net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c

   1
   2 /* (C) 1999-2001 Paul `Rusty' Russell
   3  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  */
   9
  10 #include <linux/types.h>
  11 #include <linux/ip.h>
  12 #include <linux/netfilter.h>
  13 #include <linux/module.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/icmp.h>
  16 #include <linux/sysctl.h>
  17 #include <net/route.h>
  18 #include <net/ip.h>
  19
  20 #include <linux/netfilter_ipv4.h>
  21 #include <net/netfilter/nf_conntrack.h>
  22 #include <net/netfilter/nf_conntrack_helper.h>
  23 #include <net/netfilter/nf_conntrack_l4proto.h>
  24 #include <net/netfilter/nf_conntrack_l3proto.h>
  25 #include <net/netfilter/nf_conntrack_core.h>
  26 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
  27 #include <net/netfilter/nf_nat_helper.h>
  28 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
  29
  30 int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
  31                               struct nf_conn *ct,
  32                               enum ip_conntrack_info ctinfo);
  33 EXPORT_SYMBOL_GPL(nf_nat_seq_adjust_hook);
  34
  35 static bool ipv4_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
  36                               struct nf_conntrack_tuple *tuple)
  37 {
  38         const __be32 *ap;
  39         __be32 _addrs[2];
  40         ap = skb_header_pointer(skb, nhoff + offsetof(struct iphdr, saddr),
  41                                 sizeof(u_int32_t) * 2, _addrs);
  42         if (ap == NULL)
  43                 return false;
  44
  45         tuple->src.u3.ip = ap[0];
  46         tuple->dst.u3.ip = ap[1];
  47
  48         return true;
  49 }
  50
  51 static bool ipv4_invert_tuple(struct nf_conntrack_tuple *tuple,
  52                               const struct nf_conntrack_tuple *orig)
  53 {
  54         tuple->src.u3.ip = orig->dst.u3.ip;
  55         tuple->dst.u3.ip = orig->src.u3.ip;
  56
  57         return true;
  58 }
  59
  60 static int ipv4_print_tuple(struct seq_file *s,
  61                             const struct nf_conntrack_tuple *tuple)
  62 {
  63         return seq_printf(s, "src=%pI4 dst=%pI4 ",
  64                           &tuple->src.u3.ip, &tuple->dst.u3.ip);
  65 }
  66
  67 static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
  68                             unsigned int *dataoff, u_int8_t *protonum)
  69 {
  70         const struct iphdr *iph;
  71         struct iphdr _iph;
  72
  73         iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
  74         if (iph == NULL)
  75                 return -NF_DROP;
  76
  77         /* Conntrack defragments packets, we might still see fragments
  78          * inside ICMP packets though. */
  79         if (iph->frag_off & htons(IP_OFFSET))
  80                 return -NF_DROP;
  81
  82         *dataoff = nhoff + (iph->ihl << 2);
  83         *protonum = iph->protocol;
  84
  85         return NF_ACCEPT;
  86 }
  87
  88 static unsigned int ipv4_confirm(unsigned int hooknum,
  89                                  struct sk_buff *skb,
  90                                  const struct net_device *in,
  91                                  const struct net_device *out,
  92                                  int (*okfn)(struct sk_buff *))
  93 {
  94         struct nf_conn *ct;
  95         enum ip_conntrack_info ctinfo;
  96         const struct nf_conn_help *help;
  97         const struct nf_conntrack_helper *helper;
  98         unsigned int ret;
  99
 100         /* This is where we call the helper: as the packet goes out. */
 101         ct = nf_ct_get(skb, &ctinfo);
 102         if (!ct || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)
 103                 goto out;
 104
 105         help = nfct_help(ct);
 106         if (!help)
 107                 goto out;
 108
 109         /* rcu_read_lock()ed by nf_hook_slow */
 110         helper = rcu_dereference(help->helper);
 111         if (!helper)
 112                 goto out;
 113
 114         ret = helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),
 115                            ct, ctinfo);
 116         if (ret != NF_ACCEPT)
 117                 return ret;
 118
 119         if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
 120                 typeof(nf_nat_seq_adjust_hook) seq_adjust;
 121
 122                 seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
 123                 if (!seq_adjust || !seq_adjust(skb, ct, ctinfo))
 124                         return NF_DROP;
 125         }
 126 out:
 127         /* We've seen it coming out the other side: confirm it */
 128         return nf_conntrack_confirm(skb);
 129 }
 130
 131 static unsigned int ipv4_conntrack_in(unsigned int hooknum,
 132                                       struct sk_buff *skb,
 133                                       const struct net_device *in,
 134                                       const struct net_device *out,
 135                                       int (*okfn)(struct sk_buff *))
 136 {
 137         return nf_conntrack_in(dev_net(in), PF_INET, hooknum, skb);
 138 }
 139
 140 static unsigned int ipv4_conntrack_local(unsigned int hooknum,
 141                                          struct sk_buff *skb,
 142                                          const struct net_device *in,
 143                                          const struct net_device *out,
 144                                          int (*okfn)(struct sk_buff *))
 145 {
 146         /* root is playing with raw sockets. */
 147         if (skb->len < sizeof(struct iphdr) ||
 148             ip_hdrlen(skb) < sizeof(struct iphdr))
 149                 return NF_ACCEPT;
 150         return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb);
 151 }
 152
 153 /* Connection tracking may drop packets, but never alters them, so
 154    make it the first hook. */
 155 static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
 156         {
 157                 .hook           = ipv4_conntrack_in,
 158                 .owner          = THIS_MODULE,
 159                 .pf             = PF_INET,
 160                 .hooknum        = NF_INET_PRE_ROUTING,
 161                 .priority       = NF_IP_PRI_CONNTRACK,
 162         },
 163         {
 164                 .hook           = ipv4_conntrack_local,
 165                 .owner          = THIS_MODULE,
 166                 .pf             = PF_INET,
 167                 .hooknum        = NF_INET_LOCAL_OUT,
 168                 .priority       = NF_IP_PRI_CONNTRACK,
 169         },
 170         {
 171                 .hook           = ipv4_confirm,
 172                 .owner          = THIS_MODULE,
 173                 .pf             = PF_INET,
 174                 .hooknum        = NF_INET_POST_ROUTING,
 175                 .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
 176         },
 177         {
 178                 .hook           = ipv4_confirm,
 179                 .owner          = THIS_MODULE,
 180                 .pf             = PF_INET,
 181                 .hooknum        = NF_INET_LOCAL_IN,
 182                 .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
 183         },
 184 };
 185
 186 #if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
 187 static int log_invalid_proto_min = 0;
 188 static int log_invalid_proto_max = 255;
 189
 190 static ctl_table ip_ct_sysctl_table[] = {
 191         {
 192                 .ctl_name       = NET_IPV4_NF_CONNTRACK_MAX,
 193                 .procname       = "ip_conntrack_max",
 194                 .data           = &nf_conntrack_max,
 195                 .maxlen         = sizeof(int),
 196                 .mode           = 0644,
 197                 .proc_handler   = proc_dointvec,
 198         },
 199         {
 200                 .ctl_name       = NET_IPV4_NF_CONNTRACK_COUNT,
 201                 .procname       = "ip_conntrack_count",
 202                 .data           = &init_net.ct.count,
 203                 .maxlen         = sizeof(int),
 204                 .mode           = 0444,
 205                 .proc_handler   = proc_dointvec,
 206         },
 207         {
 208                 .ctl_name       = NET_IPV4_NF_CONNTRACK_BUCKETS,
 209                 .procname       = "ip_conntrack_buckets",
 210                 .data           = &nf_conntrack_htable_size,
 211                 .maxlen         = sizeof(unsigned int),
 212                 .mode           = 0444,
 213                 .proc_handler   = proc_dointvec,
 214         },
 215         {
 216                 .ctl_name       = NET_IPV4_NF_CONNTRACK_CHECKSUM,
 217                 .procname       = "ip_conntrack_checksum",
 218                 .data           = &init_net.ct.sysctl_checksum,
 219                 .maxlen         = sizeof(int),
 220                 .mode           = 0644,
 221                 .proc_handler   = proc_dointvec,
 222         },
 223         {
 224                 .ctl_name       = NET_IPV4_NF_CONNTRACK_LOG_INVALID,
 225                 .procname       = "ip_conntrack_log_invalid",
 226                 .data           = &init_net.ct.sysctl_log_invalid,
 227                 .maxlen         = sizeof(unsigned int),
 228                 .mode           = 0644,
 229                 .proc_handler   = proc_dointvec_minmax,
 230                 .strategy       = sysctl_intvec,
 231                 .extra1         = &log_invalid_proto_min,
 232                 .extra2         = &log_invalid_proto_max,
 233         },
 234         {
 235                 .ctl_name       = 0
 236         }
 237 };
 238 #endif /* CONFIG_SYSCTL && CONFIG_NF_CONNTRACK_PROC_COMPAT */
 239
 240 /* Fast function for those who don't want to parse /proc (and I don't
 241    blame them). */
 242 /* Reversing the socket's dst/src point of view gives us the reply
 243    mapping. */
 244 static int
 245 getorigdst(struct sock *sk, int optval, void __user *user, int *len)
 246 {
 247         const struct inet_sock *inet = inet_sk(sk);
 248         const struct nf_conntrack_tuple_hash *h;
 249         struct nf_conntrack_tuple tuple;
 250
 251         memset(&tuple, 0, sizeof(tuple));
 252         tuple.src.u3.ip = inet->rcv_saddr;
 253         tuple.src.u.tcp.port = inet->sport;
 254         tuple.dst.u3.ip = inet->daddr;
 255         tuple.dst.u.tcp.port = inet->dport;
 256         tuple.src.l3num = PF_INET;
 257         tuple.dst.protonum = IPPROTO_TCP;
 258
 259         /* We only do TCP at the moment: is there a better way? */
 260         if (strcmp(sk->sk_prot->name, "TCP")) {
 261                 pr_debug("SO_ORIGINAL_DST: Not a TCP socket\n");
 262                 return -ENOPROTOOPT;
 263         }
 264
 265         if ((unsigned int) *len < sizeof(struct sockaddr_in)) {
 266                 pr_debug("SO_ORIGINAL_DST: len %d not %Zu\n",
 267                          *len, sizeof(struct sockaddr_in));
 268                 return -EINVAL;
 269         }
 270
 271         h = nf_conntrack_find_get(sock_net(sk), &tuple);
 272         if (h) {
 273                 struct sockaddr_in sin;
 274                 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
 275
 276                 sin.sin_family = AF_INET;
 277                 sin.sin_port = ct->tuplehash[IP_CT_DIR_ORIGINAL]
 278                         .tuple.dst.u.tcp.port;
 279                 sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
 280                         .tuple.dst.u3.ip;
 281                 memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
 282
 283                 pr_debug("SO_ORIGINAL_DST: %pI4 %u\n",
 284                          &sin.sin_addr.s_addr, ntohs(sin.sin_port));
 285                 nf_ct_put(ct);
 286                 if (copy_to_user(user, &sin, sizeof(sin)) != 0)
 287                         return -EFAULT;
 288                 else
 289                         return 0;
 290         }
 291         pr_debug("SO_ORIGINAL_DST: Can't find %pI4/%u-%pI4/%u.\n",
 292                  &tuple.src.u3.ip, ntohs(tuple.src.u.tcp.port),
 293                  &tuple.dst.u3.ip, ntohs(tuple.dst.u.tcp.port));
 294         return -ENOENT;
 295 }
 296
 297 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 298
 299 #include <linux/netfilter/nfnetlink.h>
 300 #include <linux/netfilter/nfnetlink_conntrack.h>
 301
 302 static int ipv4_tuple_to_nlattr(struct sk_buff *skb,
 303                                 const struct nf_conntrack_tuple *tuple)
 304 {
 305         NLA_PUT_BE32(skb, CTA_IP_V4_SRC, tuple->src.u3.ip);
 306         NLA_PUT_BE32(skb, CTA_IP_V4_DST, tuple->dst.u3.ip);
 307         return 0;
 308
 309 nla_put_failure:
 310         return -1;
 311 }
 312
 313 static const struct nla_policy ipv4_nla_policy[CTA_IP_MAX+1] = {
 314         [CTA_IP_V4_SRC] = { .type = NLA_U32 },
 315         [CTA_IP_V4_DST] = { .type = NLA_U32 },
 316 };
 317
 318 static int ipv4_nlattr_to_tuple(struct nlattr *tb[],
 319                                 struct nf_conntrack_tuple *t)
 320 {
 321         if (!tb[CTA_IP_V4_SRC] || !tb[CTA_IP_V4_DST])
 322                 return -EINVAL;
 323
 324         t->src.u3.ip = nla_get_be32(tb[CTA_IP_V4_SRC]);
 325         t->dst.u3.ip = nla_get_be32(tb[CTA_IP_V4_DST]);
 326
 327         return 0;
 328 }
 329 #endif
 330
 331 static struct nf_sockopt_ops so_getorigdst = {
 332         .pf             = PF_INET,
 333         .get_optmin     = SO_ORIGINAL_DST,
 334         .get_optmax     = SO_ORIGINAL_DST+1,
 335         .get            = &getorigdst,
 336         .owner          = THIS_MODULE,
 337 };
 338
 339 struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
 340         .l3proto         = PF_INET,
 341         .name            = "ipv4",
 342         .pkt_to_tuple    = ipv4_pkt_to_tuple,
 343         .invert_tuple    = ipv4_invert_tuple,
 344         .print_tuple     = ipv4_print_tuple,
 345         .get_l4proto     = ipv4_get_l4proto,
 346 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 347         .tuple_to_nlattr = ipv4_tuple_to_nlattr,
 348         .nlattr_to_tuple = ipv4_nlattr_to_tuple,
 349         .nla_policy      = ipv4_nla_policy,
 350 #endif
 351 #if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
 352         .ctl_table_path  = nf_net_ipv4_netfilter_sysctl_path,
 353         .ctl_table       = ip_ct_sysctl_table,
 354 #endif
 355         .me              = THIS_MODULE,
 356 };
 357
 358 module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,
 359                   &nf_conntrack_htable_size, 0600);
 360
 361 MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET));
 362 MODULE_ALIAS("ip_conntrack");
 363 MODULE_LICENSE("GPL");
 364
 365 static int __init nf_conntrack_l3proto_ipv4_init(void)
 366 {
 367         int ret = 0;
 368
 369         need_conntrack();
 370         nf_defrag_ipv4_enable();
 371
 372         ret = nf_register_sockopt(&so_getorigdst);
 373         if (ret < 0) {
 374                 printk(KERN_ERR "Unable to register netfilter socket option\n");
 375                 return ret;
 376         }
 377
 378         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_tcp4);
 379         if (ret < 0) {
 380                 printk("nf_conntrack_ipv4: can't register tcp.\n");
 381                 goto cleanup_sockopt;
 382         }
 383
 384         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udp4);
 385         if (ret < 0) {
 386                 printk("nf_conntrack_ipv4: can't register udp.\n");
 387                 goto cleanup_tcp;
 388         }
 389
 390         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_icmp);
 391         if (ret < 0) {
 392                 printk("nf_conntrack_ipv4: can't register icmp.\n");
 393                 goto cleanup_udp;
 394         }
 395
 396         ret = nf_conntrack_l3proto_register(&nf_conntrack_l3proto_ipv4);
 397         if (ret < 0) {
 398                 printk("nf_conntrack_ipv4: can't register ipv4\n");
 399                 goto cleanup_icmp;
 400         }
 401
 402         ret = nf_register_hooks(ipv4_conntrack_ops,
 403                                 ARRAY_SIZE(ipv4_conntrack_ops));
 404         if (ret < 0) {
 405                 printk("nf_conntrack_ipv4: can't register hooks.\n");
 406                 goto cleanup_ipv4;
 407         }
 408 #if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
 409         ret = nf_conntrack_ipv4_compat_init();
 410         if (ret < 0)
 411                 goto cleanup_hooks;
 412 #endif
 413         return ret;
 414 #if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
 415  cleanup_hooks:
 416         nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
 417 #endif
 418  cleanup_ipv4:
 419         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
 420  cleanup_icmp:
 421         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmp);
 422  cleanup_udp:
 423         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp4);
 424  cleanup_tcp:
 425         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp4);
 426  cleanup_sockopt:
 427         nf_unregister_sockopt(&so_getorigdst);
 428         return ret;
 429 }
 430
 431 static void __exit nf_conntrack_l3proto_ipv4_fini(void)
 432 {
 433         synchronize_net();
 434 #if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
 435         nf_conntrack_ipv4_compat_fini();
 436 #endif
 437         nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
 438         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
 439         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmp);
 440         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp4);
 441         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp4);
 442         nf_unregister_sockopt(&so_getorigdst);
 443 }
 444
 445 module_init(nf_conntrack_l3proto_ipv4_init);
 446 module_exit(nf_conntrack_l3proto_ipv4_fini);
 447
 448 void need_ipv4_conntrack(void)
 449 {
 450         return;
 451 }
 452 EXPORT_SYMBOL_GPL(need_ipv4_conntrack);