From: Antonin Steinhauser <as@strmilov•cz>
To: Randy Dunlap <rdunlap@xenotime•net>
Cc: davem@davemloft•net, kuznet@ms2•inr.ac.ru, jmorris@namei•org,
yoshfuji@linux-ipv6•org, kaber@trash•net, netdev@vger•kernel.org,
linux-kernel@vger•kernel.org
Subject: Re: TCP port firewall controlled by UDP packets
Date: Fri, 12 Aug 2011 17:35:07 +0200 [thread overview]
Message-ID: <4E45482B.7080207@strmilov.cz> (raw)
In-Reply-To: <20110811171317.271be88b.rdunlap@xenotime.net>
Dne 12.8.2011 02:13, Randy Dunlap napsal(a):
> On Fri, 12 Aug 2011 01:56:09 +0200 Tonda wrote:
>
> Need more patch description& justification here, as well as
> Signed-off-by:<your name& email address>
>
>
>
>> diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
>> --- a/net/ipv4/Kconfig
>> +++ b/net/ipv4/Kconfig
>> @@ -624,3 +624,7 @@
>> on the Internet.
>>
>> If unsure, say N.
>> +
>> +config TCPFIREWALL
>> + tristate "TCP Firewall controlled by UDP queries"
>> + depends on m
>>
> Why buildable only as a loadable module?
>
>
Because it needs parameter - address of inet_protos table from
/boot/System_map
>
>> diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
>> --- a/net/ipv4/Makefile
>> +++ b/net/ipv4/Makefile
>> @@ -51,3 +51,4 @@
>>
>> obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o \
>> xfrm4_output.o
>> +obj-$(CONFIG_TCPFIREWALL) += tcpfirewall/
>> diff --git a/net/ipv4/tcpfirewall/Makefile b/net/ipv4/tcpfirewall/Makefile
>> --- a/net/ipv4/tcpfirewall/Makefile
>> +++ b/net/ipv4/tcpfirewall/Makefile
>> @@ -0,0 +1 @@
>> +obj-$(CONFIG_TCPFIREWALL) += tcpfirewall.o
>> diff --git a/net/ipv4/tcpfirewall/tcpfirewall.c b/net/ipv4/tcpfirewall/tcpfirewall.c
>> --- a/net/ipv4/tcpfirewall/tcpfirewall.c
>> +++ b/net/ipv4/tcpfirewall/tcpfirewall.c
>> @@ -0,0 +1,451 @@
>> +#include<linux/module.h>
>> +#include<linux/kernel.h>
>> +#include<linux/init.h>
>> +#include<linux/skbuff.h>
>> +#include<linux/in.h>
>> +#include<linux/if_packet.h>
>> +#include<linux/tcp.h>
>> +#include<linux/udp.h>
>> +#include<net/tcp.h>
>> +#include<net/udp.h>
>> +
>> +struct net_protocol {
>> + int (*handler)(struct sk_buff *skb);
>> + void (*err_handler)(struct sk_buff *skb, u32 info);
>> + int (*gso_send_check)(struct sk_buff *skb);
>> + struct sk_buff *(*gso_segment)(struct sk_buff *skb,
>> + u32 features);
>> + struct sk_buff **(*gro_receive)(struct sk_buff **head,
>> + struct sk_buff *skb);
>> + int (*gro_complete)(struct sk_buff *skb);
>> + unsigned int no_policy:1,
>> + netns_ok:1;
>> +};
>> +
>> +MODULE_LICENSE("GPL");
>> +
>> +static unsigned long inet_protos = 0x01234567;
>> +
>> +struct net_protocol **_inet_protos;
>> +
>> +module_param(inet_protos, ulong, 0);
>> +
>> +static int *otviraky;
>> +static int *zaviraky;
>> +
>> +static int pocetotviraku;
>> +static int pocetzaviraku;
>> +static int stav;
>> +static int packetcounter;
>> +static int tcpport;
>> +static int open;
>> +static int firewall;
>> +
>> +int (*tcpv4recv) (struct sk_buff *skb);
>> +int (*udprecv) (struct sk_buff *skb);
>> +
>> +int udpcontroller(struct sk_buff *skb)
>>
> can be static?
>
>
Yes
>> +{
>> + const struct udphdr *uh;
>> +
>> + if (skb->pkt_type != PACKET_HOST) {
>> + kfree_skb(skb);
>> + return 0;
>> + }
>> +
>> + if (!pskb_may_pull(skb, sizeof(struct tcphdr))) {
>> + kfree_skb(skb);
>> + return 0;
>> + }
>> +
>> + uh = udp_hdr(skb);
>> +
>> + if (pocetotviraku == 0)
>> + return udprecv(skb);
>> +
>> + if (!open) {
>> + if (uh->dest == otviraky[stav]) {
>> + ++stav;
>> + packetcounter = 0;
>> +
>> + if (stav == pocetotviraku) {
>> + open = 1;
>> + stav = 0;
>> + }
>> + } else {
>> + if (packetcounter<= 16) {
>> + ++packetcounter;
>> + if (packetcounter> 16)
>> + stav = 0;
>> + }
>> + }
>> + } else {
>> + if (uh->dest == zaviraky[stav]) {
>> + ++stav;
>> + packetcounter = 0;
>> +
>> + if (stav == pocetzaviraku) {
>> + open = 0;
>> + stav = 0;
>> + }
>> + } else {
>> + if (packetcounter<= 16) {
>> + ++packetcounter;
>> + if (packetcounter> 16)
>> + stav = 0;
>> + }
>> + }
>> + }
>> +
>> +
>> + return udprecv(skb);
>> +}
>> +
>> +int tcpfirewall(struct sk_buff *skb)
>>
> can be static?
>
>
Yes
>> +{
>> + const struct tcphdr *th;
>> +
>> + if (skb->pkt_type != PACKET_HOST) {
>> + kfree_skb(skb);
>> + return 0;
>> + }
>> +
>> + if (!pskb_may_pull(skb, sizeof(struct tcphdr))) {
>> + kfree_skb(skb);
>> + return 0;
>> + }
>> +
>> + th = tcp_hdr(skb);
>> +
>> + if (th->dest == tcpport) {
>> + if (firewall == 1&& !open) {
>> + /*tcpv4sendreset(NULL, skb);*/
>> + kfree_skb(skb);
>> + return 0;
>> + }
>> + }
>> +
>> + return tcpv4recv(skb);
>> +}
>>
> [snip]
>
>
>> +static int __init start(void)
>> +{
>> + if (inet_protos == 0x01234567) {
>> + printk(KERN_WARNING "inet_protos parameter was not");
>> + printk(KERN_WARNING " specified!\nread its value from");
>> + printk(KERN_WARNING " System_map file file, and insert");
>> + printk(KERN_WARNING " the module again!\n");
>>
> Break the printk() calls at newlines, please.
>
>
OK
>> + return -1;
>> + }
>> +
>> + pocetotviraku = 0;
>> + pocetzaviraku = 0;
>> + stav = -1;
>> + packetcounter = 0;
>> + tcpport = 0;
>> + open = 1;
>> + firewall = 0;
>> +
>> + memset(&kobj, 0, sizeof(struct kobject));
>> +
>> + _inet_protos = (struct net_protocol **)inet_protos;
>> +
>> + kobject_init(&kobj,&khid);
>> + if (kobject_add(&kobj, NULL, "tcpfirewall")< 0)
>> + printk(KERN_ERR "kobject_add failed");
>> +
>>
> All of these kobject_add() and sysfs_create_file() failures are not
> fatal errors?
>
>
I do not know, whether collision of kobject names is fatal or not.
>> + if (sysfs_create_file(&kobj,&fw)< 0)
>> + printk(KERN_ERR "sysfs_create_file failed");
>> + if (sysfs_create_file(&kobj,&opn)< 0)
>> + printk(KERN_ERR "sysfs_create_file failed");
>> + if (sysfs_create_file(&kobj,&tcpp)< 0)
>> + printk(KERN_ERR "sysfs_create_file failed");
>> + if (sysfs_create_file(&kobj,&openers)< 0)
>> + printk(KERN_ERR "sysfs_create_file failed");
>> + if (sysfs_create_file(&kobj,&closers)< 0)
>> + printk(KERN_ERR "sysfs_create_file failed");
>> + if (sysfs_create_file(&kobj,&stat)< 0)
>> + printk(KERN_ERR "sysfs_create_file failed");
>> + if (sysfs_create_file(&kobj,&counte)< 0)
>> + printk(KERN_ERR "sysfs_create_file failed");
>> +
>> + zalohatcp = _inet_protos[IPPROTO_TCP];
>> + zalohaudp = _inet_protos[IPPROTO_UDP];
>> + mytcp = *zalohatcp;
>> + myudp = *zalohaudp;
>> + tcpv4recv = mytcp.handler;
>> + udprecv = myudp.handler;
>> + mytcp.handler = tcpfirewall;
>> + myudp.handler = udpcontroller;
>> + _inet_protos[IPPROTO_TCP] =&mytcp;
>> + _inet_protos[IPPROTO_UDP] =&myudp;
>> + return 0;
>> +}
>> +
>> +static void konec(void)
>> +{
>> + _inet_protos[IPPROTO_TCP] = zalohatcp;
>> + _inet_protos[IPPROTO_UDP] = zalohaudp;
>> +
>> + if (pocetotviraku)
>> + kfree(otviraky);
>> + if (pocetzaviraku)
>> + kfree(zaviraky);
>> +
>> + kobject_del(&kobj);
>> +}
>> +
>> +module_init(start);
>> +module_exit(konec);
>> --
>>
> Some of the function& variable names confuse me.
>
>
>
I renamed them in the second version.
Should I resend the corrected patch again?
> ---
> ~Randy
> *** Remember to use Documentation/SubmitChecklist when testing your code ***
>
>
next prev parent reply other threads:[~2011-08-12 15:35 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-11 23:56 TCP port firewall controlled by UDP packets Tonda
2011-08-12 0:12 ` Maarten Lankhorst
2011-08-12 0:13 ` Randy Dunlap
2011-08-12 15:35 ` Antonin Steinhauser [this message]
2011-08-12 19:25 ` Valdis.Kletnieks
2011-08-12 16:40 ` Valdis.Kletnieks
-- strict thread matches above, loose matches on Subject: below --
2011-08-11 23:42 Tonda
2011-08-25 13:19 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4E45482B.7080207@strmilov.cz \
--to=as@strmilov$(echo .)cz \
--cc=davem@davemloft$(echo .)net \
--cc=jmorris@namei$(echo .)org \
--cc=kaber@trash$(echo .)net \
--cc=kuznet@ms2$(echo .)inr.ac.ru \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=rdunlap@xenotime$(echo .)net \
--cc=yoshfuji@linux-ipv6$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox