netfilter: built-in conntrack support for DCCP, SCTP, UDPlite

PATCH In review Davide Caratti 3 participants 7 messages Nov 15, 2016 – Dec 4, 2016

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Davide Caratti

author

2016-11-15 14:09 UTC #0 lore raw

v2 cover netfilter: built-in conntrack support for DCCP, SCTP, UDPlite

When netfilter needs to match traffic made by one of the above protocols, layer-4 connection tracking functionality will not be available, unless the user explicly loads it in the kernel (e.g. "modprobe nf_conntrack_proto_sctp") or modifies the default kernel configuration and rebuilds.
In order to remove such limitation, this series converts CONFIG_NF_CT_PROTO_{DCCP,SCTP,UDPLITE} from tristate to boolean: in case conntrack support for these protocols is enabled in the kernel configuration, it will be built into nf_conntrack.ko.

Patch 1/4 fixes nf_conntrack_tuple_common.h to avoid compile-time errors when moving module per-net private data.
Patches 2/4 3,4 and 4/4 remove loadable kernel module support from DCCP, SCTP and UDPlite respectively.

footprint test (nf-next.git, x86_64, RHEL7)

Patches 2/4 to 4/4 in this series have been individually tested on a nf-next.git kernel with standard RHEL7 configuration on x86_64 architecture, recording the unstripped binary size after module clean/rebuild:

$ ls -l net/netfilter/nf_conntrack{,_proto_{dccp,sctp,udplite}}.ko \
        net/ipv4/netfilter/nf_conntrack_ipv4.ko \
        net/ipv6/netfilter/nf_conntrack_ipv6.ko

(builtin)|| dccp | sctp | udplite | ipv4 | ipv6 | nf_conntrack
---------++--------+--------+-----------+--------+--------+--------------

none     || 469140 | 498243 |  432538   | 828755 | 828676 | 6141434
DCCP     ||   -    | 498987 |  432746   | 830566 | 829935 | 6533526
SCTP     || 469276 |   -    |  432690   | 829254 | 829175 | 6547872
UDPlite  || 469484 | 498587 |    -      | 829649 | 829362 | 6498204
all      ||   -    |   -    |    -      | 831999 | 831104 | 7298358

v2:
- patch 1/4: use #ifndef __KERNEL__ directive instead of just removing "#include <linux/netfilter.h>" line
- patch 1/4: reword commit message

Davide Caratti (4):
netfilter: nf_conntrack_tuple_common.h: fix #include
netfilter: conntrack: built-in support for DCCP
netfilter: conntrack: built-in support for SCTP
netfilter: conntrack: built-in support for UDPlite

 include/linux/netfilter/nf_conntrack_dccp.h        |  2 +-
 include/net/netfilter/ipv4/nf_conntrack_ipv4.h     |  9 +++
 include/net/netfilter/ipv6/nf_conntrack_ipv6.h     |  9 +++
 include/net/netns/conntrack.h                      | 43 ++++++++++++
 .../linux/netfilter/nf_conntrack_tuple_common.h    |  3 +
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c     |  9 +++
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c     |  9 +++
 net/netfilter/Kconfig                              | 18 ++---
 net/netfilter/Makefile                             |  7 +-
 net/netfilter/nf_conntrack_proto_dccp.c            | 79 +++-------------------
 net/netfilter/nf_conntrack_proto_sctp.c            | 76 +++------------------
 net/netfilter/nf_conntrack_proto_udplite.c         | 79 +++-------------------
 12 files changed, 123 insertions(+), 220 deletions(-)

Signature · 1 line

2.7.4

Davide Caratti

author

2016-11-15 14:09 UTC #1 lore raw

PATCH v2 1/4 netfilter: nf_conntrack_tuple_common.h: fix #include

To allow usage of enum ip_conntrack_dir in include/net/netns/conntrack.h, this patch encloses #include <linux/netfilter.h> in a #ifndef __KERNEL__ directive, so that compiler errors caused by unwanted inclusion of include/linux/netfilter.h are avoided.
In addition, #include <linux/netfilter/nf_conntrack_common.h> line has been added to resolve correctly CTINFO2DIR macro.

Signed-off-by Davide Caratti <[email protected]>

---
 include/uapi/linux/netfilter/nf_conntrack_tuple_common.h | 3 +++
 1 file changed, 3 insertions(+)

include/uapi/linux/netfilter/nf_conntrack_tuple_common.h +3 -0

index a9c3834..526b424 100644
@@ -2,7 +2,10 @@
 #define _NF_CONNTRACK_TUPLE_COMMON_H
 
 #include <linux/types.h>
+#ifndef __KERNEL__
 #include <linux/netfilter.h>
+#endif
+#include <linux/netfilter/nf_conntrack_common.h> /* IP_CT_IS_REPLY */
 
 enum ip_conntrack_dir {
 	IP_CT_DIR_ORIGINAL,

Signature · 1 line

2.7.4

Mikko Rapeli

Acked-by on v2 1/4

2016-11-15 19:47 UTC #2 lore raw

Re: [PATCH nf-next v2 1/4] netfilter: nf_conntrack_tuple_common.h: fix #include

Quoted 8 lines · Davide Caratti

To allow usage of enum ip_conntrack_dir in include/net/netns/conntrack.h, this patch encloses #include <linux/netfilter.h> in a #ifndef __KERNEL__ directive, so that compiler errors caused by unwanted inclusion of include/linux/netfilter.h are avoided.
In addition, #include <linux/netfilter/nf_conntrack_common.h> line has been added to resolve correctly CTINFO2DIR macro.
Signed-off-by Davide Caratti <[email protected]>

Acked-by Mikko Rapeli <[email protected]>

-Mikko

Quoted 22 lines

---
 include/uapi/linux/netfilter/nf_conntrack_tuple_common.h | 3 +++
 1 file changed, 3 insertions(+)

include/uapi/linux/netfilter/nf_conntrack_tuple_common.h +3 -0

index a9c3834..526b424 100644
@@ -2,7 +2,10 @@
 #define _NF_CONNTRACK_TUPLE_COMMON_H
 
 #include <linux/types.h>
+#ifndef __KERNEL__
 #include <linux/netfilter.h>
+#endif
+#include <linux/netfilter/nf_conntrack_common.h> /* IP_CT_IS_REPLY */
 
 enum ip_conntrack_dir {
 	IP_CT_DIR_ORIGINAL,

Signature · 1 line

2.7.4

Davide Caratti

author

2016-11-15 14:09 UTC #3 lore raw

PATCH v2 2/4 netfilter: conntrack: built-in support for DCCP

In reply to Davide Caratti

CONFIG_NF_CT_PROTO_DCCP is no more a tristate. When set to y, connection tracking support for DCCP protocol is built-in into nf_conntrack.ko.

footprint test:

$ ls -l net/netfilter/nf_conntrack{_proto_dccp,}.ko \
        net/ipv4/netfilter/nf_conntrack_ipv4.ko \
        net/ipv6/netfilter/nf_conntrack_ipv6.ko

(builtin)|| dccp | ipv4 | ipv6 | nf_conntrack
---------++--------+--------+--------+--------------

none     || 469140 | 828755 | 828676 | 6141434
DCCP     ||   -    | 830566 | 829935 | 6533526

Signed-off-by Davide Caratti <[email protected]>

---
 include/linux/netfilter/nf_conntrack_dccp.h    |  2 +-
 include/net/netfilter/ipv4/nf_conntrack_ipv4.h |  3 +
 include/net/netfilter/ipv6/nf_conntrack_ipv6.h |  3 +
 include/net/netns/conntrack.h                  | 14 +++++
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |  3 +
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |  3 +
 net/netfilter/Kconfig                          |  6 +-
 net/netfilter/Makefile                         |  3 +-
 net/netfilter/nf_conntrack_proto_dccp.c        | 79 ++++----------------------
 9 files changed, 41 insertions(+), 75 deletions(-)

include/linux/netfilter/nf_conntrack_dccp.h +1 -1

index 40dcc82..ff721d7 100644
@@ -25,7 +25,7 @@ enum ct_dccp_roles {
 #define CT_DCCP_ROLE_MAX	(__CT_DCCP_ROLE_MAX - 1)
 
 #ifdef __KERNEL__
-#include <net/netfilter/nf_conntrack_tuple.h>
+#include <linux/netfilter/nf_conntrack_tuple_common.h>
 
 struct nf_ct_dccp {
 	u_int8_t	role[IP_CT_DIR_MAX];

include/net/netfilter/ipv4/nf_conntrack_ipv4.h +3 -0

index 981c327..c2f155f 100644
@@ -15,6 +15,9 @@ extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udp4;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp;
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4;
+#endif
 
 int nf_conntrack_ipv4_compat_init(void);
 void nf_conntrack_ipv4_compat_fini(void);

include/net/netfilter/ipv6/nf_conntrack_ipv6.h +3 -0

index a4c9936..5ec66c0 100644
@@ -6,6 +6,9 @@ extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6;
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6;
+#endif
 
 #include <linux/sysctl.h>
 extern struct ctl_table nf_ct_ipv6_sysctl_table[];

include/net/netns/conntrack.h +14 -0

index 3d06d94..440b781 100644
@@ -6,6 +6,9 @@
 #include <linux/atomic.h>
 #include <linux/workqueue.h>
 #include <linux/netfilter/nf_conntrack_tcp.h>
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+#include <linux/netfilter/nf_conntrack_dccp.h>
+#endif
 #include <linux/seqlock.h>
 
 struct ctl_table_header;

@@ -48,12 +51,23 @@ struct nf_icmp_net {
 	unsigned int timeout;
 };
 
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+struct nf_dccp_net {
+	struct nf_proto_net pn;
+	int dccp_loose;
+	unsigned int dccp_timeout[CT_DCCP_MAX + 1];
+};
+#endif
+
 struct nf_ip_net {
 	struct nf_generic_net   generic;
 	struct nf_tcp_net	tcp;
 	struct nf_udp_net	udp;
 	struct nf_icmp_net	icmp;
 	struct nf_icmp_net	icmpv6;
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+	struct nf_dccp_net	dccp;
+#endif
 };
 
 struct ct_pcpu {

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +3 -0

index 7130ed5..cb3cf77 100644
@@ -340,6 +340,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto4[] = {
 	&nf_conntrack_l4proto_tcp4,
 	&nf_conntrack_l4proto_udp4,
 	&nf_conntrack_l4proto_icmp,
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+	&nf_conntrack_l4proto_dccp4,
+#endif
 };
 
 static int ipv4_net_init(struct net *net)

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +3 -0

index 500be28..f52338d 100644
@@ -340,6 +340,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto6[] = {
 	&nf_conntrack_l4proto_tcp6,
 	&nf_conntrack_l4proto_udp6,
 	&nf_conntrack_l4proto_icmpv6,
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+	&nf_conntrack_l4proto_dccp6,
+#endif
 };
 
 static int ipv6_net_init(struct net *net)

net/netfilter/Kconfig +3 -3

index 496e1dc..27a3d8c 100644
@@ -146,14 +146,14 @@ config NF_CONNTRACK_LABELS
 	  to connection tracking entries.  It selected by the connlabel match.
 
 config NF_CT_PROTO_DCCP
-	tristate 'DCCP protocol connection tracking support'
+	bool 'DCCP protocol connection tracking support'
 	depends on NETFILTER_ADVANCED
-	default IP_DCCP
+	default y
 	help
 	  With this option enabled, the layer 3 independent connection
 	  tracking code will be able to do state tracking on DCCP connections.
 
