Skip to contentSkip to conversation

NETFILTER: new ip_conntrack_sctp

PATCH In review Harald Welte 2 participants 2 messages Aug 1, 2004 – Aug 2, 2004

Subsystems (4)
Networking Network drivers netfilter Proc sysctl
lore
Share & tools
lore

Harald Welte

author
#0 lore raw

PATCH 1/1 NETFILTER: new ip_conntrack_sctp

Hi Dave!

Incremental to all other patches so far, there is also the new SCTP conntrack helper by Kiran Kumar. Please apply for 2.6.9 ++, thanks.

Signed-off-by Kiran Kumar Immidi <[email protected]>
Signed-off-by Harald Welte <[email protected]>

Please apply, thanks.

include/linux/netfilter_ipv4/ip_conntrack.h +2 -0
diff --exclude-from /sunbeam/home/laforge/scripts/dontdiff -Nru linux-2.6.8-rc2-nfquilt/include/linux/netfilter_ipv4/ip_conntrack.h linux-2.6.8-rc2-nfquilt-nfp/include/linux/netfilter_ipv4/ip_conntrack.h
@@ -51,10 +51,12 @@
 
 #include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_icmp.h>
+#include <linux/netfilter_ipv4/ip_conntrack_sctp.h>
 
 /* per conntrack: protocol private data */
 union ip_conntrack_proto {
 	/* insert conntrack proto private data here */
+	struct ip_ct_sctp sctp;
 	struct ip_ct_tcp tcp;
 	struct ip_ct_icmp icmp;
 };
include/linux/netfilter_ipv4/ip_conntrack_sctp.h +25 -0
diff --exclude-from /sunbeam/home/laforge/scripts/dontdiff -Nru linux-2.6.8-rc2-nfquilt/include/linux/netfilter_ipv4/ip_conntrack_sctp.h linux-2.6.8-rc2-nfquilt-nfp/include/linux/netfilter_ipv4/ip_conntrack_sctp.h
@@ -0,0 +1,25 @@
+#ifndef _IP_CONNTRACK_SCTP_H
+#define _IP_CONNTRACK_SCTP_H
+/* SCTP tracking. */
+
+enum sctp_conntrack {
+	SCTP_CONNTRACK_NONE,
+	SCTP_CONNTRACK_CLOSED,
+	SCTP_CONNTRACK_COOKIE_WAIT,
+	SCTP_CONNTRACK_COOKIE_ECHOED,
+	SCTP_CONNTRACK_ESTABLISHED,
+	SCTP_CONNTRACK_SHUTDOWN_SENT,
+	SCTP_CONNTRACK_SHUTDOWN_RECD,
+	SCTP_CONNTRACK_SHUTDOWN_ACK_SENT,
+	SCTP_CONNTRACK_MAX
+};
+
+struct ip_ct_sctp
+{
+	enum sctp_conntrack state;
+
+	u_int32_t vtag[IP_CT_DIR_MAX];
+	u_int32_t ttag[IP_CT_DIR_MAX];
+};
+
+#endif /* _IP_CONNTRACK_SCTP_H */
include/linux/netfilter_ipv4/ip_conntrack_tuple.h +6 -0
diff --exclude-from /sunbeam/home/laforge/scripts/dontdiff -Nru linux-2.6.8-rc2-nfquilt/include/linux/netfilter_ipv4/ip_conntrack_tuple.h linux-2.6.8-rc2-nfquilt-nfp/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
@@ -25,6 +25,9 @@
 	struct {
 		u_int16_t id;
 	} icmp;
+	struct {
+		u_int16_t port;
+	} sctp;
 };
 
 /* The manipulable part of the tuple. */

@@ -55,6 +58,9 @@
 			struct {
 				u_int8_t type, code;
 			} icmp;
+			struct {
+				u_int16_t port;
+			} sctp;
 		} u;
 
 		/* The protocol. */
include/linux/sysctl.h +7 -0
diff --exclude-from /sunbeam/home/laforge/scripts/dontdiff -Nru linux-2.6.8-rc2-nfquilt/include/linux/sysctl.h linux-2.6.8-rc2-nfquilt-nfp/include/linux/sysctl.h
@@ -410,6 +410,13 @@
 	NET_IPV4_NF_CONNTRACK_ICMP_TIMEOUT=12,
 	NET_IPV4_NF_CONNTRACK_GENERIC_TIMEOUT=13,
 	NET_IPV4_NF_CONNTRACK_BUCKETS=14,
+	NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_CLOSED=15,
+	NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_WAIT=16,
+	NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_ECHOED=17,
+	NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_ESTABLISHED=18,
+	NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_SENT=19,
+	NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_RECD=20,
+	NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_ACK_SENT=21,
 };
  
 /* /proc/sys/net/ipv6 */
net/ipv4/netfilter/Kconfig +4 -0
diff --exclude-from /sunbeam/home/laforge/scripts/dontdiff -Nru linux-2.6.8-rc2-nfquilt/net/ipv4/netfilter/Kconfig linux-2.6.8-rc2-nfquilt-nfp/net/ipv4/netfilter/Kconfig
@@ -636,5 +636,9 @@
 	tristate  'SCTP protocol match support'
 	depends on IP_NF_IPTABLES
 
+config IP_NF_CT_PROTO_SCTP
+	tristate  'SCTP protocol connection tracking support (EXPERIMENTAL)'
+	depends on IP_NF_CONNTRACK && EXPERIMENTAL
+
 endmenu
net/ipv4/netfilter/Makefile +3 -0
diff --exclude-from /sunbeam/home/laforge/scripts/dontdiff -Nru linux-2.6.8-rc2-nfquilt/net/ipv4/netfilter/Makefile linux-2.6.8-rc2-nfquilt-nfp/net/ipv4/netfilter/Makefile
@@ -19,6 +19,9 @@
 # connection tracking
 obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o
 
+# SCTP protocol connection tracking
+obj-$(CONFIG_IP_NF_CT_PROTO_SCTP) += ip_conntrack_proto_sctp.o
+
 # connection tracking helpers
 obj-$(CONFIG_IP_NF_AMANDA) += ip_conntrack_amanda.o
 obj-$(CONFIG_IP_NF_TFTP) += ip_conntrack_tftp.o
net/ipv4/netfilter/ip_conntrack_proto_sctp.c +650 -0

650 lines not on this page · raw message

Signature · 5 lines
- Harald Welte <[email protected]>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie
#1 lore raw
Quoted 1 line · On Mon, 2 Aug 2004 01:03:38 +0200 Harald Welte <[email protected]> wrote:

Incremental to all other patches so far

Not really. Harald you really need to fixup your diff scripts wrt. handling non-netfilter files.

Every diff you've sent me in this whole set against linux/sysctl.h has rejected, including this one. In this instance, none of the tcp-window-tracking sysctls were in the sysctl.h file you diffed against.

I fixed this up by hand, so don't worry about this instance.