• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  */
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 #include <linux/module.h>
10 #include <linux/gfp.h>
11 #include <linux/skbuff.h>
12 #include <linux/netfilter_ipv4/ip_tables.h>
13 #include <linux/netfilter_ipv6/ip6_tables.h>
14 #include <linux/netfilter/x_tables.h>
15 #include <linux/netfilter/xt_CT.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_l4proto.h>
18 #include <net/netfilter/nf_conntrack_helper.h>
19 #include <net/netfilter/nf_conntrack_ecache.h>
20 #include <net/netfilter/nf_conntrack_timeout.h>
21 #include <net/netfilter/nf_conntrack_zones.h>
22 
xt_ct_target(struct sk_buff * skb,struct nf_conn * ct)23 static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
24 {
25 	/* Previously seen (loopback)? Ignore. */
26 	if (skb->nfct != NULL)
27 		return XT_CONTINUE;
28 
29 	/* special case the untracked ct : we want the percpu object */
30 	if (!ct)
31 		ct = nf_ct_untracked_get();
32 	atomic_inc(&ct->ct_general.use);
33 	skb->nfct = &ct->ct_general;
34 	skb->nfctinfo = IP_CT_NEW;
35 
36 	return XT_CONTINUE;
37 }
38 
xt_ct_target_v0(struct sk_buff * skb,const struct xt_action_param * par)39 static unsigned int xt_ct_target_v0(struct sk_buff *skb,
40 				    const struct xt_action_param *par)
41 {
42 	const struct xt_ct_target_info *info = par->targinfo;
43 	struct nf_conn *ct = info->ct;
44 
45 	return xt_ct_target(skb, ct);
46 }
47 
xt_ct_target_v1(struct sk_buff * skb,const struct xt_action_param * par)48 static unsigned int xt_ct_target_v1(struct sk_buff *skb,
49 				    const struct xt_action_param *par)
50 {
51 	const struct xt_ct_target_info_v1 *info = par->targinfo;
52 	struct nf_conn *ct = info->ct;
53 
54 	return xt_ct_target(skb, ct);
55 }
56 
xt_ct_find_proto(const struct xt_tgchk_param * par)57 static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
58 {
59 	if (par->family == NFPROTO_IPV4) {
60 		const struct ipt_entry *e = par->entryinfo;
61 
62 		if (e->ip.invflags & IPT_INV_PROTO)
63 			return 0;
64 		return e->ip.proto;
65 	} else if (par->family == NFPROTO_IPV6) {
66 		const struct ip6t_entry *e = par->entryinfo;
67 
68 		if (e->ipv6.invflags & IP6T_INV_PROTO)
69 			return 0;
70 		return e->ipv6.proto;
71 	} else
72 		return 0;
73 }
74 
75 static int
xt_ct_set_helper(struct nf_conn * ct,const char * helper_name,const struct xt_tgchk_param * par)76 xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
77 		 const struct xt_tgchk_param *par)
78 {
79 	struct nf_conntrack_helper *helper;
80 	struct nf_conn_help *help;
81 	u8 proto;
82 
83 	proto = xt_ct_find_proto(par);
84 	if (!proto) {
85 		pr_info("You must specify a L4 protocol, and not use "
86 			"inversions on it.\n");
87 		return -ENOENT;
88 	}
89 
90 	helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
91 						    proto);
92 	if (helper == NULL) {
93 		pr_info("No such helper \"%s\"\n", helper_name);
94 		return -ENOENT;
95 	}
96 
97 	help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
98 	if (help == NULL) {
99 		module_put(helper->me);
100 		return -ENOMEM;
101 	}
102 
103 	help->helper = helper;
104 	return 0;
105 }
106 
107 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
__xt_ct_tg_timeout_put(struct ctnl_timeout * timeout)108 static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
109 {
110 	typeof(nf_ct_timeout_put_hook) timeout_put;
111 
112 	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
