netfilter: ctnetlink: fix expectation mask dump
[linux-2.6.git] / net / netfilter / nf_conntrack_proto_sctp.c
index 76e2636..f9d930f 100644 (file)
@@ -1,25 +1,15 @@
 /*
  * Connection tracking protocol helper module for SCTP.
- * 
- * SCTP is defined in RFC 2960. References to various sections in this code 
+ *
+ * SCTP is defined in RFC 2960. References to various sections in this code
  * are to this RFC.
- * 
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
- *
- * 17 Oct 2004: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
- *     - enable working with L3 protocol independent connection tracking.
- *
- * Derived from net/ipv4/ip_conntrack_sctp.c
- */
-
-/*
- * Added support for proc manipulation of timeouts.
  */
 
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/netfilter.h>
 #include <linux/module.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
 
-#if 0
-#define DEBUGP(format, ...) printk(format, ## __VA_ARGS__)
-#else
-#define DEBUGP(format, args...)
-#endif
-
-/* Protects conntrack->proto.sctp */
-static DEFINE_RWLOCK(sctp_lock);
-
 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
-   closely.  They're more complex. --RR 
+   closely.  They're more complex. --RR
 
    And so for me for SCTP :D -Kiran */
 
-static const char *sctp_conntrack_names[] = {
+static const char *const sctp_conntrack_names[] = {
        "NONE",
        "CLOSED",
        "COOKIE_WAIT",
@@ -65,24 +46,15 @@ static const char *sctp_conntrack_names[] = {
 #define HOURS * 60 MINS
 #define DAYS  * 24 HOURS
 
-static unsigned int nf_ct_sctp_timeout_closed __read_mostly          =  10 SECS;
-static unsigned int nf_ct_sctp_timeout_cookie_wait __read_mostly     =   3 SECS;
-static unsigned int nf_ct_sctp_timeout_cookie_echoed __read_mostly   =   3 SECS;
-static unsigned int nf_ct_sctp_timeout_established __read_mostly     =   5 DAYS;
-static unsigned int nf_ct_sctp_timeout_shutdown_sent __read_mostly   = 300 SECS / 1000;
-static unsigned int nf_ct_sctp_timeout_shutdown_recd __read_mostly   = 300 SECS / 1000;
-static unsigned int nf_ct_sctp_timeout_shutdown_ack_sent __read_mostly = 3 SECS;
-
-static unsigned int * sctp_timeouts[]
-= { NULL,                                  /* SCTP_CONNTRACK_NONE  */
-    &nf_ct_sctp_timeout_closed,                   /* SCTP_CONNTRACK_CLOSED */
-    &nf_ct_sctp_timeout_cookie_wait,       /* SCTP_CONNTRACK_COOKIE_WAIT */
-    &nf_ct_sctp_timeout_cookie_echoed,     /* SCTP_CONNTRACK_COOKIE_ECHOED */
-    &nf_ct_sctp_timeout_established,       /* SCTP_CONNTRACK_ESTABLISHED */
-    &nf_ct_sctp_timeout_shutdown_sent,     /* SCTP_CONNTRACK_SHUTDOWN_SENT */
-    &nf_ct_sctp_timeout_shutdown_recd,     /* SCTP_CONNTRACK_SHUTDOWN_RECD */
-    &nf_ct_sctp_timeout_shutdown_ack_sent  /* SCTP_CONNTRACK_SHUTDOWN_ACK_SENT */
- };
+static unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] __read_mostly = {
+       [SCTP_CONNTRACK_CLOSED]                 = 10 SECS,
+       [SCTP_CONNTRACK_COOKIE_WAIT]            = 3 SECS,
+       [SCTP_CONNTRACK_COOKIE_ECHOED]          = 3 SECS,
+       [SCTP_CONNTRACK_ESTABLISHED]            = 5 DAYS,
+       [SCTP_CONNTRACK_SHUTDOWN_SENT]          = 300 SECS / 1000,
+       [SCTP_CONNTRACK_SHUTDOWN_RECD]          = 300 SECS / 1000,
+       [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT]      = 3 SECS,
+};
 
 #define sNO SCTP_CONNTRACK_NONE
 #define        sCL SCTP_CONNTRACK_CLOSED
@@ -94,39 +66,39 @@ static unsigned int * sctp_timeouts[]
 #define        sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
 #define        sIV SCTP_CONNTRACK_MAX
 
-/* 
+/*
        These are the descriptions of the states:
 
-NOTE: These state names are tantalizingly similar to the states of an 
+NOTE: These state names are tantalizingly similar to the states of an
 SCTP endpoint. But the interpretation of the states is a little different,
-considering that these are the states of the connection and not of an end 
+considering that these are the states of the connection and not of an end
 point. Please note the subtleties. -Kiran
 
 NONE              - Nothing so far.
-COOKIE WAIT       - We have seen an INIT chunk in the original direction, or also 
-                    an INIT_ACK chunk in the reply direction.
+COOKIE WAIT       - We have seen an INIT chunk in the original direction, or also
+                   an INIT_ACK chunk in the reply direction.
 COOKIE ECHOED     - We have seen a COOKIE_ECHO chunk in the original direction.
 ESTABLISHED       - We have seen a COOKIE_ACK in the reply direction.
 SHUTDOWN_SENT     - We have seen a SHUTDOWN chunk in the original direction.
 SHUTDOWN_RECD     - We have seen a SHUTDOWN chunk in the reply directoin.
 SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
-                    to that of the SHUTDOWN chunk.
-CLOSED            - We have seen a SHUTDOWN_COMPLETE chunk in the direction of 
-                    the SHUTDOWN chunk. Connection is closed.
+                   to that of the SHUTDOWN chunk.
+CLOSED            - We have seen a SHUTDOWN_COMPLETE chunk in the direction of
+                   the SHUTDOWN chunk. Connection is closed.
 */
 
 /* TODO
- - I have assumed that the first INIT is in the original direction. 
+ - I have assumed that the first INIT is in the original direction.
  This messes things when an INIT comes in the reply direction in CLOSED
  state.
- - Check the error type in the reply dir before transitioning from 
+ - Check the error type in the reply dir before transitioning from
 cookie echoed to closed.
  - Sec 5.2.4 of RFC 2960
  - Multi Homing support.
 */
 
 /* SCTP conntrack state transitions */
-static enum sctp_conntrack sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
+static const u8 sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
        {
 /*     ORIGINAL        */
 /*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
@@ -155,324 +127,303 @@ static enum sctp_conntrack sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
        }
 };
 
-static int sctp_pkt_to_tuple(const struct sk_buff *skb,
-                            unsigned int dataoff,
-                            struct nf_conntrack_tuple *tuple)
+static bool sctp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
+                             struct nf_conntrack_tuple *tuple)
 {
-       sctp_sctphdr_t _hdr, *hp;
-
-       DEBUGP(__FUNCTION__);
-       DEBUGP("\n");
+       const struct sctphdr *hp;
+       struct sctphdr _hdr;
 
        /* Actually only need first 8 bytes. */
        hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
        if (hp == NULL)
-               return 0;
+               return false;
 
        tuple->src.u.sctp.port = hp->source;
        tuple->dst.u.sctp.port = hp->dest;
-       return 1;
+       return true;
 }
 
-static int sctp_invert_tuple(struct nf_conntrack_tuple *tuple,
-                            const struct nf_conntrack_tuple *orig)
+static bool sctp_invert_tuple(struct nf_conntrack_tuple *tuple,
+                             const struct nf_conntrack_tuple *orig)
 {
-       DEBUGP(__FUNCTION__);
-       DEBUGP("\n");
-
        tuple->src.u.sctp.port = orig->dst.u.sctp.port;
        tuple->dst.u.sctp.port = orig->src.u.sctp.port;
-       return 1;
+       return true;
 }
 
 /* Print out the per-protocol part of the tuple. */
 static int sctp_print_tuple(struct seq_file *s,
                            const struct nf_conntrack_tuple *tuple)
 {
-       DEBUGP(__FUNCTION__);
-       DEBUGP("\n");
-
        return seq_printf(s, "sport=%hu dport=%hu ",
                          ntohs(tuple->src.u.sctp.port),
                          ntohs(tuple->dst.u.sctp.port));
 }
 
 /* Print out the private part of the conntrack. */
-static int sctp_print_conntrack(struct seq_file *s,
-                               const struct nf_conn *conntrack)
+static int sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
 {
        enum sctp_conntrack state;
 
-       DEBUGP(__FUNCTION__);
-       DEBUGP("\n");
-
-       read_lock_bh(&sctp_lock);
-       state = conntrack->proto.sctp.state;
-       read_unlock_bh(&sctp_lock);
+       spin_lock_bh(&ct->lock);
+       state = ct->proto.sctp.state;
+       spin_unlock_bh(&ct->lock);
 
        return seq_printf(s, "%s ", sctp_conntrack_names[state]);
 }
 
 #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count)    \
-for (offset = dataoff + sizeof(sctp_sctphdr_t), count = 0;             \
-       offset < skb->len &&                                            \
-       (sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch));   \
-       offset += (ntohs(sch->length) + 3) & ~3, count++)
+for ((offset) = (dataoff) + sizeof(sctp_sctphdr_t), (count) = 0;       \
+       (offset) < (skb)->len &&                                        \
+       ((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch)));   \
+       (offset) += (ntohs((sch)->length) + 3) & ~3, (count)++)
 
