Revert "netfilter: conntrack: add sctp DATA_SENT state"
This reverts commit (bff3d0534804: "netfilter: conntrack: add sctp DATA_SENT state") Using DATA/SACK to detect a new connection on secondary/alternate paths works only on new connections, while a HEARTBEAT is required on connection re-use. It is probably consistent to wait for HEARTBEAT to create a secondary connection in conntrack. Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Родитель
98ee007745
Коммит
13bd9b31a9
|
@ -16,7 +16,6 @@ enum sctp_conntrack {
|
|||
SCTP_CONNTRACK_SHUTDOWN_ACK_SENT,
|
||||
SCTP_CONNTRACK_HEARTBEAT_SENT,
|
||||
SCTP_CONNTRACK_HEARTBEAT_ACKED,
|
||||
SCTP_CONNTRACK_DATA_SENT,
|
||||
SCTP_CONNTRACK_MAX
|
||||
};
|
||||
|
||||
|
|
|
@ -95,7 +95,6 @@ enum ctattr_timeout_sctp {
|
|||
CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT,
|
||||
CTA_TIMEOUT_SCTP_HEARTBEAT_SENT,
|
||||
CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED,
|
||||
CTA_TIMEOUT_SCTP_DATA_SENT,
|
||||
__CTA_TIMEOUT_SCTP_MAX
|
||||
};
|
||||
#define CTA_TIMEOUT_SCTP_MAX (__CTA_TIMEOUT_SCTP_MAX - 1)
|
||||
|
|
|
@ -60,7 +60,6 @@ static const unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] = {
|
|||
[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = 3 SECS,
|
||||
[SCTP_CONNTRACK_HEARTBEAT_SENT] = 30 SECS,
|
||||
[SCTP_CONNTRACK_HEARTBEAT_ACKED] = 210 SECS,
|
||||
[SCTP_CONNTRACK_DATA_SENT] = 30 SECS,
|
||||
};
|
||||
|
||||
#define SCTP_FLAG_HEARTBEAT_VTAG_FAILED 1
|
||||
|
@ -75,7 +74,6 @@ static const unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] = {
|
|||
#define sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
|
||||
#define sHS SCTP_CONNTRACK_HEARTBEAT_SENT
|
||||
#define sHA SCTP_CONNTRACK_HEARTBEAT_ACKED
|
||||
#define sDS SCTP_CONNTRACK_DATA_SENT
|
||||
#define sIV SCTP_CONNTRACK_MAX
|
||||
|
||||
/*
|
||||
|
@ -98,10 +96,9 @@ SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
|
|||
CLOSED - We have seen a SHUTDOWN_COMPLETE chunk in the direction of
|
||||
the SHUTDOWN chunk. Connection is closed.
|
||||
HEARTBEAT_SENT - We have seen a HEARTBEAT in a new flow.
|
||||
HEARTBEAT_ACKED - We have seen a HEARTBEAT-ACK/DATA/SACK in the direction
|
||||
opposite to that of the HEARTBEAT/DATA chunk. Secondary connection
|
||||
is established.
|
||||
DATA_SENT - We have seen a DATA/SACK in a new flow.
|
||||
HEARTBEAT_ACKED - We have seen a HEARTBEAT-ACK in the direction opposite to
|
||||
that of the HEARTBEAT chunk. Secondary connection is
|
||||
established.
|
||||
*/
|
||||
|
||||
/* TODO
|
||||
|
@ -115,38 +112,36 @@ cookie echoed to closed.
|
|||
*/
|
||||
|
||||
/* SCTP conntrack state transitions */
|
||||
static const u8 sctp_conntracks[2][12][SCTP_CONNTRACK_MAX] = {
|
||||
static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = {
|
||||
{
|
||||
/* ORIGINAL */
|
||||
/* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA, sDS */
|
||||
/* init */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA, sCW},
|
||||
/* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA, sCL},
|
||||
/* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
|
||||
/* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL, sSS, sCL},
|
||||
/* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA, sSA, sHA, sSA},
|
||||
/* error */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA, sCL},/* Can't have Stale cookie*/
|
||||
/* cookie_echo */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA, sCL, sHA, sCL},/* 5.2.4 - Big TODO */
|
||||
/* cookie_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA, sCL},/* Can't come in orig dir */
|
||||
/* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL, sCL, sHA, sCL},
|
||||
/* heartbeat */ {sHS, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA, sDS},
|
||||
/* heartbeat_ack*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA, sDS},
|
||||
/* data/sack */ {sDS, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA, sDS}
|
||||
/* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */
|
||||
/* init */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA},
|
||||
/* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},
|
||||
/* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
|
||||
/* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL, sSS},
|
||||
/* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA, sSA, sHA},
|
||||
/* error */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},/* Can't have Stale cookie*/
|
||||
/* cookie_echo */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA, sCL, sHA},/* 5.2.4 - Big TODO */
|
||||
/* cookie_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},/* Can't come in orig dir */
|
||||
/* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL, sCL, sHA},
|
||||
/* heartbeat */ {sHS, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA},
|
||||
/* heartbeat_ack*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA}
|
||||
},
|
||||
{
|
||||
/* REPLY */
|
||||
/* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA, sDS */
|
||||
/* init */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA, sIV},/* INIT in sCL Big TODO */
|
||||
/* init_ack */ {sIV, sCW, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA, sIV},
|
||||
/* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV, sCL, sIV},
|
||||
/* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA, sIV, sSR, sIV},
|
||||
/* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA, sIV, sHA, sIV},
|
||||
/* error */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA, sIV, sHA, sIV},
|
||||
/* cookie_echo */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA, sIV},/* Can't come in reply dir */
|
||||
/* cookie_ack */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA, sIV, sHA, sIV},
|
||||
/* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL, sIV, sHA, sIV},
|
||||
/* heartbeat */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA, sHA},
|
||||
/* heartbeat_ack*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHA, sHA, sHA},
|
||||
/* data/sack */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHA, sHA, sHA},
|
||||
/* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */
|
||||
/* init */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},/* INIT in sCL Big TODO */
|
||||
/* init_ack */ {sIV, sCW, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},
|
||||
/* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV, sCL},
|
||||
/* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA, sIV, sSR},
|
||||
/* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA, sIV, sHA},
|
||||
/* error */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA, sIV, sHA},
|
||||
/* cookie_echo */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},/* Can't come in reply dir */
|
||||
/* cookie_ack */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA, sIV, sHA},
|
||||
/* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL, sIV, sHA},
|
||||
/* heartbeat */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA},
|
||||
/* heartbeat_ack*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHA, sHA}
|
||||
}
|
||||
};
|
||||
|
||||
|
@ -258,11 +253,6 @@ static int sctp_new_state(enum ip_conntrack_dir dir,
|
|||
pr_debug("SCTP_CID_HEARTBEAT_ACK");
|
||||
i = 10;
|
||||
break;
|
||||
case SCTP_CID_DATA:
|
||||
case SCTP_CID_SACK:
|
||||
pr_debug("SCTP_CID_DATA/SACK");
|
||||
i = 11;
|
||||
break;
|
||||
default:
|
||||
/* Other chunks like DATA or SACK do not change the state */
|
||||
pr_debug("Unknown chunk type, Will stay in %s\n",
|
||||
|
@ -316,9 +306,7 @@ sctp_new(struct nf_conn *ct, const struct sk_buff *skb,
|
|||
ih->init_tag);
|
||||
|
||||
ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = ih->init_tag;
|
||||
} else if (sch->type == SCTP_CID_HEARTBEAT ||
|
||||
sch->type == SCTP_CID_DATA ||
|
||||
sch->type == SCTP_CID_SACK) {
|
||||
} else if (sch->type == SCTP_CID_HEARTBEAT) {
|
||||
pr_debug("Setting vtag %x for secondary conntrack\n",
|
||||
sh->vtag);
|
||||
ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] = sh->vtag;
|
||||
|
@ -404,19 +392,19 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
|
|||
|
||||
if (!sctp_new(ct, skb, sh, dataoff))
|
||||
return -NF_ACCEPT;
|
||||
} else {
|
||||
/* Check the verification tag (Sec 8.5) */
|
||||
if (!test_bit(SCTP_CID_INIT, map) &&
|
||||
!test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) &&
|
||||
!test_bit(SCTP_CID_COOKIE_ECHO, map) &&
|
||||
!test_bit(SCTP_CID_ABORT, map) &&
|
||||
!test_bit(SCTP_CID_SHUTDOWN_ACK, map) &&
|
||||
!test_bit(SCTP_CID_HEARTBEAT, map) &&
|
||||
!test_bit(SCTP_CID_HEARTBEAT_ACK, map) &&
|
||||
sh->vtag != ct->proto.sctp.vtag[dir]) {
|
||||
pr_debug("Verification tag check failed\n");
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
|
||||
/* Check the verification tag (Sec 8.5) */
|
||||
if (!test_bit(SCTP_CID_INIT, map) &&
|
||||
!test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) &&
|
||||
!test_bit(SCTP_CID_COOKIE_ECHO, map) &&
|
||||
!test_bit(SCTP_CID_ABORT, map) &&
|
||||
!test_bit(SCTP_CID_SHUTDOWN_ACK, map) &&
|
||||
!test_bit(SCTP_CID_HEARTBEAT, map) &&
|
||||
!test_bit(SCTP_CID_HEARTBEAT_ACK, map) &&
|
||||
sh->vtag != ct->proto.sctp.vtag[dir]) {
|
||||
pr_debug("Verification tag check failed\n");
|
||||
goto out;
|
||||
}
|
||||
|
||||
old_state = new_state = SCTP_CONNTRACK_NONE;
|
||||
|
@ -483,11 +471,6 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
|
|||
} else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) {
|
||||
ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
|
||||
}
|
||||
} else if (sch->type == SCTP_CID_DATA || sch->type == SCTP_CID_SACK) {
|
||||
if (ct->proto.sctp.vtag[dir] == 0) {
|
||||
pr_debug("Setting vtag %x for dir %d\n", sh->vtag, dir);
|
||||
ct->proto.sctp.vtag[dir] = sh->vtag;
|
||||
}
|
||||
}
|
||||
|
||||
old_state = ct->proto.sctp.state;
|
||||
|
@ -708,7 +691,6 @@ sctp_timeout_nla_policy[CTA_TIMEOUT_SCTP_MAX+1] = {
|
|||
[CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT] = { .type = NLA_U32 },
|
||||
[CTA_TIMEOUT_SCTP_HEARTBEAT_SENT] = { .type = NLA_U32 },
|
||||
[CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED] = { .type = NLA_U32 },
|
||||
[CTA_TIMEOUT_SCTP_DATA_SENT] = { .type = NLA_U32 },
|
||||
};
|
||||
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
|
||||
|
||||
|
|
|
@ -602,7 +602,6 @@ enum nf_ct_sysctl_index {
|
|||
NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT,
|
||||
NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_SENT,
|
||||
NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_ACKED,
|
||||
NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_DATA_SENT,
|
||||
#endif
|
||||
#ifdef CONFIG_NF_CT_PROTO_DCCP
|
||||
NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_REQUEST,
|
||||
|
@ -893,12 +892,6 @@ static struct ctl_table nf_ct_sysctl_table[] = {
|
|||
.mode = 0644,
|
||||
.proc_handler = proc_dointvec_jiffies,
|
||||
},
|
||||
[NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_DATA_SENT] = {
|
||||
.procname = "nf_conntrack_sctp_timeout_data_sent",
|
||||
.maxlen = sizeof(unsigned int),
|
||||
.mode = 0644,
|
||||
.proc_handler = proc_dointvec_jiffies,
|
||||
},
|
||||
#endif
|
||||
#ifdef CONFIG_NF_CT_PROTO_DCCP
|
||||
[NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_REQUEST] = {
|
||||
|
@ -1043,7 +1036,6 @@ static void nf_conntrack_standalone_init_sctp_sysctl(struct net *net,
|
|||
XASSIGN(SHUTDOWN_ACK_SENT, sn);
|
||||
XASSIGN(HEARTBEAT_SENT, sn);
|
||||
XASSIGN(HEARTBEAT_ACKED, sn);
|
||||
XASSIGN(DATA_SENT, sn);
|
||||
#undef XASSIGN
|
||||
#endif
|
||||
}
|
||||
|
|
Загрузка…
Ссылка в новой задаче