nfsim: Support more netfilter modules
PATCH 1/1 nfsim: Support more netfilter modules
Hi,
this patch adds nfsim support for building most of the netfilter stuff in 2.6.15. The things still not compiling are CONFIG_IP_NF_CONNTRACK_NETLINK and CONFIG_IP_NF_MATCH_STRING
//Marcus
Signature · 3 lines
---------------------------------------+-------------------------- Marcus Sundberg <[email protected]> | Firewalls with SIP & NAT Software Developer, Ingate Systems AB | http://www.ingate.com/
[NFSIM] Support more netfilter modules
This patch makes it possible to build with, and enables, the following 2.6.15 options in the nfsim framework:
CONFIG_IP_NF_CONNTRACK_EVENTSCONFIG_IP_NF_CT_PROTO_SCTPCONFIG_IP_NF_NETBIOS_NSCONFIG_IP_NF_PPTPCONFIG_IP_NF_MATCH_DCCPCONFIG_IP_NF_MATCH_CONNBYTESCONFIG_IP_NF_TARGET_NFQUEUECONFIG_IP_NF_NAT_PPTPCONFIG_IP_NF_TARGET_TTL
It also fixes compilation of ipt_hashlimit.c and ipt_sctp.c, as well as the external IP sets patch by Jozsef Kadlecsik.
core/ipv4/ipv4.h +147 -0
@@ -72,6 +72,7 @@IPPROTO_PUP =12 ,/* PUP protocol */ IPPROTO_UDP =17 ,/* User Datagram Protocol */ IPPROTO_IDP =22 ,/* XNS IDP protocol */ +IPPROTO_DCCP =33 ,/* Datagram Congestion Control Protocol */ IPPROTO_RSVP =46 ,/* RSVP protocol */ IPPROTO_GRE = 47, /* Cisco GRE tunnels (rfc 1701,1702) */
@@ -314,6 +315,150 @@ } un; }; +/* sctp.h */ + +typedef struct sctphdr { +__u16 source; +__u16 dest; +__u32 vtag; +__u32 checksum; +} __attribute__((packed))sctp_sctphdr_t ; + +typedef struct sctp_chunkhdr { +__u8 type; +__u8 flags; +__u16 length; +} __attribute__((packed))sctp_chunkhdr_t ; + +typedef enum { +SCTP_CID_DATA =0 , +SCTP_CID_INIT =1 , +SCTP_CID_INIT_ACK =2 , +SCTP_CID_SACK =3 , +SCTP_CID_HEARTBEAT =4 , +SCTP_CID_HEARTBEAT_ACK =5 , +SCTP_CID_ABORT =6 , +SCTP_CID_SHUTDOWN =7 , +SCTP_CID_SHUTDOWN_ACK =8 , +SCTP_CID_ERROR =9 , +SCTP_CID_COOKIE_ECHO =10 , +SCTP_CID_COOKIE_ACK =11 , +SCTP_CID_ECN_ECNE =12 , +SCTP_CID_ECN_CWR =13 , +SCTP_CID_SHUTDOWN_COMPLETE =14 , + +/* PR-SCTP Sec 3.2 */ +SCTP_CID_FWD_TSN =0xC0 , + +/* Use hex, as defined in ADDIP sec. 3.1 */ +SCTP_CID_ASCONF =0xC1 , +SCTP_CID_ASCONF_ACK =0x80 , +}sctp_cid_t ;/* enum */ + +typedef struct sctp_inithdr { +__u32 init_tag; +__u32 a_rwnd; +__u16 num_outbound_streams; +__u16 num_inbound_streams; +__u32 initial_tsn; +__u8 params[0 ]; +} __attribute__((packed))sctp_inithdr_t ; + +/* dccp.h */ + +struct dccp_hdr { +__u16 dccph_sport, + dccph_dport; +__u8 dccph_doff; +#if defined(__LITTLE_ENDIAN_BITFIELD) +__u8 dccph_cscov:4 , + dccph_ccval:4 ; +#elif defined(__BIG_ENDIAN_BITFIELD) +__u8 dccph_ccval:4 , + dccph_cscov:4 ; +#else +#error "Adjust your <asm/byteorder.h> defines" +#endif +__u16 dccph_checksum; +#if defined(__LITTLE_ENDIAN_BITFIELD) +__u32 dccph_x:1 , + dccph_type:4 , + dccph_reserved:3 , + dccph_seq:24 ; +#elif defined(__BIG_ENDIAN_BITFIELD) +__u32 dccph_reserved:3 , + dccph_type:4 , + dccph_x:1 , + dccph_seq:24 ; +#else +#error "Adjust your <asm/byteorder.h> defines" +#endif +}; + +struct dccp_hdr_ext { +__u32 dccph_seq_low; +}; +struct dccp_hdr_request { +__u32 dccph_req_service; +}; +struct dccp_hdr_ack_bits { +__u32 dccph_reserved1:8 , + dccph_ack_nr_high:24 ; +__u32 dccph_ack_nr_low; +}; +struct dccp_hdr_response { +struct dccp_hdr_ack_bits dccph_resp_ack; +__u32 dccph_resp_service; +}; +struct dccp_hdr_reset { +struct dccp_hdr_ack_bits dccph_reset_ack; +__u8 