[PATCH] remove many unneeded #includes of sched.h
[linux-2.6.git] / net / netfilter / nf_conntrack_proto_sctp.c
1 /*
2  * Connection tracking protocol helper module for SCTP.
3  *
4  * SCTP is defined in RFC 2960. References to various sections in this code
5  * are to this RFC.
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  *
11  * 17 Oct 2004: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
12  *      - enable working with L3 protocol independent connection tracking.
13  *
14  * Derived from net/ipv4/ip_conntrack_sctp.c
15  */
16
17 /*
18  * Added support for proc manipulation of timeouts.
19  */
20
21 #include <linux/types.h>
22 #include <linux/timer.h>
23 #include <linux/netfilter.h>
24 #include <linux/module.h>
25 #include <linux/in.h>
26 #include <linux/ip.h>
27 #include <linux/sctp.h>
28 #include <linux/string.h>
29 #include <linux/seq_file.h>
30 #include <linux/spinlock.h>
31 #include <linux/interrupt.h>
32
33 #include <net/netfilter/nf_conntrack.h>
34 #include <net/netfilter/nf_conntrack_l4proto.h>
35 #include <net/netfilter/nf_conntrack_ecache.h>
36
37 #if 0
38 #define DEBUGP(format, ...) printk(format, ## __VA_ARGS__)
39 #else
40 #define DEBUGP(format, args...)
41 #endif
42
43 /* Protects conntrack->proto.sctp */
44 static DEFINE_RWLOCK(sctp_lock);
45
46 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
47    closely.  They're more complex. --RR
48
49    And so for me for SCTP :D -Kiran */
50
51 static const char *sctp_conntrack_names[] = {
52         "NONE",
53         "CLOSED",
54         "COOKIE_WAIT",
55         "COOKIE_ECHOED",
56         "ESTABLISHED",
57         "SHUTDOWN_SENT",
58         "SHUTDOWN_RECD",
59         "SHUTDOWN_ACK_SENT",
60 };
61
62 #define SECS  * HZ
63 #define MINS  * 60 SECS
64 #define HOURS * 60 MINS
65 #define DAYS  * 24 HOURS
66
67 static unsigned int nf_ct_sctp_timeout_closed __read_mostly          =  10 SECS;
68 static unsigned int nf_ct_sctp_timeout_cookie_wait __read_mostly     =   3 SECS;
69 static unsigned int nf_ct_sctp_timeout_cookie_echoed __read_mostly   =   3 SECS;
70 static unsigned int nf_ct_sctp_timeout_established __read_mostly     =   5 DAYS;
71 static unsigned int nf_ct_sctp_timeout_shutdown_sent __read_mostly   = 300 SECS / 1000;
72 static unsigned int nf_ct_sctp_timeout_shutdown_recd __read_mostly   = 300 SECS / 1000;
73 static unsigned int nf_ct_sctp_timeout_shutdown_ack_sent __read_mostly = 3 SECS;
74
75 static unsigned int * sctp_timeouts[]
76 = { NULL,                                  /* SCTP_CONNTRACK_NONE  */
77     &nf_ct_sctp_timeout_closed,            /* SCTP_CONNTRACK_CLOSED */
78     &nf_ct_sctp_timeout_cookie_wait,       /* SCTP_CONNTRACK_COOKIE_WAIT */
79     &nf_ct_sctp_timeout_cookie_echoed,     /* SCTP_CONNTRACK_COOKIE_ECHOED */
80     &nf_ct_sctp_timeout_established,       /* SCTP_CONNTRACK_ESTABLISHED */
81     &nf_ct_sctp_timeout_shutdown_sent,     /* SCTP_CONNTRACK_SHUTDOWN_SENT */
82     &nf_ct_sctp_timeout_shutdown_recd,     /* SCTP_CONNTRACK_SHUTDOWN_RECD */
83     &nf_ct_sctp_timeout_shutdown_ack_sent  /* SCTP_CONNTRACK_SHUTDOWN_ACK_SENT */
84  };
