[GitHub/exynos8895/android_kernel_samsung_universal8895.git] / net / netfilter / nf_conntrack_proto_sctp.c

/*
 * Connection tracking protocol helper module for SCTP.
 *
 * SCTP is defined in RFC 2960. References to various sections in this code
 * are to this RFC.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/types.h>
#include <linux/timer.h>
#include <linux/netfilter.h>
#include <linux/module.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/sctp.h>
#include <linux/string.h>
#include <linux/seq_file.h>
#include <linux/spinlock.h>
#include <linux/interrupt.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_ecache.h>

/* Protects conntrack->proto.sctp */
static DEFINE_RWLOCK(sctp_lock);

/* FIXME: Examine ipfilter's timeouts and conntrack transitions more
   closely.  They're more complex. --RR

   And so for me for SCTP :D -Kiran */

static const char *sctp_conntrack_names[] = {
	"NONE",
	"CLOSED",
	"COOKIE_WAIT",
	"COOKIE_ECHOED",
	"ESTABLISHED",
	"SHUTDOWN_SENT",
	"SHUTDOWN_RECD",
	"SHUTDOWN_ACK_SENT",
};

#define SECS  * HZ
#define MINS  * 60 SECS
#define HOURS * 60 MINS
#define DAYS  * 24 HOURS

static unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] __read_mostly = {
	[SCTP_CONNTRACK_CLOSED]			= 10 SECS,
	[SCTP_CONNTRACK_COOKIE_WAIT]		= 3 SECS,
	[SCTP_CONNTRACK_COOKIE_ECHOED]		= 3 SECS,
	[SCTP_CONNTRACK_ESTABLISHED]		= 5 DAYS,
	[SCTP_CONNTRACK_SHUTDOWN_SENT]		= 300 SECS / 1000,
	[SCTP_CONNTRACK_SHUTDOWN_RECD]		= 300 SECS / 1000,
	[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT]	= 3 SECS,
};

#define sNO SCTP_CONNTRACK_NONE
#define	sCL SCTP_CONNTRACK_CLOSED
#define	sCW SCTP_CONNTRACK_COOKIE_WAIT
#define	sCE SCTP_CONNTRACK_COOKIE_ECHOED
#define	sES SCTP_CONNTRACK_ESTABLISHED
#define	sSS SCTP_CONNTRACK_SHUTDOWN_SENT
#define	sSR SCTP_CONNTRACK_SHUTDOWN_RECD
#define	sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
#define	sIV SCTP_CONNTRACK_MAX

/*
	These are the descriptions of the states:

NOTE: These state names are tantalizingly similar to the states of an
SCTP endpoint. But the interpretation of the states is a little different,
considering that these are the states of the connection and not of an end
point. Please note the subtleties. -Kiran

NONE              - Nothing so far.
COOKIE WAIT       - We have seen an INIT chunk in the original direction, or also
		    an INIT_ACK chunk in the reply direction.
COOKIE ECHOED     - We have seen a COOKIE_ECHO chunk in the original direction.
ESTABLISHED       - We have seen a COOKIE_ACK in the reply direction.
SHUTDOWN_SENT     - We have seen a SHUTDOWN chunk in the original direction.
SHUTDOWN_RECD     - We have seen a SHUTDOWN chunk in the reply directoin.
SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
		    to that of the SHUTDOWN chunk.
CLOSED            - We have seen a SHUTDOWN_COMPLETE chunk in the direction of
		    the SHUTDOWN chunk. Connection is closed.
*/

/* TODO
 - I have assumed that the first INIT is in the original direction.
 This messes things when an INIT comes in the reply direction in CLOSED
 state.
 - Check the error type in the reply dir before transitioning from
cookie echoed to closed.
 - Sec 5.2.4 of RFC 2960
 - Multi Homing support.
*/

/* SCTP conntrack state transitions */
static const u8 sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
	{
/*	ORIGINAL	*/
/*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
/* init         */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA},
/* init_ack     */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},
/* abort        */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
/* shutdown     */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA},
/* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA},
/* error        */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant have Stale cookie*/
/* cookie_echo  */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA},/* 5.2.4 - Big TODO */
/* cookie_ack   */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in orig dir */
/* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL}
	},
	{
/*	REPLY	*/
/*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
/* init         */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* INIT in sCL Big TODO */
/* init_ack     */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},
/* abort        */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
/* shutdown     */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA},
/* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA},
/* error        */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA},
/* cookie_echo  */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in reply dir */
/* cookie_ack   */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA},
/* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL}
	}
};

static int sctp_pkt_to_tuple(const struct sk_buff *skb,
			     unsigned int dataoff,
			     struct nf_conntrack_tuple *tuple)
{
	sctp_sctphdr_t _hdr, *hp;

	/* Actually only need first 8 bytes. */
	hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
	if (hp == NULL)
		return 0;

	tuple->src.u.sctp.port = hp->source;
	tuple->dst.u.sctp.port = hp->dest;
	return 1;
}

static int sctp_invert_tuple(struct nf_conntrack_tuple *tuple,
			     const struct nf_conntrack_tuple *orig)
{
	tuple->src.u.sctp.port = orig->dst.u.sctp.port;
	tuple->dst.u.sctp.port = orig->src.u.sctp.port;
	return 1;
}

/* Print out the per-protocol part of the tuple. */
static int sctp_print_tuple(struct seq_file *s,
			    const struct nf_conntrack_tuple *tuple)
{
	return seq_printf(s, "sport=%hu dport=%hu ",
			  ntohs(tuple->src.u.sctp.port),
			  ntohs(tuple->dst.u.sctp.port));
}

/* Print out the private part of the conntrack. */
static int sctp_print_conntrack(struct seq_file *s, const struct nf_conn *ct)
{
	enum sctp_conntrack state;

	read_lock_bh(&sctp_lock);
	state = ct->proto.sctp.state;
	read_unlock_bh(&sctp_lock);

	return seq_printf(s, "%s ", sctp_conntrack_names[state]);
}

#define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count)	\
for ((offset) = (dataoff) + sizeof(sctp_sctphdr_t), (count) = 0;	\
	(offset) < (skb)->len &&					\
	((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch)));	\
	(offset) += (ntohs((sch)->length) + 3) & ~3, (count)++)

/* Some validity checks to make sure the chunks are fine */
static int do_basic_checks(struct nf_conn *ct,
			   const struct sk_buff *skb,
			   unsigned int dataoff,
			   unsigned long *map)
{
	u_int32_t offset, count;
	sctp_chunkhdr_t _sch, *sch;
	int flag;

	flag = 0;

	for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
		pr_debug("Chunk Num: %d  Type: %d\n", count, sch->type);

		if (sch->type == SCTP_CID_INIT ||
		    sch->type == SCTP_CID_INIT_ACK ||
		    sch->type == SCTP_CID_SHUTDOWN_COMPLETE)
			flag = 1;

		/*
		 * Cookie Ack/Echo chunks not the first OR
		 * Init / Init Ack / Shutdown compl chunks not the only chunks
		 * OR zero-length.
		 */
		if (((sch->type == SCTP_CID_COOKIE_ACK ||
		      sch->type == SCTP_CID_COOKIE_ECHO ||
		      flag) &&
		     count != 0) || !sch->length) {
			pr_debug("Basic checks failed\n");
			return 1;
		}

		if (map)
			set_bit(sch->type, map);
	}

	pr_debug("Basic checks passed\n");
	return count == 0;
}

static int sctp_new_state(enum ip_conntrack_dir dir,
			  enum sctp_conntrack cur_state,
			  int chunk_type)
{
	int i;

	pr_debug("Chunk type: %d\n", chunk_type);

	switch (chunk_type) {
	case SCTP_CID_INIT:
		pr_debug("SCTP_CID_INIT\n");
		i = 0;
		break;
	case SCTP_CID_INIT_ACK:
		pr_debug("SCTP_CID_INIT_ACK\n");
		i = 1;
		break;
	case SCTP_CID_ABORT:
		pr_debug("SCTP_CID_ABORT\n");
		i = 2;
		break;
	case SCTP_CID_SHUTDOWN:
		pr_debug("SCTP_CID_SHUTDOWN\n");
		i = 3;
		break;
	case SCTP_CID_SHUTDOWN_ACK:
		pr_debug("SCTP_CID_SHUTDOWN_ACK\n");
		i = 4;
		break;
	case SCTP_CID_ERROR:
		pr_debug("SCTP_CID_ERROR\n");
		i = 5;
		break;
	case SCTP_CID_COOKIE_ECHO:
		pr_debug("SCTP_CID_COOKIE_ECHO\n");
		i = 6;
		break;
	case SCTP_CID_COOKIE_ACK:
		pr_debug("SCTP_CID_COOKIE_ACK\n");
		i = 7;
		break;
	case SCTP_CID_SHUTDOWN_COMPLETE:
		pr_debug("SCTP_CID_SHUTDOWN_COMPLETE\n");
		i = 8;
		break;
	default:
		/* Other chunks like DATA, SACK, HEARTBEAT and
		its ACK do not cause a change in state */
		pr_debug("Unknown chunk type, Will stay in %s\n",
			 sctp_conntrack_names[cur_state]);
		return cur_state;
	}

	pr_debug("dir: %d   cur_state: %s  chunk_type: %d  new_state: %s\n",
		 dir, sctp_conntrack_names[cur_state], chunk_type,
		 sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);

	return sctp_conntracks[dir][i][cur_state];
}

/* Returns verdict for packet, or -NF_ACCEPT for invalid. */
static int sctp_packet(struct nf_conn *ct,
		       const struct sk_buff *skb,
		       unsigned int dataoff,
		       enum ip_conntrack_info ctinfo,
		       int pf,
		       unsigned int hooknum)
{
	enum sctp_conntrack new_state, old_state;
	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	sctp_sctphdr_t _sctph, *sh;
	sctp_chunkhdr_t _sch, *sch;
	u_int32_t offset, count;
	unsigned long map[256 / sizeof(unsigned long)] = { 0 };

	sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
	if (sh == NULL)
		goto out;

	if (do_basic_checks(ct, skb, dataoff, map) != 0)
		goto out;

	/* Check the verification tag (Sec 8.5) */
	if (!test_bit(SCTP_CID_INIT, map) &&
	    !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) &&
	    !test_bit(SCTP_CID_COOKIE_ECHO, map) &&
	    !test_bit(SCTP_CID_ABORT, map) &&
	    !test_bit(SCTP_CID_SHUTDOWN_ACK, map) &&
	    sh->vtag != ct->proto.sctp.vtag[dir]) {
		pr_debug("Verification tag check failed\n");
		goto out;
	}

	old_state = new_state = SCTP_CONNTRACK_MAX;
	write_lock_bh(&sctp_lock);
	for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
		/* Special cases of Verification tag check (Sec 8.5.1) */
		if (sch->type == SCTP_CID_INIT) {
			/* Sec 8.5.1 (A) */
			if (sh->vtag != 0)
				goto out_unlock;
		} else if (sch->type == SCTP_CID_ABORT) {
			/* Sec 8.5.1 (B) */
			if (sh->vtag != ct->proto.sctp.vtag[dir] &&
			    sh->vtag != ct->proto.sctp.vtag[!dir])
				goto out_unlock;
		} else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
			/* Sec 8.5.1 (C) */
			if (sh->vtag != ct->proto.sctp.vtag[dir] &&
			    sh->vtag != ct->proto.sctp.vtag[!dir] &&
			    sch->flags & SCTP_CHUNK_FLAG_T)
				goto out_unlock;
		} else if (sch->type == SCTP_CID_COOKIE_ECHO) {
			/* Sec 8.5.1 (D) */
			if (sh->vtag != ct->proto.sctp.vtag[dir])
				goto out_unlock;
		}

		old_state = ct->proto.sctp.state;
		new_state = sctp_new_state(dir, old_state, sch->type);

		/* Invalid */
		if (new_state == SCTP_CONNTRACK_MAX) {
			pr_debug("nf_conntrack_sctp: Invalid dir=%i ctype=%u "
				 "conntrack=%u\n",
				 dir, sch->type, old_state);
			goto out_unlock;
		}

		/* If it is an INIT or an INIT ACK note down the vtag */
		if (sch->type == SCTP_CID_INIT ||
		    sch->type == SCTP_CID_INIT_ACK) {
			sctp_inithdr_t _inithdr, *ih;

			ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
						sizeof(_inithdr), &_inithdr);
			if (ih == NULL)
				goto out_unlock;
			pr_debug("Setting vtag %x for dir %d\n",
				 ih->init_tag, !dir);
			ct->proto.sctp.vtag[!dir] = ih->init_tag;
		}

		ct->proto.sctp.state = new_state;
		if (old_state != new_state)
			nf_conntrack_event_cache(IPCT_PROTOINFO, skb);
	}
	write_unlock_bh(&sctp_lock);

	nf_ct_refresh_acct(ct, ctinfo, skb, sctp_timeouts[new_state]);

	if (old_state == SCTP_CONNTRACK_COOKIE_ECHOED &&
	    dir == IP_CT_DIR_REPLY &&
	    new_state == SCTP_CONNTRACK_ESTABLISHED) {
		pr_debug("Setting assured bit\n");
		set_bit(IPS_ASSURED_BIT, &ct->status);
		nf_conntrack_event_cache(IPCT_STATUS, skb);
	}

	return NF_ACCEPT;

out_unlock:
	write_unlock_bh(&sctp_lock);
out:
	return -NF_ACCEPT;
}

/* Called when a new connection for this protocol found. */
static int sctp_new(struct nf_conn *ct, const struct sk_buff *skb,
		    unsigned int dataoff)
{
	enum sctp_conntrack new_state;
	sctp_sctphdr_t _sctph, *sh;
	sctp_chunkhdr_t _sch, *sch;
	u_int32_t offset, count;
	unsigned long map[256 / sizeof(unsigned long)] = { 0 };

	sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
	if (sh == NULL)
		return 0;

	if (do_basic_checks(ct, skb, dataoff, map) != 0)
		return 0;

	/* If an OOTB packet has any of these chunks discard (Sec 8.4) */
	if (test_bit(SCTP_CID_ABORT, map) ||
	    test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) ||
	    test_bit(SCTP_CID_COOKIE_ACK, map))
		return 0;

	new_state = SCTP_CONNTRACK_MAX;
	for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
		/* Don't need lock here: this conntrack not in circulation yet */
		new_state = sctp_new_state(IP_CT_DIR_ORIGINAL,
					   SCTP_CONNTRACK_NONE, sch->type);

		/* Invalid: delete conntrack */
		if (new_state == SCTP_CONNTRACK_NONE ||
		    new_state == SCTP_CONNTRACK_MAX) {
			pr_debug("nf_conntrack_sctp: invalid new deleting.\n");
			return 0;
		}

		/* Copy the vtag into the state info */
		if (sch->type == SCTP_CID_INIT) {
			if (sh->vtag == 0) {
				sctp_inithdr_t _inithdr, *ih;

				ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
							sizeof(_inithdr), &_inithdr);
				if (ih == NULL)
					return 0;

				pr_debug("Setting vtag %x for new conn\n",
					 ih->init_tag);

				ct->proto.sctp.vtag[IP_CT_DIR_REPLY] =
								ih->init_tag;
			} else {
				/* Sec 8.5.1 (A) */
				return 0;
			}
		}
		/* If it is a shutdown ack OOTB packet, we expect a return
		   shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
		else {
			pr_debug("Setting vtag %x for new conn OOTB\n",
				 sh->vtag);
			ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
		}

		ct->proto.sctp.state = new_state;
	}

	return 1;
}

#ifdef CONFIG_SYSCTL
static unsigned int sctp_sysctl_table_users;
static struct ctl_table_header *sctp_sysctl_header;
static struct ctl_table sctp_sysctl_table[] = {
	{
		.procname	= "nf_conntrack_sctp_timeout_closed",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "nf_conntrack_sctp_timeout_cookie_wait",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "nf_conntrack_sctp_timeout_cookie_echoed",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "nf_conntrack_sctp_timeout_established",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "nf_conntrack_sctp_timeout_shutdown_sent",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "nf_conntrack_sctp_timeout_shutdown_recd",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "nf_conntrack_sctp_timeout_shutdown_ack_sent",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.ctl_name = 0
	}
};

#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
static struct ctl_table sctp_compat_sysctl_table[] = {
	{
		.procname	= "ip_conntrack_sctp_timeout_closed",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "ip_conntrack_sctp_timeout_cookie_wait",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "ip_conntrack_sctp_timeout_cookie_echoed",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "ip_conntrack_sctp_timeout_established",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "ip_conntrack_sctp_timeout_shutdown_sent",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "ip_conntrack_sctp_timeout_shutdown_recd",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.procname	= "ip_conntrack_sctp_timeout_shutdown_ack_sent",
		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
	},
	{
		.ctl_name = 0
	}
};
#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
#endif

static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
	.l3proto		= PF_INET,
	.l4proto 		= IPPROTO_SCTP,
	.name 			= "sctp",
	.pkt_to_tuple 		= sctp_pkt_to_tuple,
	.invert_tuple 		= sctp_invert_tuple,
	.print_tuple 		= sctp_print_tuple,
	.print_conntrack	= sctp_print_conntrack,
	.packet 		= sctp_packet,
	.new 			= sctp_new,
	.me 			= THIS_MODULE,
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
	.nla_policy		= nf_ct_port_nla_policy,
#endif
#ifdef CONFIG_SYSCTL
	.ctl_table_users	= &sctp_sysctl_table_users,
	.ctl_table_header	= &sctp_sysctl_header,
	.ctl_table		= sctp_sysctl_table,
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
	.ctl_compat_table	= sctp_compat_sysctl_table,
#endif
#endif
};

static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
	.l3proto		= PF_INET6,
	.l4proto 		= IPPROTO_SCTP,
	.name 			= "sctp",
	.pkt_to_tuple 		= sctp_pkt_to_tuple,
	.invert_tuple 		= sctp_invert_tuple,
	.print_tuple 		= sctp_print_tuple,
	.print_conntrack	= sctp_print_conntrack,
	.packet 		= sctp_packet,
	.new 			= sctp_new,
	.me 			= THIS_MODULE,
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
	.nla_policy		= nf_ct_port_nla_policy,
#endif
#ifdef CONFIG_SYSCTL
	.ctl_table_users	= &sctp_sysctl_table_users,
	.ctl_table_header	= &sctp_sysctl_header,
	.ctl_table		= sctp_sysctl_table,
#endif
};

static int __init nf_conntrack_proto_sctp_init(void)
{
	int ret;

	ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp4);
	if (ret) {
		printk("nf_conntrack_l4proto_sctp4: protocol register failed\n");
		goto out;
	}
	ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp6);
	if (ret) {
		printk("nf_conntrack_l4proto_sctp6: protocol register failed\n");
		goto cleanup_sctp4;
	}

	return ret;

 cleanup_sctp4:
	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
 out:
	return ret;
}

static void __exit nf_conntrack_proto_sctp_fini(void)
{
	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
}

