Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6fe78fa4 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: remove error callback and handle icmp from core 



icmp(v6) are the only two layer four protocols that need the error()
callback (to handle icmp errors that are related to an established
connections, e.g. packet too big, port unreachable and the like).

Remove the error callback and handle these two special cases from the core.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0150ffba

include/net/netfilter/nf_conntrack_l4proto.h

+9 −4
Original line number Diff line number Diff line
@@ -51,10 +51,6 @@ struct nf_conntrack_l4proto { 
	/* Called when a conntrack entry is destroyed */

	void (*destroy)(struct nf_conn *ct);



	int (*error)(struct nf_conn *tmpl, struct sk_buff *skb,

		     unsigned int dataoff,

		     const struct nf_hook_state *state);



	/* called by gc worker if table is full */

	bool (*can_early_drop)(const struct nf_conn *ct);
@@ -97,6 +93,15 @@ struct nf_conntrack_l4proto { 
	struct module *me;

};



int nf_conntrack_icmpv4_error(struct nf_conn *tmpl,

			      struct sk_buff *skb,

			      unsigned int dataoff,

			      const struct nf_hook_state *state);



int nf_conntrack_icmpv6_error(struct nf_conn *tmpl,

			      struct sk_buff *skb,

			      unsigned int dataoff,

			      const struct nf_hook_state *state);

/* Existing built-in generic protocol */

extern const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic;

net/netfilter/nf_conntrack_core.c

+36 −7
Original line number Diff line number Diff line
@@ -1486,6 +1486,39 @@ resolve_normal_ct(struct nf_conn *tmpl, 
	return 0;

}



/*

 * icmp packets need special treatment to handle error messages that are

 * related to a connection.

 *

 * Callers need to check if skb has a conntrack assigned when this

 * helper returns; in such case skb belongs to an already known connection.

 */

static unsigned int __cold

nf_conntrack_handle_icmp(struct nf_conn *tmpl,

			 struct sk_buff *skb,

			 unsigned int dataoff,

			 u8 protonum,

			 const struct nf_hook_state *state)

{

	int ret;



	if (state->pf == NFPROTO_IPV4 && protonum == IPPROTO_ICMP)

		ret = nf_conntrack_icmpv4_error(tmpl, skb, dataoff, state);

#if IS_ENABLED(CONFIG_IPV6)

	else if (state->pf == NFPROTO_IPV6 && protonum == IPPROTO_ICMPV6)

		ret = nf_conntrack_icmpv6_error(tmpl, skb, dataoff, state);

#endif

	else

		return NF_ACCEPT;



	if (ret <= 0) {

		NF_CT_STAT_INC_ATOMIC(state->net, error);

		NF_CT_STAT_INC_ATOMIC(state->net, invalid);

	}



	return ret;

}



unsigned int

nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state)

{
@@ -1518,14 +1551,10 @@ nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state) 


	l4proto = __nf_ct_l4proto_find(state->pf, protonum);



	/* It may be an special packet, error, unclean...

	 * inverse of the return code tells to the netfilter

	 * core what to do with the packet. */

	if (l4proto->error != NULL) {

		ret = l4proto->error(tmpl, skb, dataoff, state);

	if (protonum == IPPROTO_ICMP || protonum == IPPROTO_ICMPV6) {

		ret = nf_conntrack_handle_icmp(tmpl, skb, dataoff,

					       protonum, state);

		if (ret <= 0) {

			NF_CT_STAT_INC_ATOMIC(state->net, error);

			NF_CT_STAT_INC_ATOMIC(state->net, invalid);

			ret = -ret;

			goto out;

		}

net/netfilter/nf_conntrack_proto_icmp.c

+3 −5
Original line number Diff line number Diff line
@@ -165,8 +165,7 @@ static void icmp_error_log(const struct sk_buff *skb, 
}



/* Small and modified version of icmp_rcv */

static int

icmp_error(struct nf_conn *tmpl,

int nf_conntrack_icmpv4_error(struct nf_conn *tmpl,

			      struct sk_buff *skb, unsigned int dataoff,

			      const struct nf_hook_state *state)

{
@@ -355,7 +354,6 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp = 
	.pkt_to_tuple		= icmp_pkt_to_tuple,

	.invert_tuple		= icmp_invert_tuple,

	.packet			= icmp_packet,

	.error			= icmp_error,

	.destroy		= NULL,

	.me			= NULL,

#if IS_ENABLED(CONFIG_NF_CT_NETLINK)

net/netfilter/nf_conntrack_proto_icmpv6.c

+4 −6
Original line number Diff line number Diff line
@@ -184,8 +184,7 @@ static void icmpv6_error_log(const struct sk_buff *skb, 
			       IPPROTO_ICMPV6, "%s", msg);

}



static int

icmpv6_error(struct nf_conn *tmpl,

int nf_conntrack_icmpv6_error(struct nf_conn *tmpl,

			      struct sk_buff *skb,

			      unsigned int dataoff,

			      const struct nf_hook_state *state)
@@ -366,7 +365,6 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 = 
	.pkt_to_tuple		= icmpv6_pkt_to_tuple,

	.invert_tuple		= icmpv6_invert_tuple,

	.packet			= icmpv6_packet,

	.error			= icmpv6_error,

#if IS_ENABLED(CONFIG_NF_CT_NETLINK)

	.tuple_to_nlattr	= icmpv6_tuple_to_nlattr,

	.nlattr_tuple_size	= icmpv6_nlattr_tuple_size,