113 	if (timeout_put)
114 		timeout_put(timeout);
115 }
116 #endif
117 
118 static int
xt_ct_set_timeout(struct nf_conn * ct,const struct xt_tgchk_param * par,const char * timeout_name)119 xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
120 		  const char *timeout_name)
121 {
122 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
123 	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
124 	struct ctnl_timeout *timeout;
125 	struct nf_conn_timeout *timeout_ext;
126 	struct nf_conntrack_l4proto *l4proto;
127 	int ret = 0;
128 	u8 proto;
129 
130 	rcu_read_lock();
131 	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
132 	if (timeout_find_get == NULL) {
133 		ret = -ENOENT;
134 		pr_info("Timeout policy base is empty\n");
135 		goto out;
136 	}
137 
138 	proto = xt_ct_find_proto(par);
139 	if (!proto) {
140 		ret = -EINVAL;
141 		pr_info("You must specify a L4 protocol, and not use "
142 			"inversions on it.\n");
143 		goto out;
144 	}
145 
146 	timeout = timeout_find_get(par->net, timeout_name);
147 	if (timeout == NULL) {
148 		ret = -ENOENT;
149 		pr_info("No such timeout policy \"%s\"\n", timeout_name);
150 		goto out;
151 	}
152 
153 	if (timeout->l3num != par->family) {
154 		ret = -EINVAL;
155 		pr_info("Timeout policy `%s' can only be used by L3 protocol "
156 			"number %d\n", timeout_name, timeout->l3num);
157 		goto err_put_timeout;
158 	}
159 	/* Make sure the timeout policy matches any existing protocol tracker,
160 	 * otherwise default to generic.
161 	 */
162 	l4proto = __nf_ct_l4proto_find(par->family, proto);
163 	if (timeout->l4proto->l4proto != l4proto->l4proto) {
164 		ret = -EINVAL;
165 		pr_info("Timeout policy `%s' can only be used by L4 protocol "
166 			"number %d\n",
167 			timeout_name, timeout->l4proto->l4proto);
168 		goto err_put_timeout;
169 	}
170 	timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
171 	if (!timeout_ext) {
172 		ret = -ENOMEM;
173 		goto err_put_timeout;
174 	}
175 
176 	rcu_read_unlock();
177 	return ret;
178 
179 err_put_timeout:
180 	__xt_ct_tg_timeout_put(timeout);
181 out:
182 	rcu_read_unlock();
183 	return ret;
184 #else
185 	return -EOPNOTSUPP;
186 #endif
187 }
188 
xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 * info)189 static u16 xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 *info)
190 {
191 	switch (info->flags & (XT_CT_ZONE_DIR_ORIG |
192 			       XT_CT_ZONE_DIR_REPL)) {
193 	case XT_CT_ZONE_DIR_ORIG:
194 		return NF_CT_ZONE_DIR_ORIG;
195 	case XT_CT_ZONE_DIR_REPL:
196 		return NF_CT_ZONE_DIR_REPL;
197 	default:
198 		return NF_CT_DEFAULT_ZONE_DIR;
199 	}
200 }
201 
xt_ct_tg_check(const struct xt_tgchk_param * par,struct xt_ct_target_info_v1 * info)202 static int xt_ct_tg_check(const struct xt_tgchk_param *par,
203 			  struct xt_ct_target_info_v1 *info)
204 {
205 	struct nf_conntrack_zone zone;
206 	struct nf_conn_help *help;
207 	struct nf_conn *ct;
208 	int ret = -EOPNOTSUPP;
209 
210 	if (info->flags & XT_CT_NOTRACK) {
211 		ct = NULL;
212 		goto out;
213 	}
214 
215 #ifndef CONFIG_NF_CONNTRACK_ZONES
216 	if (info->zone || info->flags & (XT_CT_ZONE_DIR_ORIG |
217 					 XT_CT_ZONE_DIR_REPL |
218 					 XT_CT_ZONE_MARK))
219 		goto err1;
220 #endif
221 
222 	ret = nf_ct_l3proto_try_module_get(par->family);
223 	if (ret < 0)
224 		goto err1;
225 
226 	memset(&zone, 0, sizeof(zone));
227 	zone.id = info->zone;
228 	zone.dir = xt_ct_flags_to_dir(info);
229 	if (info->flags & XT_CT_ZONE_MARK)
230 		zone.flags |= NF_CT_FLAG_MARK;
231 
232 	ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL);
233 	if (!ct) {
234 		ret = -ENOMEM;
235 		goto err2;
236 	}
237 
238 	ret = 0;
239 	if ((info->ct_events || info->exp_events) &&
240 	    !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
241 				  GFP_KERNEL)) {
242 		ret = -EINVAL;
243 		goto err3;
244 	}
245 
246 	if (info->helper[0]) {
247 		ret = xt_ct_set_helper(ct, info->helper, par);
248 		if (ret < 0)
249 			goto err3;
250 	}
251 
252 	if (info->timeout[0]) {
253 		ret = xt_ct_set_timeout(ct, par, info->timeout);
254 		if (ret < 0)
255 			goto err4;
256 	}
257 	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
258 	nf_conntrack_get(&ct->ct_general);
259 out:
260 	info->ct = ct;
261 	return 0;
262 
263 err4:
264 	help = nfct_help(ct);
265 	if (help)
266 		module_put(help->helper->me);
267 err3:
268 	nf_ct_tmpl_free(ct);
269 err2:
270 	nf_ct_l3proto_module_put(par->family);
271 err1:
272 	return ret;
273 }
274 
xt_ct_tg_check_v0(const struct xt_tgchk_param * par)275 static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
276 {
277 	struct xt_ct_target_info *info = par->targinfo;
278 	struct xt_ct_target_info_v1 info_v1 = {
279 		.flags 		= info->flags,
280 		.zone		= info->zone,
281 		.ct_events	= info->ct_events,
282 		.exp_events	= info->exp_events,
283 	};
284 	int ret;
285 
286 	if (info->flags & ~XT_CT_NOTRACK)
287 		return -EINVAL;
288 
289 	memcpy(info_v1.helper, info->helper, sizeof(info->helper));
290 
291 	ret = xt_ct_tg_check(par, &info_v1);
292 	if (ret < 0)
293 		return ret;
294 
295 	info->ct = info_v1.ct;
296 
297 	return ret;
298 }
299 
xt_ct_tg_check_v1(const struct xt_tgchk_param * par)300 static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
301 {
302 	struct xt_ct_target_info_v1 *info = par->targinfo;
303 
304 	if (info->flags & ~XT_CT_NOTRACK)
305 		return -EINVAL;
306 
307 	return xt_ct_tg_check(par, par->targinfo);
308 }
309 
xt_ct_tg_check_v2(const struct xt_tgchk_param * par)310 static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
311 {
312 	struct xt_ct_target_info_v1 *info = par->targinfo;
313 
314 	if (info->flags & ~XT_CT_MASK)
315 		return -EINVAL;
316 
317 	return xt_ct_tg_check(par, par->targinfo);
318 }
319 
xt_ct_destroy_timeout(struct nf_conn * ct)320 static void xt_ct_destroy_timeout(struct nf_conn *ct)
321 {
322 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
323 	struct nf_conn_timeout *timeout_ext;
324 	typeof(nf_ct_timeout_put_hook) timeout_put;
325 
326 	rcu_read_lock();
327 	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
328 
329 	if (timeout_put) {
330 		timeout_ext = nf_ct_timeout_find(ct);
331 		if (timeout_ext) {
332 			timeout_put(timeout_ext->timeout);
333 			RCU_INIT_POINTER(timeout_ext->timeout, NULL);
334 		}
335 	}
336 	rcu_read_unlock();
337 #endif
338 }
339 
xt_ct_tg_destroy(const struct xt_tgdtor_param * par,struct xt_ct_target_info_v1 * info)340 static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
341 			     struct xt_ct_target_info_v1 *info)
342 {
343 	struct nf_conn *ct = info->ct;
344 	struct nf_conn_help *help;
345 
346 	if (ct && !nf_ct_is_untracked(ct)) {
347 		help = nfct_help(ct);
348 		if (help)
349 			module_put(help->helper->me);
350 
351 		nf_ct_l3proto_module_put(par->family);
352 
353 		xt_ct_destroy_timeout(ct);
354 		nf_ct_put(info->ct);
355 	}
356 }
357 
xt_ct_tg_destroy_v0(const struct xt_tgdtor_param * par)358 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
359 {
360 	struct xt_ct_target_info *info = par->targinfo;
361 	struct xt_ct_target_info_v1 info_v1 = {
362 		.flags 		= info->flags,
363 		.zone		= info->zone,
364 		.ct_events	= info->ct_events,
365 		.exp_events	= info->exp_events,
366 		.ct		= info->ct,
367 	};
368 	memcpy(info_v1.helper, info->helper, sizeof(info->helper));
369 
370 	xt_ct_tg_destroy(par, &info_v1);
371 }
372 
xt_ct_tg_destroy_v1(const struct xt_tgdtor_param * par)373 static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
374 {
375 	xt_ct_tg_destroy(par, par->targinfo);
376 }
377 
378 static struct xt_target xt_ct_tg_reg[] __read_mostly = {
379 	{
380 		.name		= "CT",
381 		.family		= NFPROTO_UNSPEC,
382 		.targetsize	= sizeof(struct xt_ct_target_info),
383 		.checkentry	= xt_ct_tg_check_v0,
384 		.destroy	= xt_ct_tg_destroy_v0,
385 		.target		= xt_ct_target_v0,
386 		.table		= "raw",
387 		.me		= THIS_MODULE,
388 	},
389 	{
390 		.name		= "CT",
391 		.family		= NFPROTO_UNSPEC,
392 		.revision	= 1,
393 		.targetsize	= sizeof(struct xt_ct_target_info_v1),
394 		.checkentry	= xt_ct_tg_check_v1,
395 		.destroy	= xt_ct_tg_destroy_v1,
396 		.target		= xt_ct_target_v1,
397 		.table		= "raw",
398 		.me		= THIS_MODULE,
399 	},
400 	{
401 		.name		= "CT",
402 		.family		= NFPROTO_UNSPEC,
403 		.revision	= 2,
404 		.targetsize	= sizeof(struct xt_ct_target_info_v1),
405 		.checkentry	= xt_ct_tg_check_v2,
406 		.destroy	= xt_ct_tg_destroy_v1,
407 		.target		= xt_ct_target_v1,
408 		.table		= "raw",
409 		.me		= THIS_MODULE,
410 	},
411 };
412 
413 static unsigned int
notrack_tg(struct sk_buff * skb,const struct xt_action_param * par)414 notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
415 {
416 	/* Previously seen (loopback)? Ignore. */
417 	if (skb->nfct != NULL)
418 		return XT_CONTINUE;
419 
420 	skb->nfct = &nf_ct_untracked_get()->ct_general;
421 	skb->nfctinfo = IP_CT_NEW;
422 	nf_conntrack_get(skb->nfct);
423 
424 	return XT_CONTINUE;
425 }
426 
notrack_chk(const struct xt_tgchk_param * par)427 static int notrack_chk(const struct xt_tgchk_param *par)
428 {
429 	if (!par->net->xt.notrack_deprecated_warning) {
430 		pr_info("netfilter: NOTRACK target is deprecated, "
431 			"use CT instead or upgrade iptables\n");
432 		par->net->xt.notrack_deprecated_warning = true;
433 	}
434 	return 0;
435 }
436 
437 static struct xt_target notrack_tg_reg __read_mostly = {
438 	.name		= "NOTRACK",
439 	.revision	= 0,
440 	.family		= NFPROTO_UNSPEC,
441 	.checkentry	= notrack_chk,
442 	.target		= notrack_tg,
443 	.table		= "raw",
444 	.me		= THIS_MODULE,
445 };
446 
xt_ct_tg_init(void)447 static int __init xt_ct_tg_init(void)
448 {
449 	int ret;
450 
451 	ret = xt_register_target(&notrack_tg_reg);
452 	if (ret < 0)
453 		return ret;
454 
455 	ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
456 	if (ret < 0) {
457 		xt_unregister_target(&notrack_tg_reg);
458 		return ret;
459 	}
460 	return 0;
461 }
462 
xt_ct_tg_exit(void)463 static void __exit xt_ct_tg_exit(void)
464 {
465 	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
466 	xt_unregister_target(&notrack_tg_reg);
467 }
468 
469 module_init(xt_ct_tg_init);
470 module_exit(xt_ct_tg_exit);
471 
472 MODULE_LICENSE("GPL");
473 MODULE_DESCRIPTION("Xtables: connection tracking target");
474 MODULE_ALIAS("ipt_CT");
475 MODULE_ALIAS("ip6t_CT");
476 MODULE_ALIAS("ipt_NOTRACK");
477 MODULE_ALIAS("ip6t_NOTRACK");
478