From 65645763ebe870fa01b5c1a5dbe810feb9397ff2 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 6 Oct 2009 11:19:28 +0200
Subject: conntrackd: add ICMP support for state-synchronization

This patch adds state-synchronization for ICMP. You SHOULD use a
Linux kernel >= 2.6.31, otherwise this patch can result in tons
of state-updates.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/build.c |  9 ++++++++-
 src/parse.c | 15 +++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/build.c b/src/build.c
index defb2ec..6d8b12e 100644
--- a/src/build.c
+++ b/src/build.c
@@ -124,6 +124,13 @@ static void build_l4proto_dccp(const struct nf_conntrack *ct, struct nethdr *n)
 	__build_u8(ct, ATTR_DCCP_ROLE, n, NTA_DCCP_ROLE);
 }
 
+static void build_l4proto_icmp(const struct nf_conntrack *ct, struct nethdr *n)
+{
+	__build_u8(ct, ATTR_ICMP_TYPE, n, NTA_ICMP_TYPE);
+	__build_u8(ct, ATTR_ICMP_CODE, n, NTA_ICMP_CODE);
+	__build_u16(ct, ATTR_ICMP_ID, n, NTA_ICMP_ID);
+}
+
 #ifndef IPPROTO_DCCP
 #define IPPROTO_DCCP 33
 #endif
@@ -134,9 +141,9 @@ static struct build_l4proto {
 	[IPPROTO_TCP]		= { .build = build_l4proto_tcp },
 	[IPPROTO_SCTP]		= { .build = build_l4proto_sctp },
 	[IPPROTO_DCCP]		= { .build = build_l4proto_dccp },
+	[IPPROTO_ICMP]		= { .build = build_l4proto_icmp },
 };
 
-/* XXX: ICMP not supported */
 void build_payload(const struct nf_conntrack *ct, struct nethdr *n)
 {
 	uint8_t l4proto = nfct_get_attr_u8(ct, ATTR_L4PROTO);
diff --git a/src/parse.c b/src/parse.c
index b5f257c..e6eefe4 100644
--- a/src/parse.c
+++ b/src/parse.c
@@ -146,6 +146,21 @@ static struct parser h[NTA_MAX] = {
 		.attr	= ATTR_DCCP_ROLE,
 		.size	= NTA_SIZE(sizeof(uint8_t)),
 	},
+	[NTA_ICMP_TYPE] = {
+		.parse	= parse_u8,
+		.attr	= ATTR_ICMP_TYPE,
+		.size	= NTA_SIZE(sizeof(uint8_t)),
+	},
+	[NTA_ICMP_CODE] = {
+		.parse	= parse_u8,
+		.attr	= ATTR_ICMP_CODE,
+		.size	= NTA_SIZE(sizeof(uint8_t)),
+	},
+	[NTA_ICMP_ID] = {
+		.parse	= parse_u16,
+		.attr	= ATTR_ICMP_ID,
+		.size	= NTA_SIZE(sizeof(uint16_t)),
+	},
 };
 
 static void
-- 
cgit v1.2.3