Commit ffc30690 authored by Yasuyuki Kozakai's avatar Yasuyuki Kozakai Committed by David S. Miller

[NETFILTER]: nf_conntrack: make l3proto->prepare() generic and renames it

The icmp[v6] l4proto modules parse headers in ICMP[v6] error to get tuple.
But they have to find the offset to transport protocol header before that.
Their processings are almost same as prepare() of l3proto modules.
This makes prepare() more generic to simplify icmp[v6] l4proto module
later.
Signed-off-by: default avatarYasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d87d8469
...@@ -7,7 +7,7 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6; ...@@ -7,7 +7,7 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6;
extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6; extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6;
extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6; extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6;
extern int nf_ct_ipv6_skip_exthdr(struct sk_buff *skb, int start, extern int nf_ct_ipv6_skip_exthdr(const struct sk_buff *skb, int start,
u8 *nexthdrp, int len); u8 *nexthdrp, int len);
extern int nf_ct_frag6_init(void); extern int nf_ct_frag6_init(void);
......
...@@ -58,10 +58,10 @@ struct nf_conntrack_l3proto ...@@ -58,10 +58,10 @@ struct nf_conntrack_l3proto
/* /*
* Called before tracking. * Called before tracking.
* *dataoff: offset of protocol header (TCP, UDP,...) in *pskb * *dataoff: offset of protocol header (TCP, UDP,...) in skb
* *protonum: protocol number * *protonum: protocol number
*/ */
int (*prepare)(struct sk_buff **pskb, unsigned int hooknum, int (*get_l4proto)(const struct sk_buff *skb, unsigned int nhoff,
unsigned int *dataoff, u_int8_t *protonum); unsigned int *dataoff, u_int8_t *protonum);
int (*tuple_to_nfattr)(struct sk_buff *skb, int (*tuple_to_nfattr)(struct sk_buff *skb,
......
...@@ -78,21 +78,26 @@ nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user) ...@@ -78,21 +78,26 @@ nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
return skb; return skb;
} }
static int static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
ipv4_prepare(struct sk_buff **pskb, unsigned int hooknum, unsigned int *dataoff, unsigned int *dataoff, u_int8_t *protonum)
u_int8_t *protonum)
{ {
struct iphdr _iph, *iph;
iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
if (iph == NULL)
return -NF_DROP;
/* Never happen */ /* Never happen */
if (ip_hdr(*pskb)->frag_off & htons(IP_OFFSET)) { if (iph->frag_off & htons(IP_OFFSET)) {
if (net_ratelimit()) { if (net_ratelimit()) {
printk(KERN_ERR "ipv4_prepare: Frag of proto %u (hook=%u)\n", printk(KERN_ERR "ipv4_get_l4proto: Frag of proto %u\n",
ip_hdr(*pskb)->protocol, hooknum); iph->protocol);
} }
return -NF_DROP; return -NF_DROP;
} }
*dataoff = skb_network_offset(*pskb) + ip_hdrlen(*pskb); *dataoff = nhoff + (iph->ihl << 2);
*protonum = ip_hdr(*pskb)->protocol; *protonum = iph->protocol;
return NF_ACCEPT; return NF_ACCEPT;
} }
...@@ -407,7 +412,7 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 = { ...@@ -407,7 +412,7 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 = {
.invert_tuple = ipv4_invert_tuple, .invert_tuple = ipv4_invert_tuple,
.print_tuple = ipv4_print_tuple, .print_tuple = ipv4_print_tuple,
.print_conntrack = ipv4_print_conntrack, .print_conntrack = ipv4_print_conntrack,
.prepare = ipv4_prepare, .get_l4proto = ipv4_get_l4proto,
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE) #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
.tuple_to_nfattr = ipv4_tuple_to_nfattr, .tuple_to_nfattr = ipv4_tuple_to_nfattr,
.nfattr_to_tuple = ipv4_nfattr_to_tuple, .nfattr_to_tuple = ipv4_nfattr_to_tuple,
......
...@@ -86,7 +86,7 @@ static int ipv6_print_conntrack(struct seq_file *s, ...@@ -86,7 +86,7 @@ static int ipv6_print_conntrack(struct seq_file *s,
* - Note also special handling of AUTH header. Thanks to IPsec wizards. * - Note also special handling of AUTH header. Thanks to IPsec wizards.
*/ */
int nf_ct_ipv6_skip_exthdr(struct sk_buff *skb, int start, u8 *nexthdrp, int nf_ct_ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
int len) int len)
{ {
u8 nexthdr = *nexthdrp; u8 nexthdr = *nexthdrp;
...@@ -117,19 +117,24 @@ int nf_ct_ipv6_skip_exthdr(struct sk_buff *skb, int start, u8 *nexthdrp, ...@@ -117,19 +117,24 @@ int nf_ct_ipv6_skip_exthdr(struct sk_buff *skb, int start, u8 *nexthdrp,
return start; return start;
} }
static int static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
ipv6_prepare(struct sk_buff **pskb, unsigned int hooknum, unsigned int *dataoff, unsigned int *dataoff, u_int8_t *protonum)
u_int8_t *protonum)
{ {
unsigned int extoff = (u8 *)(ipv6_hdr(*pskb) + 1) - (*pskb)->data; unsigned int extoff = nhoff + sizeof(struct ipv6hdr);
unsigned char pnum = ipv6_hdr(*pskb)->nexthdr; unsigned char pnum;
int protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum, int protoff;
(*pskb)->len - extoff);
if (skb_copy_bits(skb, nhoff + offsetof(struct ipv6hdr, nexthdr),
&pnum, sizeof(pnum)) != 0) {
pr_debug("ip6_conntrack_core: can't get nexthdr\n");
return -NF_ACCEPT;
}
protoff = nf_ct_ipv6_skip_exthdr(skb, extoff, &pnum, skb->len - extoff);
/* /*
* (protoff == (*pskb)->len) mean that the packet doesn't have no data * (protoff == skb->len) mean that the packet doesn't have no data
* except of IPv6 & ext headers. but it's tracked anyway. - YK * except of IPv6 & ext headers. but it's tracked anyway. - YK
*/ */
if ((protoff < 0) || (protoff > (*pskb)->len)) { if ((protoff < 0) || (protoff > skb->len)) {
pr_debug("ip6_conntrack_core: can't find proto in pkt\n"); pr_debug("ip6_conntrack_core: can't find proto in pkt\n");
return -NF_ACCEPT; return -NF_ACCEPT;
} }
...@@ -375,7 +380,7 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 = { ...@@ -375,7 +380,7 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 = {
.invert_tuple = ipv6_invert_tuple, .invert_tuple = ipv6_invert_tuple,
.print_tuple = ipv6_print_tuple, .print_tuple = ipv6_print_tuple,
.print_conntrack = ipv6_print_conntrack, .print_conntrack = ipv6_print_conntrack,
.prepare = ipv6_prepare, .get_l4proto = ipv6_get_l4proto,
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE) #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
.tuple_to_nfattr = ipv6_tuple_to_nfattr, .tuple_to_nfattr = ipv6_tuple_to_nfattr,
.nfattr_to_tuple = ipv6_nfattr_to_tuple, .nfattr_to_tuple = ipv6_nfattr_to_tuple,
......
...@@ -622,8 +622,9 @@ nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff **pskb) ...@@ -622,8 +622,9 @@ nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff **pskb)
/* rcu_read_lock()ed by nf_hook_slow */ /* rcu_read_lock()ed by nf_hook_slow */
l3proto = __nf_ct_l3proto_find((u_int16_t)pf); l3proto = __nf_ct_l3proto_find((u_int16_t)pf);
ret = l3proto->get_l4proto(*pskb, skb_network_offset(*pskb),
if ((ret = l3proto->prepare(pskb, hooknum, &dataoff, &protonum)) <= 0) { &dataoff, &protonum);
if (ret <= 0) {
pr_debug("not prepared to track yet or error occured\n"); pr_debug("not prepared to track yet or error occured\n");
NF_CT_STAT_INC_ATOMIC(error); NF_CT_STAT_INC_ATOMIC(error);
NF_CT_STAT_INC_ATOMIC(invalid); NF_CT_STAT_INC_ATOMIC(invalid);
......
...@@ -61,8 +61,7 @@ static int generic_print_conntrack(struct seq_file *s, ...@@ -61,8 +61,7 @@ static int generic_print_conntrack(struct seq_file *s,
return 0; return 0;
} }
static int static int generic_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
generic_prepare(struct sk_buff **pskb, unsigned int hooknum,
unsigned int *dataoff, u_int8_t *protonum) unsigned int *dataoff, u_int8_t *protonum)
{ {
/* Never track !!! */ /* Never track !!! */
...@@ -77,6 +76,6 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_generic = { ...@@ -77,6 +76,6 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_generic = {
.invert_tuple = generic_invert_tuple, .invert_tuple = generic_invert_tuple,
.print_tuple = generic_print_tuple, .print_tuple = generic_print_tuple,
.print_conntrack = generic_print_conntrack, .print_conntrack = generic_print_conntrack,
.prepare = generic_prepare, .get_l4proto = generic_get_l4proto,
}; };
EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_generic); EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_generic);
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment