21 +00:00
|
|
|
struct nf_proto_net nf;
|
2008-10-08 09:35:10 +00:00
|
|
|
rwlock_t keymap_lock;
|
|
|
|
struct list_head keymap_list;
|
2012-05-28 21:04:21 +00:00
|
|
|
unsigned int gre_timeouts[GRE_CT_MAX];
|
2008-10-08 09:35:10 +00:00
|
|
|
};
|
2006-12-03 06:09:41 +00:00
|
|
|
|
2012-05-28 21:04:21 +00:00
|
|
|
static inline struct netns_proto_gre *gre_pernet(struct net *net)
|
|
|
|
{
|
|
|
|
return net_generic(net, proto_gre_net_id);
|
|
|
|
}
|
|
|
|
|
2014-03-31 14:14:18 +00:00
|
|
|
static void nf_ct_gre_keymap_flush(struct net *net)
|
2006-12-03 06:09:41 +00:00
|
|
|
{
|
2012-05-28 21:04:21 +00:00
|
|
|
struct netns_proto_gre *net_gre = gre_pernet(net);
|
2008-09-08 01:20:36 +00:00
|
|
|
struct nf_ct_gre_keymap *km, *tmp;
|
2006-12-03 06:09:41 +00:00
|
|
|
|
2008-10-08 09:35:10 +00:00
|
|
|
write_lock_bh(&net_gre->keymap_lock);
|
|
|
|
list_for_each_entry_safe(km, tmp, &net_gre->keymap_list, list) {
|
2008-09-08 01:20:36 +00:00
|
|
|
list_del(&km->list);
|
|
|
|
kfree(km);
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
2008-10-08 09:35:10 +00:00
|
|
|
write_unlock_bh(&net_gre->keymap_lock);
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline int gre_key_cmpfn(const struct nf_ct_gre_keymap *km,
|
|
|
|
const struct nf_conntrack_tuple *t)
|
|
|
|
{
|
|
|
|
return km->tuple.src.l3num == t->src.l3num &&
|
|
|
|
!memcmp(&km->tuple.src.u3, &t->src.u3, sizeof(t->src.u3)) &&
|
|
|
|
!memcmp(&km->tuple.dst.u3, &t->dst.u3, sizeof(t->dst.u3)) &&
|
|
|
|
km->tuple.dst.protonum == t->dst.protonum &&
|
|
|
|
km->tuple.dst.u.all == t->dst.u.all;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* look up the source key for a given tuple */
|
2008-10-08 09:35:10 +00:00
|
|
|
static __be16 gre_keymap_lookup(struct net *net, struct nf_conntrack_tuple *t)
|
2006-12-03 06:09:41 +00:00
|
|
|
{
|
2012-05-28 21:04:21 +00:00
|
|
|
struct netns_proto_gre *net_gre = gre_pernet(net);
|
2006-12-03 06:09:41 +00:00
|
|
|
struct nf_ct_gre_keymap *km;
|
|
|
|
__be16 key = 0;
|
|
|
|
|
2008-10-08 09:35:10 +00:00
|
|
|
read_lock_bh(&net_gre->keymap_lock);
|
|
|
|
list_for_each_entry(km, &net_gre->keymap_list, list) {
|
2006-12-03 06:09:41 +00:00
|
|
|
if (gre_key_cmpfn(km, t)) {
|
|
|
|
key = km->tuple.src.u.gre.key;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
2008-10-08 09:35:10 +00:00
|
|
|
read_unlock_bh(&net_gre->keymap_lock);
|
2006-12-03 06:09:41 +00:00
|
|
|
|
2007-07-08 05:39:38 +00:00
|
|
|
pr_debug("lookup src key 0x%x for ", key);
|
2008-04-14 09:15:54 +00:00
|
|
|
nf_ct_dump_tuple(t);
|
2006-12-03 06:09:41 +00:00
|
|
|
|
|
|
|
return key;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* add a single keymap entry, associate with specified master ct */
|
|
|
|
int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir,
|
|
|
|
struct nf_conntrack_tuple *t)
|
|
|
|
{
|
2008-10-08 09:35:10 +00:00
|
|
|
struct net *net = nf_ct_net(ct);
|
2012-05-28 21:04:21 +00:00
|
|
|
struct netns_proto_gre *net_gre = gre_pernet(net);
|
2012-06-07 10:11:50 +00:00
|
|
|
struct nf_ct_pptp_master *ct_pptp_info = nfct_help_data(ct);
|
2006-12-03 06:09:41 +00:00
|
|
|
struct nf_ct_gre_keymap **kmp, *km;
|
|
|
|
|
2012-06-07 10:11:50 +00:00
|
|
|
kmp = &ct_pptp_info->keymap[dir];
|
2006-12-03 06:09:41 +00:00
|
|
|
if (*kmp) {
|
|
|
|
/* check whether it's a retransmission */
|
2008-10-08 09:35:10 +00:00
|
|
|
read_lock_bh(&net_gre->keymap_lock);
|
|
|
|
list_for_each_entry(km, &net_gre->keymap_list, list) {
|
2008-09-08 01:20:08 +00:00
|
|
|
if (gre_key_cmpfn(km, t) && km == *kmp) {
|
2008-10-08 09:35:10 +00:00
|
|
|
read_unlock_bh(&net_gre->keymap_lock);
|
2006-12-03 06:09:41 +00:00
|
|
|
return 0;
|
2008-09-08 01:20:08 +00:00
|
|
|
}
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
2008-10-08 09:35:10 +00:00
|
|
|
read_unlock_bh(&net_gre->keymap_lock);
|
2007-07-08 05:39:38 +00:00
|
|
|
pr_debug("trying to override keymap_%s for ct %p\n",
|
|
|
|
dir == IP_CT_DIR_REPLY ? "reply" : "orig", ct);
|
2006-12-03 06:09:41 +00:00
|
|
|
return -EEXIST;
|
|
|
|
}
|
|
|
|
|
|
|
|
km = kmalloc(sizeof(*km), GFP_ATOMIC);
|
|
|
|
if (!km)
|
|
|
|
return -ENOMEM;
|
|
|
|
memcpy(&km->tuple, t, sizeof(*t));
|
|
|
|
*kmp = km;
|
|
|
|
|
2007-07-08 05:39:38 +00:00
|
|
|
pr_debug("adding new entry %p: ", km);
|
2008-04-14 09:15:54 +00:00
|
|
|
nf_ct_dump_tuple(&km->tuple);
|
2006-12-03 06:09:41 +00:00
|
|
|
|
2008-10-08 09:35:10 +00:00
|
|
|
write_lock_bh(&net_gre->keymap_lock);
|
|
|
|
list_add_tail(&km->list, &net_gre->keymap_list);
|
|
|
|
write_unlock_bh(&net_gre->keymap_lock);
|
2006-12-03 06:09:41 +00:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(nf_ct_gre_keymap_add);
|
|
|
|
|
|
|
|
/* destroy the keymap entries associated with specified master ct */
|
|
|
|
void nf_ct_gre_keymap_destroy(struct nf_conn *ct)
|
|
|
|
{
|
2008-10-08 09:35:10 +00:00
|
|
|
struct net *net = nf_ct_net(ct);
|
2012-05-28 21:04:21 +00:00
|
|
|
struct netns_proto_gre *net_gre = gre_pernet(net);
|
2012-06-07 10:11:50 +00:00
|
|
|
struct nf_ct_pptp_master *ct_pptp_info = nfct_help_data(ct);
|
2006-12-03 06:09:41 +00:00
|
|
|
enum ip_conntrack_dir dir;
|
|
|
|
|
2007-07-08 05:39:38 +00:00
|
|
|
pr_debug("entering for ct %p\n", ct);
|
2006-12-03 06:09:41 +00:00
|
|
|
|
2008-10-08 09:35:10 +00:00
|
|
|
write_lock_bh(&net_gre->keymap_lock);
|
2006-12-03 06:09:41 +00:00
|
|
|
for (dir = IP_CT_DIR_ORIGINAL; dir < IP_CT_DIR_MAX; dir++) {
|
2012-06-07 10:11:50 +00:00
|
|
|
if (ct_pptp_info->keymap[dir]) {
|
2007-07-08 05:39:38 +00:00
|
|
|
pr_debug("removing %p from list\n",
|
2012-06-07 10:11:50 +00:00
|
|
|
ct_pptp_info->keymap[dir]);
|
|
|
|
list_del(&ct_pptp_info->keymap[dir]->list);
|
|
|
|
kfree(ct_pptp_info->keymap[dir]);
|
|
|
|
ct_pptp_info->keymap[dir] = NULL;
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
|
|
|
}
|
2008-10-08 09:35:10 +00:00
|
|
|
write_unlock_bh(&net_gre->keymap_lock);
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(nf_ct_gre_keymap_destroy);
|
|
|
|
|
|
|
|
/* PUBLIC CONNTRACK PROTO HELPER FUNCTIONS */
|
|
|
|
|
|
|
|
/* invert gre part of tuple */
|
2008-04-14 09:15:53 +00:00
|
|
|
static bool gre_invert_tuple(struct nf_conntrack_tuple *tuple,
|
|
|
|
const struct nf_conntrack_tuple *orig)
|
2006-12-03 06:09:41 +00:00
|
|
|
{
|
|
|
|
tuple->dst.u.gre.key = orig->src.u.gre.key;
|
|
|
|
tuple->src.u.gre.key = orig->dst.u.gre.key;
|
2008-04-14 09:15:53 +00:00
|
|
|
return true;
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* gre hdr info to tuple */
|
2008-04-14 09:15:53 +00:00
|
|
|
static bool gre_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
|
2015-09-18 19:33:04 +00:00
|
|
|
struct net *net, struct nf_conntrack_tuple *tuple)
|
2006-12-03 06:09:41 +00:00
|
|
|
{
|
2016-08-25 15:08:47 +00:00
|
|
|
const struct pptp_gre_header *pgrehdr;
|
|
|
|
struct pptp_gre_header _pgrehdr;
|
2006-12-03 06:09:41 +00:00
|
|
|
__be16 srckey;
|
2016-08-25 15:08:47 +00:00
|
|
|
const struct gre_base_hdr *grehdr;
|
|
|
|
struct gre_base_hdr _grehdr;
|
2006-12-03 06:09:41 +00:00
|
|
|
|
|
|
|
/* first only delinearize old RFC1701 GRE header */
|
|
|
|
grehdr = skb_header_pointer(skb, dataoff, sizeof(_grehdr), &_grehdr);
|
2016-08-25 15:08:47 +00:00
|
|
|
if (!grehdr || (grehdr->flags & GRE_VERSION) != GRE_VERSION_1) {
|
2006-12-03 06:09:41 +00:00
|
|
|
/* try to behave like "nf_conntrack_proto_generic" */
|
|
|
|
tuple->src.u.all = 0;
|
|
|
|
tuple->dst.u.all = 0;
|
2008-04-14 09:15:53 +00:00
|
|
|
return true;
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* PPTP header is variable length, only need up to the call_id field */
|
|
|
|
pgrehdr = skb_header_pointer(skb, dataoff, 8, &_pgrehdr);
|
|
|
|
if (!pgrehdr)
|
2008-04-14 09:15:53 +00:00
|
|
|
return true;
|
2006-12-03 06:09:41 +00:00
|
|
|
|
2016-08-25 15:08:11 +00:00
|
|
|
if (grehdr->protocol != GRE_PROTO_PPP) {
|
2016-08-25 15:08:47 +00:00
|
|
|
pr_debug("Unsupported GRE proto(0x%x)\n", ntohs(grehdr->protocol));
|
2008-04-14 09:15:53 +00:00
|
|
|
return false;
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
tuple->dst.u.gre.key = pgrehdr->call_id;
|
2008-10-08 09:35:10 +00:00
|
|
|
srckey = gre_keymap_lookup(net, tuple);
|
2006-12-03 06:09:41 +00:00
|
|
|
tuple->src.u.gre.key = srckey;
|
|
|
|
|
2008-04-14 09:15:53 +00:00
|
|
|
return true;
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
|
|
|
|
2017-08-11 22:57:07 +00:00
|
|
|
#ifdef CONFIG_NF_CONNTRACK_PROCFS
|
2006-12-03 06:09:41 +00:00
|
|
|
/* print private data for conntrack */
|
2014-10-27 20:02:47 +00:00
|
|
|
static void gre_print_conntrack(struct seq_file *s, struct nf_conn *ct)
|
2006-12-03 06:09:41 +00:00
|
|
|
{
|
2014-10-27 20:02:47 +00:00
|
|
|
seq_printf(s, "timeout=%u, stream_timeout=%u ",
|
|
|
|
(ct->proto.gre.timeout / HZ),
|
|
|
|
(ct->proto.gre.stream_timeout / HZ));
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
2017-08-11 22:57:07 +00:00
|
|
|
#endif
|
2006-12-03 06:09:41 +00:00
|
|
|
|
2012-02-28 17:23:31 +00:00
|
|
|
static unsigned int *gre_get_timeouts(struct net *net)
|
|
|
|
{
|
2012-05-28 21:04:21 +00:00
|
|
|
return gre_pernet(net)->gre_timeouts;
|
2012-02-28 17:23:31 +00:00
|
|
|
}
|
|
|
|
|
2006-12-03 06:09:41 +00:00
|
|
|
/* Returns verdict for packet, and may modify conntrack */
|
|
|
|
static int gre_packet(struct nf_conn *ct,
|
|
|
|
const struct sk_buff *skb,
|
|
|
|
unsigned int dataoff,
|
|
|
|
enum ip_conntrack_info ctinfo,
|
2012-02-28 17:23:31 +00:00
|
|
|
unsigned int *timeouts)
|
2006-12-03 06:09:41 +00:00
|
|
|
{
|
|
|
|
/* If we've seen traffic both ways, this is a GRE connection.
|
|
|
|
* Extend timeout. */
|
|
|
|
if (ct->status & IPS_SEEN_REPLY) {
|
|
|
|
nf_ct_refresh_acct(ct, ctinfo, skb,
|
|
|
|
ct->proto.gre.stream_timeout);
|
|
|
|
/* Also, more likely to be important, and not a probe. */
|
2011-09-30 14:38:29 +00:00
|
|
|
if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
|
|
|
|
nf_conntrack_event_cache(IPCT_ASSURED, ct);
|
2006-12-03 06:09:41 +00:00
|
|
|
} else
|
|
|
|
nf_ct_refresh_acct(ct, ctinfo, skb,
|
|
|
|
ct->proto.gre.timeout);
|
|
|
|
|
|
|
|
return NF_ACCEPT;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Called when a new connection for this protocol found. */
|
2008-04-14 09:15:53 +00:00
|
|
|
static bool gre_new(struct nf_conn *ct, const struct sk_buff *skb,
|
2012-02-28 17:23:31 +00:00
|
|
|
unsigned int dataoff, unsigned int *timeouts)
|
2006-12-03 06:09:41 +00:00
|
|
|
{
|
2007-07-08 05:39:38 +00:00
|
|
|
pr_debug(": ");
|
2008-04-14 09:15:54 +00:00
|
|
|
nf_ct_dump_tuple(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
|
2006-12-03 06:09:41 +00:00
|
|
|
|
|
|
|
/* initialize to sane value. Ideally a conntrack helper
|
|
|
|
* (e.g. in case of pptp) is increasing them */
|
2012-02-28 17:23:31 +00:00
|
|
|
ct->proto.gre.stream_timeout = timeouts[GRE_CT_REPLIED];
|
|
|
|
ct->proto.gre.timeout = timeouts[GRE_CT_UNREPLIED];
|
2006-12-03 06:09:41 +00:00
|
|
|
|
2008-04-14 09:15:53 +00:00
|
|
|
return true;
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Called when a conntrack entry has already been removed from the hashes
|
|
|
|
* and is about to be deleted from memory */
|
|
|
|
static void gre_destroy(struct nf_conn *ct)
|
|
|
|
{
|
|
|
|
struct nf_conn *master = ct->master;
|
2007-07-08 05:39:38 +00:00
|
|
|
pr_debug(" entering\n");
|
2006-12-03 06:09:41 +00:00
|
|
|
|
|
|
|
if (!master)
|
2007-07-08 05:39:38 +00:00
|
|
|
pr_debug("no master !?!\n");
|
2006-12-03 06:09:41 +00:00
|
|
|
else
|
|
|
|
nf_ct_gre_keymap_destroy(master);
|
|
|
|
}
|
|
|
|
|
2012-02-28 18:13:48 +00:00
|
|
|
#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
|
|
|
|
|
|
|
|
#include <linux/netfilter/nfnetlink.h>
|
|
|
|
#include <linux/netfilter/nfnetlink_cttimeout.h>
|
|
|
|
|
2012-05-28 21:04:23 +00:00
|
|
|
static int gre_timeout_nlattr_to_obj(struct nlattr *tb[],
|
|
|
|
struct net *net, void *data)
|
2012-02-28 18:13:48 +00:00
|
|
|
{
|
|
|
|
unsigned int *timeouts = data;
|
2012-05-28 21:04:23 +00:00
|
|
|
struct netns_proto_gre *net_gre = gre_pernet(net);
|
2012-02-28 18:13:48 +00:00
|
|
|
|
|
|
|
/* set default timeouts for GRE. */
|
2012-05-28 21:04:23 +00:00
|
|
|
timeouts[GRE_CT_UNREPLIED] = net_gre->gre_timeouts[GRE_CT_UNREPLIED];
|
|
|
|
timeouts[GRE_CT_REPLIED] = net_gre->gre_timeouts[GRE_CT_REPLIED];
|
2012-02-28 18:13:48 +00:00
|
|
|
|
|
|
|
if (tb[CTA_TIMEOUT_GRE_UNREPLIED]) {
|
|
|
|
timeouts[GRE_CT_UNREPLIED] =
|
|
|
|
ntohl(nla_get_be32(tb[CTA_TIMEOUT_GRE_UNREPLIED])) * HZ;
|
|
|
|
}
|
|
|
|
if (tb[CTA_TIMEOUT_GRE_REPLIED]) {
|
|
|
|
timeouts[GRE_CT_REPLIED] =
|
|
|
|
ntohl(nla_get_be32(tb[CTA_TIMEOUT_GRE_REPLIED])) * HZ;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
gre_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
|
|
|
|
{
|
|
|
|
const unsigned int *timeouts = data;
|
|
|
|
|
2012-04-01 22:52:03 +00:00
|
|
|
if (nla_put_be32(skb, CTA_TIMEOUT_GRE_UNREPLIED,
|
|
|
|
htonl(timeouts[GRE_CT_UNREPLIED] / HZ)) ||
|
|
|
|
nla_put_be32(skb, CTA_TIMEOUT_GRE_REPLIED,
|
|
|
|
htonl(timeouts[GRE_CT_REPLIED] / HZ)))
|
|
|
|
goto nla_put_failure;
|
2012-02-28 18:13:48 +00:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
nla_put_failure:
|
|
|
|
return -ENOSPC;
|
|
|
|
}
|
|
|
|
|
|
|
|
static const struct nla_policy
|
|
|
|
gre_timeout_nla_policy[CTA_TIMEOUT_GRE_MAX+1] = {
|
|
|
|
[CTA_TIMEOUT_GRE_UNREPLIED] = { .type = NLA_U32 },
|
|
|
|
[CTA_TIMEOUT_GRE_REPLIED] = { .type = NLA_U32 },
|
|
|
|
};
|
|
|
|
#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
|
|
|
|
|
2012-06-21 04:36:39 +00:00
|
|
|
static int gre_init_net(struct net *net, u_int16_t proto)
|
2012-05-28 21:04:21 +00:00
|
|
|
{
|
|
|
|
struct netns_proto_gre *net_gre = gre_pernet(net);
|
|
|
|
int i;
|
|
|
|
|
|
|
|
rwlock_init(&net_gre->keymap_lock);
|
|
|
|
INIT_LIST_HEAD(&net_gre->keymap_list);
|
|
|
|
for (i = 0; i < GRE_CT_MAX; i++)
|
|
|
|
net_gre->gre_timeouts[i] = gre_timeouts[i];
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2006-12-03 06:09:41 +00:00
|
|
|
/* protocol helper struct */
|
2007-07-15 03:48:19 +00:00
|
|
|
static struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 __read_mostly = {
|
2006-12-03 06:09:41 +00:00
|
|
|
.l3proto = AF_INET,
|
|
|
|
.l4proto = IPPROTO_GRE,
|
|
|
|
.pkt_to_tuple = gre_pkt_to_tuple,
|
|
|
|
.invert_tuple = gre_invert_tuple,
|
2017-08-11 22:57:07 +00:00
|
|
|
#ifdef CONFIG_NF_CONNTRACK_PROCFS
|
2006-12-03 06:09:41 +00:00
|
|
|
.print_conntrack = gre_print_conntrack,
|
2017-08-11 22:57:07 +00:00
|
|
|
#endif
|
2012-02-28 17:23:31 +00:00
|
|
|
.get_timeouts = gre_get_timeouts,
|
2006-12-03 06:09:41 +00:00
|
|
|
.packet = gre_packet,
|
|
|
|
.new = gre_new,
|
|
|
|
.destroy = gre_destroy,
|
|
|
|
.me = THIS_MODULE,
|
2011-12-12 02:58:24 +00:00
|
|
|
#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
|
2007-09-28 21:37:41 +00:00
|
|
|
.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
|
2009-03-25 20:53:39 +00:00
|
|
|
.nlattr_tuple_size = nf_ct_port_nlattr_tuple_size,
|
2007-09-28 21:37:41 +00:00
|
|
|
.nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
|
2007-09-28 21:39:55 +00:00
|
|
|
.nla_policy = nf_ct_port_nla_policy,
|
2006-12-03 06:09:41 +00:00
|
|
|
#endif
|
