net/netfilter/xt_CT.c

   1 /*
   2  * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   9 #include <linux/module.h>
  10 #include <linux/gfp.h>
  11 #include <linux/skbuff.h>
  12 #include <linux/netfilter_ipv4/ip_tables.h>
  13 #include <linux/netfilter_ipv6/ip6_tables.h>
  14 #include <linux/netfilter/x_tables.h>
  15 #include <linux/netfilter/xt_CT.h>
  16 #include <net/netfilter/nf_conntrack.h>
  17 #include <net/netfilter/nf_conntrack_l4proto.h>
  18 #include <net/netfilter/nf_conntrack_helper.h>
  19 #include <net/netfilter/nf_conntrack_ecache.h>
  20 #include <net/netfilter/nf_conntrack_l4proto.h>
  21 #include <net/netfilter/nf_conntrack_timeout.h>
  22 #include <net/netfilter/nf_conntrack_zones.h>
  23
  24 static unsigned int xt_ct_target_v0(struct sk_buff *skb,
  25                                     const struct xt_action_param *par)
  26 {
  27         const struct xt_ct_target_info *info = par->targinfo;
  28         struct nf_conn *ct = info->ct;
  29
  30         /* Previously seen (loopback)? Ignore. */
  31         if (skb->nfct != NULL)
  32                 return XT_CONTINUE;
  33
  34         atomic_inc(&ct->ct_general.use);
  35         skb->nfct = &ct->ct_general;
  36         skb->nfctinfo = IP_CT_NEW;
  37
  38         return XT_CONTINUE;
  39 }
  40
  41 static unsigned int xt_ct_target_v1(struct sk_buff *skb,
  42                                     const struct xt_action_param *par)
  43 {
  44         const struct xt_ct_target_info_v1 *info = par->targinfo;
  45         struct nf_conn *ct = info->ct;
  46
  47         /* Previously seen (loopback)? Ignore. */
  48         if (skb->nfct != NULL)
  49                 return XT_CONTINUE;
  50
  51         atomic_inc(&ct->ct_general.use);
  52         skb->nfct = &ct->ct_general;
  53         skb->nfctinfo = IP_CT_NEW;
  54
  55         return XT_CONTINUE;
  56 }
  57
  58 static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
  59 {
  60         if (par->family == NFPROTO_IPV4) {
  61                 const struct ipt_entry *e = par->entryinfo;
  62
  63                 if (e->ip.invflags & IPT_INV_PROTO)
  64                         return 0;
  65                 return e->ip.proto;
  66         } else if (par->family == NFPROTO_IPV6) {
  67                 const struct ip6t_entry *e = par->entryinfo;
  68
  69                 if (e->ipv6.invflags & IP6T_INV_PROTO)
  70                         return 0;
  71                 return e->ipv6.proto;
  72         } else
  73                 return 0;
  74 }
  75
  76 static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
  77 {
  78         struct xt_ct_target_info *info = par->targinfo;
  79         struct nf_conntrack_tuple t;
  80         struct nf_conn_help *help;
  81         struct nf_conn *ct;
  82         int ret = 0;
  83         u8 proto;
  84
  85         if (info->flags & ~XT_CT_NOTRACK)
  86                 return -EINVAL;
  87
  88         if (info->flags & XT_CT_NOTRACK) {
  89                 ct = nf_ct_untracked_get();
  90                 atomic_inc(&ct->ct_general.use);
  91                 goto out;
  92         }
  93
  94 #ifndef CONFIG_NF_CONNTRACK_ZONES
  95         if (info->zone)
  96                 goto err1;
  97 #endif
  98
  99         ret = nf_ct_l3proto_try_module_get(par->family);
 100         if (ret < 0)
 101                 goto err1;
 102
 103         memset(&t, 0, sizeof(t));
 104         ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
 105         ret = PTR_ERR(ct);
 106         if (IS_ERR(ct))
 107                 goto err2;
 108
 109         ret = 0;
 110         if ((info->ct_events || info->exp_events) &&
 111             !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
 112                                   GFP_KERNEL))
 113                 goto err3;
 114
 115         if (info->helper[0]) {
 116                 ret = -ENOENT;
 117                 proto = xt_ct_find_proto(par);
 118                 if (!proto) {
 119                         pr_info("You must specify a L4 protocol, "
 120                                 "and not use inversions on it.\n");
 121                         goto err3;
 122                 }
 123
 124                 ret = -ENOMEM;
 125                 help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
 126                 if (help == NULL)
 127                         goto err3;
 128
 129                 ret = -ENOENT;
 130                 help->helper = nf_conntrack_helper_try_module_get(info->helper,
 131                                                                   par->family,
 132                                                                   proto);
 133                 if (help->helper == NULL) {
 134                         pr_info("No such helper \"%s\"\n", info->helper);
 135                         goto err3;
 136                 }
 137         }
 138
 139         __set_bit(IPS_TEMPLATE_BIT, &ct->status);
 140         __set_bit(IPS_CONFIRMED_BIT, &ct->status);
 141 out:
 142         info->ct = ct;
 143         return 0;
 144
 145 err3:
 146         nf_conntrack_free(ct);
 147 err2:
 148         nf_ct_l3proto_module_put(par->family);
 149 err1:
 150         return ret;
 151 }
 152
 153 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 154 static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
 155 {
 156         typeof(nf_ct_timeout_put_hook) timeout_put;
 157
 158         timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
 159         if (timeout_put)
 160                 timeout_put(timeout);
 161 }
 162 #endif
 163
 164 static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
 165 {
 166         struct xt_ct_target_info_v1 *info = par->targinfo;
 167         struct nf_conntrack_tuple t;
 168         struct nf_conn_help *help;
 169         struct nf_conn *ct;
 170         int ret = 0;
 171         u8 proto;
 172 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 173         struct ctnl_timeout *timeout;
 174 #endif
 175         if (info->flags & ~XT_CT_NOTRACK)
 176                 return -EINVAL;
 177
 178         if (info->flags & XT_CT_NOTRACK) {
 179                 ct = nf_ct_untracked_get();
 180                 atomic_inc(&ct->ct_general.use);
 181                 goto out;
 182         }
 183
 184 #ifndef CONFIG_NF_CONNTRACK_ZONES
 185         if (info->zone)
 186                 goto err1;
 187 #endif
 188
 189         ret = nf_ct_l3proto_try_module_get(par->family);
 190         if (ret < 0)
 191                 goto err1;
 192
 193         memset(&t, 0, sizeof(t));
 194         ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
 195         ret = PTR_ERR(ct);
 196         if (IS_ERR(ct))
 197                 goto err2;
 198
 199         ret = 0;
 200         if ((info->ct_events || info->exp_events) &&
 201             !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
 202                                   GFP_KERNEL))
 203                 goto err3;
 204
 205         if (info->helper[0]) {
 206                 ret = -ENOENT;
 207                 proto = xt_ct_find_proto(par);
 208                 if (!proto) {
 209                         pr_info("You must specify a L4 protocol, "
 210                                 "and not use inversions on it.\n");
 211                         goto err3;
 212                 }
 213
 214                 ret = -ENOMEM;
 215                 help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
 216                 if (help == NULL)
 217                         goto err3;
 218
 219                 ret = -ENOENT;
 220                 help->helper = nf_conntrack_helper_try_module_get(info->helper,
 221                                                                   par->family,
 222                                                                   proto);
 223                 if (help->helper == NULL) {
 224                         pr_info("No such helper \"%s\"\n", info->helper);
 225                         goto err3;
 226                 }
 227         }
 228
 229 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 230         if (info->timeout[0]) {
 231                 typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
 232                 struct nf_conn_timeout *timeout_ext;
 233
 234                 rcu_read_lock();
 235                 timeout_find_get =
 236                         rcu_dereference(nf_ct_timeout_find_get_hook);
 237
 238                 if (timeout_find_get) {
 239                         const struct ipt_entry *e = par->entryinfo;
 240                         struct nf_conntrack_l4proto *l4proto;
 241
 242                         if (e->ip.invflags & IPT_INV_PROTO) {
 243                                 ret = -EINVAL;
 244                                 pr_info("You cannot use inversion on "
 245                                          "L4 protocol\n");
 246                                 goto err4;
 247                         }
 248                         timeout = timeout_find_get(info->timeout);
 249                         if (timeout == NULL) {
 250                                 ret = -ENOENT;
 251                                 pr_info("No such timeout policy \"%s\"\n",
 252                                         info->timeout);
 253                                 goto err4;
 254                         }
 255                         if (timeout->l3num != par->family) {
 256                                 ret = -EINVAL;
 257                                 pr_info("Timeout policy `%s' can only be "
 258                                         "used by L3 protocol number %d\n",
 259                                         info->timeout, timeout->l3num);
 260                                 goto err5;
 261                         }
 262                         /* Make sure the timeout policy matches any existing
 263                          * protocol tracker, otherwise default to generic.
 264                          */
 265                         l4proto = __nf_ct_l4proto_find(par->family,
 266                                                        e->ip.proto);
 267                         if (timeout->l4proto->l4proto != l4proto->l4proto) {
 268                                 ret = -EINVAL;
 269                                 pr_info("Timeout policy `%s' can only be "
 270                                         "used by L4 protocol number %d\n",
 271                                         info->timeout,
 272                                         timeout->l4proto->l4proto);
 273                                 goto err5;
 274                         }
 275                         timeout_ext = nf_ct_timeout_ext_add(ct, timeout,
 276                                                             GFP_ATOMIC);
 277                         if (timeout_ext == NULL) {
 278                                 ret = -ENOMEM;
 279                                 goto err5;
 280                         }
 281                 } else {
 282                         ret = -ENOENT;
 283                         pr_info("Timeout policy base is empty\n");
 284                         goto err4;
 285                 }
 286                 rcu_read_unlock();
 287         }
 288 #endif
 289
 290         __set_bit(IPS_TEMPLATE_BIT, &ct->status);
 291         __set_bit(IPS_CONFIRMED_BIT, &ct->status);
 292 out:
 293         info->ct = ct;
 294         return 0;
 295
 296 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 297 err5:
 298         __xt_ct_tg_timeout_put(timeout);
 299 err4:
 300         rcu_read_unlock();
 301 #endif
 302 err3:
 303         nf_conntrack_free(ct);
 304 err2:
 305         nf_ct_l3proto_module_put(par->family);
 306 err1:
 307         return ret;
 308 }
 309
 310 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
 311 {
 312         struct xt_ct_target_info *info = par->targinfo;
 313         struct nf_conn *ct = info->ct;
 314         struct nf_conn_help *help;
 315
 316         if (!nf_ct_is_untracked(ct)) {
 317                 help = nfct_help(ct);
 318                 if (help)
 319                         module_put(help->helper->me);
 320
 321                 nf_ct_l3proto_module_put(par->family);
 322         }
 323         nf_ct_put(info->ct);
 324 }
 325
 326 static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
 327 {
 328         struct xt_ct_target_info_v1 *info = par->targinfo;
 329         struct nf_conn *ct = info->ct;
 330         struct nf_conn_help *help;
 331 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 332         struct nf_conn_timeout *timeout_ext;
 333         typeof(nf_ct_timeout_put_hook) timeout_put;
 334 #endif
 335         if (!nf_ct_is_untracked(ct)) {
 336                 help = nfct_help(ct);
 337                 if (help)
 338                         module_put(help->helper->me);
 339
 340                 nf_ct_l3proto_module_put(par->family);
 341
 342 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 343                 rcu_read_lock();
 344                 timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
 345
 346                 if (timeout_put) {
 347                         timeout_ext = nf_ct_timeout_find(ct);
 348                         if (timeout_ext)
 349                                 timeout_put(timeout_ext->timeout);
 350                 }
 351                 rcu_read_unlock();
 352 #endif
 353         }
 354         nf_ct_put(info->ct);
 355 }
 356
 357 static struct xt_target xt_ct_tg_reg[] __read_mostly = {
 358         {
 359                 .name           = "CT",
 360                 .family         = NFPROTO_UNSPEC,
 361                 .targetsize     = sizeof(struct xt_ct_target_info),
 362                 .checkentry     = xt_ct_tg_check_v0,
 363                 .destroy        = xt_ct_tg_destroy_v0,
 364                 .target         = xt_ct_target_v0,
 365                 .table          = "raw",
 366                 .me             = THIS_MODULE,
 367         },
 368         {
 369                 .name           = "CT",
 370                 .family         = NFPROTO_UNSPEC,
 371                 .revision       = 1,
 372                 .targetsize     = sizeof(struct xt_ct_target_info_v1),
 373                 .checkentry     = xt_ct_tg_check_v1,
 374                 .destroy        = xt_ct_tg_destroy_v1,
 375                 .target         = xt_ct_target_v1,
 376                 .table          = "raw",
 377                 .me             = THIS_MODULE,
 378         },
 379 };
 380
 381 static int __init xt_ct_tg_init(void)
 382 {
 383         return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
 384 }
 385
 386 static void __exit xt_ct_tg_exit(void)
 387 {
 388         xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
 389 }
 390
 391 module_init(xt_ct_tg_init);
 392 module_exit(xt_ct_tg_exit);
 393
 394 MODULE_LICENSE("GPL");
 395 MODULE_DESCRIPTION("Xtables: connection tracking target");
 396 MODULE_ALIAS("ipt_CT");
 397 MODULE_ALIAS("ip6t_CT");