 /* Some validity checks to make sure the chunks are fine */
-static int do_basic_checks(struct nf_conn *conntrack,
+static int do_basic_checks(struct nf_conn *ct,
                           const struct sk_buff *skb,
                           unsigned int dataoff,
-                          char *map)
+                          unsigned long *map)
 {
        u_int32_t offset, count;
        sctp_chunkhdr_t _sch, *sch;
        int flag;
 
-       DEBUGP(__FUNCTION__);
-       DEBUGP("\n");
-
        flag = 0;
 
        for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
-               DEBUGP("Chunk Num: %d  Type: %d\n", count, sch->type);
+               pr_debug("Chunk Num: %d  Type: %d\n", count, sch->type);
 
-               if (sch->type == SCTP_CID_INIT 
-                       || sch->type == SCTP_CID_INIT_ACK
-                       || sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
+               if (sch->type == SCTP_CID_INIT ||
+                   sch->type == SCTP_CID_INIT_ACK ||
+                   sch->type == SCTP_CID_SHUTDOWN_COMPLETE)
                        flag = 1;
-               }
 
                /*
                 * Cookie Ack/Echo chunks not the first OR
                 * Init / Init Ack / Shutdown compl chunks not the only chunks
                 * OR zero-length.
                 */
-               if (((sch->type == SCTP_CID_COOKIE_ACK
-                       || sch->type == SCTP_CID_COOKIE_ECHO
-                       || flag)
-                     && count !=0) || !sch->length) {
-                       DEBUGP("Basic checks failed\n");
+               if (((sch->type == SCTP_CID_COOKIE_ACK ||
+                     sch->type == SCTP_CID_COOKIE_ECHO ||
+                     flag) &&
+                    count != 0) || !sch->length) {
+                       pr_debug("Basic checks failed\n");
                        return 1;
                }
 
-               if (map) {
-                       set_bit(sch->type, (void *)map);
-               }
+               if (map)
+                       set_bit(sch->type, map);
        }
 
-       DEBUGP("Basic checks passed\n");
+       pr_debug("Basic checks passed\n");
        return count == 0;
 }
 
-static int new_state(enum ip_conntrack_dir dir,
-                    enum sctp_conntrack cur_state,
-                    int chunk_type)
+static int sctp_new_state(enum ip_conntrack_dir dir,
+                         enum sctp_conntrack cur_state,
+                         int chunk_type)
 {
        int i;
 
-       DEBUGP(__FUNCTION__);
-       DEBUGP("\n");
-
-       DEBUGP("Chunk type: %d\n", chunk_type);
+       pr_debug("Chunk type: %d\n", chunk_type);
 
        switch (chunk_type) {
-               case SCTP_CID_INIT: 
-                       DEBUGP("SCTP_CID_INIT\n");
-                       i = 0; break;
-               case SCTP_CID_INIT_ACK: 
-                       DEBUGP("SCTP_CID_INIT_ACK\n");
-                       i = 1; break;
-               case SCTP_CID_ABORT: 
-                       DEBUGP("SCTP_CID_ABORT\n");
-                       i = 2; break;
-               case SCTP_CID_SHUTDOWN: 
-                       DEBUGP("SCTP_CID_SHUTDOWN\n");
-                       i = 3; break;
-               case SCTP_CID_SHUTDOWN_ACK: 
-                       DEBUGP("SCTP_CID_SHUTDOWN_ACK\n");
-                       i = 4; break;
-               case SCTP_CID_ERROR: 
-                       DEBUGP("SCTP_CID_ERROR\n");
-                       i = 5; break;
-               case SCTP_CID_COOKIE_ECHO: 
-                       DEBUGP("SCTP_CID_COOKIE_ECHO\n");
-                       i = 6; break;
-               case SCTP_CID_COOKIE_ACK: 
-                       DEBUGP("SCTP_CID_COOKIE_ACK\n");
-                       i = 7; break;
-               case SCTP_CID_SHUTDOWN_COMPLETE: 
-                       DEBUGP("SCTP_CID_SHUTDOWN_COMPLETE\n");
-                       i = 8; break;
-               default:
-                       /* Other chunks like DATA, SACK, HEARTBEAT and
-                       its ACK do not cause a change in state */
-                       DEBUGP("Unknown chunk type, Will stay in %s\n", 
-                                               sctp_conntrack_names[cur_state]);
-                       return cur_state;
+       case SCTP_CID_INIT:
+               pr_debug("SCTP_CID_INIT\n");
+               i = 0;
+               break;
+       case SCTP_CID_INIT_ACK:
+               pr_debug("SCTP_CID_INIT_ACK\n");
+               i = 1;
+               break;
+       case SCTP_CID_ABORT:
+               pr_debug("SCTP_CID_ABORT\n");
+               i = 2;
+               break;
+       case SCTP_CID_SHUTDOWN:
+               pr_debug("SCTP_CID_SHUTDOWN\n");
+               i = 3;
+               break;
+       case SCTP_CID_SHUTDOWN_ACK:
+               pr_debug("SCTP_CID_SHUTDOWN_ACK\n");
+               i = 4;
+               break;
+       case SCTP_CID_ERROR:
+               pr_debug("SCTP_CID_ERROR\n");
+               i = 5;
+               break;
+       case SCTP_CID_COOKIE_ECHO:
+               pr_debug("SCTP_CID_COOKIE_ECHO\n");
+               i = 6;
+               break;
+       case SCTP_CID_COOKIE_ACK:
+               pr_debug("SCTP_CID_COOKIE_ACK\n");
+               i = 7;
+               break;
+       case SCTP_CID_SHUTDOWN_COMPLETE:
+               pr_debug("SCTP_CID_SHUTDOWN_COMPLETE\n");
+               i = 8;
+               break;
+       default:
+               /* Other chunks like DATA, SACK, HEARTBEAT and
+               its ACK do not cause a change in state */
+               pr_debug("Unknown chunk type, Will stay in %s\n",
+                        sctp_conntrack_names[cur_state]);
+               return cur_state;
        }
 
-       DEBUGP("dir: %d   cur_state: %s  chunk_type: %d  new_state: %s\n", 
-                       dir, sctp_conntrack_names[cur_state], chunk_type,
-                       sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);
+       pr_debug("dir: %d   cur_state: %s  chunk_type: %d  new_state: %s\n",
+                dir, sctp_conntrack_names[cur_state], chunk_type,
+                sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);
 
        return sctp_conntracks[dir][i][cur_state];
 }
 
-/* Returns verdict for packet, or -1 for invalid. */
-static int sctp_packet(struct nf_conn *conntrack,
+/* Returns verdict for packet, or -NF_ACCEPT for invalid. */
+static int sctp_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
-                      int pf,
+                      u_int8_t pf,
                       unsigned int hooknum)
 {
-       enum sctp_conntrack newconntrack, oldsctpstate;
-       sctp_sctphdr_t _sctph, *sh;
-       sctp_chunkhdr_t _sch, *sch;
+       enum sctp_conntrack new_state, old_state;
+       enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+       const struct sctphdr *sh;
+       struct sctphdr _sctph;
+       const struct sctp_chunkhdr *sch;
+       struct sctp_chunkhdr _sch;
        u_int32_t offset, count;
-       char map[256 / sizeof (char)] = {0};
-
-       DEBUGP(__FUNCTION__);
-       DEBUGP("\n");
+       unsigned long map[256 / sizeof(unsigned long)] = { 0 };
 
        sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
        if (sh == NULL)
-               return -1;
+               goto out;
 
-       if (do_basic_checks(conntrack, skb, dataoff, map) != 0)
-               return -1;
+       if (do_basic_checks(ct, skb, dataoff, map) != 0)
+               goto out;
 
        /* Check the verification tag (Sec 8.5) */
-       if (!test_bit(SCTP_CID_INIT, (void *)map)
-               && !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, (void *)map)
-               && !test_bit(SCTP_CID_COOKIE_ECHO, (void *)map)
-               && !test_bit(SCTP_CID_ABORT, (void *)map)
-               && !test_bit(SCTP_CID_SHUTDOWN_ACK, (void *)map)
-               && (sh->vtag != conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
-               DEBUGP("Verification tag check failed\n");
-               return -1;
+       if (!test_bit(SCTP_CID_INIT, map) &&
+           !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) &&
+           !test_bit(SCTP_CID_COOKIE_ECHO, map) &&
+           !test_bit(SCTP_CID_ABORT, map) &&
+           !test_bit(SCTP_CID_SHUTDOWN_ACK, map) &&
+           sh->vtag != ct->proto.sctp.vtag[dir]) {
+               pr_debug("Verification tag check failed\n");
+               goto out;
        }
 
-       oldsctpstate = newconntrack = SCTP_CONNTRACK_MAX;
+       old_state = new_state = SCTP_CONNTRACK_NONE;
+       spin_lock_bh(&ct->lock);
        for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
-               write_lock_bh(&sctp_lock);
-
                /* Special cases of Verification tag check (Sec 8.5.1) */
                if (sch->type == SCTP_CID_INIT) {
                        /* Sec 8.5.1 (A) */
-                       if (sh->vtag != 0) {
-                               write_unlock_bh(&sctp_lock);
-                               return -1;
-                       }
+                       if (sh->vtag != 0)
+                               goto out_unlock;
                } else if (sch->type == SCTP_CID_ABORT) {
                        /* Sec 8.5.1 (B) */
-                       if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
-                               && !(sh->vtag == conntrack->proto.sctp.vtag
-                                                       [1 - CTINFO2DIR(ctinfo)])) {
-                               write_unlock_bh(&sctp_lock);
-                               return -1;
-                       }
+                       if (sh->vtag != ct->proto.sctp.vtag[dir] &&
+                           sh->vtag != ct->proto.sctp.vtag[!dir])
+                               goto out_unlock;
                } else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
                        /* Sec 8.5.1 (C) */
-                       if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
-                               && !(sh->vtag == conntrack->proto.sctp.vtag
-                                                       [1 - CTINFO2DIR(ctinfo)] 
-                                       && (sch->flags & 1))) {
-                               write_unlock_bh(&sctp_lock);
-                               return -1;
-                       }
+                       if (sh->vtag != ct->proto.sctp.vtag[dir] &&
+                           sh->vtag != ct->proto.sctp.vtag[!dir] &&
+                           sch->flags & SCTP_CHUNK_FLAG_T)
+                               goto out_unlock;
                } else if (sch->type == SCTP_CID_COOKIE_ECHO) {
                        /* Sec 8.5.1 (D) */
-                       if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
-                               write_unlock_bh(&sctp_lock);
-                               return -1;
-                       }
+                       if (sh->vtag != ct->proto.sctp.vtag[dir])
+                               goto out_unlock;
                }
 
-               oldsctpstate = conntrack->proto.sctp.state;
-               newconntrack = new_state(CTINFO2DIR(ctinfo), oldsctpstate, sch->type);
+               old_state = ct->proto.sctp.state;
+               new_state = sctp_new_state(dir, old_state, sch->type);
 
                /* Invalid */
-               if (newconntrack == SCTP_CONNTRACK_MAX) {
-                       DEBUGP("nf_conntrack_sctp: Invalid dir=%i ctype=%u conntrack=%u\n",
-                              CTINFO2DIR(ctinfo), sch->type, oldsctpstate);
-                       write_unlock_bh(&sctp_lock);
-                       return -1;
+               if (new_state == SCTP_CONNTRACK_MAX) {
+                       pr_debug("nf_conntrack_sctp: Invalid dir=%i ctype=%u "
+                                "conntrack=%u\n",
+                                dir, sch->type, old_state);
+                       goto out_unlock;
                }
 
                /* If it is an INIT or an INIT ACK note down the vtag */
-               if (sch->type == SCTP_CID_INIT 
-                       || sch->type == SCTP_CID_INIT_ACK) {
+               if (sch->type == SCTP_CID_INIT ||
+                   sch->type == SCTP_CID_INIT_ACK) {
                        sctp_inithdr_t _inithdr, *ih;
 
                        ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
-                                               sizeof(_inithdr), &_inithdr);
-                       if (ih == NULL) {
-                                       write_unlock_bh(&sctp_lock);
-                                       return -1;
-                       }
-                       DEBUGP("Setting vtag %x for dir %d\n", 
-                                       ih->init_tag, !CTINFO2DIR(ctinfo));
-                       conntrack->proto.sctp.vtag[!CTINFO2DIR(ctinfo)] = ih->init_tag;
+                                               sizeof(_inithdr), &_inithdr);
+                       if (ih == NULL)
+                               goto out_unlock;
+                       pr_debug("Setting vtag %x for dir %d\n",
+                                ih->init_tag, !dir);
+                       ct->proto.sctp.vtag[!dir] = ih->init_tag;
                }
 
-               conntrack->proto.sctp.state = newconntrack;
-               if (oldsctpstate != newconntrack)
-                       nf_conntrack_event_cache(IPCT_PROTOINFO, skb);
-               write_unlock_bh(&sctp_lock);
+               ct->proto.sctp.state = new_state;
+               if (old_state != new_state)
+                       nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
        }
+       spin_unlock_bh(&ct->lock);
 
-       nf_ct_refresh_acct(conntrack, ctinfo, skb, *sctp_timeouts[newconntrack]);
+       nf_ct_refresh_acct(ct, ctinfo, skb, sctp_timeouts[new_state]);
 
-       if (oldsctpstate == SCTP_CONNTRACK_COOKIE_ECHOED
-               && CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY
-               && newconntrack == SCTP_CONNTRACK_ESTABLISHED) {
-               DEBUGP("Setting assured bit\n");
-               set_bit(IPS_ASSURED_BIT, &conntrack->status);
-               nf_conntrack_event_cache(IPCT_STATUS, skb);
+       if (old_state == SCTP_CONNTRACK_COOKIE_ECHOED &&
+           dir == IP_CT_DIR_REPLY &&
+           new_state == SCTP_CONNTRACK_ESTABLISHED) {
+               pr_debug("Setting assured bit\n");
+               set_bit(IPS_ASSURED_BIT, &ct->status);
+               nf_conntrack_event_cache(IPCT_STATUS, ct);
        }
 
        return NF_ACCEPT;
+
+out_unlock:
+       spin_unlock_bh(&ct->lock);
+out:
+       return -NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
-static int sctp_new(struct nf_conn *conntrack, const struct sk_buff *skb,
-                   unsigned int dataoff)
+static bool sctp_new(struct nf_conn *ct, const struct sk_buff *skb,
+                    unsigned int dataoff)
 {
-       enum sctp_conntrack newconntrack;
-       sctp_sctphdr_t _sctph, *sh;
-       sctp_chunkhdr_t _sch, *sch;
+       enum sctp_conntrack new_state;
+       const struct sctphdr *sh;
+       struct sctphdr _sctph;
+       const struct sctp_chunkhdr *sch;
+       struct sctp_chunkhdr _sch;
        u_int32_t offset, count;
-       char map[256 / sizeof (char)] = {0};
-
-       DEBUGP(__FUNCTION__);
-       DEBUGP("\n");
+       unsigned long map[256 / sizeof(unsigned long)] = { 0 };
 
        sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
        if (sh == NULL)
-               return 0;
+               return false;
 
-       if (do_basic_checks(conntrack, skb, dataoff, map) != 0)
-               return 0;
+       if (do_basic_checks(ct, skb, dataoff, map) != 0)
+               return false;
 
        /* If an OOTB packet has any of these chunks discard (Sec 8.4) */
-       if ((test_bit (SCTP_CID_ABORT, (void *)map))
-               || (test_bit (SCTP_CID_SHUTDOWN_COMPLETE, (void *)map))
-               || (test_bit (SCTP_CID_COOKIE_ACK, (void *)map))) {
-               return 0;
-       }
+       if (test_bit(SCTP_CID_ABORT, map) ||
+           test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) ||
+           test_bit(SCTP_CID_COOKIE_ACK, map))
+               return false;
 
-       newconntrack = SCTP_CONNTRACK_MAX;
+       new_state = SCTP_CONNTRACK_MAX;
        for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
                /* Don't need lock here: this conntrack not in circulation yet */
-               newconntrack = new_state(IP_CT_DIR_ORIGINAL, 
-                                        SCTP_CONNTRACK_NONE, sch->type);
+               new_state = sctp_new_state(IP_CT_DIR_ORIGINAL,
+                                          SCTP_CONNTRACK_NONE, sch->type);
 
                /* Invalid: delete conntrack */
-               if (newconntrack == SCTP_CONNTRACK_MAX) {
-                       DEBUGP("nf_conntrack_sctp: invalid new deleting.\n");
-                       return 0;
+               if (new_state == SCTP_CONNTRACK_NONE ||
+                   new_state == SCTP_CONNTRACK_MAX) {
+                       pr_debug("nf_conntrack_sctp: invalid new deleting.\n");
+                       return false;
                }
 
                /* Copy the vtag into the state info */
@@ -481,165 +432,229 @@ static int sctp_new(struct nf_conn *conntrack, const struct sk_buff *skb,
                                sctp_inithdr_t _inithdr, *ih;
 
                                ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
-                                                       sizeof(_inithdr), &_inithdr);
+                                                       sizeof(_inithdr), &_inithdr);
                                if (ih == NULL)
-                                       return 0;
+                                       return false;
 
-                               DEBUGP("Setting vtag %x for new conn\n", 
-                                       ih->init_tag);
+                               pr_debug("Setting vtag %x for new conn\n",
+                                        ih->init_tag);
 
-                               conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] = 
+                               ct->proto.sctp.vtag[IP_CT_DIR_REPLY] =
                                                                ih->init_tag;
                        } else {
                                /* Sec 8.5.1 (A) */
-                               return 0;
+                               return false;
                        }
                }
                /* If it is a shutdown ack OOTB packet, we expect a return
                   shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
                else {
-                       DEBUGP("Setting vtag %x for new conn OOTB\n", 
-                               sh->vtag);
-                       conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
+                       pr_debug("Setting vtag %x for new conn OOTB\n",
+                                sh->vtag);
+                       ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
                }
 
-               conntrack->proto.sctp.state = newconntrack;
+               ct->proto.sctp.state = new_state;
        }
 
-       return 1;
+       return true;
+}
+
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_conntrack.h>
+
+static int sctp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
+                         struct nf_conn *ct)
+{
+       struct nlattr *nest_parms;
+
+       spin_lock_bh(&ct->lock);
+       nest_parms = nla_nest_start(skb, CTA_PROTOINFO_SCTP | NLA_F_NESTED);
+       if (!nest_parms)
+               goto nla_put_failure;
+
+       NLA_PUT_U8(skb, CTA_PROTOINFO_SCTP_STATE, ct->proto.sctp.state);
+
+       NLA_PUT_BE32(skb,
+                    CTA_PROTOINFO_SCTP_VTAG_ORIGINAL,
+                    ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL]);
+
+       NLA_PUT_BE32(skb,
+                    CTA_PROTOINFO_SCTP_VTAG_REPLY,
+                    ct->proto.sctp.vtag[IP_CT_DIR_REPLY]);
+
+       spin_unlock_bh(&ct->lock);
+
+       nla_nest_end(skb, nest_parms);
+
+       return 0;
+
+nla_put_failure:
+       spin_unlock_bh(&ct->lock);
+       return -1;
 }
 
+static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX+1] = {
+       [CTA_PROTOINFO_SCTP_STATE]          = { .type = NLA_U8 },
+       [CTA_PROTOINFO_SCTP_VTAG_ORIGINAL]  = { .type = NLA_U32 },
+       [CTA_PROTOINFO_SCTP_VTAG_REPLY]     = { .type = NLA_U32 },
+};
+
+static int nlattr_to_sctp(struct nlattr *cda[], struct nf_conn *ct)
+{
+       struct nlattr *attr = cda[CTA_PROTOINFO_SCTP];
+       struct nlattr *tb[CTA_PROTOINFO_SCTP_MAX+1];
+       int err;
+
+       /* updates may not contain the internal protocol info, skip parsing */
+       if (!attr)
+               return 0;
+
+       err = nla_parse_nested(tb,
+                              CTA_PROTOINFO_SCTP_MAX,
+                              attr,
+                              sctp_nla_policy);
+       if (err < 0)
+               return err;
+
+       if (!tb[CTA_PROTOINFO_SCTP_STATE] ||
+           !tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] ||
+           !tb[CTA_PROTOINFO_SCTP_VTAG_REPLY])
+               return -EINVAL;
+
+       spin_lock_bh(&ct->lock);
+       ct->proto.sctp.state = nla_get_u8(tb[CTA_PROTOINFO_SCTP_STATE]);
+       ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] =
+               nla_get_be32(tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL]);
+       ct->proto.sctp.vtag[IP_CT_DIR_REPLY] =
+               nla_get_be32(tb[CTA_PROTOINFO_SCTP_VTAG_REPLY]);
+       spin_unlock_bh(&ct->lock);
+
+       return 0;
+}
+
+static int sctp_nlattr_size(void)
+{
+       return nla_total_size(0)        /* CTA_PROTOINFO_SCTP */
+               + nla_policy_len(sctp_nla_policy, CTA_PROTOINFO_SCTP_MAX + 1);
+}
+#endif
+
 #ifdef CONFIG_SYSCTL
 static unsigned int sctp_sysctl_table_users;
 static struct ctl_table_header *sctp_sysctl_header;
 static struct ctl_table sctp_sysctl_table[] = {
        {
-               .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_CLOSED,
                .procname       = "nf_conntrack_sctp_timeout_closed",
-               .data           = &nf_ct_sctp_timeout_closed,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_WAIT,
                .procname       = "nf_conntrack_sctp_timeout_cookie_wait",
-               .data           = &nf_ct_sctp_timeout_cookie_wait,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_ECHOED,
                .procname       = "nf_conntrack_sctp_timeout_cookie_echoed",
-               .data           = &nf_ct_sctp_timeout_cookie_echoed,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_ESTABLISHED,
                .procname       = "nf_conntrack_sctp_timeout_established",
-               .data           = &nf_ct_sctp_timeout_established,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_SENT,
                .procname       = "nf_conntrack_sctp_timeout_shutdown_sent",
-               .data           = &nf_ct_sctp_timeout_shutdown_sent,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_RECD,
                .procname       = "nf_conntrack_sctp_timeout_shutdown_recd",
-               .data           = &nf_ct_sctp_timeout_shutdown_recd,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_ACK_SENT,
                .procname       = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
-               .data           = &nf_ct_sctp_timeout_shutdown_ack_sent,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
-       {
-               .ctl_name = 0
-       }
+       { }
 };
 
