Skip to contentSkip to conversation

nfsim: Support more netfilter modules

PATCH Applied Marcus Sundberg 3 participants 7 messages Dec 13, 2005 – Jan 12, 2006 netfilter

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 nfsim: Support more netfilter modules

Hi,

this patch adds nfsim support for building most of the netfilter stuff in 2.6.15. The things still not compiling are CONFIG_IP_NF_CONNTRACK_NETLINK and CONFIG_IP_NF_MATCH_STRING

//Marcus

Signature · 3 lines
---------------------------------------+--------------------------
  Marcus Sundberg <[email protected]>  | Firewalls with SIP & NAT
 Software Developer, Ingate Systems AB |  http://www.ingate.com/

[NFSIM] Support more netfilter modules

This patch makes it possible to build with, and enables, the following 2.6.15 options in the nfsim framework:

CONFIG_IP_NF_CONNTRACK_EVENTS
CONFIG_IP_NF_CT_PROTO_SCTP
CONFIG_IP_NF_NETBIOS_NS
CONFIG_IP_NF_PPTP
CONFIG_IP_NF_MATCH_DCCP
CONFIG_IP_NF_MATCH_CONNBYTES
CONFIG_IP_NF_TARGET_NFQUEUE
CONFIG_IP_NF_NAT_PPTP
CONFIG_IP_NF_TARGET_TTL

It also fixes compilation of ipt_hashlimit.c and ipt_sctp.c, as well as the external IP sets patch by Jozsef Kadlecsik.

core/ipv4/ipv4.h +147 -0
@@ -72,6 +72,7 @@
   IPPROTO_PUP = 12,		/* PUP protocol				*/
   IPPROTO_UDP = 17,		/* User Datagram Protocol		*/
   IPPROTO_IDP = 22,		/* XNS IDP protocol			*/
+  IPPROTO_DCCP = 33,		/* Datagram Congestion Control Protocol */
   IPPROTO_RSVP = 46,		/* RSVP protocol			*/
   IPPROTO_GRE = 47,		/* Cisco GRE tunnels (rfc 1701,1702)	*/
 
@@ -314,6 +315,150 @@
   } un;
 };
 
+/* sctp.h */
+
+typedef struct sctphdr {
+	__u16 source;
+	__u16 dest;
+	__u32 vtag;
+	__u32 checksum;
+} __attribute__((packed)) sctp_sctphdr_t;
+
+typedef struct sctp_chunkhdr {
+	__u8 type;
+	__u8 flags;
+	__u16 length;
+} __attribute__((packed)) sctp_chunkhdr_t;
+
+typedef enum {
+	SCTP_CID_DATA			= 0,
+        SCTP_CID_INIT			= 1,
+        SCTP_CID_INIT_ACK		= 2,
+        SCTP_CID_SACK			= 3,
+        SCTP_CID_HEARTBEAT		= 4,
+        SCTP_CID_HEARTBEAT_ACK		= 5,
+        SCTP_CID_ABORT			= 6,
+        SCTP_CID_SHUTDOWN		= 7,
+        SCTP_CID_SHUTDOWN_ACK		= 8,
+        SCTP_CID_ERROR			= 9,
+        SCTP_CID_COOKIE_ECHO		= 10,
+        SCTP_CID_COOKIE_ACK	        = 11,
+        SCTP_CID_ECN_ECNE		= 12,
+        SCTP_CID_ECN_CWR		= 13,
+        SCTP_CID_SHUTDOWN_COMPLETE	= 14,
+
+	/* PR-SCTP Sec 3.2 */
+	SCTP_CID_FWD_TSN		= 0xC0,
+
+	/* Use hex, as defined in ADDIP sec. 3.1 */
+	SCTP_CID_ASCONF			= 0xC1,
+	SCTP_CID_ASCONF_ACK		= 0x80,
+} sctp_cid_t; /* enum */
+
+typedef struct sctp_inithdr {
+	__u32 init_tag;
+	__u32 a_rwnd;
+	__u16 num_outbound_streams;
+	__u16 num_inbound_streams;
+	__u32 initial_tsn;
+	__u8  params[0];
+} __attribute__((packed)) sctp_inithdr_t;
+
+/* dccp.h */
+
+struct dccp_hdr {
+	__u16	dccph_sport,
+		dccph_dport;
+	__u8	dccph_doff;
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+	__u8	dccph_cscov:4,
+		dccph_ccval:4;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+	__u8	dccph_ccval:4,
+		dccph_cscov:4;
+#else
+#error  "Adjust your <asm/byteorder.h> defines"
+#endif
+	__u16	dccph_checksum;
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+	__u32	dccph_x:1,
+		dccph_type:4,
+		dccph_reserved:3,
+		dccph_seq:24;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+	__u32	dccph_reserved:3,
+		dccph_type:4,
+		dccph_x:1,
+		dccph_seq:24;
+#else
+#error  "Adjust your <asm/byteorder.h> defines"
+#endif
+};
+
+struct dccp_hdr_ext {
+	__u32	dccph_seq_low;
+};
+struct dccp_hdr_request {
+	__u32	dccph_req_service;
+};
+struct dccp_hdr_ack_bits {
+	__u32	dccph_reserved1:8,
+		dccph_ack_nr_high:24;
+	__u32	dccph_ack_nr_low;
+};
+struct dccp_hdr_response {
+	struct dccp_hdr_ack_bits	dccph_resp_ack;
+	__u32				dccph_resp_service;
+};
+struct dccp_hdr_reset {
+	struct dccp_hdr_ack_bits	dccph_reset_ack;
+	__u8				dccph_reset_code,
+					dccph_reset_data[3];
+};
+
+enum dccp_pkt_type {
+	DCCP_PKT_REQUEST = 0,
+	DCCP_PKT_RESPONSE,
+	DCCP_PKT_DATA,
+	DCCP_PKT_ACK,
+	DCCP_PKT_DATAACK,
+	DCCP_PKT_CLOSEREQ,
+	DCCP_PKT_CLOSE,
+	DCCP_PKT_RESET,
+	DCCP_PKT_SYNC,
+	DCCP_PKT_SYNCACK,
+	DCCP_PKT_INVALID,
+};
+
+static inline unsigned int dccp_packet_hdr_len(const __u8 type)
+{
+	if (type == DCCP_PKT_DATA)
+		return 0;
+	if (type == DCCP_PKT_DATAACK	||
+	    type == DCCP_PKT_ACK	||
+	    type == DCCP_PKT_SYNC	||
+	    type == DCCP_PKT_SYNCACK	||
+	    type == DCCP_PKT_CLOSE	||
+	    type == DCCP_PKT_CLOSEREQ)
+		return sizeof(struct dccp_hdr_ack_bits);
+	if (type == DCCP_PKT_REQUEST)
+		return sizeof(struct dccp_hdr_request);
+	if (type == DCCP_PKT_RESPONSE)
+		return sizeof(struct dccp_hdr_response);
+	return sizeof(struct dccp_hdr_reset);
+}
+
+static inline unsigned int __dccp_basic_hdr_len(const struct dccp_hdr *dh)
+{
+	return sizeof(*dh) + (dh->dccph_x ? sizeof(struct dccp_hdr_ext) : 0);
+}
+
+static inline unsigned int __dccp_hdr_len(const struct dccp_hdr *dh)
+{
+	return __dccp_basic_hdr_len(dh) +
+	       dccp_packet_hdr_len(dh->dccph_type);
+}
+
 /* in_route.h */
 /* IPv4 routing cache flags */
 
@@ -503,6 +648,8 @@
 	u32			ifa_address;
 	u32			ifa_mask;
 	u32			ifa_broadcast;
+
+	unsigned char		ifa_flags;
 };
 
 
kernelenv/include/kernelenv.h +70 -0

101 lines not on this page · raw message

kernelenv/kernelenv.c +46 -0

58 lines not on this page · raw message

.links +5 -0
@@ -57,6 +57,7 @@
 ./asm/page.h
 ./asm/types.h
 ./asm/byteorder.h
+./asm/div64.h
 ./net/tcp.h
 ./net/checksum.h
 ./net/route.h
@@ -72,3 +73,7 @@
 ./linux/swap.h
 ./linux/list.h
 ./linux/random.h
+./linux/delay.h
+./linux/sctp.h
+./linux/dccp.h
+./linux/kmalloc_sizes.h
.config.sample +9 -0
@@ -14,10 +14,14 @@
 CONFIG_IP_NF_CONNTRACK=m
 CONFIG_IP_NF_CT_ACCT=y
 CONFIG_IP_NF_CONNTRACK_MARK=y
+CONFIG_IP_NF_CONNTRACK_EVENTS=y
+CONFIG_IP_NF_CT_PROTO_SCTP=m
 CONFIG_IP_NF_FTP=m
 CONFIG_IP_NF_IRC=m
+CONFIG_IP_NF_NETBIOS_NS=m
 CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
+CONFIG_IP_NF_PPTP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_LIMIT=m
 CONFIG_IP_NF_MATCH_IPRANGE=m
@@ -39,13 +43,16 @@
 CONFIG_IP_NF_MATCH_ADDRTYPE=m
 CONFIG_IP_NF_MATCH_REALM=m
 CONFIG_IP_NF_MATCH_SCTP=m
+CONFIG_IP_NF_MATCH_DCCP=m
 CONFIG_IP_NF_MATCH_COMMENT=m
 CONFIG_IP_NF_MATCH_CONNMARK=m
+CONFIG_IP_NF_MATCH_CONNBYTES=m
 CONFIG_IP_NF_MATCH_HASHLIMIT=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_TARGET_LOG=m
 CONFIG_IP_NF_TARGET_TCPMSS=m
+CONFIG_IP_NF_TARGET_NFQUEUE=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_NAT_LOCAL=y
 CONFIG_IP_NF_NAT_NEEDED=y
@@ -57,12 +64,14 @@
 CONFIG_IP_NF_NAT_FTP=m
 CONFIG_IP_NF_NAT_TFTP=m
 CONFIG_IP_NF_NAT_AMANDA=m
+CONFIG_IP_NF_NAT_PPTP=m
 CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_TOS=m
 CONFIG_IP_NF_TARGET_ECN=m
 CONFIG_IP_NF_TARGET_DSCP=m
 CONFIG_IP_NF_TARGET_MARK=m
 CONFIG_IP_NF_TARGET_CLASSIFY=m
+CONFIG_IP_NF_TARGET_TTL=m
 CONFIG_IP_NF_TARGET_CONNMARK=m
 CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_TARGET_NOTRACK=m
#1 lore raw

kernelenv/include/kernelenv.h line 1186

Quoted 13 lines · Marcus Sundberg
kernelenv/include/kernelenv.h +4 -0
@@ -1166,6 +1177,10 @@
 
 static inline void smp_read_barrier_depends(void) {;}
 
+/* delay.h */
+
+#define msleep(x)	do{unsigned int y = (x)*1000; usleep(y);}while(0)
+
 /* timer.h */
 
 /* not used at the moment */

Hmm, actually I guess something like:

#define msleep(x) increment_time((x)*HZ/1000)

would make more sense. Comments (on this or the original patch)?

//Marcus

Signature · 3 lines
---------------------------------------+--------------------------
  Marcus Sundberg <[email protected]>  | Firewalls with SIP & NAT
 Software Developer, Ingate Systems AB |  http://www.ingate.com/
#2 lore raw
Quoted 14 lines · Marcus Sundberg
Quoted 12 lines · Marcus Sundberg
kernelenv/include/kernelenv.h +4 -0
@@ -1166,6 +1177,10 @@
 
 static inline void smp_read_barrier_depends(void) {;}
 
+/* delay.h */
+
+#define msleep(x)	do{unsigned int y = (x)*1000; usleep(y);}while(0)
+
 /* timer.h */
 
Quoted 8 lines

kernelenv/include/kernelenv.h line 1186

Quoted 1 line
kernelenv/include/kernelenv.h +0 -0
 /* not used at the moment */

Hmm, actually I guess something like:

#define msleep(x) increment_time((x)*HZ/1000)

would make more sense. Comments (on this or the original patch)?

Definitely :) We don't really want to sleep.

#3 lore raw
In reply to Marcus Sundberg
Quoted 5 lines · Marcus Sundberg

Hi,

this patch adds nfsim support for building most of the netfilter stuff in 2.6.15. The things still not compiling are CONFIG_IP_NF_CONNTRACK_NETLINK and CONFIG_IP_NF_MATCH_STRING

Looks good. Harald is currently working on nfsim so I'll leave it to him to apply your patch.

kernelenv/include/kernelenv.h line 1273

Quoted 11 lines
kernelenv/include/kernelenv.h +11 -0
+/* div64.h */
+
+#if BITS_PER_LONG == 64
+# define do_div(n,base) ({					\
+	uint32_t __base = (base);				\
+	uint32_t __rem;						\
+	__rem = ((uint64_t)(n)) % __base;			\
+	(n) = ((uint64_t)(n)) / __base;				\
+	__rem;							\
+ })
+#elif BITS_PER_LONG == 32

Just using the 64 bit version unconditionally is fine in userspace and avoids the need for __div64_32.

Applied
#4 lore raw
In reply to Marcus Sundberg
Quoted 5 lines · Marcus Sundberg

Hi,

this patch adds nfsim support for building most of the netfilter stuff in 2.6.15. The things still not compiling are CONFIG_IP_NF_CONNTRACK_NETLINK and CONFIG_IP_NF_MATCH_STRING

thanks, applied.

Signature · 5 lines
- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie
#5 lore raw
Quoted 7 lines · Harald Welte
Quoted 3 lines · Marcus Sundberg

this patch adds nfsim support for building most of the netfilter stuff in 2.6.15. The things still not compiling are CONFIG_IP_NF_CONNTRACK_NETLINK and CONFIG_IP_NF_MATCH_STRING

thanks, applied.

Hi,

the patch contained a bogus msleep() implementation, please accept the following correction.

//Marcus

Signature · 3 lines
---------------------------------------+--------------------------
  Marcus Sundberg <[email protected]>  | Firewalls with SIP & NAT
 Software Developer, Ingate Systems AB |  http://www.ingate.com/

[NFSIM] Implement msleep() better

There's no point in actually sleeping in the nfsim framework, just increment time properly.

kernelenv/include/kernelenv.h +1 -1
@@ -1231,7 +1231,7 @@
 
 /* delay.h */
 
-#define msleep(x)	do{unsigned int y = (x)*1000; usleep(y);}while(0)
+#define msleep(x)	increment_time((x)*HZ/1000)
 
 /* timer.h */
 
Applied
#6 lore raw
Quoted 2 lines · Marcus Sundberg

the patch contained a bogus msleep() implementation, please accept the following correction.

thanks, applied.

Signature · 5 lines
- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie