/* This file contains all the functions required for the standalone   ip_conntrack module.   These are not required by the compatibility layer.*//* (C) 1999-2001 Paul `Rusty' Russell * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. */#include <linux/config.h>#include <linux/types.h>#include <linux/ip.h>#include <linux/netfilter.h>#include <linux/netfilter_ipv4.h>#include <linux/module.h>#include <linux/skbuff.h>#include <linux/proc_fs.h>#ifdef CONFIG_SYSCTL#include <linux/sysctl.h>#endif#include <net/checksum.h>#include <net/ip.h>#define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_conntrack_lock)#define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_conntrack_lock)#include <linux/netfilter_ipv4/ip_conntrack.h>#include <linux/netfilter_ipv4/ip_conntrack_protocol.h>#include <linux/netfilter_ipv4/ip_conntrack_core.h>#include <linux/netfilter_ipv4/ip_conntrack_helper.h>#include <linux/netfilter_ipv4/listhelp.h>#if 0#define DEBUGP printk#else#define DEBUGP(format, args...)#endifMODULE_LICENSE("GPL");static int kill_proto(const struct ip_conntrack *i, void *data){	return (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum == 			*((u_int8_t *) data));}static unsigned intprint_tuple(char *buffer, const struct ip_conntrack_tuple *tuple,	    struct ip_conntrack_protocol *proto){	int len;	len = sprintf(buffer, "src=%u.%u.%u.%u dst=%u.%u.%u.%u ",		      NIPQUAD(tuple->src.ip), NIPQUAD(tuple->dst.ip));	len += proto->print_tuple(buffer + len, tuple);	return len;}/* FIXME: Don't print source proto part. --RR */static unsigned intprint_expect(char *buffer, const struct ip_conntrack_expect *expect){	unsigned int len;	if (expect->expectant->helper->timeout)		len = sprintf(buffer, "EXPECTING: %lu ",			      timer_pending(&expect->timeout)			      ? (expect->timeout.expires - jiffies)/HZ : 0);	else		len = sprintf(buffer, "EXPECTING: - ");	len += sprintf(buffer + len, "use=%u proto=%u ",		      atomic_read(&expect->use), expect->tuple.dst.protonum);	len += print_tuple(buffer + len, &expect->tuple,			   __ip_ct_find_proto(expect->tuple.dst.protonum));	len += sprintf(buffer + len, "\n");	return len;}static unsigned intprint_conntrack(char *buffer, struct ip_conntrack *conntrack){	unsigned int len;	struct ip_conntrack_protocol *proto		= __ip_ct_find_proto(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]			       .tuple.dst.protonum);	len = sprintf(buffer, "%-8s %u %lu ",		      proto->name,		      conntrack->tuplehash[IP_CT_DIR_ORIGINAL]		      .tuple.dst.protonum,		      timer_pending(&conntrack->timeout)		      ? (conntrack->timeout.expires - jiffies)/HZ : 0);	len += proto->print_conntrack(buffer + len, conntrack);	len += print_tuple(buffer + len,			   &conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,			   proto);	if (!(test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)))		len += sprintf(buffer + len, "[UNREPLIED] ");	len += print_tuple(buffer + len,			   &conntrack->tuplehash[IP_CT_DIR_REPLY].tuple,			   proto);	if (test_bit(IPS_ASSURED_BIT, &conntrack->status))		len += sprintf(buffer + len, "[ASSURED] ");	len += sprintf(buffer + len, "use=%u ",		       atomic_read(&conntrack->ct_general.use));	len += sprintf(buffer + len, "\n");	return len;}/* Returns true when finished. */static inline intconntrack_iterate(const struct ip_conntrack_tuple_hash *hash,		  char *buffer, off_t offset, off_t *upto,		  unsigned int *len, unsigned int maxlen){	unsigned int newlen;	IP_NF_ASSERT(hash->ctrack);	MUST_BE_READ_LOCKED(&ip_conntrack_lock);	/* Only count originals */	if (DIRECTION(hash))		return 0;	if ((*upto)++ < offset)		return 0;	newlen = print_conntrack(buffer + *len, hash->ctrack);	if (*len + newlen > maxlen)		return 1;	else *len += newlen;	return 0;}static intlist_conntracks(char *buffer, char **start, off_t offset, int length){	unsigned int i;	unsigned int len = 0;	off_t upto = 0;	struct list_head *e;	READ_LOCK(&ip_conntrack_lock);	/* Traverse hash; print originals then reply. */	for (i = 0; i < ip_conntrack_htable_size; i++) {		if (LIST_FIND(&ip_conntrack_hash[i], conntrack_iterate,			      struct ip_conntrack_tuple_hash *,			      buffer, offset, &upto, &len, length))			goto finished;	}	/* Now iterate through expecteds. */	READ_LOCK(&ip_conntrack_expect_tuple_lock);	list_for_each(e, &ip_conntrack_expect_list) {		unsigned int last_len;		struct ip_conntrack_expect *expect			= (struct ip_conntrack_expect *)e;		if (upto++ < offset) continue;		last_len = len;		len += print_expect(buffer + len, expect);		if (len > length) {			len = last_len;			goto finished_expects;		}	} finished_expects:	READ_UNLOCK(&ip_conntrack_expect_tuple_lock); finished:	READ_UNLOCK(&ip_conntrack_lock);	/* `start' hack - see fs/proc/generic.c line ~165 */	*start = (char *)((unsigned int)upto - offset);	return len;}static unsigned int ip_confirm(unsigned int hooknum,			       struct sk_buff **pskb,			       const struct net_device *in,			       const struct net_device *out,			       int (*okfn)(struct sk_buff *)){	/* We've seen it coming out the other side: confirm it */	return ip_conntrack_confirm(*pskb);}static unsigned int ip_conntrack_defrag(unsigned int hooknum,				        struct sk_buff **pskb,				        const struct net_device *in,				        const struct net_device *out,				        int (*okfn)(struct sk_buff *)){	/* Previously seen (loopback)?  Ignore.  Do this before           fragment check. */	if ((*pskb)->nfct)		return NF_ACCEPT;	/* Gather fragments. */	if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {		*pskb = ip_ct_gather_frags(*pskb);		if (!*pskb)			return NF_STOLEN;	}	return NF_ACCEPT;}static unsigned int ip_refrag(unsigned int hooknum,			      struct sk_buff **pskb,			      const struct net_device *in,			      const struct net_device *out,			      int (*okfn)(struct sk_buff *)){	struct rtable *rt = (struct rtable *)(*pskb)->dst;	/* We've seen it coming out the other side: confirm */	if (ip_confirm(hooknum, pskb, in, out, okfn) != NF_ACCEPT)		return NF_DROP;	/* Local packets are never produced too large for their	   interface.  We degfragment them at LOCAL_OUT, however,	   so we have to refragment them here. */	if ((*pskb)->len > dst_pmtu(&rt->u.dst) &&	    !skb_shinfo(*pskb)->tso_size) {		/* No hook can be after us, so this should be OK. */		ip_fragment(*pskb, okfn);		return NF_STOLEN;	}	return NF_ACCEPT;}static unsigned int ip_conntrack_local(unsigned int hooknum,				       struct sk_buff **pskb,				       const struct net_device *in,				       const struct net_device *out,				       int (*okfn)(struct sk_buff *)){	/* root is playing with raw sockets. */	if ((*pskb)->len < sizeof(struct iphdr)	    || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr)) {		if (net_ratelimit())			printk("ipt_hook: happy cracking.\n");		return NF_ACCEPT;	}	return ip_conntrack_in(hooknum, pskb, in, out, okfn);}/* Connection tracking may drop packets, but never alters them, so   make it the first hook. */static struct nf_hook_ops ip_conntrack_defrag_ops = {	.hook		= ip_conntrack_defrag,	.owner		= THIS_MODULE,	.pf		= PF_INET,	.hooknum	= NF_IP_PRE_ROUTING,	.priority	= NF_IP_PRI_CONNTRACK_DEFRAG,};static struct nf_hook_ops ip_conntrack_in_ops = {	.hook		= ip_conntrack_in,	.owner		= THIS_MODULE,	.pf		= PF_INET,	.hooknum	= NF_IP_PRE_ROUTING,	.priority	= NF_IP_PRI_CONNTRACK,};static struct nf_hook_ops ip_conntrack_defrag_local_out_ops = {	.hook		= ip_conntrack_defrag,	.owner		= THIS_MODULE,	.pf		= PF_INET,	.hooknum	= NF_IP_LOCAL_OUT,	.priority	= NF_IP_PRI_CONNTRACK_DEFRAG,};static struct nf_hook_ops ip_conntrack_local_out_ops = {	.hook		= ip_conntrack_local,	.owner		= THIS_MODULE,	.pf		= PF_INET,	.hooknum	= NF_IP_LOCAL_OUT,	.priority	= NF_IP_PRI_CONNTRACK,};/* Refragmenter; last chance. */static struct nf_hook_ops ip_conntrack_out_ops = {	.hook		= ip_refrag,	.owner		= THIS_MODULE,	.pf		= PF_INET,	.hooknum	= NF_IP_POST_ROUTING,	.priority	= NF_IP_PRI_LAST,};static struct nf_hook_ops ip_conntrack_local_in_ops = {	.hook		= ip_confirm,	.owner		= THIS_MODULE,	.pf		= PF_INET,	.hooknum	= NF_IP_LOCAL_IN,	.priority	= NF_IP_PRI_LAST-1,};/* Sysctl support */#ifdef CONFIG_SYSCTL/* From ip_conntrack_core.c */extern int ip_conntrack_max;extern unsigned int ip_conntrack_htable_size;/* From ip_conntrack_proto_tcp.c */extern unsigned long ip_ct_tcp_timeout_syn_sent;extern unsigned long ip_ct_tcp_timeout_syn_recv;extern unsigned long ip_ct_tcp_timeout_established;extern unsigned long ip_ct_tcp_timeout_fin_wait;extern unsigned long ip_ct_tcp_timeout_close_wait;extern unsigned long ip_ct_tcp_timeout_last_ack;extern unsigned long ip_ct_tcp_timeout_time_wait;extern unsigned long ip_ct_tcp_timeout_close;/* From ip_conntrack_proto_udp.c */extern unsigned long ip_ct_udp_timeout;extern unsigned long ip_ct_udp_timeout_stream;