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 static struct ctl_table sctp_compat_sysctl_table[] = {
        {
-               .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_CLOSED,
                .procname       = "ip_conntrack_sctp_timeout_closed",
-               .data           = &nf_ct_sctp_timeout_closed,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_WAIT,
                .procname       = "ip_conntrack_sctp_timeout_cookie_wait",
-               .data           = &nf_ct_sctp_timeout_cookie_wait,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_ECHOED,
                .procname       = "ip_conntrack_sctp_timeout_cookie_echoed",
-               .data           = &nf_ct_sctp_timeout_cookie_echoed,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_ESTABLISHED,
                .procname       = "ip_conntrack_sctp_timeout_established",
-               .data           = &nf_ct_sctp_timeout_established,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_SENT,
                .procname       = "ip_conntrack_sctp_timeout_shutdown_sent",
-               .data           = &nf_ct_sctp_timeout_shutdown_sent,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_RECD,
                .procname       = "ip_conntrack_sctp_timeout_shutdown_recd",
-               .data           = &nf_ct_sctp_timeout_shutdown_recd,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
        {
-               .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_ACK_SENT,
                .procname       = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
-               .data           = &nf_ct_sctp_timeout_shutdown_ack_sent,
+               .data           = &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_jiffies,
+               .proc_handler   = proc_dointvec_jiffies,
        },
-       {
-               .ctl_name = 0
-       }
+       { }
 };
 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 #endif
 
-struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 = {
+static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
        .l3proto                = PF_INET,
        .l4proto                = IPPROTO_SCTP,
        .name                   = "sctp",
@@ -650,6 +665,15 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 = {
        .packet                 = sctp_packet,
        .new                    = sctp_new,
        .me                     = THIS_MODULE,
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
+       .to_nlattr              = sctp_to_nlattr,
+       .nlattr_size            = sctp_nlattr_size,
+       .from_nlattr            = nlattr_to_sctp,
+       .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
+       .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
+       .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
+       .nla_policy             = nf_ct_port_nla_policy,
+#endif
 #ifdef CONFIG_SYSCTL
        .ctl_table_users        = &sctp_sysctl_table_users,
        .ctl_table_header       = &sctp_sysctl_header,
@@ -660,7 +684,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 = {
 #endif
 };
 
-struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 = {
+static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
        .l3proto                = PF_INET6,
        .l4proto                = IPPROTO_SCTP,
        .name                   = "sctp",
@@ -671,6 +695,15 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 = {
        .packet                 = sctp_packet,
        .new                    = sctp_new,
        .me                     = THIS_MODULE,
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
+       .to_nlattr              = sctp_to_nlattr,
+       .nlattr_size            = sctp_nlattr_size,
+       .from_nlattr            = nlattr_to_sctp,
+       .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
+       .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
+       .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
+       .nla_policy             = nf_ct_port_nla_policy,
+#endif
 #ifdef CONFIG_SYSCTL
        .ctl_table_users        = &sctp_sysctl_table_users,
        .ctl_table_header       = &sctp_sysctl_header,
@@ -678,7 +711,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 = {
 #endif
 };
 
-int __init nf_conntrack_proto_sctp_init(void)
+static int __init nf_conntrack_proto_sctp_init(void)
 {
        int ret;
 
@@ -698,16 +731,13 @@ int __init nf_conntrack_proto_sctp_init(void)
  cleanup_sctp4:
        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
  out:
-       DEBUGP("SCTP conntrack module loading %s\n", 
-                                       ret ? "failed": "succeeded");
        return ret;
 }
 
-void __exit nf_conntrack_proto_sctp_fini(void)
+static void __exit nf_conntrack_proto_sctp_fini(void)
 {
        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
-       DEBUGP("SCTP conntrack module unloaded\n");
 }
 
 module_init(nf_conntrack_proto_sctp_init);