85
86 #define sNO SCTP_CONNTRACK_NONE
87 #define sCL SCTP_CONNTRACK_CLOSED
88 #define sCW SCTP_CONNTRACK_COOKIE_WAIT
89 #define sCE SCTP_CONNTRACK_COOKIE_ECHOED
90 #define sES SCTP_CONNTRACK_ESTABLISHED
91 #define sSS SCTP_CONNTRACK_SHUTDOWN_SENT
92 #define sSR SCTP_CONNTRACK_SHUTDOWN_RECD
93 #define sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
94 #define sIV SCTP_CONNTRACK_MAX
95
96 /*
97         These are the descriptions of the states:
98
99 NOTE: These state names are tantalizingly similar to the states of an
100 SCTP endpoint. But the interpretation of the states is a little different,
101 considering that these are the states of the connection and not of an end
102 point. Please note the subtleties. -Kiran
103
104 NONE              - Nothing so far.
105 COOKIE WAIT       - We have seen an INIT chunk in the original direction, or also
106                     an INIT_ACK chunk in the reply direction.
107 COOKIE ECHOED     - We have seen a COOKIE_ECHO chunk in the original direction.
108 ESTABLISHED       - We have seen a COOKIE_ACK in the reply direction.
109 SHUTDOWN_SENT     - We have seen a SHUTDOWN chunk in the original direction.
110 SHUTDOWN_RECD     - We have seen a SHUTDOWN chunk in the reply directoin.
111 SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
112                     to that of the SHUTDOWN chunk.
113 CLOSED            - We have seen a SHUTDOWN_COMPLETE chunk in the direction of
114                     the SHUTDOWN chunk. Connection is closed.
115 */
116
117 /* TODO
118  - I have assumed that the first INIT is in the original direction.
119  This messes things when an INIT comes in the reply direction in CLOSED
120  state.
121  - Check the error type in the reply dir before transitioning from
122 cookie echoed to closed.
123  - Sec 5.2.4 of RFC 2960
124  - Multi Homing support.
125 */
126
127 /* SCTP conntrack state transitions */
128 static enum sctp_conntrack sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
129         {
130 /*      ORIGINAL        */
131 /*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
132 /* init         */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA},
133 /* init_ack     */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},
134 /* abort        */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
135 /* shutdown     */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA},
136 /* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA},
137 /* error        */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant have Stale cookie*/
138 /* cookie_echo  */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA},/* 5.2.4 - Big TODO */
139 /* cookie_ack   */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in orig dir */
140 /* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL}
141         },
142         {
143 /*      REPLY   */
144 /*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
145 /* init         */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* INIT in sCL Big TODO */
146 /* init_ack     */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},
147 /* abort        */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
148 /* shutdown     */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA},
149 /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA},
150 /* error        */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA},
151 /* cookie_echo  */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in reply dir */
152 /* cookie_ack   */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA},
153 /* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL}
154         }
155 };
156
157 static int sctp_pkt_to_tuple(const struct sk_buff *skb,
158                              unsigned int dataoff,
159                              struct nf_conntrack_tuple *tuple)
160 {
161         sctp_sctphdr_t _hdr, *hp;
162
163         DEBUGP(__FUNCTION__);
164         DEBUGP("\n");
165
166         /* Actually only need first 8 bytes. */
167         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
168         if (hp == NULL)
169                 return 0;
170
171         tuple->src.u.sctp.port = hp->source;
172         tuple->dst.u.sctp.port = hp->dest;
173         return 1;
174 }
175
176 static int sctp_invert_tuple(struct nf_conntrack_tuple *tuple,
177                              const struct nf_conntrack_tuple *orig)
178 {
179         DEBUGP(__FUNCTION__);
180         DEBUGP("\n");
181
182         tuple->src.u.sctp.port = orig->dst.u.sctp.port;
183         tuple->dst.u.sctp.port = orig->src.u.sctp.port;
184         return 1;
185 }
186
187 /* Print out the per-protocol part of the tuple. */
188 static int sctp_print_tuple(struct seq_file *s,
189                             const struct nf_conntrack_tuple *tuple)
190 {
191         DEBUGP(__FUNCTION__);
192         DEBUGP("\n");
193
194         return seq_printf(s, "sport=%hu dport=%hu ",
195                           ntohs(tuple->src.u.sctp.port),
196                           ntohs(tuple->dst.u.sctp.port));
197 }
198
199 /* Print out the private part of the conntrack. */
200 static int sctp_print_conntrack(struct seq_file *s,
201                                 const struct nf_conn *conntrack)
202 {
203         enum sctp_conntrack state;
204
205         DEBUGP(__FUNCTION__);
206         DEBUGP("\n");
207
208         read_lock_bh(&sctp_lock);
209         state = conntrack->proto.sctp.state;
210         read_unlock_bh(&sctp_lock);
211
212         return seq_printf(s, "%s ", sctp_conntrack_names[state]);
213 }
214
215 #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count)     \
216 for (offset = dataoff + sizeof(sctp_sctphdr_t), count = 0;              \
217         offset < skb->len &&                                            \
218         (sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch));   \
219         offset += (ntohs(sch->length) + 3) & ~3, count++)
220
221 /* Some validity checks to make sure the chunks are fine */
222 static int do_basic_checks(struct nf_conn *conntrack,
223                            const struct sk_buff *skb,
224                            unsigned int dataoff,
225                            char *map)
226 {
227         u_int32_t offset, count;
228         sctp_chunkhdr_t _sch, *sch;
229         int flag;
230
231         DEBUGP(__FUNCTION__);
232         DEBUGP("\n");
233
234         flag = 0;
235
236         for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
237                 DEBUGP("Chunk Num: %d  Type: %d\n", count, sch->type);
238
239                 if (sch->type == SCTP_CID_INIT
240                         || sch->type == SCTP_CID_INIT_ACK
241                         || sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
242                         flag = 1;
243                 }
244
245                 /*
246                  * Cookie Ack/Echo chunks not the first OR
247                  * Init / Init Ack / Shutdown compl chunks not the only chunks
248                  * OR zero-length.
249                  */
250                 if (((sch->type == SCTP_CID_COOKIE_ACK
251                         || sch->type == SCTP_CID_COOKIE_ECHO
252                         || flag)
253                       && count !=0) || !sch->length) {
254                         DEBUGP("Basic checks failed\n");
255                         return 1;
256                 }
257
258                 if (map) {
259                         set_bit(sch->type, (void *)map);
260                 }
261         }
262
263         DEBUGP("Basic checks passed\n");
264         return count == 0;
265 }
266
267 static int new_state(enum ip_conntrack_dir dir,
268                      enum sctp_conntrack cur_state,
269                      int chunk_type)
270 {
271         int i;
272
273         DEBUGP(__FUNCTION__);
274         DEBUGP("\n");
275
276         DEBUGP("Chunk type: %d\n", chunk_type);
277
278         switch (chunk_type) {
279                 case SCTP_CID_INIT:
280                         DEBUGP("SCTP_CID_INIT\n");
281                         i = 0; break;
282                 case SCTP_CID_INIT_ACK:
283                         DEBUGP("SCTP_CID_INIT_ACK\n");
284                         i = 1; break;
285                 case SCTP_CID_ABORT:
286                         DEBUGP("SCTP_CID_ABORT\n");
287                         i = 2; break;
288                 case SCTP_CID_SHUTDOWN:
289                         DEBUGP("SCTP_CID_SHUTDOWN\n");
290                         i = 3; break;
291                 case SCTP_CID_SHUTDOWN_ACK:
292                         DEBUGP("SCTP_CID_SHUTDOWN_ACK\n");
293                         i = 4; break;
294                 case SCTP_CID_ERROR:
295                         DEBUGP("SCTP_CID_ERROR\n");
296                         i = 5; break;
297                 case SCTP_CID_COOKIE_ECHO:
298                         DEBUGP("SCTP_CID_COOKIE_ECHO\n");
299                         i = 6; break;
300                 case SCTP_CID_COOKIE_ACK:
301                         DEBUGP("SCTP_CID_COOKIE_ACK\n");
302                         i = 7; break;
303                 case SCTP_CID_SHUTDOWN_COMPLETE:
304                         DEBUGP("SCTP_CID_SHUTDOWN_COMPLETE\n");
305                         i = 8; break;
306                 default:
307                         /* Other chunks like DATA, SACK, HEARTBEAT and
308                         its ACK do not cause a change in state */
309                         DEBUGP("Unknown chunk type, Will stay in %s\n",
310                                                 sctp_conntrack_names[cur_state]);
311                         return cur_state;
312         }
313
314         DEBUGP("dir: %d   cur_state: %s  chunk_type: %d  new_state: %s\n",
315                         dir, sctp_conntrack_names[cur_state], chunk_type,
316                         sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);
317
318         return sctp_conntracks[dir][i][cur_state];
319 }
320
321 /* Returns verdict for packet, or -1 for invalid. */
322 static int sctp_packet(struct nf_conn *conntrack,
323                        const struct sk_buff *skb,
324                        unsigned int dataoff,
325                        enum ip_conntrack_info ctinfo,
326                        int pf,
327                        unsigned int hooknum)
328 {
329         enum sctp_conntrack newconntrack, oldsctpstate;
330         sctp_sctphdr_t _sctph, *sh;
331         sctp_chunkhdr_t _sch, *sch;
332         u_int32_t offset, count;
333         char map[256 / sizeof (char)] = {0};
334
335         DEBUGP(__FUNCTION__);
336         DEBUGP("\n");
337
338         sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
339         if (sh == NULL)
340                 return -1;
341
342         if (do_basic_checks(conntrack, skb, dataoff, map) != 0)
343                 return -1;
344
345         /* Check the verification tag (Sec 8.5) */
346         if (!test_bit(SCTP_CID_INIT, (void *)map)
347                 && !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, (void *)map)
348                 && !test_bit(SCTP_CID_COOKIE_ECHO, (void *)map)
349                 && !test_bit(SCTP_CID_ABORT, (void *)map)
350                 && !test_bit(SCTP_CID_SHUTDOWN_ACK, (void *)map)
351                 && (sh->vtag != conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
352                 DEBUGP("Verification tag check failed\n");
353                 return -1;
354         }
355
356         oldsctpstate = newconntrack = SCTP_CONNTRACK_MAX;
357         for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
358                 write_lock_bh(&sctp_lock);
359
360                 /* Special cases of Verification tag check (Sec 8.5.1) */
361                 if (sch->type == SCTP_CID_INIT) {
362                         /* Sec 8.5.1 (A) */
363                         if (sh->vtag != 0) {
364                                 write_unlock_bh(&sctp_lock);
365                                 return -1;
366                         }
367                 } else if (sch->type == SCTP_CID_ABORT) {
368                         /* Sec 8.5.1 (B) */
369                         if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
370                                 && !(sh->vtag == conntrack->proto.sctp.vtag
371                                                         [1 - CTINFO2DIR(ctinfo)])) {
372                                 write_unlock_bh(&sctp_lock);
373                                 return -1;
374                         }
375                 } else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
376                         /* Sec 8.5.1 (C) */
377                         if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
378                                 && !(sh->vtag == conntrack->proto.sctp.vtag
379                                                         [1 - CTINFO2DIR(ctinfo)]
380                                         && (sch->flags & 1))) {
381                                 write_unlock_bh(&sctp_lock);
382                                 return -1;
383                         }
384                 } else if (sch->type == SCTP_CID_COOKIE_ECHO) {
385                         /* Sec 8.5.1 (D) */
386                         if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
387                                 write_unlock_bh(&sctp_lock);
388                                 return -1;
389                         }
390                 }
391
392                 oldsctpstate = conntrack->proto.sctp.state;
393                 newconntrack = new_state(CTINFO2DIR(ctinfo), oldsctpstate, sch->type);
394
395                 /* Invalid */
396                 if (newconntrack == SCTP_CONNTRACK_MAX) {
397                         DEBUGP("nf_conntrack_sctp: Invalid dir=%i ctype=%u conntrack=%u\n",
398                                CTINFO2DIR(ctinfo), sch->type, oldsctpstate);
399                         write_unlock_bh(&sctp_lock);
400                         return -1;
401                 }
402
403                 /* If it is an INIT or an INIT ACK note down the vtag */
404                 if (sch->type == SCTP_CID_INIT
405                         || sch->type == SCTP_CID_INIT_ACK) {
406                         sctp_inithdr_t _inithdr, *ih;
407
