Linux-2.6.12-rc2
[linux-2.6.git] / net / ipv4 / netfilter / ip_conntrack_proto_sctp.c
1 /*
2  * Connection tracking protocol helper module for SCTP.
3  * 
4  * SCTP is defined in RFC 2960. References to various sections in this code 
5  * are to this RFC.
6  * 
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11
12 /*
13  * Added support for proc manipulation of timeouts.
14  */
15
16 #include <linux/types.h>
17 #include <linux/sched.h>
18 #include <linux/timer.h>
19 #include <linux/netfilter.h>
20 #include <linux/module.h>
21 #include <linux/in.h>
22 #include <linux/ip.h>
23 #include <linux/sctp.h>
24 #include <linux/string.h>
25 #include <linux/seq_file.h>
26
27 #include <linux/netfilter_ipv4/ip_conntrack.h>
28 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
29 #include <linux/netfilter_ipv4/lockhelp.h>
30
31 #if 0
32 #define DEBUGP(format, ...) printk(format, ## __VA_ARGS__)
33 #else
34 #define DEBUGP(format, args...)
35 #endif
36
37 /* Protects conntrack->proto.sctp */
38 static DECLARE_RWLOCK(sctp_lock);
39
40 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
41    closely.  They're more complex. --RR 
42
43    And so for me for SCTP :D -Kiran */
44
45 static const char *sctp_conntrack_names[] = {
46         "NONE",
47         "CLOSED",
48         "COOKIE_WAIT",
49         "COOKIE_ECHOED",
50         "ESTABLISHED",
51         "SHUTDOWN_SENT",
52         "SHUTDOWN_RECD",
53         "SHUTDOWN_ACK_SENT",
54 };
55
56 #define SECS  * HZ
57 #define MINS  * 60 SECS
58 #define HOURS * 60 MINS
59 #define DAYS  * 24 HOURS
60
61 static unsigned long ip_ct_sctp_timeout_closed            =  10 SECS;
62 static unsigned long ip_ct_sctp_timeout_cookie_wait       =   3 SECS;
63 static unsigned long ip_ct_sctp_timeout_cookie_echoed     =   3 SECS;
64 static unsigned long ip_ct_sctp_timeout_established       =   5 DAYS;
65 static unsigned long ip_ct_sctp_timeout_shutdown_sent     = 300 SECS / 1000;
66 static unsigned long ip_ct_sctp_timeout_shutdown_recd     = 300 SECS / 1000;
67 static unsigned long ip_ct_sctp_timeout_shutdown_ack_sent =   3 SECS;
68
69 static unsigned long * sctp_timeouts[]
70 = { NULL,                                  /* SCTP_CONNTRACK_NONE  */
71     &ip_ct_sctp_timeout_closed,            /* SCTP_CONNTRACK_CLOSED */
72     &ip_ct_sctp_timeout_cookie_wait,       /* SCTP_CONNTRACK_COOKIE_WAIT */
73     &ip_ct_sctp_timeout_cookie_echoed,     /* SCTP_CONNTRACK_COOKIE_ECHOED */
74     &ip_ct_sctp_timeout_established,       /* SCTP_CONNTRACK_ESTABLISHED */
75     &ip_ct_sctp_timeout_shutdown_sent,     /* SCTP_CONNTRACK_SHUTDOWN_SENT */
76     &ip_ct_sctp_timeout_shutdown_recd,     /* SCTP_CONNTRACK_SHUTDOWN_RECD */
77     &ip_ct_sctp_timeout_shutdown_ack_sent  /* SCTP_CONNTRACK_SHUTDOWN_ACK_SENT */
78  };
79
80 #define sNO SCTP_CONNTRACK_NONE
81 #define sCL SCTP_CONNTRACK_CLOSED
82 #define sCW SCTP_CONNTRACK_COOKIE_WAIT
83 #define sCE SCTP_CONNTRACK_COOKIE_ECHOED
84 #define sES SCTP_CONNTRACK_ESTABLISHED
85 #define sSS SCTP_CONNTRACK_SHUTDOWN_SENT
86 #define sSR SCTP_CONNTRACK_SHUTDOWN_RECD
87 #define sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
88 #define sIV SCTP_CONNTRACK_MAX
89
90 /* 
91         These are the descriptions of the states:
92
93 NOTE: These state names are tantalizingly similar to the states of an 
94 SCTP endpoint. But the interpretation of the states is a little different,
95 considering that these are the states of the connection and not of an end 
96 point. Please note the subtleties. -Kiran
97
98 NONE              - Nothing so far.
99 COOKIE WAIT       - We have seen an INIT chunk in the original direction, or also 
100                     an INIT_ACK chunk in the reply direction.
101 COOKIE ECHOED     - We have seen a COOKIE_ECHO chunk in the original direction.
102 ESTABLISHED       - We have seen a COOKIE_ACK in the reply direction.
103 SHUTDOWN_SENT     - We have seen a SHUTDOWN chunk in the original direction.
104 SHUTDOWN_RECD     - We have seen a SHUTDOWN chunk in the reply directoin.
105 SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
106                     to that of the SHUTDOWN chunk.
107 CLOSED            - We have seen a SHUTDOWN_COMPLETE chunk in the direction of 
108                     the SHUTDOWN chunk. Connection is closed.
109 */
110
111 /* TODO
112  - I have assumed that the first INIT is in the original direction. 
113  This messes things when an INIT comes in the reply direction in CLOSED
114  state.
115  - Check the error type in the reply dir before transitioning from 
116 cookie echoed to closed.
117  - Sec 5.2.4 of RFC 2960
118  - Multi Homing support.
119 */
120
121 /* SCTP conntrack state transitions */
122 static enum sctp_conntrack sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
123         {
124 /*      ORIGINAL        */
125 /*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
126 /* init         */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA},
127 /* init_ack     */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},
128 /* abort        */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
129 /* shutdown     */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA},
130 /* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA},
131 /* error        */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant have Stale cookie*/
132 /* cookie_echo  */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA},/* 5.2.4 - Big TODO */
133 /* cookie_ack   */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in orig dir */
134 /* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL}
135         },
136         {
137 /*      REPLY   */
138 /*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
139 /* init         */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* INIT in sCL Big TODO */
140 /* init_ack     */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},
141 /* abort        */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
142 /* shutdown     */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA},
143 /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA},
144 /* error        */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA},
145 /* cookie_echo  */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in reply dir */
146 /* cookie_ack   */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA},
147 /* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL}
148         }
149 };
150
151 static int sctp_pkt_to_tuple(const struct sk_buff *skb,
152                              unsigned int dataoff,
153                              struct ip_conntrack_tuple *tuple)
154 {
155         sctp_sctphdr_t _hdr, *hp;
156
157         DEBUGP(__FUNCTION__);
158         DEBUGP("\n");
159
160         /* Actually only need first 8 bytes. */
161         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
162         if (hp == NULL)
163                 return 0;
164
165         tuple->src.u.sctp.port = hp->source;
166         tuple->dst.u.sctp.port = hp->dest;
167         return 1;
168 }
169
170 static int sctp_invert_tuple(struct ip_conntrack_tuple *tuple,
171                              const struct ip_conntrack_tuple *orig)
172 {
173         DEBUGP(__FUNCTION__);
174         DEBUGP("\n");
175
176         tuple->src.u.sctp.port = orig->dst.u.sctp.port;
177         tuple->dst.u.sctp.port = orig->src.u.sctp.port;
178         return 1;
179 }
180
181 /* Print out the per-protocol part of the tuple. */
182 static int sctp_print_tuple(struct seq_file *s,
183                             const struct ip_conntrack_tuple *tuple)
184 {
185         DEBUGP(__FUNCTION__);
186         DEBUGP("\n");
187
188         return seq_printf(s, "sport=%hu dport=%hu ",
189                           ntohs(tuple->src.u.sctp.port),
190                           ntohs(tuple->dst.u.sctp.port));
191 }
192
193 /* Print out the private part of the conntrack. */
194 static int sctp_print_conntrack(struct seq_file *s,
195                                 const struct ip_conntrack *conntrack)
196 {
197         enum sctp_conntrack state;
198
199         DEBUGP(__FUNCTION__);
200         DEBUGP("\n");
201
202         READ_LOCK(&sctp_lock);
203         state = conntrack->proto.sctp.state;
204         READ_UNLOCK(&sctp_lock);
205
206         return seq_printf(s, "%s ", sctp_conntrack_names[state]);
207 }
208
209 #define for_each_sctp_chunk(skb, sch, _sch, offset, count)              \
210 for (offset = skb->nh.iph->ihl * 4 + sizeof(sctp_sctphdr_t), count = 0; \
211         offset < skb->len &&                                            \
212         (sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch));   \
213         offset += (htons(sch->length) + 3) & ~3, count++)
214
215 /* Some validity checks to make sure the chunks are fine */
216 static int do_basic_checks(struct ip_conntrack *conntrack,
217                            const struct sk_buff *skb,
218                            char *map)
219 {
220         u_int32_t offset, count;
221         sctp_chunkhdr_t _sch, *sch;
222         int flag;
223
224         DEBUGP(__FUNCTION__);
225         DEBUGP("\n");
226
227         flag = 0;
228
229         for_each_sctp_chunk (skb, sch, _sch, offset, count) {
230                 DEBUGP("Chunk Num: %d  Type: %d\n", count, sch->type);
231
232                 if (sch->type == SCTP_CID_INIT 
233                         || sch->type == SCTP_CID_INIT_ACK
234                         || sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
235                         flag = 1;
236                 }
237
238                 /* Cookie Ack/Echo chunks not the first OR 
239                    Init / Init Ack / Shutdown compl chunks not the only chunks */
240                 if ((sch->type == SCTP_CID_COOKIE_ACK 
241                         || sch->type == SCTP_CID_COOKIE_ECHO
242                         || flag)
243                      && count !=0 ) {
244                         DEBUGP("Basic checks failed\n");
245                         return 1;
246                 }
247
248                 if (map) {
249                         set_bit(sch->type, (void *)map);
250                 }
251         }
252
253         DEBUGP("Basic checks passed\n");
254         return 0;
255 }
256
257 static int new_state(enum ip_conntrack_dir dir,
258                      enum sctp_conntrack cur_state,
259                      int chunk_type)
260 {
261         int i;
262
263         DEBUGP(__FUNCTION__);
264         DEBUGP("\n");
265
266         DEBUGP("Chunk type: %d\n", chunk_type);
267
268         switch (chunk_type) {
269                 case SCTP_CID_INIT: 
270                         DEBUGP("SCTP_CID_INIT\n");
271                         i = 0; break;
272                 case SCTP_CID_INIT_ACK: 
273                         DEBUGP("SCTP_CID_INIT_ACK\n");
274                         i = 1; break;
275                 case SCTP_CID_ABORT: 
276                         DEBUGP("SCTP_CID_ABORT\n");
277                         i = 2; break;
278                 case SCTP_CID_SHUTDOWN: 
279                         DEBUGP("SCTP_CID_SHUTDOWN\n");
280                         i = 3; break;
281                 case SCTP_CID_SHUTDOWN_ACK: 
282                         DEBUGP("SCTP_CID_SHUTDOWN_ACK\n");
283                         i = 4; break;
284                 case SCTP_CID_ERROR: 
285                         DEBUGP("SCTP_CID_ERROR\n");
286                         i = 5; break;
287                 case SCTP_CID_COOKIE_ECHO: 
288                         DEBUGP("SCTP_CID_COOKIE_ECHO\n");
289                         i = 6; break;
290                 case SCTP_CID_COOKIE_ACK: 
291                         DEBUGP("SCTP_CID_COOKIE_ACK\n");
292                         i = 7; break;
293                 case SCTP_CID_SHUTDOWN_COMPLETE: 
294                         DEBUGP("SCTP_CID_SHUTDOWN_COMPLETE\n");
295                         i = 8; break;
296                 default:
297                         /* Other chunks like DATA, SACK, HEARTBEAT and
298                         its ACK do not cause a change in state */
299                         DEBUGP("Unknown chunk type, Will stay in %s\n", 
300                                                 sctp_conntrack_names[cur_state]);
301                         return cur_state;
302         }
303
304         DEBUGP("dir: %d   cur_state: %s  chunk_type: %d  new_state: %s\n", 
305                         dir, sctp_conntrack_names[cur_state], chunk_type,
306                         sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);
307
308         return sctp_conntracks[dir][i][cur_state];
309 }
310
311 /* Returns verdict for packet, or -1 for invalid. */
312 static int sctp_packet(struct ip_conntrack *conntrack,
313                        const struct sk_buff *skb,
314                        enum ip_conntrack_info ctinfo)
315 {
316         enum sctp_conntrack newconntrack, oldsctpstate;
317         struct iphdr *iph = skb->nh.iph;
318         sctp_sctphdr_t _sctph, *sh;
319         sctp_chunkhdr_t _sch, *sch;
320         u_int32_t offset, count;
321         char map[256 / sizeof (char)] = {0};
322
323         DEBUGP(__FUNCTION__);
324         DEBUGP("\n");
325
326         sh = skb_header_pointer(skb, iph->ihl * 4, sizeof(_sctph), &_sctph);
327         if (sh == NULL)
328                 return -1;
329
330         if (do_basic_checks(conntrack, skb, map) != 0)
331                 return -1;
332
333         /* Check the verification tag (Sec 8.5) */
334         if (!test_bit(SCTP_CID_INIT, (void *)map)
335                 && !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, (void *)map)
336                 && !test_bit(SCTP_CID_COOKIE_ECHO, (void *)map)
337                 && !test_bit(SCTP_CID_ABORT, (void *)map)
338                 && !test_bit(SCTP_CID_SHUTDOWN_ACK, (void *)map)
339                 && (sh->vtag != conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
340                 DEBUGP("Verification tag check failed\n");
341                 return -1;
342         }
343
344         oldsctpstate = newconntrack = SCTP_CONNTRACK_MAX;
345         for_each_sctp_chunk (skb, sch, _sch, offset, count) {
346                 WRITE_LOCK(&sctp_lock);
347
348                 /* Special cases of Verification tag check (Sec 8.5.1) */
349                 if (sch->type == SCTP_CID_INIT) {
350                         /* Sec 8.5.1 (A) */
351                         if (sh->vtag != 0) {
352                                 WRITE_UNLOCK(&sctp_lock);
353                                 return -1;
354                         }
355                 } else if (sch->type == SCTP_CID_ABORT) {
356                         /* Sec 8.5.1 (B) */
357                         if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
358                                 && !(sh->vtag == conntrack->proto.sctp.vtag
359                                                         [1 - CTINFO2DIR(ctinfo)])) {
360                                 WRITE_UNLOCK(&sctp_lock);
361                                 return -1;
362                         }
363                 } else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
364                         /* Sec 8.5.1 (C) */
365                         if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
366                                 && !(sh->vtag == conntrack->proto.sctp.vtag
367                                                         [1 - CTINFO2DIR(ctinfo)] 
368                                         && (sch->flags & 1))) {
369                                 WRITE_UNLOCK(&sctp_lock);
370                                 return -1;
371                         }
372                 } else if (sch->type == SCTP_CID_COOKIE_ECHO) {
373                         /* Sec 8.5.1 (D) */
374                         if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
375                                 WRITE_UNLOCK(&sctp_lock);
376                                 return -1;
377                         }
378                 }
379
380                 oldsctpstate = conntrack->proto.sctp.state;
381                 newconntrack = new_state(CTINFO2DIR(ctinfo), oldsctpstate, sch->type);
382
383                 /* Invalid */
384                 if (newconntrack == SCTP_CONNTRACK_MAX) {
385                         DEBUGP("ip_conntrack_sctp: Invalid dir=%i ctype=%u conntrack=%u\n",
386                                CTINFO2DIR(ctinfo), sch->type, oldsctpstate);
387                         WRITE_UNLOCK(&sctp_lock);
388                         return -1;
389                 }
390
391                 /* If it is an INIT or an INIT ACK note down the vtag */
392                 if (sch->type == SCTP_CID_INIT 
393                         || sch->type == SCTP_CID_INIT_ACK) {
394                         sctp_inithdr_t _inithdr, *ih;
395
396                         ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
397                                                 sizeof(_inithdr), &_inithdr);
398                         if (ih == NULL) {
399                                         WRITE_UNLOCK(&sctp_lock);
400                                         return -1;
401                         }
402                         DEBUGP("Setting vtag %x for dir %d\n", 
403                                         ih->init_tag, !CTINFO2DIR(ctinfo));
404                         conntrack->proto.sctp.vtag[!CTINFO2DIR(ctinfo)] = ih->init_tag;
405                 }
406
407                 conntrack->proto.sctp.state = newconntrack;
408                 WRITE_UNLOCK(&sctp_lock);
409         }
410
411         ip_ct_refresh_acct(conntrack, ctinfo, skb, *sctp_timeouts[newconntrack]);
412
413         if (oldsctpstate == SCTP_CONNTRACK_COOKIE_ECHOED
414                 && CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY
415                 && newconntrack == SCTP_CONNTRACK_ESTABLISHED) {
416                 DEBUGP("Setting assured bit\n");
417                 set_bit(IPS_ASSURED_BIT, &conntrack->status);
418         }
419
420         return NF_ACCEPT;
421 }
422
423 /* Called when a new connection for this protocol found. */
424 static int sctp_new(struct ip_conntrack *conntrack, 
425                     const struct sk_buff *skb)
426 {
427         enum sctp_conntrack newconntrack;
428         struct iphdr *iph = skb->nh.iph;
429         sctp_sctphdr_t _sctph, *sh;
430         sctp_chunkhdr_t _sch, *sch;
431         u_int32_t offset, count;
432         char map[256 / sizeof (char)] = {0};
433
434         DEBUGP(__FUNCTION__);
435         DEBUGP("\n");
436
437         sh = skb_header_pointer(skb, iph->ihl * 4, sizeof(_sctph), &_sctph);
438         if (sh == NULL)
439                 return 0;
440
441         if (do_basic_checks(conntrack, skb, map) != 0)
442                 return 0;
443
444         /* If an OOTB packet has any of these chunks discard (Sec 8.4) */
445         if ((test_bit (SCTP_CID_ABORT, (void *)map))
446                 || (test_bit (SCTP_CID_SHUTDOWN_COMPLETE, (void *)map))
447                 || (test_bit (SCTP_CID_COOKIE_ACK, (void *)map))) {
448                 return 0;
449         }
450
451         newconntrack = SCTP_CONNTRACK_MAX;
452         for_each_sctp_chunk (skb, sch, _sch, offset, count) {
453                 /* Don't need lock here: this conntrack not in circulation yet */
454                 newconntrack = new_state (IP_CT_DIR_ORIGINAL, 
455                                                 SCTP_CONNTRACK_NONE, sch->type);
456
457                 /* Invalid: delete conntrack */
458                 if (newconntrack == SCTP_CONNTRACK_MAX) {
459                         DEBUGP("ip_conntrack_sctp: invalid new deleting.\n");
460                         return 0;
461                 }
462
463                 /* Copy the vtag into the state info */
464                 if (sch->type == SCTP_CID_INIT) {
465                         if (sh->vtag == 0) {
466                                 sctp_inithdr_t _inithdr, *ih;
467
468                                 ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
469                                                         sizeof(_inithdr), &_inithdr);
470                                 if (ih == NULL)
471                                         return 0;
472
473                                 DEBUGP("Setting vtag %x for new conn\n", 
474                                         ih->init_tag);
475
476                                 conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] = 
477                                                                 ih->init_tag;
478                         } else {
479                                 /* Sec 8.5.1 (A) */
480                                 return 0;
481                         }
482                 }
483                 /* If it is a shutdown ack OOTB packet, we expect a return
484                    shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
485                 else {
486                         DEBUGP("Setting vtag %x for new conn OOTB\n", 
487                                 sh->vtag);
488                         conntrack->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
489                 }
490
491                 conntrack->proto.sctp.state = newconntrack;
492         }
493
494         return 1;
495 }
496
497 static struct ip_conntrack_protocol ip_conntrack_protocol_sctp = { 
498         .proto           = IPPROTO_SCTP, 
499         .name            = "sctp",
500         .pkt_to_tuple    = sctp_pkt_to_tuple, 
501         .invert_tuple    = sctp_invert_tuple, 
502         .print_tuple     = sctp_print_tuple, 
503         .print_conntrack = sctp_print_conntrack,
504         .packet          = sctp_packet, 
505         .new             = sctp_new, 
506         .destroy         = NULL, 
507         .me              = THIS_MODULE 
508 };
509
510 #ifdef CONFIG_SYSCTL
511 static ctl_table ip_ct_sysctl_table[] = {
512         {
513                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_CLOSED,
514                 .procname       = "ip_conntrack_sctp_timeout_closed",
515                 .data           = &ip_ct_sctp_timeout_closed,
516                 .maxlen         = sizeof(unsigned int),
517                 .mode           = 0644,
518                 .proc_handler   = &proc_dointvec_jiffies,
519         },
520         {
521                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_WAIT,
522                 .procname       = "ip_conntrack_sctp_timeout_cookie_wait",
523                 .data           = &ip_ct_sctp_timeout_cookie_wait,
524                 .maxlen         = sizeof(unsigned int),
525                 .mode           = 0644,
526                 .proc_handler   = &proc_dointvec_jiffies,
527         },
528         {
529                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_COOKIE_ECHOED,
530                 .procname       = "ip_conntrack_sctp_timeout_cookie_echoed",
531                 .data           = &ip_ct_sctp_timeout_cookie_echoed,
532                 .maxlen         = sizeof(unsigned int),
533                 .mode           = 0644,
534                 .proc_handler   = &proc_dointvec_jiffies,
535         },
536         {
537                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_ESTABLISHED,
538                 .procname       = "ip_conntrack_sctp_timeout_established",
539                 .data           = &ip_ct_sctp_timeout_established,
540                 .maxlen         = sizeof(unsigned int),
541                 .mode           = 0644,
542                 .proc_handler   = &proc_dointvec_jiffies,
543         },
544         {
545                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_SENT,
546                 .procname       = "ip_conntrack_sctp_timeout_shutdown_sent",
547                 .data           = &ip_ct_sctp_timeout_shutdown_sent,
548                 .maxlen         = sizeof(unsigned int),
549                 .mode           = 0644,
550                 .proc_handler   = &proc_dointvec_jiffies,
551         },
552         {
553                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_RECD,
554                 .procname       = "ip_conntrack_sctp_timeout_shutdown_recd",
555                 .data           = &ip_ct_sctp_timeout_shutdown_recd,
556                 .maxlen         = sizeof(unsigned int),
557                 .mode           = 0644,
558                 .proc_handler   = &proc_dointvec_jiffies,
559         },
560         {
561                 .ctl_name       = NET_IPV4_NF_CONNTRACK_SCTP_TIMEOUT_SHUTDOWN_ACK_SENT,
562                 .procname       = "ip_conntrack_sctp_timeout_shutdown_ack_sent",
563                 .data           = &ip_ct_sctp_timeout_shutdown_ack_sent,
564                 .maxlen         = sizeof(unsigned int),
565                 .mode           = 0644,
566                 .proc_handler   = &proc_dointvec_jiffies,
567         },
568         { .ctl_name = 0 }
569 };
570
571 static ctl_table ip_ct_netfilter_table[] = {
572         {
573                 .ctl_name       = NET_IPV4_NETFILTER,
574                 .procname       = "netfilter",
575                 .mode           = 0555,
576                 .child          = ip_ct_sysctl_table,
577         },
578         { .ctl_name = 0 }
579 };
580
581 static ctl_table ip_ct_ipv4_table[] = {
582         {
583                 .ctl_name       = NET_IPV4,
584                 .procname       = "ipv4",
585                 .mode           = 0555,
586                 .child          = ip_ct_netfilter_table,
587         },
588         { .ctl_name = 0 }
589 };
590
591 static ctl_table ip_ct_net_table[] = {
592         {
593                 .ctl_name       = CTL_NET,
594                 .procname       = "net",
595                 .mode           = 0555, 
596                 .child          = ip_ct_ipv4_table,
597         },
598         { .ctl_name = 0 }
599 };
600
601 static struct ctl_table_header *ip_ct_sysctl_header;
602 #endif
603
604 static int __init init(void)
605 {
606         int ret;
607
608         ret = ip_conntrack_protocol_register(&ip_conntrack_protocol_sctp);
609         if (ret) {
610                 printk("ip_conntrack_proto_sctp: protocol register failed\n");
611                 goto out;
612         }
613
614 #ifdef CONFIG_SYSCTL
615         ip_ct_sysctl_header = register_sysctl_table(ip_ct_net_table, 0);
616         if (ip_ct_sysctl_header == NULL) {
617                 ret = -ENOMEM;
618                 printk("ip_conntrack_proto_sctp: can't register to sysctl.\n");
619                 goto cleanup;
620         }
621 #endif
622
623         return ret;
624
625 #ifdef CONFIG_SYSCTL
626  cleanup:
627         ip_conntrack_protocol_unregister(&ip_conntrack_protocol_sctp);
628 #endif
629  out:
630         DEBUGP("SCTP conntrack module loading %s\n", 
631                                         ret ? "failed": "succeeded");
632         return ret;
633 }
634
635 static void __exit fini(void)
636 {
637         ip_conntrack_protocol_unregister(&ip_conntrack_protocol_sctp);
638 #ifdef CONFIG_SYSCTL
639         unregister_sysctl_table(ip_ct_sysctl_header);
640 #endif
641         DEBUGP("SCTP conntrack module unloaded\n");
642 }
643
644 module_init(init);
645 module_exit(fini);
646
647 MODULE_LICENSE("GPL");
648 MODULE_AUTHOR("Kiran Kumar Immidi");
649 MODULE_DESCRIPTION("Netfilter connection tracking protocol helper for SCTP");