module_init(nf_conntrack_proto_sctp_init);
module_exit(nf_conntrack_proto_sctp_fini);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Kiran Kumar Immidi");
MODULE_DESCRIPTION("Netfilter connection tracking protocol helper for SCTP");
MODULE_ALIAS("ip_conntrack_proto_sctp");
Commit	Line	Data
	1	/*
	2	* Connection tracking protocol helper module for SCTP.
	3	*
	4	* SCTP is defined in RFC 2960. References to various sections in this code
	5	* are to this RFC.
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
	10	*/
	11
	12	#include <linux/types.h>
	13	#include <linux/timer.h>
	14	#include <linux/netfilter.h>
	15	#include <linux/module.h>
	16	#include <linux/in.h>
	17	#include <linux/ip.h>
	18	#include <linux/sctp.h>
	19	#include <linux/string.h>
	20	#include <linux/seq_file.h>
	21	#include <linux/spinlock.h>
	22	#include <linux/interrupt.h>
	23
	24	#include <net/netfilter/nf_conntrack.h>
	25	#include <net/netfilter/nf_conntrack_l4proto.h>
	26	#include <net/netfilter/nf_conntrack_ecache.h>
	27
	28	/* Protects conntrack->proto.sctp */
	29	static DEFINE_RWLOCK(sctp_lock);
	30
	31	/* FIXME: Examine ipfilter's timeouts and conntrack transitions more
	32	closely. They're more complex. --RR
	33
	34	And so for me for SCTP :D -Kiran */
	35
	36	static const char *sctp_conntrack_names[] = {
	37	"NONE",
	38	"CLOSED",
	39	"COOKIE_WAIT",
	40	"COOKIE_ECHOED",
	41	"ESTABLISHED",
	42	"SHUTDOWN_SENT",
	43	"SHUTDOWN_RECD",
	44	"SHUTDOWN_ACK_SENT",
	45	};
	46
	47	#define SECS * HZ
	48	#define MINS * 60 SECS
	49	#define HOURS * 60 MINS
	50	#define DAYS * 24 HOURS
	51
	52	static unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] __read_mostly = {
	53	[SCTP_CONNTRACK_CLOSED] = 10 SECS,
	54	[SCTP_CONNTRACK_COOKIE_WAIT] = 3 SECS,
	55	[SCTP_CONNTRACK_COOKIE_ECHOED] = 3 SECS,
	56	[SCTP_CONNTRACK_ESTABLISHED] = 5 DAYS,
	57	[SCTP_CONNTRACK_SHUTDOWN_SENT] = 300 SECS / 1000,
	58	[SCTP_CONNTRACK_SHUTDOWN_RECD] = 300 SECS / 1000,
	59	[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = 3 SECS,
	60	};
	61
	62	#define sNO SCTP_CONNTRACK_NONE
	63	#define sCL SCTP_CONNTRACK_CLOSED
	64	#define sCW SCTP_CONNTRACK_COOKIE_WAIT
	65	#define sCE SCTP_CONNTRACK_COOKIE_ECHOED
	66	#define sES SCTP_CONNTRACK_ESTABLISHED
	67	#define sSS SCTP_CONNTRACK_SHUTDOWN_SENT
	68	#define sSR SCTP_CONNTRACK_SHUTDOWN_RECD
	69	#define sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
	70	#define sIV SCTP_CONNTRACK_MAX
	71
	72	/*
	73	These are the descriptions of the states:
	74
	75	NOTE: These state names are tantalizingly similar to the states of an
	76	SCTP endpoint. But the interpretation of the states is a little different,
	77	considering that these are the states of the connection and not of an end
	78	point. Please note the subtleties. -Kiran
	79
	80	NONE - Nothing so far.
	81	COOKIE WAIT - We have seen an INIT chunk in the original direction, or also
	82	an INIT_ACK chunk in the reply direction.
	83	COOKIE ECHOED - We have seen a COOKIE_ECHO chunk in the original direction.
	84	ESTABLISHED - We have seen a COOKIE_ACK in the reply direction.
	85	SHUTDOWN_SENT - We have seen a SHUTDOWN chunk in the original direction.
	86	SHUTDOWN_RECD - We have seen a SHUTDOWN chunk in the reply directoin.
	87	SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
	88	to that of the SHUTDOWN chunk.
	89	CLOSED - We have seen a SHUTDOWN_COMPLETE chunk in the direction of
	90	the SHUTDOWN chunk. Connection is closed.
	91	*/
	92
	93	/* TODO
	94	- I have assumed that the first INIT is in the original direction.
	95	This messes things when an INIT comes in the reply direction in CLOSED
	96	state.
	97	- Check the error type in the reply dir before transitioning from
	98	cookie echoed to closed.
	99	- Sec 5.2.4 of RFC 2960
	100	- Multi Homing support.
	101	*/
	102
	103	/* SCTP conntrack state transitions */
	104	static const u8 sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
	105	{
	106	/* ORIGINAL */
	107	/* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
	108	/* init */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA},
	109	/* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},
	110	/* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
	111	/* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA},
	112	/* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA},
	113	/* error / {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/ Cant have Stale cookie*/
	114	/* cookie_echo / {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA},/ 5.2.4 - Big TODO */
	115	/* cookie_ack / {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/ Cant come in orig dir */
	116	/* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL}
	117	},
	118	{
	119	/* REPLY */
	120	/* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
	121	/* init / {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/ INIT in sCL Big TODO */
	122	/* init_ack */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},
	123	/* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
	124	/* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA},
	125	/* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA},
	126	/* error */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA},
	127	/* cookie_echo / {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/ Cant come in reply dir */
	128	/* cookie_ack */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA},
	129	/* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL}
	130	}
	131	};
	132
	133	static int sctp_pkt_to_tuple(const struct sk_buff *skb,
	134	unsigned int dataoff,
	135	struct nf_conntrack_tuple *tuple)
	136	{
	137	sctp_sctphdr_t _hdr, *hp;
	138
	139	/* Actually only need first 8 bytes. */
	140	hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
	141	if (hp == NULL)
	142	return 0;
	143
	144	tuple->src.u.sctp.port = hp->source;
	145	tuple->dst.u.sctp.port = hp->dest;
	146	return 1;
	147	}
	148
	149	static int sctp_invert_tuple(struct nf_conntrack_tuple *tuple,
	150	const struct nf_conntrack_tuple *orig)
	151	{
	152	tuple->src.u.sctp.port = orig->dst.u.sctp.port;
	153	tuple->dst.u.sctp.port = orig->src.u.sctp.port;
	154	return 1;
	155	}
	156
	157	/* Print out the per-protocol part of the tuple. */
	158	static int sctp_print_tuple(struct seq_file *s,
	159	const struct nf_conntrack_tuple *tuple)
	160	{
	161	return seq_printf(s, "sport=%hu dport=%hu ",
	162	ntohs(tuple->src.u.sctp.port),
	163	ntohs(tuple->dst.u.sctp.port));
	164	}
	165
	166	/* Print out the private part of the conntrack. */
	167	static int sctp_print_conntrack(struct seq_file s, const struct nf_conn ct)
	168	{
	169	enum sctp_conntrack state;
	170
	171	read_lock_bh(&sctp_lock);
	172	state = ct->proto.sctp.state;
	173	read_unlock_bh(&sctp_lock);
	174
	175	return seq_printf(s, "%s ", sctp_conntrack_names[state]);
	176	}
	177
	178	#define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count) \
	179	for ((offset) = (dataoff) + sizeof(sctp_sctphdr_t), (count) = 0; \
	180	(offset) < (skb)->len && \
	181	((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch))); \
	182	(offset) += (ntohs((sch)->length) + 3) & ~3, (count)++)
	183
	184	/* Some validity checks to make sure the chunks are fine */
	185	static int do_basic_checks(struct nf_conn *ct,
	186	const struct sk_buff *skb,
	187	unsigned int dataoff,
	188	unsigned long *map)
	189	{
	190	u_int32_t offset, count;
	191	sctp_chunkhdr_t _sch, *sch;
	192	int flag;
	193
	194	flag = 0;
	195
	196	for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
	197	pr_debug("Chunk Num: %d Type: %d\n", count, sch->type);
	198
	199	if (sch->type == SCTP_CID_INIT \|\|
	200	sch->type == SCTP_CID_INIT_ACK \|\|
	201	sch->type == SCTP_CID_SHUTDOWN_COMPLETE)
	202	flag = 1;
	203
	204	/*
	205	* Cookie Ack/Echo chunks not the first OR
	206	* Init / Init Ack / Shutdown compl chunks not the only chunks
	207	* OR zero-length.
	208	*/
	209	if (((sch->type == SCTP_CID_COOKIE_ACK \|\|
	210	sch->type == SCTP_CID_COOKIE_ECHO \|\|
	211	flag) &&
	212	count != 0) \|\| !sch->length) {
	213	pr_debug("Basic checks failed\n");
	214	return 1;
	215	}
	216
	217	if (map)
	218	set_bit(sch->type, map);
	219	}
	220
	221	pr_debug("Basic checks passed\n");
	222	return count == 0;
	223	}
	224
	225	static int sctp_new_state(enum ip_conntrack_dir dir,
	226	enum sctp_conntrack cur_state,
	227	int chunk_type)
	228	{
	229	int i;
	230
	231	pr_debug("Chunk type: %d\n", chunk_type);
	232
	233	switch (chunk_type) {
	234	case SCTP_CID_INIT:
	235	pr_debug("SCTP_CID_INIT\n");
	236	i = 0;
	237	break;
	238	case SCTP_CID_INIT_ACK:
	239	pr_debug("SCTP_CID_INIT_ACK\n");
	240	i = 1;
	241	break;
	242	case SCTP_CID_ABORT:
	243	pr_debug("SCTP_CID_ABORT\n");
	244	i = 2;
	245	break;
	246	case SCTP_CID_SHUTDOWN:
	247	pr_debug("SCTP_CID_SHUTDOWN\n");
	248	i = 3;
	249	break;
	250	case SCTP_CID_SHUTDOWN_ACK:
	251	pr_debug("SCTP_CID_SHUTDOWN_ACK\n");
	252	i = 4;
	253	break;
	254	case SCTP_CID_ERROR:
	255	pr_debug("SCTP_CID_ERROR\n");
	256	i = 5;
	257	break;
	258	case SCTP_CID_COOKIE_ECHO:
	259	pr_debug("SCTP_CID_COOKIE_ECHO\n");
	260	i = 6;
	261	break;
	262	case SCTP_CID_COOKIE_ACK:
	263	pr_debug("SCTP_CID_COOKIE_ACK\n");
	264	i = 7;
	265	break;
	266	case SCTP_CID_SHUTDOWN_COMPLETE:
	267	pr_debug("SCTP_CID_SHUTDOWN_COMPLETE\n");
	268	i = 8;
	269	break;
	270	default:
	271	/* Other chunks like DATA, SACK, HEARTBEAT and
	272	its ACK do not cause a change in state */
	273	pr_debug("Unknown chunk type, Will stay in %s\n",
	274	sctp_conntrack_names[cur_state]);
	275	return cur_state;
	276	}
	277
	278	pr_debug("dir: %d cur_state: %s chunk_type: %d new_state: %s\n",
	279	dir, sctp_conntrack_names[cur_state], chunk_type,
	280	sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);
	281
	282	return sctp_conntracks[dir][i][cur_state];
	283	}
	284
	285	/* Returns verdict for packet, or -NF_ACCEPT for invalid. */
	286	static int sctp_packet(struct nf_conn *ct,
	287	const struct sk_buff *skb,
	288	unsigned int dataoff,
	289	enum ip_conntrack_info ctinfo,
	290	int pf,
	291	unsigned int hooknum)
	292	{
	293	enum sctp_conntrack new_state, old_state;
	294	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	295	sctp_sctphdr_t _sctph, *sh;
	296	sctp_chunkhdr_t _sch, *sch;
	297	u_int32_t offset, count;
	298	unsigned long map[256 / sizeof(unsigned long)] = { 0 };
	299
	300	sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
	301	if (sh == NULL)
	302	goto out;
	303
	304	if (do_basic_checks(ct, skb, dataoff, map) != 0)
	305	goto out;
	306
	307	/* Check the verification tag (Sec 8.5) */
	308	if (!test_bit(SCTP_CID_INIT, map) &&
	309	!test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) &&
	310	!test_bit(SCTP_CID_COOKIE_ECHO, map) &&
	311	!test_bit(SCTP_CID_ABORT, map) &&
	312	!test_bit(SCTP_CID_SHUTDOWN_ACK, map) &&
	313	sh->vtag != ct->proto.sctp.vtag[dir]) {
	314	pr_debug("Verification tag check failed\n");
	315	goto out;
	316	}
	317
	318	old_state = new_state = SCTP_CONNTRACK_MAX;
	319	write_lock_bh(&sctp_lock);
	320	for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
	321	/* Special cases of Verification tag check (Sec 8.5.1) */
	322	if (sch->type == SCTP_CID_INIT) {
	323	/* Sec 8.5.1 (A) */
	324	if (sh->vtag != 0)
	325	goto out_unlock;
	326	} else if (sch->type == SCTP_CID_ABORT) {
	327	/* Sec 8.5.1 (B) */
	328	if (sh->vtag != ct->proto.sctp.vtag[dir] &&
	329	sh->vtag != ct->proto.sctp.vtag[!dir])
	330	goto out_unlock;
	331	} else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
	332	/* Sec 8.5.1 (C) */
	333	if (sh->vtag != ct->proto.sctp.vtag[dir] &&
	334	sh->vtag != ct->proto.sctp.vtag[!dir] &&
	335	sch->flags & SCTP_CHUNK_FLAG_T)
	336	goto out_unlock;
	337	} else if (sch->type == SCTP_CID_COOKIE_ECHO) {
	338	/* Sec 8.5.1 (D) */
	339	if (sh->vtag != ct->proto.sctp.vtag[dir])
	340	goto out_unlock;
	341	}
	342
	343	old_state = ct->proto.sctp.state;
	344	new_state = sctp_new_state(dir, old_state, sch->type);
	345
	346	/* Invalid */
	347	if (new_state == SCTP_CONNTRACK_MAX) {
	348	pr_debug("nf_conntrack_sctp: Invalid dir=%i ctype=%u "
	349	"conntrack=%u\n",
	350	dir, sch->type, old_state);
	351	goto out_unlock;
	352	}
	353
	354	/* If it is an INIT or an INIT ACK note down the vtag */
	355	if (sch->type == SCTP_CID_INIT \|\|
	356	sch->type == SCTP_CID_INIT_ACK) {
	357	sctp_inithdr_t _inithdr, *ih;
	358
	359	ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
	360	sizeof(_inithdr), &_inithdr);
	361	if (ih == NULL)
	362	goto out_unlock;
	363	pr_debug("Setting vtag %x for dir %d\n",
	364	ih->init_tag, !dir);
	365	ct->proto.sctp.vtag[!dir] = ih->init_tag;
	366	}
	367
	368	ct->proto.sctp.state = new_state;
	369	if (old_state != new_state)
	370	nf_conntrack_event_cache(IPCT_PROTOINFO, skb);
	371	}
	372	write_unlock_bh(&sctp_lock);
	373
	374	nf_ct_refresh_acct(ct, ctinfo, skb, sctp_timeouts[new_state]);
	375
	376	if (old_state == SCTP_CONNTRACK_COOKIE_ECHOED &&
	377	dir == IP_CT_DIR_REPLY &&
	378	new_state == SCTP_CONNTRACK_ESTABLISHED) {
	379	pr_debug("Setting assured bit\n");
	380	set_bit(IPS_ASSURED_BIT, &ct->status);
	381	nf_conntrack_event_cache(IPCT_STATUS, skb);
	382	}
	383
	384	return NF_ACCEPT;
	385
	386	out_unlock:
	387	write_unlock_bh(&sctp_lock);
	388	out:
	389	return -NF_ACCEPT;
	390	}
	391
	392	/* Called when a new connection for this protocol found. */
	393	static int sctp_new(struct nf_conn ct, const struct sk_buff skb,
	394	unsigned int dataoff)
	395	{
	396	enum sctp_conntrack new_state;
	397	sctp_sctphdr_t _sctph, *sh;
	398	sctp_chunkhdr_t _sch, *sch;
	399	u_int32_t offset, count;
	400	unsigned long map[256 / sizeof(unsigned long)] = { 0 };
	401
	402	sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
	403	if (sh == NULL)
	404	return 0;
	405
	406	if (do_basic_checks(ct, skb, dataoff, map) != 0)
	407	return 0;
	408
	409	/* If an OOTB packet has any of these chunks discard (Sec 8.4) */
	410	if (test_bit(SCTP_CID_ABORT, map) \|\|
	411	test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) \|\|
	412	test_bit(SCTP_CID_COOKIE_ACK, map))
	413	return 0;
	414
	415	new_state = SCTP_CONNTRACK_MAX;
	416	for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
	417	/* Don't need lock here: this conntrack not in circulation yet */
	418	new_state = sctp_new_state(IP_CT_DIR_ORIGINAL,
	419	SCTP_CONNTRACK_NONE, sch->type);
	420
	421	/* Invalid: delete conntrack */
	422	if (new_state == SCTP_CONNTRACK_NONE \|\|
	423	new_state == SCTP_CONNTRACK_MAX) {
	424	pr_debug("nf_conntrack_sctp: invalid new deleting.\n");
	425	return 0;
	426	}
	427
	428	/* Copy the vtag into the state info */
	429	if (sch->type == SCTP_CID_INIT) {
	430	if (sh->vtag == 0) {
	431	sctp_inithdr_t _inithdr, *ih;
	432
	433	ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
	434	sizeof(_inithdr), &_inithdr);
	435	if (ih == NULL)
	436	return 0;
	437
	438	pr_debug("Setting vtag %x for new conn\n",
	439	ih->init_tag);
	440
	441	ct->proto.sctp.vtag[IP_CT_DIR_REPLY] =
	442	ih->init_tag;
	443	} else {
	444	/* Sec 8.5.1 (A) */
	445	return 0;
	446	}
	447	}
	448	/* If it is a shutdown ack OOTB packet, we expect a return
	449	shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
	450	else {
	451	pr_debug("Setting vtag %x for new conn OOTB\n",
	452	sh->vtag);
	453	ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
	454	}
	455
	456	ct->proto.sctp.state = new_state;
	457	}
	458
	459	return 1;
	460	}
	461
	462	#ifdef CONFIG_SYSCTL
	463	static unsigned int sctp_sysctl_table_users;
	464	static struct ctl_table_header *sctp_sysctl_header;
	465	static struct ctl_table sctp_sysctl_table[] = {
	466	{
	467	.procname = "nf_conntrack_sctp_timeout_closed",
	468	.data = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
	469	.maxlen = sizeof(unsigned int),
	470	.mode = 0644,
	471	.proc_handler = &proc_dointvec_jiffies,
	472	},
	473	{
	474	.procname = "nf_conntrack_sctp_timeout_cookie_wait",
	475	.data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
	476	.maxlen = sizeof(unsigned int),
	477	.mode = 0644,
	478	.proc_handler = &proc_dointvec_jiffies,
	479	},
	480	{
	481	.procname = "nf_conntrack_sctp_timeout_cookie_echoed",
	482	.data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
	483	.maxlen = sizeof(unsigned int),
	484	.mode = 0644,
	485	.proc_handler = &proc_dointvec_jiffies,
	486	},
	487	{
	488	.procname = "nf_conntrack_sctp_timeout_established",
	489	.data = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
	490	.maxlen = sizeof(unsigned int),
	491	.mode = 0644,
	492	.proc_handler = &proc_dointvec_jiffies,
	493	},
	494	{
	495	.procname = "nf_conntrack_sctp_timeout_shutdown_sent",
	496	.data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
	497	.maxlen = sizeof(unsigned int),
	498	.mode = 0644,
	499	.proc_handler = &proc_dointvec_jiffies,
	500	},
	501	{
	502	.procname = "nf_conntrack_sctp_timeout_shutdown_recd",
	503	.data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
	504	.maxlen = sizeof(unsigned int),
	505	.mode = 0644,
	506	.proc_handler = &proc_dointvec_jiffies,
	507	},
	508	{
	509	.procname = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
	510	.data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
	511	.maxlen = sizeof(unsigned int),
	512	.mode = 0644,
	513	.proc_handler = &proc_dointvec_jiffies,
	514	},
	515	{
	516	.ctl_name = 0
	517	}
	518	};
	519
	520	#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
	521	static struct ctl_table sctp_compat_sysctl_table[] = {
	522	{
	523	.procname = "ip_conntrack_sctp_timeout_closed",
	524	.data = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
	525	.maxlen = sizeof(unsigned int),
	526	.mode = 0644,
	527	.proc_handler = &proc_dointvec_jiffies,
	528	},
	529	{
	530	.procname = "ip_conntrack_sctp_timeout_cookie_wait",
	531	.data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
	532	.maxlen = sizeof(unsigned int),
	533	.mode = 0644,
	534	.proc_handler = &proc_dointvec_jiffies,
	535	},
	536	{
	537	.procname = "ip_conntrack_sctp_timeout_cookie_echoed",
	538	.data = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
	539	.maxlen = sizeof(unsigned int),
	540	.mode = 0644,
	541	.proc_handler = &proc_dointvec_jiffies,
	542	},
	543	{
	544	.procname = "ip_conntrack_sctp_timeout_established",
	545	.data = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
	546	.maxlen = sizeof(unsigned int),
	547	.mode = 0644,
	548	.proc_handler = &proc_dointvec_jiffies,
	549	},
	550	{
	551	.procname = "ip_conntrack_sctp_timeout_shutdown_sent",
	552	.data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
	553	.maxlen = sizeof(unsigned int),
	554	.mode = 0644,
	555	.proc_handler = &proc_dointvec_jiffies,
	556	},
	557	{
	558	.procname = "ip_conntrack_sctp_timeout_shutdown_recd",
	559	.data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
	560	.maxlen = sizeof(unsigned int),
	561	.mode = 0644,
	562	.proc_handler = &proc_dointvec_jiffies,
	563	},
	564	{
	565	.procname = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
	566	.data = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
	567	.maxlen = sizeof(unsigned int),
	568	.mode = 0644,
	569	.proc_handler = &proc_dointvec_jiffies,
	570	},
	571	{
	572	.ctl_name = 0
	573	}
	574	};
	575	#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
	576	#endif
	577
	578	static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
	579	.l3proto = PF_INET,
	580	.l4proto = IPPROTO_SCTP,
	581	.name = "sctp",
	582	.pkt_to_tuple = sctp_pkt_to_tuple,
	583	.invert_tuple = sctp_invert_tuple,
	584	.print_tuple = sctp_print_tuple,
	585	.print_conntrack = sctp_print_conntrack,
	586	.packet = sctp_packet,
	587	.new = sctp_new,
	588	.me = THIS_MODULE,
	589	#if defined(CONFIG_NF_CT_NETLINK) \|\| defined(CONFIG_NF_CT_NETLINK_MODULE)
	590	.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
	591	.nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
	592	.nla_policy = nf_ct_port_nla_policy,
	593	#endif
	594	#ifdef CONFIG_SYSCTL
	595	.ctl_table_users = &sctp_sysctl_table_users,
	596	.ctl_table_header = &sctp_sysctl_header,
	597	.ctl_table = sctp_sysctl_table,
	598	#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
	599	.ctl_compat_table = sctp_compat_sysctl_table,
	600	#endif
	601	#endif
	602	};
	603
	604	static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
	605	.l3proto = PF_INET6,
	606	.l4proto = IPPROTO_SCTP,
	607	.name = "sctp",
	608	.pkt_to_tuple = sctp_pkt_to_tuple,
	609	.invert_tuple = sctp_invert_tuple,
	610	.print_tuple = sctp_print_tuple,
	611	.print_conntrack = sctp_print_conntrack,
	612	.packet = sctp_packet,
	613	.new = sctp_new,
	614	.me = THIS_MODULE,
	615	#if defined(CONFIG_NF_CT_NETLINK) \|\| defined(CONFIG_NF_CT_NETLINK_MODULE)
	616	.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
	617	.nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
	618	.nla_policy = nf_ct_port_nla_policy,
	619	#endif
	620	#ifdef CONFIG_SYSCTL
	621	.ctl_table_users = &sctp_sysctl_table_users,
	622	.ctl_table_header = &sctp_sysctl_header,
	623	.ctl_table = sctp_sysctl_table,
	624	#endif
	625	};
	626
	627	static int __init nf_conntrack_proto_sctp_init(void)
	628	{
	629	int ret;
	630
	631	ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp4);
	632	if (ret) {
	633	printk("nf_conntrack_l4proto_sctp4: protocol register failed\n");
	634	goto out;
	635	}
	636	ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp6);
	637	if (ret) {
	638	printk("nf_conntrack_l4proto_sctp6: protocol register failed\n");
	639	goto cleanup_sctp4;
	640	}
	641
	642	return ret;
	643
	644	cleanup_sctp4:
	645	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
	646	out:
	647	return ret;
	648	}
	649
	650	static void __exit nf_conntrack_proto_sctp_fini(void)
	651	{
	652	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
	653	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
	654	}
	655
	656	module_init(nf_conntrack_proto_sctp_init);
	657	module_exit(nf_conntrack_proto_sctp_fini);
	658
	659	MODULE_LICENSE("GPL");
	660	MODULE_AUTHOR("Kiran Kumar Immidi");
	661	MODULE_DESCRIPTION("Netfilter connection tracking protocol helper for SCTP");
	662	MODULE_ALIAS("ip_conntrack_proto_sctp");