netfilter: built-in conntrack support for DCCP, SCTP, UDPlite

When netfilter needs to match traffic made by one of the above protocols, layer-4 connection tracking functionality will not be available, unless the user explicly loads it in the kernel (e.g. "modprobe nf_conntrack_proto_sctp") or modifies the default kernel configuration and rebuilds.
In order to remove such limitation, this series converts CONFIG_NF_CT_PROTO_{DCCP,SCTP,UDPLITE} from tristate to boolean: in case conntrack support for these protocols is enabled in the kernel configuration, it will be built into nf_conntrack.ko.

Patch 1/4 fixes nf_conntrack_tuple_common.h to avoid compile-time errors when moving module per-net private data.
Patches 2/4 3,4 and 4/4 remove loadable kernel module support from DCCP, SCTP and UDPlite respectively.

footprint test (nf-next.git, x86_64, RHEL7)

Patches 2/4 to 4/4 in this series have been individually tested on a nf-next.git kernel with standard RHEL7 configuration on x86_64 architecture, recording the unstripped binary size after module clean/rebuild:

$ ls -l net/netfilter/nf_conntrack{,_proto_{dccp,sctp,udplite}}.ko \
        net/ipv4/netfilter/nf_conntrack_ipv4.ko \
        net/ipv6/netfilter/nf_conntrack_ipv6.ko

(builtin)|| dccp | sctp | udplite | ipv4 | ipv6 | nf_conntrack
---------++--------+--------+-----------+--------+--------+--------------

none     || 469140 | 498243 |  432538   | 828755 | 828676 | 6141434                                                   
DCCP     ||   -    | 498987 |  432746   | 830566 | 829935 | 6533526                                                   
SCTP     || 469276 |   -    |  432690   | 829254 | 829175 | 6547872                                                   
UDPlite  || 469484 | 498587 |    -      | 829649 | 829362 | 6498204                                                   
all      ||   -    |   -    |    -      | 831999 | 831104 | 7298358

Davide Caratti (4):
netfilter: nf_conntrack_tuple_common.h: fix #include
netfilter: conntrack: built-in support for DCCP
netfilter: conntrack: built-in support for SCTP
netfilter: conntrack: built-in support for UDPlite

 include/linux/netfilter/nf_conntrack_dccp.h        |  2 +-
 include/net/netfilter/ipv4/nf_conntrack_ipv4.h     |  9 +++
 include/net/netfilter/ipv6/nf_conntrack_ipv6.h     |  9 +++
 include/net/netns/conntrack.h                      | 43 ++++++++++++
 .../linux/netfilter/nf_conntrack_tuple_common.h    |  2 +-
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c     |  9 +++
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c     |  9 +++
 net/netfilter/Kconfig                              | 18 ++---
 net/netfilter/Makefile                             |  7 +-
 net/netfilter/nf_conntrack_proto_dccp.c            | 79 +++-------------------
 net/netfilter/nf_conntrack_proto_sctp.c            | 76 +++------------------
 net/netfilter/nf_conntrack_proto_udplite.c         | 79 +++-------------------
 12 files changed, 121 insertions(+), 221 deletions(-)

2.7.4

In commit 1ffad83dffd6 ("netfilter: fix include files for compilation"), compile-time errors were fixed for userspace programs including UAPI nf_conntrack_tuple_common.h: this was done by adding a "#include
<linux/netfilter.h>" line to that header file. This patch replaces
"<linux/netfilter.h>" with "<linux/netfilter/nf_conntrack_common.h>" in nf_conntrack_tuple_common.h to avoid compile-time errors when trying to use enum ip_conntrack_dir in include/net/netns/conntrack.h, and still correctly resolve IP_CT_IS_REPLY.

This accidentally fixes two failures in the output of the script used to test the above commit [1]:

$ pushd usr/include
$ ../../scripts/headers_compile_test.sh -k | grep FAILED >before.txt
$ sed -i s/netfilter.h/netfilter\/nf_conntrack_common.h/1 \
  linux/netfilter/nf_conntrack_tuple_common.h
$ ../../scripts/headers_compile_test.sh -k | grep FAILED >after.txt
$ diff before.txt after.txt
 24,25d23
 < FAILED: ./linux/netfilter/nf_conntrack_sctp.h
 < FAILED: ./linux/netfilter/nf_conntrack_tuple_common.h
$ popd

[1] https://github.com/mcfrisk/linux/blob/headers_test_v05/scripts/headers_compile_test.sh

---
 include/uapi/linux/netfilter/nf_conntrack_tuple_common.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index a9c3834..941e8ea 100644
@@ -2,7 +2,7 @@
 #define _NF_CONNTRACK_TUPLE_COMMON_H
 
 #include <linux/types.h>
-#include <linux/netfilter.h>
+#include <linux/netfilter/nf_conntrack_common.h>
 
 enum ip_conntrack_dir {
 	IP_CT_DIR_ORIGINAL,

2.7.4

Hi,

I assume also with this change it is ok to include both <linux/netfilter.h> and <linux/netfilter/nf_conntrack_tuple_common.h> userspace but what was the kernel compile error with include/net/netns/conntrack.h and ip_conntrack_dir?

Is there a kernel side conflict between uapi and net/netns headers?

Could the fix be confined into the kernel side private headers somehow to avoid changes visible to userspace?

I kind of like the pattern that netfilter uapi headers include <linux/netfilter.h> and get what they need from there. Maybe maintainers disagree though.

-Mikko

hi Mikko, thank you for looking at this!

The problem is in patch 3/4 as I added #include <linux/netfilter/nf_conntrack_sctp.h>  in include/net/netns/conntrack.h, but I saw similar things also with DCCP.

<...>
  CC      kernel/sysctl_binary.o
In file included from ./include/linux/netfilter.h:14:0,
                 from ./include/uapi/linux/netfilter/nf_conntrack_tuple_common.h:5, from ./include/uapi/linux/netfilter/nf_conntrack_sctp.h:5, from ./include/linux/netfilter/nf_conntrack_sctp.h:5, from ./include/net/netns/conntrack.h:13,
                 from ./include/net/net_namespace.h:25,
                 from ./include/linux/init_task.h:15,
                 from init/init_task.c:1:
./include/linux/netdevice.h:1859:2: error: unknown type name ‘possible_net_t’ possible_net_t   nd_net;
  ^
(possile_net_t is in net_namespace.h).

Looks like a circular dependency is here, or nf_conntrack_tuple_common.h is including the wrong netfilter.h. From within net/netns/conntrack.h I can include only those UAPI files that don't include <linux/netfilter.h> (for example, nf_conntrack_tcp.h that uses '2' instead of IP_CT_DIR_MAX).

Do you have any suggestion?
thank you in advance,
--
davide

hello Mikko,

I looked at the dependency issue:

current include/linux/netfilter.h needs include/net/net_namespace.h (i.e. nf_hook() needs struct net), and include/net/net_namespace.h needs include/net/netns/conntrack.h (i.e. struct net needs struct netns_ct).

That's why it's not possible to do #include <linux/netfilter.h> in include/net/netns/conntrack.h, and it's not possible in include/net/netns/conntrack.h to include any linux/netfilter/*.h UAPI header where #include <linux/netfilter.h> line is present: the preprocessor will prefer including include/linux/netfilter.h before include/uapi/linux/netfilter.h, thus generating the dependency error.

One possible fix for the above issue is to modify include/uapi/nf_conntrack_tuple_common.h in a way that it avoids including <linux/netfilter.h> when kernel sources are being built, and still exposes to userspace applications the same contents as commit 1ffad83dffd6 ("netfilter: fix include files for compilation"):

<...>
#include <linux/types.h>
#ifndef __KERNEL__
#include <linux/netfilter.h>
#endif
#include <linux/netfilter/nf_conntrack_common.h> /* for IP_CT_IS_REPLY */ <...>

BTW, include/uapi/linux/capi.h apparently does something similar with linux/kernelcapi.h. With the above change, also the output of

$ pushd usr/include
$ ../../scripts/headers_compile_test.sh -k | grep FAILED
$ popd

is preserved.

Are you ok if I post a v2 where the above change (and a minor fix: use _UAPI_NF_CONNTRACK_TUPLE_COMMON_H in place of NF_CONNTRACK_TUPLE_COMMON_H on the first lines) is done to nf_conntrack_tuple_common.h?

regards,
--
davide

Hi,

Am Mo. Nov. 14 15:01:57 2016 GMT+0100 schrieb Davide Caratti:

Thanks for digging into this. In many other subsystems the kernel side headers start by including the matching uapi header and then add the kernel side stuff. It seems netfilter has not done this and the split to uapi is not always clear.

Yes, this looks ok for me.

-Mikko

Sent from my Jolla

CONFIG_NF_CT_PROTO_DCCP is no more a tristate. When set to y, connection tracking support for DCCP protocol is built-in into nf_conntrack.ko.

footprint test:

$ ls -l net/netfilter/nf_conntrack{_proto_dccp,}.ko \
        net/ipv4/netfilter/nf_conntrack_ipv4.ko \
        net/ipv6/netfilter/nf_conntrack_ipv6.ko

(builtin)|| dccp | ipv4 | ipv6 | nf_conntrack
---------++--------+--------+--------+--------------

none     || 469140 | 828755 | 828676 | 6141434
DCCP     ||   -    | 830566 | 829935 | 6533526

---
 include/linux/netfilter/nf_conntrack_dccp.h    |  2 +-
 include/net/netfilter/ipv4/nf_conntrack_ipv4.h |  3 +
 include/net/netfilter/ipv6/nf_conntrack_ipv6.h |  3 +
 include/net/netns/conntrack.h                  | 14 +++++
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |  3 +
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |  3 +
 net/netfilter/Kconfig                          |  6 +-
 net/netfilter/Makefile                         |  3 +-
 net/netfilter/nf_conntrack_proto_dccp.c        | 79 ++++----------------------
 9 files changed, 41 insertions(+), 75 deletions(-)

index 40dcc82..ff721d7 100644
@@ -25,7 +25,7 @@ enum ct_dccp_roles {
 #define CT_DCCP_ROLE_MAX	(__CT_DCCP_ROLE_MAX - 1)
 
 #ifdef __KERNEL__
-#include <net/netfilter/nf_conntrack_tuple.h>
+#include <linux/netfilter/nf_conntrack_tuple_common.h>
 
 struct nf_ct_dccp {
 	u_int8_t	role[IP_CT_DIR_MAX];

index 981c327..c2f155f 100644
@@ -15,6 +15,9 @@ extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udp4;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp;
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4;
+#endif
 
 int nf_conntrack_ipv4_compat_init(void);
 void nf_conntrack_ipv4_compat_fini(void);

index a4c9936..5ec66c0 100644
@@ -6,6 +6,9 @@ extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6;
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6;
+#endif
 
 #include <linux/sysctl.h>
 extern struct ctl_table nf_ct_ipv6_sysctl_table[];

index e469e85..b0edb1e 100644
@@ -6,6 +6,9 @@
 #include <linux/atomic.h>
 #include <linux/workqueue.h>
 #include <linux/netfilter/nf_conntrack_tcp.h>
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+#include <linux/netfilter/nf_conntrack_dccp.h>
+#endif
 #include <linux/seqlock.h>
 
 struct ctl_table_header;

@@ -48,12 +51,23 @@ struct nf_icmp_net {
 	unsigned int timeout;
 };
 
