Commit 9b91c96c authored by Davide Caratti's avatar Davide Caratti Committed by Pablo Neira Ayuso

netfilter: conntrack: built-in support for UDPlite

CONFIG_NF_CT_PROTO_UDPLITE is no more a tristate. When set to y,
connection tracking support for UDPlite protocol is built-in into
nf_conntrack.ko.

footprint test:
$ ls -l net/netfilter/nf_conntrack{_proto_udplite,}.ko \
        net/ipv4/netfilter/nf_conntrack_ipv4.ko \
        net/ipv6/netfilter/nf_conntrack_ipv6.ko

(builtin)|| udplite|  ipv4  |  ipv6  |nf_conntrack
---------++--------+--------+--------+--------------
none     || 432538 | 828755 | 828676 | 6141434
UDPlite  ||   -    | 829649 | 829362 | 6498204
Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent a85406af
...@@ -21,6 +21,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4; ...@@ -21,6 +21,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4;
#ifdef CONFIG_NF_CT_PROTO_SCTP #ifdef CONFIG_NF_CT_PROTO_SCTP
extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4; extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4;
#endif #endif
#ifdef CONFIG_NF_CT_PROTO_UDPLITE
extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4;
#endif
int nf_conntrack_ipv4_compat_init(void); int nf_conntrack_ipv4_compat_init(void);
void nf_conntrack_ipv4_compat_fini(void); void nf_conntrack_ipv4_compat_fini(void);
......
...@@ -12,6 +12,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6; ...@@ -12,6 +12,9 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6;
#ifdef CONFIG_NF_CT_PROTO_SCTP #ifdef CONFIG_NF_CT_PROTO_SCTP
extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6; extern struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6;
#endif #endif
#ifdef CONFIG_NF_CT_PROTO_UDPLITE
extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6;
#endif
#include <linux/sysctl.h> #include <linux/sysctl.h>
extern struct ctl_table nf_ct_ipv6_sysctl_table[]; extern struct ctl_table nf_ct_ipv6_sysctl_table[];
......
...@@ -69,6 +69,19 @@ struct nf_sctp_net { ...@@ -69,6 +69,19 @@ struct nf_sctp_net {
}; };
#endif #endif
#ifdef CONFIG_NF_CT_PROTO_UDPLITE
enum udplite_conntrack {
UDPLITE_CT_UNREPLIED,
UDPLITE_CT_REPLIED,
UDPLITE_CT_MAX
};
struct nf_udplite_net {
struct nf_proto_net pn;
unsigned int timeouts[UDPLITE_CT_MAX];
};
#endif
struct nf_ip_net { struct nf_ip_net {
struct nf_generic_net generic; struct nf_generic_net generic;
struct nf_tcp_net tcp; struct nf_tcp_net tcp;
...@@ -81,6 +94,9 @@ struct nf_ip_net { ...@@ -81,6 +94,9 @@ struct nf_ip_net {
#ifdef CONFIG_NF_CT_PROTO_SCTP #ifdef CONFIG_NF_CT_PROTO_SCTP
struct nf_sctp_net sctp; struct nf_sctp_net sctp;
#endif #endif
#ifdef CONFIG_NF_CT_PROTO_UDPLITE
struct nf_udplite_net udplite;
#endif
}; };
struct ct_pcpu { struct ct_pcpu {
......
...@@ -346,6 +346,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto4[] = { ...@@ -346,6 +346,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto4[] = {
#ifdef CONFIG_NF_CT_PROTO_SCTP #ifdef CONFIG_NF_CT_PROTO_SCTP
&nf_conntrack_l4proto_sctp4, &nf_conntrack_l4proto_sctp4,
#endif #endif
#ifdef CONFIG_NF_CT_PROTO_UDPLITE
&nf_conntrack_l4proto_udplite4,
#endif
}; };
static int ipv4_net_init(struct net *net) static int ipv4_net_init(struct net *net)
......
...@@ -346,6 +346,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto6[] = { ...@@ -346,6 +346,9 @@ static struct nf_conntrack_l4proto *builtin_l4proto6[] = {
#ifdef CONFIG_NF_CT_PROTO_SCTP #ifdef CONFIG_NF_CT_PROTO_SCTP
&nf_conntrack_l4proto_sctp6, &nf_conntrack_l4proto_sctp6,
#endif #endif
#ifdef CONFIG_NF_CT_PROTO_UDPLITE
&nf_conntrack_l4proto_udplite6,
#endif
}; };
static int ipv6_net_init(struct net *net) static int ipv6_net_init(struct net *net)
......
...@@ -169,14 +169,15 @@ config NF_CT_PROTO_SCTP ...@@ -169,14 +169,15 @@ config NF_CT_PROTO_SCTP
If unsure, say Y. If unsure, say Y.
config NF_CT_PROTO_UDPLITE config NF_CT_PROTO_UDPLITE
tristate 'UDP-Lite protocol connection tracking support' bool 'UDP-Lite protocol connection tracking support'
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
default y
help help
With this option enabled, the layer 3 independent connection With this option enabled, the layer 3 independent connection
tracking code will be able to do state tracking on UDP-Lite tracking code will be able to do state tracking on UDP-Lite
connections. connections.
To compile it as a module, choose M here. If unsure, say N. If unsure, say Y.
config NF_CONNTRACK_AMANDA config NF_CONNTRACK_AMANDA
tristate "Amanda backup protocol support" tristate "Amanda backup protocol support"
......
...@@ -7,6 +7,7 @@ nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o ...@@ -7,6 +7,7 @@ nf_conntrack-$(CONFIG_NF_CONNTRACK_EVENTS) += nf_conntrack_ecache.o
nf_conntrack-$(CONFIG_NF_CONNTRACK_LABELS) += nf_conntrack_labels.o nf_conntrack-$(CONFIG_NF_CONNTRACK_LABELS) += nf_conntrack_labels.o
nf_conntrack-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o nf_conntrack-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o
nf_conntrack-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o nf_conntrack-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
nf_conntrack-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o
obj-$(CONFIG_NETFILTER) = netfilter.o obj-$(CONFIG_NETFILTER) = netfilter.o
...@@ -19,7 +20,6 @@ obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o ...@@ -19,7 +20,6 @@ obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o
obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o obj-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o
obj-$(CONFIG_NF_CT_PROTO_UDPLITE) += nf_conntrack_proto_udplite.o
# netlink interface for nf_conntrack # netlink interface for nf_conntrack
obj-$(CONFIG_NF_CT_NETLINK) += nf_conntrack_netlink.o obj-$(CONFIG_NF_CT_NETLINK) += nf_conntrack_netlink.o
......
...@@ -9,7 +9,6 @@ ...@@ -9,7 +9,6 @@
#include <linux/types.h> #include <linux/types.h>
#include <linux/timer.h> #include <linux/timer.h>
#include <linux/module.h>
#include <linux/udp.h> #include <linux/udp.h>
#include <linux/seq_file.h> #include <linux/seq_file.h>
#include <linux/skbuff.h> #include <linux/skbuff.h>
...@@ -24,26 +23,14 @@ ...@@ -24,26 +23,14 @@
#include <net/netfilter/nf_conntrack_ecache.h> #include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_log.h> #include <net/netfilter/nf_log.h>
enum udplite_conntrack {
UDPLITE_CT_UNREPLIED,
UDPLITE_CT_REPLIED,
UDPLITE_CT_MAX
};
static unsigned int udplite_timeouts[UDPLITE_CT_MAX] = { static unsigned int udplite_timeouts[UDPLITE_CT_MAX] = {
[UDPLITE_CT_UNREPLIED] = 30*HZ, [UDPLITE_CT_UNREPLIED] = 30*HZ,
[UDPLITE_CT_REPLIED] = 180*HZ, [UDPLITE_CT_REPLIED] = 180*HZ,
}; };
static unsigned int udplite_net_id __read_mostly; static inline struct nf_udplite_net *udplite_pernet(struct net *net)
struct udplite_net {
struct nf_proto_net pn;
unsigned int timeouts[UDPLITE_CT_MAX];
};
static inline struct udplite_net *udplite_pernet(struct net *net)
{ {
return net_generic(net, udplite_net_id); return &net->ct.nf_ct_proto.udplite;
} }
static bool udplite_pkt_to_tuple(const struct sk_buff *skb, static bool udplite_pkt_to_tuple(const struct sk_buff *skb,
...@@ -178,7 +165,7 @@ static int udplite_timeout_nlattr_to_obj(struct nlattr *tb[], ...@@ -178,7 +165,7 @@ static int udplite_timeout_nlattr_to_obj(struct nlattr *tb[],
struct net *net, void *data) struct net *net, void *data)
{ {
unsigned int *timeouts = data; unsigned int *timeouts = data;
struct udplite_net *un = udplite_pernet(net); struct nf_udplite_net *un = udplite_pernet(net);
/* set default timeouts for UDPlite. */ /* set default timeouts for UDPlite. */
timeouts[UDPLITE_CT_UNREPLIED] = un->timeouts[UDPLITE_CT_UNREPLIED]; timeouts[UDPLITE_CT_UNREPLIED] = un->timeouts[UDPLITE_CT_UNREPLIED];
...@@ -237,7 +224,7 @@ static struct ctl_table udplite_sysctl_table[] = { ...@@ -237,7 +224,7 @@ static struct ctl_table udplite_sysctl_table[] = {
#endif /* CONFIG_SYSCTL */ #endif /* CONFIG_SYSCTL */
static int udplite_kmemdup_sysctl_table(struct nf_proto_net *pn, static int udplite_kmemdup_sysctl_table(struct nf_proto_net *pn,
struct udplite_net *un) struct nf_udplite_net *un)
{ {
#ifdef CONFIG_SYSCTL #ifdef CONFIG_SYSCTL
if (pn->ctl_table) if (pn->ctl_table)
...@@ -257,7 +244,7 @@ static int udplite_kmemdup_sysctl_table(struct nf_proto_net *pn, ...@@ -257,7 +244,7 @@ static int udplite_kmemdup_sysctl_table(struct nf_proto_net *pn,
static int udplite_init_net(struct net *net, u_int16_t proto) static int udplite_init_net(struct net *net, u_int16_t proto)
{ {
struct udplite_net *un = udplite_pernet(net); struct nf_udplite_net *un = udplite_pernet(net);
struct nf_proto_net *pn = &un->pn; struct nf_proto_net *pn = &un->pn;
if (!pn->users) { if (!pn->users) {
...@@ -270,7 +257,7 @@ static int udplite_init_net(struct net *net, u_int16_t proto) ...@@ -270,7 +257,7 @@ static int udplite_init_net(struct net *net, u_int16_t proto)
return udplite_kmemdup_sysctl_table(pn, un); return udplite_kmemdup_sysctl_table(pn, un);
} }
static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 __read_mostly = struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 __read_mostly =
{ {
.l3proto = PF_INET, .l3proto = PF_INET,
.l4proto = IPPROTO_UDPLITE, .l4proto = IPPROTO_UDPLITE,
...@@ -299,11 +286,11 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 __read_mostly = ...@@ -299,11 +286,11 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 __read_mostly =
.nla_policy = udplite_timeout_nla_policy, .nla_policy = udplite_timeout_nla_policy,
}, },
#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */ #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
.net_id = &udplite_net_id,
.init_net = udplite_init_net, .init_net = udplite_init_net,
}; };
EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_udplite4);
static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 __read_mostly = struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 __read_mostly =
{ {
.l3proto = PF_INET6, .l3proto = PF_INET6,
.l4proto = IPPROTO_UDPLITE, .l4proto = IPPROTO_UDPLITE,
...@@ -332,54 +319,6 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 __read_mostly = ...@@ -332,54 +319,6 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 __read_mostly =
.nla_policy = udplite_timeout_nla_policy, .nla_policy = udplite_timeout_nla_policy,
}, },
#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */ #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
.net_id = &udplite_net_id,
.init_net = udplite_init_net, .init_net = udplite_init_net,
}; };
EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_udplite6);
static struct nf_conntrack_l4proto *udplite_proto[] = {
&nf_conntrack_l4proto_udplite4,
&nf_conntrack_l4proto_udplite6,
};
static int udplite_net_init(struct net *net)
{
return nf_ct_l4proto_pernet_register(net, udplite_proto,
ARRAY_SIZE(udplite_proto));
}
static void udplite_net_exit(struct net *net)
{
nf_ct_l4proto_pernet_unregister(net, udplite_proto,
ARRAY_SIZE(udplite_proto));
}
static struct pernet_operations udplite_net_ops = {
.init = udplite_net_init,
.exit = udplite_net_exit,
.id = &udplite_net_id,
.size = sizeof(struct udplite_net),
};
static int __init nf_conntrack_proto_udplite_init(void)
{
int ret;
ret = register_pernet_subsys(&udplite_net_ops);
if (ret < 0)
return ret;
ret = nf_ct_l4proto_register(udplite_proto, ARRAY_SIZE(udplite_proto));
if (ret < 0)
unregister_pernet_subsys(&udplite_net_ops);
return ret;
}
static void __exit nf_conntrack_proto_udplite_exit(void)
{
nf_ct_l4proto_unregister(udplite_proto, ARRAY_SIZE(udplite_proto));
unregister_pernet_subsys(&udplite_net_ops);
}
module_init(nf_conntrack_proto_udplite_init);
module_exit(nf_conntrack_proto_udplite_exit);
MODULE_LICENSE("GPL");
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment