Merge "netfilter: Changes to handle segmentation in SIP ALG" (e71fa8be) · Commits · e / devices / android_kernel_fairphone_FP5

include/linux/netfilter/nf_conntrack_sip.h

+7 −0

Original line number	Diff line number	Diff line
		@@ -166,6 +166,13 @@ struct nf_nat_sip_hooks {
		};
		extern const struct nf_nat_sip_hooks *nf_nat_sip_hooks;

		#ifdef CONFIG_NF_CONNTRACK_SIP_SEGMENTATION
		extern void (*nf_nat_sip_seq_adjust_hook)
		(struct sk_buff *skb,
		unsigned int protoff,
		s16 off);
		#endif

		int ct_sip_parse_request(const struct nf_conn ct, const char dptr,
		unsigned int datalen, unsigned int *matchoff,
		unsigned int matchlen, union nf_inet_addr addr,

include/net/netfilter/nf_conntrack.h

+22 −0

Original line number	Diff line number	Diff line
		@@ -17,6 +17,9 @@
		#include <linux/compiler.h>
		#include <linux/android_kabi.h>
		#include <linux/android_vendor.h>
		#ifdef CONFIG_NF_CONNTRACK_SIP_SEGMENTATION
		#include <linux/list.h>
		#endif

		#include <linux/netfilter/nf_conntrack_common.h>
		#include <linux/netfilter/nf_conntrack_tcp.h>
		@@ -26,10 +29,22 @@

		#include <net/netfilter/nf_conntrack_tuple.h>

		#ifdef CONFIG_NF_CONNTRACK_SIP_SEGMENTATION
		#define SIP_LIST_ELEMENTS 2
		#endif

		struct nf_ct_udp {
		unsigned long stream_ts;
		};

		#ifdef CONFIG_NF_CONNTRACK_SIP_SEGMENTATION
		struct sip_length {
		int msg_length[SIP_LIST_ELEMENTS];
		int skb_len[SIP_LIST_ELEMENTS];
		int data_len[SIP_LIST_ELEMENTS];
		};
		#endif

		/* per conntrack: protocol private data */
		union nf_conntrack_proto {
		/* insert conntrack proto private data here */
		@@ -117,6 +132,13 @@ struct nf_conn {
		#ifdef CONFIG_ENABLE_SFE
		void *sfe_entry;
		#endif
		#ifdef CONFIG_NF_CONNTRACK_SIP_SEGMENTATION
		struct list_head sip_segment_list;
		const char *dptr_prev;
		struct sip_length segment;
		bool sip_original_dir;
		bool sip_reply_dir;
		#endif

		/* Storage reserved for other modules, must be the last member */
		union nf_conntrack_proto proto;

include/net/netfilter/nf_conntrack_core.h

+9 −0

Original line number	Diff line number	Diff line
		@@ -22,6 +22,8 @@
		standalone connection tracking module, and the compatibility layer's use
		of connection tracking. */

		extern unsigned int nf_conntrack_hash_rnd;

		unsigned int nf_conntrack_in(struct sk_buff *skb,
		const struct nf_hook_state *state);

		@@ -90,4 +92,11 @@ void nf_conntrack_lock(spinlock_t *lock);

		extern spinlock_t nf_conntrack_expect_lock;

		#ifdef CONFIG_NF_CONNTRACK_SIP_SEGMENTATION
		struct sip_list {
		struct nf_queue_entry *entry;
		struct list_head list;
		};
		#endif

		#endif /* _NF_CONNTRACK_CORE_H */

net/netfilter/Kconfig

+12 −0

Original line number	Diff line number	Diff line
		@@ -342,6 +342,18 @@ config NF_CONNTRACK_SIP

		To compile it as a module, choose M here. If unsure, say N.

		config NF_CONNTRACK_SIP_SEGMENTATION
		tristate "SIP protocol segmentation support"
		depends on NF_CONNTRACK_SIP
		default m if NETFILTER_ADVANCED=n
		help
		Linux Kernel SIP ALG did not handle Segmented TCP Packets
		because of which SIP communication could not be established
		for some clients. This special type supports SIP segmentation
		packets

		To compile it as a module, choose M here. If unsure, say N.

		config NF_CONNTRACK_TFTP
		tristate "TFTP protocol support"
		depends on NETFILTER_ADVANCED

net/netfilter/nf_conntrack_core.c

+20 −1

Original line number	Diff line number	Diff line
		@@ -192,7 +192,8 @@ unsigned int nf_conntrack_pkt_threshold __read_mostly;
		EXPORT_SYMBOL(nf_conntrack_pkt_threshold);
		#endif

		static unsigned int nf_conntrack_hash_rnd __read_mostly;
		unsigned int nf_conntrack_hash_rnd __read_mostly;
		EXPORT_SYMBOL(nf_conntrack_hash_rnd);

		static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple,
		const struct net *net)
		@@ -617,6 +618,11 @@ destroy_conntrack(struct nf_conntrack *nfct)
		#ifdef CONFIG_ENABLE_SFE
		void (delete_entry)(struct nf_conn ct);
		#endif
		#ifdef CONFIG_NF_CONNTRACK_SIP_SEGMENTATION
		struct sip_list *sip_node = NULL;
		struct list_head *sip_node_list;
		struct list_head *sip_node_save_list;
		#endif

		pr_debug("destroy_conntrack(%p)\n", ct);
		WARN_ON(atomic_read(&nfct->use) != 0);
		@@ -638,6 +644,16 @@ destroy_conntrack(struct nf_conntrack *nfct)
		#endif

		local_bh_disable();

		#ifdef CONFIG_NF_CONNTRACK_SIP_SEGMENTATION
		pr_debug("freeing item in the SIP list\n");
		list_for_each_safe(sip_node_list, sip_node_save_list,
		&ct->sip_segment_list) {
		sip_node = list_entry(sip_node_list, struct sip_list, list);
		list_del(&sip_node->list);
		kfree(sip_node);
		}
		#endif
		/* Expectations will have been removed in clean_from_lists,
		* except TFTP can create an expectation on the first packet,
		* before connection is in the list, so we need to clean here,
		@@ -1510,6 +1526,9 @@ init_conntrack(struct net net, struct nf_conn tmpl,
		GFP_ATOMIC);

		local_bh_disable();
		#ifdef CONFIG_NF_CONNTRACK_SIP_SEGMENTATION
		INIT_LIST_HEAD(&ct->sip_segment_list);
		#endif
		if (net->ct.expect_count) {
		spin_lock(&nf_conntrack_expect_lock);
		exp = nf_ct_find_expectation(net, zone, tuple);