Commit f71cb8f4 authored by Florian Westphal's avatar Florian Westphal
Browse files

netfilter: conntrack: sctp: use nf log infrastructure for invalid packets 



The conntrack logging facilities include useful info such as in/out
interface names and packet headers.

Use those in more places instead of pr_debug calls.
Furthermore, several pr_debug calls can be removed, they are useless
on production machines due to the sheer volume of log messages.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent c4791b31

net/netfilter/nf_conntrack_proto_sctp.c

+15 −31
Original line number Diff line number Diff line
@@ -168,7 +168,8 @@ for ((offset) = (dataoff) + sizeof(struct sctphdr), (count) = 0; \ 
static int do_basic_checks(struct nf_conn *ct,

			   const struct sk_buff *skb,

			   unsigned int dataoff,

			   unsigned long *map)

			   unsigned long *map,

			   const struct nf_hook_state *state)

{

	u_int32_t offset, count;

	struct sctp_chunkhdr _sch, *sch;
@@ -177,8 +178,6 @@ static int do_basic_checks(struct nf_conn *ct, 
	flag = 0;



	for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {

		pr_debug("Chunk Num: %d  Type: %d\n", count, sch->type);



		if (sch->type == SCTP_CID_INIT ||

		    sch->type == SCTP_CID_INIT_ACK ||

		    sch->type == SCTP_CID_SHUTDOWN_COMPLETE)
@@ -193,7 +192,9 @@ static int do_basic_checks(struct nf_conn *ct, 
		      sch->type == SCTP_CID_COOKIE_ECHO ||

		      flag) &&

		     count != 0) || !sch->length) {

			pr_debug("Basic checks failed\n");

			nf_ct_l4proto_log_invalid(skb, ct, state,

						  "%s failed. chunk num %d, type %d, len %d flag %d\n",

						  __func__, count, sch->type, sch->length, flag);

			return 1;

		}
@@ -201,7 +202,6 @@ static int do_basic_checks(struct nf_conn *ct, 
			set_bit(sch->type, map);

	}



	pr_debug("Basic checks passed\n");

	return count == 0;

}
@@ -211,69 +211,51 @@ static int sctp_new_state(enum ip_conntrack_dir dir, 
{

	int i;



	pr_debug("Chunk type: %d\n", chunk_type);



	switch (chunk_type) {

	case SCTP_CID_INIT:

		pr_debug("SCTP_CID_INIT\n");

		i = 0;

		break;

	case SCTP_CID_INIT_ACK:

		pr_debug("SCTP_CID_INIT_ACK\n");

		i = 1;

		break;

	case SCTP_CID_ABORT:

		pr_debug("SCTP_CID_ABORT\n");

		i = 2;

		break;

	case SCTP_CID_SHUTDOWN:

		pr_debug("SCTP_CID_SHUTDOWN\n");

		i = 3;

		break;

	case SCTP_CID_SHUTDOWN_ACK:

		pr_debug("SCTP_CID_SHUTDOWN_ACK\n");

		i = 4;

		break;

	case SCTP_CID_ERROR:

		pr_debug("SCTP_CID_ERROR\n");

		i = 5;

		break;

	case SCTP_CID_COOKIE_ECHO:

		pr_debug("SCTP_CID_COOKIE_ECHO\n");

		i = 6;

		break;

	case SCTP_CID_COOKIE_ACK:

		pr_debug("SCTP_CID_COOKIE_ACK\n");

		i = 7;

		break;

	case SCTP_CID_SHUTDOWN_COMPLETE:

		pr_debug("SCTP_CID_SHUTDOWN_COMPLETE\n");

		i = 8;

		break;

	case SCTP_CID_HEARTBEAT:

		pr_debug("SCTP_CID_HEARTBEAT");

		i = 9;

		break;

	case SCTP_CID_HEARTBEAT_ACK:

		pr_debug("SCTP_CID_HEARTBEAT_ACK");

		i = 10;

		break;

	case SCTP_CID_DATA:

	case SCTP_CID_SACK:

		pr_debug("SCTP_CID_DATA/SACK");

		i = 11;

		break;

	default:

		/* Other chunks like DATA or SACK do not change the state */

		pr_debug("Unknown chunk type, Will stay in %s\n",

			 sctp_conntrack_names[cur_state]);

		pr_debug("Unknown chunk type %d, Will stay in %s\n",

			 chunk_type, sctp_conntrack_names[cur_state]);

		return cur_state;

	}



	pr_debug("dir: %d   cur_state: %s  chunk_type: %d  new_state: %s\n",

		 dir, sctp_conntrack_names[cur_state], chunk_type,

		 sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);



	return sctp_conntracks[dir][i][cur_state];

}
@@ -392,7 +374,7 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, 
	if (sh == NULL)

		goto out;



	if (do_basic_checks(ct, skb, dataoff, map) != 0)

	if (do_basic_checks(ct, skb, dataoff, map, state) != 0)

		goto out;



	if (!nf_ct_is_confirmed(ct)) {
@@ -414,7 +396,9 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, 
		    !test_bit(SCTP_CID_HEARTBEAT, map) &&

		    !test_bit(SCTP_CID_HEARTBEAT_ACK, map) &&

		    sh->vtag != ct->proto.sctp.vtag[dir]) {

			pr_debug("Verification tag check failed\n");

			nf_ct_l4proto_log_invalid(skb, ct, state,

						  "verification tag check failed %x vs %x for dir %d",

						  sh->vtag, ct->proto.sctp.vtag[dir], dir);

			goto out;

		}

	}
@@ -488,9 +472,10 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, 


		/* Invalid */

		if (new_state == SCTP_CONNTRACK_MAX) {

			pr_debug("nf_conntrack_sctp: Invalid dir=%i ctype=%u "

				 "conntrack=%u\n",

				 dir, sch->type, old_state);

			nf_ct_l4proto_log_invalid(skb, ct, state,

						  "Invalid, old_state %d, dir %d, type %d",

						  old_state, dir, sch->type);



			goto out_unlock;

		}
@@ -536,7 +521,6 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, 
	if (old_state == SCTP_CONNTRACK_COOKIE_ECHOED &&

	    dir == IP_CT_DIR_REPLY &&

	    new_state == SCTP_CONNTRACK_ESTABLISHED) {

		pr_debug("Setting assured bit\n");

		set_bit(IPS_ASSURED_BIT, &ct->status);

		nf_conntrack_event_cache(IPCT_ASSURED, ct);

	}