408                         ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
409                                                 sizeof(_inithdr), &_inithdr);
410                         if (ih == NULL) {
411                                         write_unlock_bh(&sctp_lock);
412                                         return -1;
413                         }
414                         DEBUGP("Setting vtag %x for dir %d\n",
415                                         ih->init_tag, !CTINFO2DIR(ctinfo));
416                         conntrack->proto.sctp.vtag[!CTINFO2DIR(ctinfo)] = ih->init_tag;
417                 }
418
419                 conntrack->proto.sctp.state = newconntrack;
420                 if (oldsctpstate != newconntrack)
421                         nf_conntrack_event_cache(IPCT_PROTOINFO, skb);
422                 write_unlock_bh(&sctp_lock);
423         }
424
425         nf_ct_refresh_acct(conntrack, ctinfo, skb, *sctp_timeouts[newconntrack]);
426
427         if (oldsctpstate == SCTP_CONNTRACK_COOKIE_ECHOED
428                 && CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY
429                 && newconntrack == SCTP_CONNTRACK_ESTABLISHED) {
430                 DEBUGP("Setting assured bit\n");
431                 set_bit(IPS_ASSURED_BIT, &conntrack->status);
432                 nf_conntrack_event_cache(IPCT_STATUS, skb);
433         }
434
435         return NF_ACCEPT;
436 }
437
438 /* Called when a new connection for this protocol found. */
439 static int sctp_new(struct nf_conn *conntrack, const struct sk_buff *skb,
440                     unsigned int dataoff)
441 {
442         enum sctp_conntrack newconntrack;
443         sctp_sctphdr_t _sctph, *sh;
444         sctp_chunkhdr_t _sch, *sch;
445         u_int32_t offset, count;
446         char map[256 / sizeof (char)] = {0};
447
448         DEBUGP(__FUNCTION__);
449         DEBUGP("\n");
450
451         sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
452         if (sh == NULL)
453                 return 0;
454
455         if (do_basic_checks(conntrack, skb, dataoff, map) != 0)
456                 return 0;
457
458         /* If an OOTB packet has any of these chunks discard (Sec 8.4) */
459         if ((test_bit (SCTP_CID_ABORT, (void *)map))
460                 || (test_bit (SCTP_CID_SHUTDOWN_COMPLETE, (void *)map))
461                 || (test_bit (SCTP_CID_COOKIE_ACK, (void *)map))) {
462                 return 0;
463         }
464
465         newconntrack = SCTP_CONNTRACK_MAX;
466         for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
467                 /* Don't need lock here: this conntrack not in circulation yet */
468                 newconntrack = new_state(IP_CT_DIR_ORIGINAL,
469                                          SCTP_CONNTRACK_NONE, sch->type);
470
471                 /* Invalid: delete conntrack */
472                 if (newconntrack == SCTP_CONNTRACK_MAX) {
473                         DEBUGP("nf_conntrack_sctp: invalid new deleting.\n");
474                         return 0;
475                 }
476
477                 /* Copy the vtag into the state info */
478                 if (sch->type == SCTP_CID_INIT) {
479                         if (sh->vtag == 0) {
480                                 sctp_inithdr_t _inithdr, *ih;
481
482                                 ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
483                                                         sizeof(_inithdr), &_inithdr);
484                                 if (ih == NULL)
485                                         return 0;
486
487                                 DEBUGP("Setting vtag %x for new conn\n",
488                                         ih->init_tag);
489
490                                 conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] =
491                                                                 ih->init_tag;
492                         } else {
493                                 /* Sec 8.5.1 (A) */
494                                 return 0;
495                         }
496                 }
497                 /* If it is a shutdown ack OOTB packet, we expect a return
498                    shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
499                 else {
500                         DEBUGP("Setting vtag %x for new conn OOTB\n",
501                                 sh->vtag);
502                         conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
503                 }
504
505                 conntrack->proto.sctp.state = newconntrack;
506         }
507
508         return 1;
509 }
510
511 #ifdef CONFIG_SYSCTL
512 static unsigned int sctp_sysctl_table_users;
513 static struct ctl_table_header *sctp_sysctl_header;
514 static struct ctl_table sctp_sysctl_table[] = {
515         {
516                 .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_CLOSED,
517                 .procname       = "nf_conntrack_sctp_timeout_closed",
518                 .data           = &nf_ct_sctp_timeout_closed,
519                 .maxlen         = sizeof(unsigned int),
520                 .mode           = 0644,
521                 .proc_handler   = &proc_dointvec_jiffies,
522         },
523         {
524                 .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_WAIT,
525                 .procname       = "nf_conntrack_sctp_timeout_cookie_wait",
526                 .data           = &nf_ct_sctp_timeout_cookie_wait,
527                 .maxlen         = sizeof(unsigned int),
528                 .mode           = 0644,
529                 .proc_handler   = &proc_dointvec_jiffies,
530         },
531         {
532                 .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_ECHOED,
533                 .procname       = "nf_conntrack_sctp_timeout_cookie_echoed",
534                 .data           = &nf_ct_sctp_timeout_cookie_echoed,
535                 .maxlen         = sizeof(unsigned int),
536                 .mode           = 0644,
537                 .proc_handler   = &proc_dointvec_jiffies,
538         },
539         {
540                 .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_ESTABLISHED,
541                 .procname       = "nf_conntrack_sctp_timeout_established",
542                 .data           = &nf_ct_sctp_timeout_established,
543                 .maxlen         = sizeof(unsigned int),
544                 .mode           = 0644,
545                 .proc_handler   = &proc_dointvec_jiffies,
546         },
547         {
548                 .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_SENT,
549                 .procname       = "nf_conntrack_sctp_timeout_shutdown_sent",
550                 .data           = &nf_ct_sctp_timeout_shutdown_sent,
551                 .maxlen         = sizeof(unsigned int),
552                 .mode           = 0644,
553                 .proc_handler   = &proc_dointvec_jiffies,
554         },
555         {
556                 .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_RECD,
557                 .procname       = "nf_conntrack_sctp_timeout_shutdown_recd",
558                 .data           = &nf_ct_sctp_timeout_shutdown_recd,
559                 .maxlen         = sizeof(unsigned int),
560                 .mode           = 0644,
561                 .proc_handler   = &proc_dointvec_jiffies,
562         },
563         {
564                 .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_ACK_SENT,
565                 .procname       = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
566                 .data           = &nf_ct_sctp_timeout_shutdown_ack_sent,
567                 .maxlen         = sizeof(unsigned int),
568                 .mode           = 0644,
569                 .proc_handler   = &proc_dointvec_jiffies,
570         },
571         {
572                 .ctl_name = 0
573         }
574 };
575
576 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
577 static struct ctl_table sctp_compat_sysctl_table[] = {
578         {
579                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_CLOSED,
580                 .procname       = "ip_conntrack_sctp_timeout_closed",
581                 .data           = &nf_ct_sctp_timeout_closed,
582                 .maxlen         = sizeof(unsigned int),
583                 .mode           = 0644,
584                 .proc_handler   = &proc_dointvec_jiffies,
585         },
586         {
587                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_WAIT,
588                 .procname       = "ip_conntrack_sctp_timeout_cookie_wait",
589                 .data           = &nf_ct_sctp_timeout_cookie_wait,
590                 .maxlen         = sizeof(unsigned int),
591                 .mode           = 0644,
592                 .proc_handler   = &proc_dointvec_jiffies,
593         },
594         {
595                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_ECHOED,
596                 .procname       = "ip_conntrack_sctp_timeout_cookie_echoed",
597                 .data           = &nf_ct_sctp_timeout_cookie_echoed,
598                 .maxlen         = sizeof(unsigned int),
599                 .mode           = 0644,
600                 .proc_handler   = &proc_dointvec_jiffies,
601         },
602         {
603                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_ESTABLISHED,
604                 .procname       = "ip_conntrack_sctp_timeout_established",
605                 .data           = &nf_ct_sctp_timeout_established,
606                 .maxlen         = sizeof(unsigned int),
607                 .mode           = 0644,
608                 .proc_handler   = &proc_dointvec_jiffies,
609         },
610         {
611                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_SENT,
612                 .procname       = "ip_conntrack_sctp_timeout_shutdown_sent",
613                 .data           = &nf_ct_sctp_timeout_shutdown_sent,
614                 .maxlen         = sizeof(unsigned int),
615                 .mode           = 0644,
616                 .proc_handler   = &proc_dointvec_jiffies,
617         },
618         {
619                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_RECD,
620                 .procname       = "ip_conntrack_sctp_timeout_shutdown_recd",
621                 .data           = &nf_ct_sctp_timeout_shutdown_recd,
622                 .maxlen         = sizeof(unsigned int),
623                 .mode           = 0644,
624                 .proc_handler   = &proc_dointvec_jiffies,
625         },
626         {
627                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_ACK_SENT,
628                 .procname       = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
629                 .data           = &nf_ct_sctp_timeout_shutdown_ack_sent,
630                 .maxlen         = sizeof(unsigned int),
631                 .mode           = 0644,
632                 .proc_handler   = &proc_dointvec_jiffies,
633         },
634         {
635                 .ctl_name = 0
636         }
637 };
638 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
639 #endif
640
641 struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 = {
642         .l3proto                = PF_INET,
643         .l4proto                = IPPROTO_SCTP,
644         .name                   = "sctp",
645         .pkt_to_tuple           = sctp_pkt_to_tuple,
646         .invert_tuple           = sctp_invert_tuple,
647         .print_tuple            = sctp_print_tuple,
648         .print_conntrack        = sctp_print_conntrack,
649         .packet                 = sctp_packet,
650         .new                    = sctp_new,
651         .me                     = THIS_MODULE,
652 #ifdef CONFIG_SYSCTL
653         .ctl_table_users        = &sctp_sysctl_table_users,
654         .ctl_table_header       = &sctp_sysctl_header,
655         .ctl_table              = sctp_sysctl_table,
656 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
657         .ctl_compat_table       = sctp_compat_sysctl_table,
658 #endif
659 #endif
660 };
661
662 struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 = {
663         .l3proto                = PF_INET6,
664         .l4proto                = IPPROTO_SCTP,
665         .name                   = "sctp",
666         .pkt_to_tuple           = sctp_pkt_to_tuple,
667         .invert_tuple           = sctp_invert_tuple,
668         .print_tuple            = sctp_print_tuple,
669         .print_conntrack        = sctp_print_conntrack,
670         .packet                 = sctp_packet,
671         .new                    = sctp_new,
672         .me                     = THIS_MODULE,
673 #ifdef CONFIG_SYSCTL
674         .ctl_table_users        = &sctp_sysctl_table_users,
675         .ctl_table_header       = &sctp_sysctl_header,
676         .ctl_table              = sctp_sysctl_table,
677 #endif
678 };
679
680 int __init nf_conntrack_proto_sctp_init(void)
681 {
682         int ret;
683
684         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp4);
685         if (ret) {
686                 printk("nf_conntrack_l4proto_sctp4: protocol register failed\n");
687                 goto out;
688         }
689         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp6);
690         if (ret) {
691                 printk("nf_conntrack_l4proto_sctp6: protocol register failed\n");
692                 goto cleanup_sctp4;
693         }
694
695         return ret;
696
697  cleanup_sctp4:
698         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
699  out:
700         DEBUGP("SCTP conntrack module loading %s\n",
701                                         ret ? "failed": "succeeded");
702         return ret;
703 }
704
705 void __exit nf_conntrack_proto_sctp_fini(void)
706 {
707         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
708         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
709         DEBUGP("SCTP conntrack module unloaded\n");
710 }
711
712 module_init(nf_conntrack_proto_sctp_init);
713 module_exit(nf_conntrack_proto_sctp_fini);
714
715 MODULE_LICENSE("GPL");
716 MODULE_AUTHOR("Kiran Kumar Immidi");
717 MODULE_DESCRIPTION("Netfilter connection tracking protocol helper for SCTP");
718 MODULE_ALIAS("ip_conntrack_proto_sctp");