@@ -75,6 +75,7 @@ struct sockaddr_in6 {
#define IPPROTO_SCTP 132
#define IPPORT_FTP 21
+#define IPPORT_TFTP 69
/* All the IP options documented in Linux ip(7). */
#define IP_ADD_MEMBERSHIP 35
@@ -63,6 +63,7 @@ enum ftp_ctl_pkt {
enum ct_alg_mode {
CT_FTP_MODE_ACTIVE,
CT_FTP_MODE_PASSIVE,
+ CT_TFTP_MODE,
};
static bool conn_key_extract(struct conntrack *, struct dp_packet *,
@@ -141,6 +142,11 @@ handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx,
const struct conn *conn_for_expectation,
long long now, enum ftp_ctl_pkt ftp_ctl, bool nat);
+static void
+handle_tftp_ctl(struct conntrack *ct,
+ const struct conn *conn_for_expectation,
+ long long now);
+
static struct ct_l4_proto *l4_protos[] = {
[IPPROTO_TCP] = &ct_proto_tcp,
[IPPROTO_UDP] = &ct_proto_other,
@@ -361,6 +367,21 @@ is_ftp_ctl(const struct dp_packet *pkt)
}
+static bool
+is_tftp_ctl(const struct dp_packet *pkt)
+{
+ uint8_t ip_proto = get_ip_proto(pkt);
+ struct udp_header *uh = dp_packet_l4(pkt);
+
+ /* CT_IPPORT_TFTP is used because IPPORT_TFTP in not defined in OSX,
+ * at least in in.h. Since this value will never change, remove
+ * the external dependency. */
+#define CT_IPPORT_TFTP 69
+ return (ip_proto == IPPROTO_UDP &&
+ uh->udp_dst == htons(CT_IPPORT_TFTP));
+
+}
+
static void
alg_exp_init_expiration(struct conntrack *ct,
struct alg_exp_node *alg_exp_node,
@@ -1057,8 +1078,9 @@ process_one(struct conntrack *ct, struct dp_packet *pkt,
set_label(pkt, conn, &setlabel[0], &setlabel[1]);
}
+ bool tftp_ctl = is_tftp_ctl(pkt);
struct conn conn_for_expectation;
- if (conn && ftp_ctl) {
+ if (conn && (ftp_ctl || tftp_ctl)) {
conn_for_expectation = *conn;
}
@@ -1072,6 +1094,8 @@ process_one(struct conntrack *ct, struct dp_packet *pkt,
if (OVS_UNLIKELY(conn && ftp_ctl)) {
handle_ftp_ctl(ct, ctx, pkt, &conn_for_expectation,
now, CT_FTP_CTL_INTEREST, !!nat_action_info);
+ } else if (OVS_UNLIKELY(conn && tftp_ctl)) {
+ handle_tftp_ctl(ct, &conn_for_expectation, now);
}
}
@@ -2361,6 +2385,7 @@ expectation_create(struct conntrack *ct,
switch (mode) {
case CT_FTP_MODE_ACTIVE:
+ case CT_TFTP_MODE:
src_addr = master_conn->rev_key.src.addr;
dst_addr = master_conn->rev_key.dst.addr;
alg_nat_repl_addr = master_conn->key.src.addr;
@@ -2655,6 +2680,7 @@ process_ftp_ctl_v4(struct conntrack *ct,
*v4_addr_rep = conn_for_expectation->key.dst.addr.ipv4_aligned;
conn_ipv4_addr = conn_for_expectation->rev_key.src.addr.ipv4_aligned;
break;
+ case CT_TFTP_MODE:
default:
OVS_NOT_REACHED();
}
@@ -2766,6 +2792,7 @@ process_ftp_ctl_v6(struct conntrack *ct,
case CT_FTP_MODE_PASSIVE:
*v6_addr_rep = conn_for_expectation->key.dst.addr;
break;
+ case CT_TFTP_MODE:
default:
OVS_NOT_REACHED();
}
@@ -2943,3 +2970,13 @@ handle_ftp_ctl(struct conntrack *ct, const struct conn_lookup_ctx *ctx,
csum_continue(tcp_csum, th, tail - (char *) th - pad));
return;
}
+
+static void
+handle_tftp_ctl(struct conntrack *ct,
+ const struct conn *conn_for_expectation,
+ long long now)
+{
+ expectation_create(ct, conn_for_expectation->key.src.port, now,
+ CT_TFTP_MODE, conn_for_expectation);
+ return;
+}
Both ipv4 and ipv6 are supported. Also, NAT support is included. Signed-off-by: Darrell Ball <dlu998@gmail.com> --- include/sparse/netinet/in.h | 1 + lib/conntrack.c | 39 ++++++++++++++++++++++++++++++++++++++- 2 files changed, 39 insertions(+), 1 deletion(-)