-	  If unsure, say 'N'.
+	  If unsure, say Y.
 
 config NF_CT_PROTO_GRE
 	tristate

net/netfilter/Makefile +1 -2

index 3b97d89..bbd0cc0 100644
@@ -5,6 +5,7 @@ nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMEOUT) += nf_conntrack_timeout.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMESTAMP) += nf_conntrack_timestamp.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_LABELS) += nf_conntrack_labels.o
+nf_conntrack-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o
 
 obj-$(CONFIG_NETFILTER) = netfilter.o

@@ -16,8 +17,6 @@ obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
 # connection tracking
 obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o
 
-# SCTP protocol connection tracking
-obj-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o
 obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o
 obj-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
 obj-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o

net/netfilter/nf_conntrack_proto_dccp.c +10 ~~-69~~

136 lines not on this page · raw message

Signature · 1 line

2.7.4

Davide Caratti

author

2016-11-15 14:09 UTC #4 lore raw

PATCH v2 3/4 netfilter: conntrack: built-in support for SCTP

In reply to Davide Caratti

CONFIG_NF_CT_PROTO_SCTP is no more a tristate. When set to y, connection tracking support for SCTP protocol is built-in into nf_conntrack.ko.

footprint test:

$ ls -l net/netfilter/nf_conntrack{_proto_sctp,}.ko \
        net/ipv4/netfilter/nf_conntrack_ipv4.ko \
        net/ipv6/netfilter/nf_conntrack_ipv6.ko

(builtin)|| sctp | ipv4 | ipv6 | nf_conntrack
---------++--------+--------+--------+--------------

none     || 498243 | 828755 | 828676 | 6141434
SCTP     ||   -    | 829254 | 829175 | 6547872

Signed-off-by Davide Caratti <[email protected]>

---
 include/net/netfilter/ipv4/nf_conntrack_ipv4.h |  3 +
 include/net/netfilter/ipv6/nf_conntrack_ipv6.h |  3 +
 include/net/netns/conntrack.h                  | 13 +++++
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |  3 +
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |  3 +
 net/netfilter/Kconfig                          |  7 +--
 net/netfilter/Makefile                         |  2 +-
 net/netfilter/nf_conntrack_proto_sctp.c        | 76 +++-----------------------
 8 files changed, 38 insertions(+), 72 deletions(-)

include/net/netfilter/ipv4/nf_conntrack_ipv4.h +3 -0

index c2f155f..5f1fc15 100644
@@ -18,6 +18,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp;
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4;
+#endif
 
 int nf_conntrack_ipv4_compat_init(void);
 void nf_conntrack_ipv4_compat_fini(void);

include/net/netfilter/ipv6/nf_conntrack_ipv6.h +3 -0

index 5ec66c0..f70d191 100644
@@ -9,6 +9,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6;
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6;
+#endif
 
 #include <linux/sysctl.h>
 extern struct ctl_table nf_ct_ipv6_sysctl_table[];

include/net/netns/conntrack.h +13 -0

index 440b781..17724c6 100644
@@ -9,6 +9,9 @@
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 #include <linux/netfilter/nf_conntrack_dccp.h>
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+#include <linux/netfilter/nf_conntrack_sctp.h>
+#endif
 #include <linux/seqlock.h>
 
 struct ctl_table_header;

@@ -59,6 +62,13 @@ struct nf_dccp_net {
 };
 #endif
 
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+struct nf_sctp_net {
+	struct nf_proto_net pn;
+	unsigned int timeouts[SCTP_CONNTRACK_MAX];
+};
+#endif
+
 struct nf_ip_net {
 	struct nf_generic_net   generic;
 	struct nf_tcp_net	tcp;

@@ -68,6 +78,9 @@ struct nf_ip_net {
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 	struct nf_dccp_net	dccp;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+	struct nf_sctp_net	sctp;
+#endif
 };
 
 struct ct_pcpu {

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +3 -0

index cb3cf77..0a9d354 100644
@@ -343,6 +343,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto4[] = {
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 	&nf_conntrack_l4proto_dccp4,
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+	&nf_conntrack_l4proto_sctp4,
+#endif
 };
 
 static int ipv4_net_init(struct net *net)

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +3 -0

index f52338d..1d8daaf 100644
@@ -343,6 +343,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto6[] = {
 #ifdef CONFIG_NF_CT_PROTO_DCCP
 	&nf_conntrack_l4proto_dccp6,
 #endif
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+	&nf_conntrack_l4proto_sctp6,
+#endif
 };
 
 static int ipv6_net_init(struct net *net)

net/netfilter/Kconfig +3 -4

index 27a3d8c..29c0bf0 100644
@@ -159,15 +159,14 @@ config NF_CT_PROTO_GRE
 	tristate
 
 config NF_CT_PROTO_SCTP
-	tristate 'SCTP protocol connection tracking support'
+	bool 'SCTP protocol connection tracking support'
 	depends on NETFILTER_ADVANCED
-	default IP_SCTP
+	default y
 	help
 	  With this option enabled, the layer 3 independent connection
 	  tracking code will be able to do state tracking on SCTP connections.
 
