[mirror_ubuntu-hirsute-kernel.git] / net / netfilter / nf_conntrack_irc.c

// SPDX-License-Identifier: GPL-2.0-or-later
/* IRC extension for IP connection tracking, Version 1.21
 * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
 * based on RR's ip_conntrack_ftp.c
 * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/skbuff.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/netfilter.h>
#include <linux/slab.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_expect.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <linux/netfilter/nf_conntrack_irc.h>

#define MAX_PORTS 8
static unsigned short ports[MAX_PORTS];
static unsigned int ports_c;
static unsigned int max_dcc_channels = 8;
static unsigned int dcc_timeout __read_mostly = 300;
/* This is slow, but it's simple. --RR */
static char *irc_buffer;
static DEFINE_SPINLOCK(irc_buffer_lock);

unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
				enum ip_conntrack_info ctinfo,
				unsigned int protoff,
				unsigned int matchoff,
				unsigned int matchlen,
				struct nf_conntrack_expect *exp) __read_mostly;
EXPORT_SYMBOL_GPL(nf_nat_irc_hook);

#define HELPER_NAME "irc"

MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ip_conntrack_irc");
MODULE_ALIAS_NFCT_HELPER(HELPER_NAME);

module_param_array(ports, ushort, &ports_c, 0400);
MODULE_PARM_DESC(ports, "port numbers of IRC servers");
module_param(max_dcc_channels, uint, 0400);
MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per "
				   "IRC session");
module_param(dcc_timeout, uint, 0400);
MODULE_PARM_DESC(dcc_timeout, "timeout on for unestablished DCC channels");

static const char *const dccprotos[] = {
	"SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT "
};

#define MINMATCHLEN	5

/* tries to get the ip_addr and port out of a dcc command
 * return value: -1 on failure, 0 on success
 *	data		pointer to first byte of DCC command data
 *	data_end	pointer to last byte of dcc command data
 *	ip		returns parsed ip of dcc command
 *	port		returns parsed port of dcc command
 *	ad_beg_p	returns pointer to first byte of addr data
 *	ad_end_p	returns pointer to last byte of addr data
 */
static int parse_dcc(char *data, const char *data_end, __be32 *ip,
		     u_int16_t *port, char **ad_beg_p, char **ad_end_p)
{
	char *tmp;

	/* at least 12: "AAAAAAAA P\1\n" */
	while (*data++ != ' ')
		if (data > data_end - 12)
			return -1;

	/* Make sure we have a newline character within the packet boundaries
	 * because simple_strtoul parses until the first invalid character. */
	for (tmp = data; tmp <= data_end; tmp++)
		if (*tmp == '\n')
			break;
	if (tmp > data_end || *tmp != '\n')
		return -1;

	*ad_beg_p = data;
	*ip = cpu_to_be32(simple_strtoul(data, &data, 10));

	/* skip blanks between ip and port */
	while (*data == ' ') {
		if (data >= data_end)
			return -1;
		data++;
	}

	*port = simple_strtoul(data, &data, 10);
	*ad_end_p = data;

	return 0;
}

static int help(struct sk_buff *skb, unsigned int protoff,
		struct nf_conn *ct, enum ip_conntrack_info ctinfo)
{
	unsigned int dataoff;
	const struct iphdr *iph;
	const struct tcphdr *th;
	struct tcphdr _tcph;
	const char *data_limit;
	char *data, *ib_ptr;
	int dir = CTINFO2DIR(ctinfo);
	struct nf_conntrack_expect *exp;
	struct nf_conntrack_tuple *tuple;
	__be32 dcc_ip;
	u_int16_t dcc_port;
	__be16 port;
	int i, ret = NF_ACCEPT;
	char *addr_beg_p, *addr_end_p;
	typeof(nf_nat_irc_hook) nf_nat_irc;

	/* If packet is coming from IRC server */
	if (dir == IP_CT_DIR_REPLY)
		return NF_ACCEPT;

	/* Until there's been traffic both ways, don't look in packets. */
	if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY)
		return NF_ACCEPT;

	/* Not a full tcp header? */
	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
	if (th == NULL)
		return NF_ACCEPT;

	/* No data? */
	dataoff = protoff + th->doff*4;
	if (dataoff >= skb->len)
		return NF_ACCEPT;

	spin_lock_bh(&irc_buffer_lock);
	ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff,
				    irc_buffer);
	BUG_ON(ib_ptr == NULL);

	data = ib_ptr;
	data_limit = ib_ptr + skb->len - dataoff;

	/* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
	 * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
	while (data < data_limit - (19 + MINMATCHLEN)) {
		if (memcmp(data, "\1DCC ", 5)) {
			data++;
			continue;
		}
		data += 5;
		/* we have at least (19+MINMATCHLEN)-5 bytes valid data left */

		iph = ip_hdr(skb);
		pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
			 &iph->saddr, ntohs(th->source),
			 &iph->daddr, ntohs(th->dest));

		for (i = 0; i < ARRAY_SIZE(dccprotos); i++) {
			if (memcmp(data, dccprotos[i], strlen(dccprotos[i]))) {
				/* no match */
				continue;
			}
			data += strlen(dccprotos[i]);
			pr_debug("DCC %s detected\n", dccprotos[i]);

			/* we have at least
			 * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
			 * data left (== 14/13 bytes) */
			if (parse_dcc(data, data_limit, &dcc_ip,
				       &dcc_port, &addr_beg_p, &addr_end_p)) {
				pr_debug("unable to parse dcc command\n");
				continue;
			}

			pr_debug("DCC bound ip/port: %pI4:%u\n",
				 &dcc_ip, dcc_port);

			/* dcc_ip can be the internal OR external (NAT'ed) IP */
			tuple = &ct->tuplehash[dir].tuple;
			if (tuple->src.u3.ip != dcc_ip &&
			    tuple->dst.u3.ip != dcc_ip) {
				net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
						     &tuple->src.u3.ip,
						     &dcc_ip, dcc_port);
				continue;
			}

			exp = nf_ct_expect_alloc(ct);
			if (exp == NULL) {
				nf_ct_helper_log(skb, ct,
						 "cannot alloc expectation");
				ret = NF_DROP;
				goto out;
			}
			tuple = &ct->tuplehash[!dir].tuple;
			port = htons(dcc_port);
			nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
					  tuple->src.l3num,
					  NULL, &tuple->dst.u3,
					  IPPROTO_TCP, NULL, &port);

			nf_nat_irc = rcu_dereference(nf_nat_irc_hook);
			if (nf_nat_irc && ct->status & IPS_NAT_MASK)
				ret = nf_nat_irc(skb, ctinfo, protoff,
						 addr_beg_p - ib_ptr,
						 addr_end_p - addr_beg_p,
						 exp);
			else if (nf_ct_expect_related(exp, 0) != 0) {
				nf_ct_helper_log(skb, ct,
						 "cannot add expectation");
				ret = NF_DROP;
			}
			nf_ct_expect_put(exp);
			goto out;
		}
	}
 out:
	spin_unlock_bh(&irc_buffer_lock);
	return ret;
}

static struct nf_conntrack_helper irc[MAX_PORTS] __read_mostly;
static struct nf_conntrack_expect_policy irc_exp_policy;

static int __init nf_conntrack_irc_init(void)
{
	int i, ret;

	if (max_dcc_channels < 1) {
		pr_err("max_dcc_channels must not be zero\n");
		return -EINVAL;
	}

	if (max_dcc_channels > NF_CT_EXPECT_MAX_CNT) {
		pr_err("max_dcc_channels must not be more than %u\n",
		       NF_CT_EXPECT_MAX_CNT);
		return -EINVAL;
	}

	irc_exp_policy.max_expected = max_dcc_channels;
	irc_exp_policy.timeout = dcc_timeout;

	irc_buffer = kmalloc(65536, GFP_KERNEL);
	if (!irc_buffer)
		return -ENOMEM;

	/* If no port given, default to standard irc port */
	if (ports_c == 0)
		ports[ports_c++] = IRC_PORT;

	for (i = 0; i < ports_c; i++) {
		nf_ct_helper_init(&irc[i], AF_INET, IPPROTO_TCP, HELPER_NAME,
				  IRC_PORT, ports[i], i, &irc_exp_policy,
				  0, help, NULL, THIS_MODULE);
	}

	ret = nf_conntrack_helpers_register(&irc[0], ports_c);
	if (ret) {
		pr_err("failed to register helpers\n");
		kfree(irc_buffer);
		return ret;
	}

	return 0;
}

static void __exit nf_conntrack_irc_fini(void)
{
	nf_conntrack_helpers_unregister(irc, ports_c);
	kfree(irc_buffer);
}

module_init(nf_conntrack_irc_init);
module_exit(nf_conntrack_irc_fini);
Commit	Line	Data
2874c5fd	1	// SPDX-License-Identifier: GPL-2.0-or-later
869f37d8 PM	2	/* IRC extension for IP connection tracking, Version 1.21
	3	* (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
	4	* based on RR's ip_conntrack_ftp.c
f229f6ce	5	* (C) 2006-2012 Patrick McHardy <kaber@trash.net>
869f37d8 PM	6	*/
869f37d8 PM	7
ad6d9503 PNA	8	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
ad6d9503 PNA	9
869f37d8 PM	10	#include <linux/module.h>
	11	#include <linux/moduleparam.h>
	12	#include <linux/skbuff.h>
	13	#include <linux/in.h>
0d53778e	14	#include <linux/ip.h>
869f37d8 PM	15	#include <linux/tcp.h>
869f37d8 PM	16	#include <linux/netfilter.h>
5a0e3ad6	17	#include <linux/slab.h>
869f37d8 PM	18
	19	#include <net/netfilter/nf_conntrack.h>
	20	#include <net/netfilter/nf_conntrack_expect.h>
	21	#include <net/netfilter/nf_conntrack_helper.h>
	22	#include <linux/netfilter/nf_conntrack_irc.h>
	23
	24	#define MAX_PORTS 8
	25	static unsigned short ports[MAX_PORTS];
2f0d2f10	26	static unsigned int ports_c;
869f37d8 PM	27	static unsigned int max_dcc_channels = 8;
	28	static unsigned int dcc_timeout __read_mostly = 300;
	29	/* This is slow, but it's simple. --RR */
	30	static char *irc_buffer;
	31	static DEFINE_SPINLOCK(irc_buffer_lock);
	32
3db05fea	33	unsigned int (nf_nat_irc_hook)(struct sk_buff skb,
869f37d8	34	enum ip_conntrack_info ctinfo,
051966c0	35	unsigned int protoff,
869f37d8 PM	36	unsigned int matchoff,
	37	unsigned int matchlen,
	38	struct nf_conntrack_expect *exp) __read_mostly;
	39	EXPORT_SYMBOL_GPL(nf_nat_irc_hook);
	40
08010a21 FL	41	#define HELPER_NAME "irc"
08010a21 FL	42
869f37d8 PM	43	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
	44	MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
	45	MODULE_LICENSE("GPL");
	46	MODULE_ALIAS("ip_conntrack_irc");
08010a21	47	MODULE_ALIAS_NFCT_HELPER(HELPER_NAME);
869f37d8 PM	48
	49	module_param_array(ports, ushort, &ports_c, 0400);
	50	MODULE_PARM_DESC(ports, "port numbers of IRC servers");
	51	module_param(max_dcc_channels, uint, 0400);
	52	MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per "
	53	"IRC session");
	54	module_param(dcc_timeout, uint, 0400);
	55	MODULE_PARM_DESC(dcc_timeout, "timeout on for unestablished DCC channels");
	56
58c0fb0d	57	static const char *const dccprotos[] = {
869f37d8 PM	58	"SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT "
	59	};
	60
	61	#define MINMATCHLEN 5
	62
869f37d8 PM	63	/* tries to get the ip_addr and port out of a dcc command
	64	* return value: -1 on failure, 0 on success
	65	* data pointer to first byte of DCC command data
	66	* data_end pointer to last byte of dcc command data
	67	* ip returns parsed ip of dcc command
	68	* port returns parsed port of dcc command
	69	* ad_beg_p returns pointer to first byte of addr data
	70	* ad_end_p returns pointer to last byte of addr data
	71	*/
f9409649	72	static int parse_dcc(char data, const char data_end, __be32 *ip,
869f37d8 PM	73	u_int16_t port, char ad_beg_p, char *ad_end_p)
869f37d8 PM	74	{
e3b802ba PM	75	char *tmp;
e3b802ba PM	76
869f37d8 PM	77	/* at least 12: "AAAAAAAA P\1\n" */
	78	while (*data++ != ' ')
	79	if (data > data_end - 12)
	80	return -1;
	81
e3b802ba PM	82	/* Make sure we have a newline character within the packet boundaries
	83	* because simple_strtoul parses until the first invalid character. */
	84	for (tmp = data; tmp <= data_end; tmp++)
	85	if (*tmp == '\n')
	86	break;
	87	if (tmp > data_end \|\| *tmp != '\n')
	88	return -1;
	89
869f37d8	90	*ad_beg_p = data;
f9409649	91	*ip = cpu_to_be32(simple_strtoul(data, &data, 10));
869f37d8 PM	92
	93	/* skip blanks between ip and port */
	94	while (*data == ' ') {
	95	if (data >= data_end)
	96	return -1;
	97	data++;
	98	}
	99
	100	*port = simple_strtoul(data, &data, 10);
	101	*ad_end_p = data;
	102
	103	return 0;
	104	}
	105
3db05fea	106	static int help(struct sk_buff *skb, unsigned int protoff,
869f37d8 PM	107	struct nf_conn *ct, enum ip_conntrack_info ctinfo)
	108	{
	109	unsigned int dataoff;
58c0fb0d JE	110	const struct iphdr *iph;
	111	const struct tcphdr *th;
	112	struct tcphdr _tcph;
	113	const char *data_limit;
	114	char data, ib_ptr;
869f37d8 PM	115	int dir = CTINFO2DIR(ctinfo);
	116	struct nf_conntrack_expect *exp;
	117	struct nf_conntrack_tuple *tuple;
f9409649	118	__be32 dcc_ip;
869f37d8 PM	119	u_int16_t dcc_port;
	120	__be16 port;
	121	int i, ret = NF_ACCEPT;
	122	char addr_beg_p, addr_end_p;
	123	typeof(nf_nat_irc_hook) nf_nat_irc;
	124
	125	/* If packet is coming from IRC server */
	126	if (dir == IP_CT_DIR_REPLY)
	127	return NF_ACCEPT;
	128
	129	/* Until there's been traffic both ways, don't look in packets. */
fb048833	130	if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY)
869f37d8 PM	131	return NF_ACCEPT;
	132
	133	/* Not a full tcp header? */
3db05fea	134	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
869f37d8 PM	135	if (th == NULL)
	136	return NF_ACCEPT;
	137
	138	/* No data? */
	139	dataoff = protoff + th->doff*4;
3db05fea	140	if (dataoff >= skb->len)
869f37d8 PM	141	return NF_ACCEPT;
	142
	143	spin_lock_bh(&irc_buffer_lock);
3db05fea	144	ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff,
869f37d8 PM	145	irc_buffer);
	146	BUG_ON(ib_ptr == NULL);
	147
	148	data = ib_ptr;
3db05fea	149	data_limit = ib_ptr + skb->len - dataoff;
869f37d8 PM	150
	151	/* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
	152	* 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
	153	while (data < data_limit - (19 + MINMATCHLEN)) {
	154	if (memcmp(data, "\1DCC ", 5)) {
	155	data++;
	156	continue;
	157	}
	158	data += 5;
	159	/* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
	160
3db05fea	161	iph = ip_hdr(skb);
14d5e834 HH	162	pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
	163	&iph->saddr, ntohs(th->source),
	164	&iph->daddr, ntohs(th->dest));
869f37d8 PM	165
	166	for (i = 0; i < ARRAY_SIZE(dccprotos); i++) {
	167	if (memcmp(data, dccprotos[i], strlen(dccprotos[i]))) {
	168	/* no match */
	169	continue;
	170	}
	171	data += strlen(dccprotos[i]);
0d53778e	172	pr_debug("DCC %s detected\n", dccprotos[i]);
869f37d8 PM	173
	174	/* we have at least
	175	* (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
	176	* data left (== 14/13 bytes) */
58c0fb0d	177	if (parse_dcc(data, data_limit, &dcc_ip,
869f37d8	178	&dcc_port, &addr_beg_p, &addr_end_p)) {
0d53778e	179	pr_debug("unable to parse dcc command\n");
869f37d8 PM	180	continue;
869f37d8 PM	181	}
f9409649 HH	182
	183	pr_debug("DCC bound ip/port: %pI4:%u\n",
	184	&dcc_ip, dcc_port);
869f37d8 PM	185
	186	/* dcc_ip can be the internal OR external (NAT'ed) IP */
	187	tuple = &ct->tuplehash[dir].tuple;
f9409649 HH	188	if (tuple->src.u3.ip != dcc_ip &&
f9409649 HH	189	tuple->dst.u3.ip != dcc_ip) {
e87cc472 JP	190	net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
	191	&tuple->src.u3.ip,
	192	&dcc_ip, dcc_port);
869f37d8 PM	193	continue;
	194	}
	195
6823645d	196	exp = nf_ct_expect_alloc(ct);
869f37d8	197	if (exp == NULL) {
b20ab9cc PNA	198	nf_ct_helper_log(skb, ct,
b20ab9cc PNA	199	"cannot alloc expectation");
869f37d8 PM	200	ret = NF_DROP;
	201	goto out;
	202	}
	203	tuple = &ct->tuplehash[!dir].tuple;
	204	port = htons(dcc_port);
6002f266 PM	205	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
6002f266 PM	206	tuple->src.l3num,
6823645d PM	207	NULL, &tuple->dst.u3,
6823645d PM	208	IPPROTO_TCP, NULL, &port);
869f37d8 PM	209
869f37d8 PM	210	nf_nat_irc = rcu_dereference(nf_nat_irc_hook);
5901b6be	211	if (nf_nat_irc && ct->status & IPS_NAT_MASK)
051966c0	212	ret = nf_nat_irc(skb, ctinfo, protoff,
869f37d8 PM	213	addr_beg_p - ib_ptr,
	214	addr_end_p - addr_beg_p,
	215	exp);
3c00fb0b	216	else if (nf_ct_expect_related(exp, 0) != 0) {
b20ab9cc PNA	217	nf_ct_helper_log(skb, ct,
b20ab9cc PNA	218	"cannot add expectation");
869f37d8	219	ret = NF_DROP;
b20ab9cc	220	}
6823645d	221	nf_ct_expect_put(exp);
869f37d8 PM	222	goto out;
	223	}
	224	}
	225	out:
	226	spin_unlock_bh(&irc_buffer_lock);
	227	return ret;
	228	}
	229
	230	static struct nf_conntrack_helper irc[MAX_PORTS] __read_mostly;
6002f266	231	static struct nf_conntrack_expect_policy irc_exp_policy;
869f37d8	232
869f37d8 PM	233	static int __init nf_conntrack_irc_init(void)
	234	{
	235	int i, ret;
869f37d8 PM	236
869f37d8 PM	237	if (max_dcc_channels < 1) {
ad6d9503	238	pr_err("max_dcc_channels must not be zero\n");
869f37d8 PM	239	return -EINVAL;
	240	}
	241
92f73221 GF	242	if (max_dcc_channels > NF_CT_EXPECT_MAX_CNT) {
	243	pr_err("max_dcc_channels must not be more than %u\n",
	244	NF_CT_EXPECT_MAX_CNT);
	245	return -EINVAL;
	246	}
	247
6002f266 PM	248	irc_exp_policy.max_expected = max_dcc_channels;
	249	irc_exp_policy.timeout = dcc_timeout;
	250
869f37d8 PM	251	irc_buffer = kmalloc(65536, GFP_KERNEL);
	252	if (!irc_buffer)
	253	return -ENOMEM;
	254
	255	/* If no port given, default to standard irc port */
	256	if (ports_c == 0)
	257	ports[ports_c++] = IRC_PORT;
	258
	259	for (i = 0; i < ports_c; i++) {
08010a21	260	nf_ct_helper_init(&irc[i], AF_INET, IPPROTO_TCP, HELPER_NAME,
82de0be6	261	IRC_PORT, ports[i], i, &irc_exp_policy,
9f0f3ebe	262	0, help, NULL, THIS_MODULE);
82de0be6 GF	263	}
	264
	265	ret = nf_conntrack_helpers_register(&irc[0], ports_c);
	266	if (ret) {
	267	pr_err("failed to register helpers\n");
	268	kfree(irc_buffer);
	269	return ret;
869f37d8	270	}
82de0be6	271
869f37d8 PM	272	return 0;
	273	}
	274
35341a61	275	static void __exit nf_conntrack_irc_fini(void)
869f37d8	276	{
82de0be6	277	nf_conntrack_helpers_unregister(irc, ports_c);
869f37d8 PM	278	kfree(irc_buffer);
	279	}
	280
	281	module_init(nf_conntrack_irc_init);
	282	module_exit(nf_conntrack_irc_fini);