dccph_reset_code, + dccph_reset_data[3 ]; +}; + +enum dccp_pkt_type { +DCCP_PKT_REQUEST =0 , +DCCP_PKT_RESPONSE , +DCCP_PKT_DATA , +DCCP_PKT_ACK , +DCCP_PKT_DATAACK , +DCCP_PKT_CLOSEREQ , +DCCP_PKT_CLOSE , +DCCP_PKT_RESET , +DCCP_PKT_SYNC , +DCCP_PKT_SYNCACK , +DCCP_PKT_INVALID , +}; + +static inline unsigned int dccp_packet_hdr_len (const __u8 type) +{ +if (type ==DCCP_PKT_DATA ) +return 0 ; +if (type ==DCCP_PKT_DATAACK || + type ==DCCP_PKT_ACK || + type ==DCCP_PKT_SYNC || + type ==DCCP_PKT_SYNCACK || + type ==DCCP_PKT_CLOSE || + type ==DCCP_PKT_CLOSEREQ ) +return sizeof (struct dccp_hdr_ack_bits ); +if (type ==DCCP_PKT_REQUEST ) +return sizeof (struct dccp_hdr_request ); +if (type ==DCCP_PKT_RESPONSE ) +return sizeof (struct dccp_hdr_response ); +return sizeof (struct dccp_hdr_reset ); +} + +static inline unsigned int __dccp_basic_hdr_len (const struct dccp_hdr *dh) +{ +return sizeof (*dh) + (dh->dccph_x ?sizeof (struct dccp_hdr_ext ) :0 ); +} + +static inline unsigned int __dccp_hdr_len (const struct dccp_hdr *dh) +{ +return __dccp_basic_hdr_len (dh) + +dccp_packet_hdr_len (dh->dccph_type); +} +/* in_route.h */ /* IPv4 routing cache flags */
@@ -503,6 +648,8 @@u32 ifa_address;u32 ifa_mask;u32 ifa_broadcast; + +unsigned char ifa_flags; };
kernelenv/include/kernelenv.h +70 -0
101 lines not on this page · raw message
kernelenv/kernelenv.c +46 -0
58 lines not on this page · raw message
.links +5 -0
@@ -57,6 +57,7 @@ ./asm/page.h ./asm/types.h ./asm/byteorder.h +./asm/div64.h ./net/tcp.h ./net/checksum.h ./net/route.h
@@ -72,3 +73,7 @@ ./linux/swap.h ./linux/list.h ./linux/random.h +./linux/delay.h +./linux/sctp.h +./linux/dccp.h +./linux/kmalloc_sizes.h
.config.sample +9 -0
@@ -14,10 +14,14 @@ CONFIG_IP_NF_CONNTRACK=m CONFIG_IP_NF_CT_ACCT=y CONFIG_IP_NF_CONNTRACK_MARK=y +CONFIG_IP_NF_CONNTRACK_EVENTS=y +CONFIG_IP_NF_CT_PROTO_SCTP=m CONFIG_IP_NF_FTP=m CONFIG_IP_NF_IRC=m +CONFIG_IP_NF_NETBIOS_NS=m CONFIG_IP_NF_TFTP=m CONFIG_IP_NF_AMANDA=m +CONFIG_IP_NF_PPTP=m CONFIG_IP_NF_IPTABLES=m CONFIG_IP_NF_MATCH_LIMIT=m CONFIG_IP_NF_MATCH_IPRANGE=m
@@ -39,13 +43,16 @@ CONFIG_IP_NF_MATCH_ADDRTYPE=m CONFIG_IP_NF_MATCH_REALM=m CONFIG_IP_NF_MATCH_SCTP=m +CONFIG_IP_NF_MATCH_DCCP=m CONFIG_IP_NF_MATCH_COMMENT=m CONFIG_IP_NF_MATCH_CONNMARK=m +CONFIG_IP_NF_MATCH_CONNBYTES=m CONFIG_IP_NF_MATCH_HASHLIMIT=m CONFIG_IP_NF_FILTER=m CONFIG_IP_NF_TARGET_REJECT=m CONFIG_IP_NF_TARGET_LOG=m CONFIG_IP_NF_TARGET_TCPMSS=m +CONFIG_IP_NF_TARGET_NFQUEUE=m CONFIG_IP_NF_NAT=m CONFIG_IP_NF_NAT_LOCAL=y CONFIG_IP_NF_NAT_NEEDED=y
@@ -57,12 +64,14 @@ CONFIG_IP_NF_NAT_FTP=m CONFIG_IP_NF_NAT_TFTP=m CONFIG_IP_NF_NAT_AMANDA=m +CONFIG_IP_NF_NAT_PPTP=m CONFIG_IP_NF_MANGLE=m CONFIG_IP_NF_TARGET_TOS=m CONFIG_IP_NF_TARGET_ECN=m CONFIG_IP_NF_TARGET_DSCP=m CONFIG_IP_NF_TARGET_MARK=m CONFIG_IP_NF_TARGET_CLASSIFY=m +CONFIG_IP_NF_TARGET_TTL=m CONFIG_IP_NF_TARGET_CONNMARK=m CONFIG_IP_NF_RAW=m CONFIG_IP_NF_TARGET_NOTRACK=m
kernelenv/include/kernelenv.h line 1186
Quoted 13 lines · Marcus Sundberg
kernelenv/include/kernelenv.h +4
-0@@ -1166,6 +1177,10 @@static inline void smp_read_barrier_depends (void ) {;} +/* delay.h */ + +#define msleep (x) do{unsigned int y = (x)*1000; usleep(y);}while(0) +/* timer.h */ /* not used at the moment */
Hmm, actually I guess something like:
#define msleep(x) increment_time((x)*HZ/1000)
would make more sense. Comments (on this or the original patch)?