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+struct nf_dccp_net {
+	struct nf_proto_net pn;
+	int dccp_loose;
+	unsigned int dccp_timeout[CT_DCCP_MAX + 1];
+};
+#endif
+
 struct nf_ip_net {
 	struct nf_generic_net   generic;
 	struct nf_tcp_net	tcp;
 	struct nf_udp_net	udp;
 	struct nf_icmp_net	icmp;
 	struct nf_icmp_net	icmpv6;
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+	struct nf_dccp_net	dccp;
+#endif
 };
 
 struct ct_pcpu {

index 7130ed5..cb3cf77 100644
@@ -340,6 +340,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto4[] = {
 	&nf_conntrack_l4proto_tcp4,
 	&nf_conntrack_l4proto_udp4,
 	&nf_conntrack_l4proto_icmp,
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+	&nf_conntrack_l4proto_dccp4,
+#endif
 };
 
 static int ipv4_net_init(struct net *net)

index 500be28..f52338d 100644
@@ -340,6 +340,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto6[] = {
 	&nf_conntrack_l4proto_tcp6,
 	&nf_conntrack_l4proto_udp6,
 	&nf_conntrack_l4proto_icmpv6,
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+	&nf_conntrack_l4proto_dccp6,
+#endif
 };
 
 static int ipv6_net_init(struct net *net)

index 496e1dc..27a3d8c 100644
@@ -146,14 +146,14 @@ config NF_CONNTRACK_LABELS
 	  to connection tracking entries.  It selected by the connlabel match.
 
 config NF_CT_PROTO_DCCP
-	tristate 'DCCP protocol connection tracking support'
+	bool 'DCCP protocol connection tracking support'
 	depends on NETFILTER_ADVANCED
-	default IP_DCCP
+	default y
 	help
 	  With this option enabled, the layer 3 independent connection
 	  tracking code will be able to do state tracking on DCCP connections.
 
-	  If unsure, say 'N'.
+	  If unsure, say Y.
 
 config NF_CT_PROTO_GRE
 	tristate

index 3b97d89..bbd0cc0 100644
@@ -5,6 +5,7 @@ nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMEOUT) += nf_conntrack_timeout.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMESTAMP) += nf_conntrack_timestamp.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_LABELS) += nf_conntrack_labels.o
+nf_conntrack-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o
 
 obj-$(CONFIG_NETFILTER) = netfilter.o
 

@@ -16,8 +17,6 @@ obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
 # connection tracking
 obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o
 
-# SCTP protocol connection tracking
-obj-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o
 obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o
 obj-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
 obj-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o

2.7.4

CONFIG_NF_CT_PROTO_SCTP is no more a tristate. When set to y, connection tracking support for SCTP protocol is built-in into nf_conntrack.ko.

footprint test:

$ ls -l net/netfilter/nf_conntrack{_proto_sctp,}.ko \
        net/ipv4/netfilter/nf_conntrack_ipv4.ko \
        net/ipv6/netfilter/nf_conntrack_ipv6.ko

(builtin)|| sctp | ipv4 | ipv6 | nf_conntrack
---------++--------+--------+--------+--------------

none     || 498243 | 828755 | 828676 | 6141434
SCTP     ||   -    | 829254 | 829175 | 6547872

---
 include/net/netfilter/ipv4/nf_conntrack_ipv4.h |  3 +
 include/net/netfilter/ipv6/nf_conntrack_ipv6.h |  3 +
 include/net/netns/conntrack.h                  | 13 +++++
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |  3 +
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |  3 +
 net/netfilter/Kconfig                          |  7 +--
 net/netfilter/Makefile                         |  2 +-
 net/netfilter/nf_conntrack_proto_sctp.c        | 76 +++-----------------------
 8 files changed, 38 insertions(+), 72 deletions(-)

index c2f155f..5f1fc15 100644
@@ -18,6 +18,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp;
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4;
+#endif
 
 int nf_conntrack_ipv4_compat_init(void);
 void nf_conntrack_ipv4_compat_fini(void);

index 5ec66c0..f70d191 100644
@@ -9,6 +9,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6;
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6;
+#endif
 
 #include <linux/sysctl.h>
 extern struct ctl_table nf_ct_ipv6_sysctl_table[];

index b0edb1e..7f73aa8 100644
@@ -9,6 +9,9 @@
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 #include <linux/netfilter/nf_conntrack_dccp.h>
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+#include <linux/netfilter/nf_conntrack_sctp.h>
+#endif
 #include <linux/seqlock.h>
 
 struct ctl_table_header;

@@ -59,6 +62,13 @@ struct nf_dccp_net {
 };
 #endif
 
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+struct nf_sctp_net {
+	struct nf_proto_net pn;
+	unsigned int timeouts[SCTP_CONNTRACK_MAX];
+};
+#endif
+
 struct nf_ip_net {
 	struct nf_generic_net   generic;
 	struct nf_tcp_net	tcp;

@@ -68,6 +78,9 @@ struct nf_ip_net {
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 	struct nf_dccp_net	dccp;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+	struct nf_sctp_net	sctp;
+#endif
 };
 
 struct ct_pcpu {

index cb3cf77..0a9d354 100644
@@ -343,6 +343,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto4[] = {
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 	&nf_conntrack_l4proto_dccp4,
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+	&nf_conntrack_l4proto_sctp4,
+#endif
 };
 
 static int ipv4_net_init(struct net *net)

index f52338d..1d8daaf 100644
@@ -343,6 +343,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto6[] = {
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 	&nf_conntrack_l4proto_dccp6,
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+	&nf_conntrack_l4proto_sctp6,
+#endif
 };
 
 static int ipv6_net_init(struct net *net)

index 27a3d8c..29c0bf0 100644
@@ -159,15 +159,14 @@ config NF_CT_PROTO_GRE
 	tristate
 
 config NF_CT_PROTO_SCTP
-	tristate 'SCTP protocol connection tracking support'
+	bool 'SCTP protocol connection tracking support'
 	depends on NETFILTER_ADVANCED
-	default IP_SCTP
+	default y
 	help
 	  With this option enabled, the layer 3 independent connection
 	  tracking code will be able to do state tracking on SCTP connections.
 
-	  If you want to compile it as a module, say M here and read
-	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
+	  If unsure, say Y.
 
 config NF_CT_PROTO_UDPLITE
 	tristate 'UDP-Lite protocol connection tracking support'

index bbd0cc0..6545c28 100644
@@ -6,6 +6,7 @@ nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMESTAMP) += nf_conntrack_timestamp.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_LABELS) += nf_conntrack_labels.o
 nf_conntrack-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o
+nf_conntrack-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
 
 obj-$(CONFIG_NETFILTER) = netfilter.o
 

@@ -18,7 +19,6 @@ obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
 obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o
 
 obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o
-obj-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
 obj-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o
 
 # netlink interface for nf_conntrack

2.7.4

CONFIG_NF_CT_PROTO_UDPLITE is no more a tristate. When set to y, connection tracking support for UDPlite protocol is built-in into nf_conntrack.ko.

footprint test:

$ ls -l net/netfilter/nf_conntrack{_proto_udplite,}.ko \
        net/ipv4/netfilter/nf_conntrack_ipv4.ko \
        net/ipv6/netfilter/nf_conntrack_ipv6.ko

(builtin)|| udplite| ipv4 | ipv6 |nf_conntrack
---------++--------+--------+--------+--------------

none     || 432538 | 828755 | 828676 | 6141434
UDPlite  ||   -    | 829649 | 829362 | 6498204

---
 include/net/netfilter/ipv4/nf_conntrack_ipv4.h |  3 +
 include/net/netfilter/ipv6/nf_conntrack_ipv6.h |  3 +
 include/net/netns/conntrack.h                  | 16 ++++++
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |  3 +
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |  3 +
 net/netfilter/Kconfig                          |  5 +-
 net/netfilter/Makefile                         |  2 +-
 net/netfilter/nf_conntrack_proto_udplite.c     | 79 +++-----------------------
 8 files changed, 41 insertions(+), 73 deletions(-)

index 5f1fc15..919e4e8 100644
@@ -21,6 +21,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4;
 #ifdef CONFIG_NF_CT_PROTO_SCTP
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4;
+#endif
 
 int nf_conntrack_ipv4_compat_init(void);
 void nf_conntrack_ipv4_compat_fini(void);

index f70d191..eaea968 100644
@@ -12,6 +12,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6;
 #ifdef CONFIG_NF_CT_PROTO_SCTP
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6;
+#endif
 
 #include <linux/sysctl.h>
 extern struct ctl_table nf_ct_ipv6_sysctl_table[];

index 7f73aa8..d5e1452 100644
@@ -69,6 +69,19 @@ struct nf_sctp_net {
 };
 #endif
 
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+enum udplite_conntrack {
+	UDPLITE_CT_UNREPLIED,
+	UDPLITE_CT_REPLIED,
+	UDPLITE_CT_MAX
+};
+
+struct nf_udplite_net {
+	struct nf_proto_net pn;
+	unsigned int timeouts[UDPLITE_CT_MAX];
+};
+#endif
+
 struct nf_ip_net {
 	struct nf_generic_net   generic;
 	struct nf_tcp_net	tcp;

@@ -81,6 +94,9 @@ struct nf_ip_net {
 #ifdef CONFIG_NF_CT_PROTO_SCTP
 	struct nf_sctp_net	sctp;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+	struct nf_udplite_net	udplite;
+#endif
 };
 
 struct ct_pcpu {

index 0a9d354..22fce4f 100644
@@ -346,6 +346,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto4[] = {
 #ifdef CONFIG_NF_CT_PROTO_SCTP
 	&nf_conntrack_l4proto_sctp4,
 #endif
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+	&nf_conntrack_l4proto_udplite4,
+#endif
 };
 
 static int ipv4_net_init(struct net *net)

index 1d8daaf..389f712 100644
@@ -346,6 +346,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto6[] = {
 #ifdef CONFIG_NF_CT_PROTO_SCTP
 	&nf_conntrack_l4proto_sctp6,
 #endif
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+	&nf_conntrack_l4proto_udplite6,
+#endif
 };
 
 static int ipv6_net_init(struct net *net)

index 29c0bf0..def4be0 100644
@@ -169,14 +169,15 @@ config NF_CT_PROTO_SCTP
 	  If unsure, say Y.
 
 config NF_CT_PROTO_UDPLITE
-	tristate 'UDP-Lite protocol connection tracking support'
+	bool 'UDP-Lite protocol connection tracking support'
 	depends on NETFILTER_ADVANCED
+	default y
 	help
 	  With this option enabled, the layer 3 independent connection
 	  tracking code will be able to do state tracking on UDP-Lite
 	  connections.
 
-	  To compile it as a module, choose M here.  If unsure, say N.
+	  If unsure, say Y.
 
 config NF_CONNTRACK_AMANDA
 	tristate "Amanda backup protocol support"

index 6545c28..e4c8c1d 100644
@@ -7,6 +7,7 @@ nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_LABELS) += nf_conntrack_labels.o
 nf_conntrack-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o
 nf_conntrack-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
+nf_conntrack-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o
 
 obj-$(CONFIG_NETFILTER) = netfilter.o
 

@@ -19,7 +20,6 @@ obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
 obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o
 
 obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o
-obj-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o
 
 # netlink interface for nf_conntrack
 obj-$(CONFIG_NF_CT_NETLINK) += nf_conntrack_netlink.o

2.7.4