2012-02-28 18:13:48 +00:00
|
|
|
#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
|
|
|
|
.ctnl_timeout = {
|
|
|
|
.nlattr_to_obj = gre_timeout_nlattr_to_obj,
|
|
|
|
.obj_to_nlattr = gre_timeout_obj_to_nlattr,
|
|
|
|
.nlattr_max = CTA_TIMEOUT_GRE_MAX,
|
|
|
|
.obj_size = sizeof(unsigned int) * GRE_CT_MAX,
|
|
|
|
.nla_policy = gre_timeout_nla_policy,
|
|
|
|
},
|
|
|
|
#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
|
2012-05-28 21:04:21 +00:00
|
|
|
.net_id = &proto_gre_net_id,
|
|
|
|
.init_net = gre_init_net,
|
2006-12-03 06:09:41 +00:00
|
|
|
};
|
|
|
|
|
2008-10-08 09:35:10 +00:00
|
|
|
static int proto_gre_net_init(struct net *net)
|
|
|
|
{
|
2012-05-28 21:04:21 +00:00
|
|
|
int ret = 0;
|
2016-11-07 17:31:17 +00:00
|
|
|
|
|
|
|
ret = nf_ct_l4proto_pernet_register_one(net,
|
|
|
|
&nf_conntrack_l4proto_gre4);
|
2012-05-28 21:04:21 +00:00
|
|
|
if (ret < 0)
|
2013-01-23 11:51:10 +00:00
|
|
|
pr_err("nf_conntrack_gre4: pernet registration failed.\n");
|
2012-05-28 21:04:21 +00:00
|
|
|
return ret;
|
2008-10-08 09:35:10 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void proto_gre_net_exit(struct net *net)
|
|
|
|
{
|
2016-11-07 17:31:17 +00:00
|
|
|
nf_ct_l4proto_pernet_unregister_one(net, &nf_conntrack_l4proto_gre4);
|
2008-10-08 09:35:10 +00:00
|
|
|
nf_ct_gre_keymap_flush(net);
|
|
|
|
}
|
|
|
|
|
|
|
|
static struct pernet_operations proto_gre_net_ops = {
|
|
|
|
.init = proto_gre_net_init,
|
|
|
|
.exit = proto_gre_net_exit,
|
2009-11-29 15:46:08 +00:00
|
|
|
.id = &proto_gre_net_id,
|
|
|
|
.size = sizeof(struct netns_proto_gre),
|
2008-10-08 09:35:10 +00:00
|
|
|
};
|
|
|
|
|
2006-12-03 06:09:41 +00:00
|
|
|
static int __init nf_ct_proto_gre_init(void)
|
|
|
|
{
|
2013-01-23 11:51:10 +00:00
|
|
|
int ret;
|
|
|
|
|
|
|
|
ret = register_pernet_subsys(&proto_gre_net_ops);
|
|
|
|
if (ret < 0)
|
|
|
|
goto out_pernet;
|
2016-11-07 17:31:17 +00:00
|
|
|
ret = nf_ct_l4proto_register_one(&nf_conntrack_l4proto_gre4);
|
2013-03-07 17:20:46 +00:00
|
|
|
if (ret < 0)
|
|
|
|
goto out_gre4;
|
|
|
|
|
2013-01-23 11:51:10 +00:00
|
|
|
return 0;
|
|
|
|
out_gre4:
|
2013-03-07 17:20:46 +00:00
|
|
|
unregister_pernet_subsys(&proto_gre_net_ops);
|
|
|
|
out_pernet:
|
2013-01-23 11:51:10 +00:00
|
|
|
return ret;
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
|
|
|
|
2008-11-20 09:01:37 +00:00
|
|
|
static void __exit nf_ct_proto_gre_fini(void)
|
2006-12-03 06:09:41 +00:00
|
|
|
{
|
2016-11-07 17:31:17 +00:00
|
|
|
nf_ct_l4proto_unregister_one(&nf_conntrack_l4proto_gre4);
|
2009-11-29 15:46:08 +00:00
|
|
|
unregister_pernet_subsys(&proto_gre_net_ops);
|
2006-12-03 06:09:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
module_init(nf_ct_proto_gre_init);
|
|
|
|
module_exit(nf_ct_proto_gre_fini);
|
|
|
|
|
|
|
|
MODULE_LICENSE("GPL");
|