//Marcus
Signature · 3 lines
---------------------------------------+-------------------------- Marcus Sundberg <[email protected]> | Firewalls with SIP & NAT Software Developer, Ingate Systems AB | http://www.ingate.com/
Quoted 14 lines · Marcus Sundberg
Quoted 12 lines · Marcus Sundberg
kernelenv/include/kernelenv.h +4
-0@@ -1166,6 +1177,10 @@static inline void smp_read_barrier_depends (void ) {;} +/* delay.h */ + +#define msleep (x) do{unsigned int y = (x)*1000; usleep(y);}while(0) +/* timer.h */
Quoted 8 lines
kernelenv/include/kernelenv.h line 1186
Quoted 1 line
kernelenv/include/kernelenv.h +0
-0/* not used at the moment */ Hmm, actually I guess something like:
#define msleep(x) increment_time((x)*HZ/1000)
would make more sense. Comments (on this or the original patch)?
Definitely :) We don't really want to sleep.
Quoted 5 lines · Marcus Sundberg
Hi,
this patch adds nfsim support for building most of the netfilter stuff in 2.6.15. The things still not compiling are
CONFIG_IP_NF_CONNTRACK_NETLINKandCONFIG_IP_NF_MATCH_STRING
Looks good. Harald is currently working on nfsim so I'll leave it to him to apply your patch.
kernelenv/include/kernelenv.h line 1273
Quoted 11 lines
kernelenv/include/kernelenv.h +11
-0+/* div64.h */ + +#if BITS_PER_LONG ==64 +# define do_div (n,base) ({ \ + uint32_t __base = (base); \ + uint32_t __rem; \ + __rem = ((uint64_t)(n)) % __base; \ + (n) = ((uint64_t)(n)) / __base; \ + __rem; \ + }) +#elif BITS_PER_LONG ==32
Just using the 64 bit version unconditionally is fine in userspace and avoids the need for __div64_32.
Harald Welte
AppliedQuoted 5 lines · Marcus Sundberg
Hi,
this patch adds nfsim support for building most of the netfilter stuff in 2.6.15. The things still not compiling are
CONFIG_IP_NF_CONNTRACK_NETLINKandCONFIG_IP_NF_MATCH_STRING
thanks, applied.
Signature · 5 lines
- Harald Welte <[email protected]> http://netfilter.org/ ============================================================================ "Fragmentation is like classful addressing -- an interesting early architectural error that shows how much experimentation was going on while IP was being designed." -- Paul Vixie
Quoted 7 lines · Harald Welte
Quoted 3 lines · Marcus Sundberg
this patch adds nfsim support for building most of the netfilter stuff in 2.6.15. The things still not compiling are
CONFIG_IP_NF_CONNTRACK_NETLINKandCONFIG_IP_NF_MATCH_STRINGthanks, applied.
Hi,
the patch contained a bogus msleep() implementation, please accept the following correction.
//Marcus
Signature · 3 lines
---------------------------------------+-------------------------- Marcus Sundberg <[email protected]> | Firewalls with SIP & NAT Software Developer, Ingate Systems AB | http://www.ingate.com/
[NFSIM] Implement msleep() better
There's no point in actually sleeping in the nfsim framework, just increment time properly.
kernelenv/include/kernelenv.h +1 -1
@@ -1231,7 +1231,7 @@/* delay.h */ -#define msleep (x) do{unsigned int y = (x)*1000; usleep(y);}while(0) +#define msleep (x) increment_time((x)*HZ/1000)/* timer.h */
Harald Welte
AppliedQuoted 2 lines · Marcus Sundberg
the patch contained a bogus
msleep()implementation, please accept the following correction.
thanks, applied.
Signature · 5 lines
- Harald Welte <[email protected]> http://netfilter.org/ ============================================================================ "Fragmentation is like classful addressing -- an interesting early architectural error that shows how much experimentation was going on while IP was being designed." -- Paul Vixie