-	  If you want to compile it as a module, say M here and read
-	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
+	  If unsure, say Y.
 
 config NF_CT_PROTO_UDPLITE
 	tristate 'UDP-Lite protocol connection tracking support'

net/netfilter/Makefile +1 -1

index bbd0cc0..6545c28 100644
@@ -6,6 +6,7 @@ nf_conntrack-$(CONFIG_NF_CONNTRACK_TIMESTAMP) += nf_conntrack_timestamp.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_LABELS) += nf_conntrack_labels.o
 nf_conntrack-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o
+nf_conntrack-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
 
 obj-$(CONFIG_NETFILTER) = netfilter.o

@@ -18,7 +19,6 @@ obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
 obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o
 
 obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o
-obj-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
 obj-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o
 
 # netlink interface for nf_conntrack

net/netfilter/nf_conntrack_proto_sctp.c +9 ~~-67~~

127 lines not on this page · raw message

Signature · 1 line

2.7.4

Davide Caratti

author

2016-11-15 14:09 UTC #5 lore raw

PATCH v2 4/4 netfilter: conntrack: built-in support for UDPlite

In reply to Davide Caratti

CONFIG_NF_CT_PROTO_UDPLITE is no more a tristate. When set to y, connection tracking support for UDPlite protocol is built-in into nf_conntrack.ko.

footprint test:

$ ls -l net/netfilter/nf_conntrack{_proto_udplite,}.ko \
        net/ipv4/netfilter/nf_conntrack_ipv4.ko \
        net/ipv6/netfilter/nf_conntrack_ipv6.ko

(builtin)|| udplite| ipv4 | ipv6 |nf_conntrack
---------++--------+--------+--------+--------------

none     || 432538 | 828755 | 828676 | 6141434
UDPlite  ||   -    | 829649 | 829362 | 6498204

Signed-off-by Davide Caratti <[email protected]>

---
 include/net/netfilter/ipv4/nf_conntrack_ipv4.h |  3 +
 include/net/netfilter/ipv6/nf_conntrack_ipv6.h |  3 +
 include/net/netns/conntrack.h                  | 16 ++++++
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |  3 +
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |  3 +
 net/netfilter/Kconfig                          |  5 +-
 net/netfilter/Makefile                         |  2 +-
 net/netfilter/nf_conntrack_proto_udplite.c     | 79 +++-----------------------
 8 files changed, 41 insertions(+), 73 deletions(-)

include/net/netfilter/ipv4/nf_conntrack_ipv4.h +3 -0

index 5f1fc15..919e4e8 100644
@@ -21,6 +21,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4;
 #ifdef CONFIG_NF_CT_PROTO_SCTP
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4;
+#endif
 
 int nf_conntrack_ipv4_compat_init(void);
 void nf_conntrack_ipv4_compat_fini(void);

include/net/netfilter/ipv6/nf_conntrack_ipv6.h +3 -0

index f70d191..eaea968 100644
@@ -12,6 +12,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6;
 #ifdef CONFIG_NF_CT_PROTO_SCTP
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6;
+#endif
 
 #include <linux/sysctl.h>
 extern struct ctl_table nf_ct_ipv6_sysctl_table[];

include/net/netns/conntrack.h +16 -0

index 17724c6..cf799fc 100644
@@ -69,6 +69,19 @@ struct nf_sctp_net {
 };
 #endif
 
