Commit 41d73ec0 authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_conntrack: make sequence number adjustments usuable without NAT 



Split out sequence number adjustments from NAT and move them to the conntrack
core to make them usable for SYN proxying. The sequence number adjustment
information is moved to a seperate extend. The extend is added to new
conntracks when a NAT mapping is set up for a connection using a helper.

As a side effect, this saves 24 bytes per connection with NAT in the common
case that a connection does not have a helper assigned.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Tested-by: default avatarMartin Topholm <mph@one.com>
Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 706f5151

include/linux/netfilter.h

+3 −6
Original line number Diff line number Diff line
@@ -319,6 +319,7 @@ extern void nf_ct_attach(struct sk_buff *, const struct sk_buff *); 
extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu;



struct nf_conn;

enum ip_conntrack_info;

struct nlattr;



struct nfq_ct_hook {
@@ -327,14 +328,10 @@ struct nfq_ct_hook { 
	int (*parse)(const struct nlattr *attr, struct nf_conn *ct);

	int (*attach_expect)(const struct nlattr *attr, struct nf_conn *ct,

			     u32 portid, u32 report);

};

extern struct nfq_ct_hook __rcu *nfq_ct_hook;



struct nfq_ct_nat_hook {

	void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,

			   u32 ctinfo, s32 off);

			   enum ip_conntrack_info ctinfo, s32 off);

};

extern struct nfq_ct_nat_hook __rcu *nfq_ct_nat_hook;

extern struct nfq_ct_hook __rcu *nfq_ct_hook;

#else

static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}

#endif

include/net/netfilter/nf_conntrack_extend.h

+2 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ enum nf_ct_ext_id { 
	NF_CT_EXT_HELPER,

#if defined(CONFIG_NF_NAT) || defined(CONFIG_NF_NAT_MODULE)

	NF_CT_EXT_NAT,

	NF_CT_EXT_SEQADJ,

#endif

	NF_CT_EXT_ACCT,

#ifdef CONFIG_NF_CONNTRACK_EVENTS
@@ -31,6 +32,7 @@ enum nf_ct_ext_id { 


#define NF_CT_EXT_HELPER_TYPE struct nf_conn_help

#define NF_CT_EXT_NAT_TYPE struct nf_conn_nat

#define NF_CT_EXT_SEQADJ_TYPE struct nf_conn_seqadj

#define NF_CT_EXT_ACCT_TYPE struct nf_conn_counter

#define NF_CT_EXT_ECACHE_TYPE struct nf_conntrack_ecache

#define NF_CT_EXT_ZONE_TYPE struct nf_conntrack_zone

include/net/netfilter/nf_conntrack_seqadj.h

0 → 100644
+49 −0
Original line number Diff line number Diff line 
#ifndef _NF_CONNTRACK_SEQADJ_H

#define _NF_CONNTRACK_SEQADJ_H



#include <net/netfilter/nf_conntrack_extend.h>



/**

 * struct nf_ct_seqadj - sequence number adjustment information

 *

 * @correction_pos: position of the last TCP sequence number modification

 * @offset_before: sequence number offset before last modification

 * @offset_after: sequence number offset after last modification

 */

struct nf_ct_seqadj {

	u32		correction_pos;

	s32		offset_before;

	s32		offset_after;

};



struct nf_conn_seqadj {

	struct nf_ct_seqadj	seq[IP_CT_DIR_MAX];

};



static inline struct nf_conn_seqadj *nfct_seqadj(const struct nf_conn *ct)

{

	return nf_ct_ext_find(ct, NF_CT_EXT_SEQADJ);

}



static inline struct nf_conn_seqadj *nfct_seqadj_ext_add(struct nf_conn *ct)

{

	return nf_ct_ext_add(ct, NF_CT_EXT_SEQADJ, GFP_ATOMIC);

}



extern int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,

			    __be32 seq, s32 off);

extern void nf_ct_tcp_seqadj_set(struct sk_buff *skb,

				 struct nf_conn *ct,

				 enum ip_conntrack_info ctinfo,

				 s32 off);



extern int nf_ct_seq_adjust(struct sk_buff *skb,

			    struct nf_conn *ct, enum ip_conntrack_info ctinfo,

			    unsigned int protoff);

extern s32 nf_ct_seq_offset(const struct nf_conn *ct, enum ip_conntrack_dir,

			    u32 seq);



extern int nf_conntrack_seqadj_init(void);

extern void nf_conntrack_seqadj_fini(void);



#endif /* _NF_CONNTRACK_SEQADJ_H */

include/net/netfilter/nf_nat.h

+0 −10
Original line number Diff line number Diff line
@@ -13,15 +13,6 @@ enum nf_nat_manip_type { 
#define HOOK2MANIP(hooknum) ((hooknum) != NF_INET_POST_ROUTING && \

			     (hooknum) != NF_INET_LOCAL_IN)



/* NAT sequence number modifications */

struct nf_nat_seq {

	/* position of the last TCP sequence number modification (if any) */

	u_int32_t correction_pos;



	/* sequence number offset before and after last modification */

	int32_t offset_before, offset_after;

};



#include <linux/list.h>

#include <linux/netfilter/nf_conntrack_pptp.h>

#include <net/netfilter/nf_conntrack_extend.h>
@@ -39,7 +30,6 @@ struct nf_conn; 
/* The structure embedded in the conntrack structure. */

struct nf_conn_nat {

	struct hlist_node bysource;

	struct nf_nat_seq seq[IP_CT_DIR_MAX];

	struct nf_conn *ct;

	union nf_conntrack_nat_help help;

#if defined(CONFIG_IP_NF_TARGET_MASQUERADE) || \

include/net/netfilter/nf_nat_helper.h

+0 −19
Original line number Diff line number Diff line
@@ -39,28 +39,9 @@ extern int nf_nat_mangle_udp_packet(struct sk_buff *skb, 
				    const char *rep_buffer,

				    unsigned int rep_len);



extern void nf_nat_set_seq_adjust(struct nf_conn *ct,

				  enum ip_conntrack_info ctinfo,

				  __be32 seq, s32 off);

extern int nf_nat_seq_adjust(struct sk_buff *skb,

			     struct nf_conn *ct,

			     enum ip_conntrack_info ctinfo,

			     unsigned int protoff);

extern int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,

				     struct nf_conn *ct,

				     enum ip_conntrack_info ctinfo,

				     unsigned int protoff);



/* Setup NAT on this expected conntrack so it follows master, but goes

 * to port ct->master->saved_proto. */

extern void nf_nat_follow_master(struct nf_conn *ct,

				 struct nf_conntrack_expect *this);



extern s32 nf_nat_get_offset(const struct nf_conn *ct,

			     enum ip_conntrack_dir dir,

			     u32 seq);



extern void nf_nat_tcp_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,

				  u32 dir, s32 off);



#endif

CRA Git | Maintained and supported by SUSTech CRA and CCSE