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+enum udplite_conntrack {
+	UDPLITE_CT_UNREPLIED,
+	UDPLITE_CT_REPLIED,
+	UDPLITE_CT_MAX
+};
+
+struct nf_udplite_net {
+	struct nf_proto_net pn;
+	unsigned int timeouts[UDPLITE_CT_MAX];
+};
+#endif
+
 struct nf_ip_net {
 	struct nf_generic_net   generic;
 	struct nf_tcp_net	tcp;

@@ -81,6 +94,9 @@ struct nf_ip_net {
 #ifdef CONFIG_NF_CT_PROTO_SCTP
 	struct nf_sctp_net	sctp;
 #endif
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+	struct nf_udplite_net	udplite;
+#endif
 };
 
 struct ct_pcpu {

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +3 -0

index 0a9d354..22fce4f 100644
@@ -346,6 +346,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto4[] = {
 #ifdef CONFIG_NF_CT_PROTO_SCTP
 	&nf_conntrack_l4proto_sctp4,
 #endif
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+	&nf_conntrack_l4proto_udplite4,
+#endif
 };
 
 static int ipv4_net_init(struct net *net)

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +3 -0

index 1d8daaf..389f712 100644
@@ -346,6 +346,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto6[] = {
 #ifdef CONFIG_NF_CT_PROTO_SCTP
 	&nf_conntrack_l4proto_sctp6,
 #endif
+#ifdef CONFIG_NF_CT_PROTO_UDPLITE
+	&nf_conntrack_l4proto_udplite6,
+#endif
 };
 
 static int ipv6_net_init(struct net *net)

net/netfilter/Kconfig +3 -2

index 29c0bf0..def4be0 100644
@@ -169,14 +169,15 @@ config NF_CT_PROTO_SCTP
 	  If unsure, say Y.
 
 config NF_CT_PROTO_UDPLITE
-	tristate 'UDP-Lite protocol connection tracking support'
+	bool 'UDP-Lite protocol connection tracking support'
 	depends on NETFILTER_ADVANCED
+	default y
 	help
 	  With this option enabled, the layer 3 independent connection
 	  tracking code will be able to do state tracking on UDP-Lite
 	  connections.
 
-	  To compile it as a module, choose M here.  If unsure, say N.
+	  If unsure, say Y.
 
 config NF_CONNTRACK_AMANDA
 	tristate "Amanda backup protocol support"

net/netfilter/Makefile +1 -1

index 6545c28..e4c8c1d 100644
@@ -7,6 +7,7 @@ nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o
 nf_conntrack-$(CONFIG_NF_CONNTRACK_LABELS) += nf_conntrack_labels.o
 nf_conntrack-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o
 nf_conntrack-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
+nf_conntrack-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o
 
 obj-$(CONFIG_NETFILTER) = netfilter.o

@@ -19,7 +20,6 @@ obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
 obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o
 
 obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o
-obj-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o
 
 # netlink interface for nf_conntrack
 obj-$(CONFIG_NF_CT_NETLINK) += nf_conntrack_netlink.o

net/netfilter/nf_conntrack_proto_udplite.c +9 ~~-70~~

135 lines not on this page · raw message

Signature · 1 line

2.7.4

Pablo Neira Ayuso

maintainer

2016-12-04 19:43 UTC #6 lore raw

In reply to Davide Caratti

Quoted 9 lines · Davide Caratti

When netfilter needs to match traffic made by one of the above protocols, layer-4 connection tracking functionality will not be available, unless the user explicly loads it in the kernel (e.g. "modprobe nf_conntrack_proto_sctp") or modifies the default kernel configuration and rebuilds.
In order to remove such limitation, this series converts CONFIG_NF_CT_PROTO_{DCCP,SCTP,UDPLITE} from tristate to boolean: in case conntrack support for these protocols is enabled in the kernel configuration, it will be built into nf_conntrack.ko.

Quoted 4 lines

Patch 1/4 fixes nf_conntrack_tuple_common.h to avoid compile-time errors when moving module per-net private data.
Patches 2/4 3,4 and 4/4 remove loadable kernel module support from DCCP, SCTP and UDPlite respectively.

Series applies, thanks Davide.