]>
Commit | Line | Data |
---|---|---|
84f3bb9a PM |
1 | /* |
2 | * Copyright (c) 2010 Patrick McHardy <kaber@trash.net> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License version 2 as | |
6 | * published by the Free Software Foundation. | |
7 | */ | |
a7fed762 | 8 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
84f3bb9a | 9 | #include <linux/module.h> |
5a0e3ad6 | 10 | #include <linux/gfp.h> |
84f3bb9a | 11 | #include <linux/skbuff.h> |
84f3bb9a PM |
12 | #include <linux/netfilter_ipv4/ip_tables.h> |
13 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
14 | #include <linux/netfilter/x_tables.h> | |
15 | #include <linux/netfilter/xt_CT.h> | |
16 | #include <net/netfilter/nf_conntrack.h> | |
eeb4cb95 | 17 | #include <net/netfilter/nf_conntrack_l4proto.h> |
84f3bb9a PM |
18 | #include <net/netfilter/nf_conntrack_helper.h> |
19 | #include <net/netfilter/nf_conntrack_ecache.h> | |
24de58f4 | 20 | #include <net/netfilter/nf_conntrack_timeout.h> |
5d0aa2cc | 21 | #include <net/netfilter/nf_conntrack_zones.h> |
84f3bb9a | 22 | |
d52ed437 | 23 | static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct) |
84f3bb9a | 24 | { |
84f3bb9a PM |
25 | /* Previously seen (loopback)? Ignore. */ |
26 | if (skb->nfct != NULL) | |
27 | return XT_CONTINUE; | |
28 | ||
29 | atomic_inc(&ct->ct_general.use); | |
30 | skb->nfct = &ct->ct_general; | |
31 | skb->nfctinfo = IP_CT_NEW; | |
32 | ||
33 | return XT_CONTINUE; | |
34 | } | |
35 | ||
d52ed437 | 36 | static unsigned int xt_ct_target_v0(struct sk_buff *skb, |
24de58f4 PNA |
37 | const struct xt_action_param *par) |
38 | { | |
d52ed437 | 39 | const struct xt_ct_target_info *info = par->targinfo; |
24de58f4 PNA |
40 | struct nf_conn *ct = info->ct; |
41 | ||
d52ed437 PNA |
42 | return xt_ct_target(skb, ct); |
43 | } | |
24de58f4 | 44 | |
d52ed437 PNA |
45 | static unsigned int xt_ct_target_v1(struct sk_buff *skb, |
46 | const struct xt_action_param *par) | |
47 | { | |
48 | const struct xt_ct_target_info_v1 *info = par->targinfo; | |
49 | struct nf_conn *ct = info->ct; | |
24de58f4 | 50 | |
d52ed437 | 51 | return xt_ct_target(skb, ct); |
24de58f4 PNA |
52 | } |
53 | ||
84f3bb9a PM |
54 | static u8 xt_ct_find_proto(const struct xt_tgchk_param *par) |
55 | { | |
076f7839 | 56 | if (par->family == NFPROTO_IPV4) { |
84f3bb9a PM |
57 | const struct ipt_entry *e = par->entryinfo; |
58 | ||
59 | if (e->ip.invflags & IPT_INV_PROTO) | |
60 | return 0; | |
61 | return e->ip.proto; | |
076f7839 | 62 | } else if (par->family == NFPROTO_IPV6) { |
84f3bb9a PM |
63 | const struct ip6t_entry *e = par->entryinfo; |
64 | ||
65 | if (e->ipv6.invflags & IP6T_INV_PROTO) | |
66 | return 0; | |
67 | return e->ipv6.proto; | |
68 | } else | |
69 | return 0; | |
70 | } | |
71 | ||
236df005 PNA |
72 | static int |
73 | xt_ct_set_helper(struct nf_conn *ct, const char *helper_name, | |
74 | const struct xt_tgchk_param *par) | |
75 | { | |
76 | struct nf_conntrack_helper *helper; | |
77 | struct nf_conn_help *help; | |
78 | u8 proto; | |
79 | ||
80 | proto = xt_ct_find_proto(par); | |
81 | if (!proto) { | |
82 | pr_info("You must specify a L4 protocol, and not use " | |
83 | "inversions on it.\n"); | |
84 | return -ENOENT; | |
85 | } | |
86 | ||
87 | helper = nf_conntrack_helper_try_module_get(helper_name, par->family, | |
88 | proto); | |
89 | if (helper == NULL) { | |
90 | pr_info("No such helper \"%s\"\n", helper_name); | |
91 | return -ENOENT; | |
92 | } | |
93 | ||
94 | help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL); | |
95 | if (help == NULL) { | |
96 | module_put(helper->me); | |
97 | return -ENOMEM; | |
98 | } | |
99 | ||
100 | help->helper = helper; | |
101 | return 0; | |
102 | } | |
103 | ||
ee14186f PNA |
104 | #ifdef CONFIG_NF_CONNTRACK_TIMEOUT |
105 | static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout) | |
106 | { | |
107 | typeof(nf_ct_timeout_put_hook) timeout_put; | |
108 | ||
109 | timeout_put = rcu_dereference(nf_ct_timeout_put_hook); | |
110 | if (timeout_put) | |
111 | timeout_put(timeout); | |
112 | } | |
113 | #endif | |
114 | ||
236df005 PNA |
115 | static int |
116 | xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par, | |
117 | const char *timeout_name) | |
118 | { | |
119 | #ifdef CONFIG_NF_CONNTRACK_TIMEOUT | |
120 | typeof(nf_ct_timeout_find_get_hook) timeout_find_get; | |
121 | struct ctnl_timeout *timeout; | |
122 | struct nf_conn_timeout *timeout_ext; | |
236df005 PNA |
123 | struct nf_conntrack_l4proto *l4proto; |
124 | int ret = 0; | |
0153d5a8 | 125 | u8 proto; |
236df005 PNA |
126 | |
127 | rcu_read_lock(); | |
128 | timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook); | |
129 | if (timeout_find_get == NULL) { | |
130 | ret = -ENOENT; | |
131 | pr_info("Timeout policy base is empty\n"); | |
132 | goto out; | |
133 | } | |
134 | ||
0153d5a8 PNA |
135 | proto = xt_ct_find_proto(par); |
136 | if (!proto) { | |
236df005 | 137 | ret = -EINVAL; |
0153d5a8 PNA |
138 | pr_info("You must specify a L4 protocol, and not use " |
139 | "inversions on it.\n"); | |
236df005 PNA |
140 | goto out; |
141 | } | |
142 | ||
143 | timeout = timeout_find_get(timeout_name); | |
144 | if (timeout == NULL) { | |
145 | ret = -ENOENT; | |
146 | pr_info("No such timeout policy \"%s\"\n", timeout_name); | |
147 | goto out; | |
148 | } | |
149 | ||
150 | if (timeout->l3num != par->family) { | |
151 | ret = -EINVAL; | |
152 | pr_info("Timeout policy `%s' can only be used by L3 protocol " | |
153 | "number %d\n", timeout_name, timeout->l3num); | |
154 | goto err_put_timeout; | |
155 | } | |
156 | /* Make sure the timeout policy matches any existing protocol tracker, | |
157 | * otherwise default to generic. | |
158 | */ | |
0153d5a8 | 159 | l4proto = __nf_ct_l4proto_find(par->family, proto); |
236df005 PNA |
160 | if (timeout->l4proto->l4proto != l4proto->l4proto) { |
161 | ret = -EINVAL; | |
162 | pr_info("Timeout policy `%s' can only be used by L4 protocol " | |
163 | "number %d\n", | |
164 | timeout_name, timeout->l4proto->l4proto); | |
165 | goto err_put_timeout; | |
166 | } | |
167 | timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC); | |
168 | if (timeout_ext == NULL) | |
169 | ret = -ENOMEM; | |
170 | ||
171 | err_put_timeout: | |
172 | __xt_ct_tg_timeout_put(timeout); | |
173 | out: | |
174 | rcu_read_unlock(); | |
175 | return ret; | |
176 | #else | |
177 | return -EOPNOTSUPP; | |
178 | #endif | |
179 | } | |
180 | ||
d52ed437 PNA |
181 | static int xt_ct_tg_check(const struct xt_tgchk_param *par, |
182 | struct xt_ct_target_info_v1 *info) | |
24de58f4 | 183 | { |
24de58f4 | 184 | struct nf_conntrack_tuple t; |
24de58f4 | 185 | struct nf_conn *ct; |
4610476d | 186 | int ret = -EOPNOTSUPP; |
236df005 | 187 | |
24de58f4 PNA |
188 | if (info->flags & XT_CT_NOTRACK) { |
189 | ct = nf_ct_untracked_get(); | |
190 | atomic_inc(&ct->ct_general.use); | |
191 | goto out; | |
192 | } | |
193 | ||
194 | #ifndef CONFIG_NF_CONNTRACK_ZONES | |
195 | if (info->zone) | |
196 | goto err1; | |
197 | #endif | |
198 | ||
199 | ret = nf_ct_l3proto_try_module_get(par->family); | |
200 | if (ret < 0) | |
201 | goto err1; | |
202 | ||
203 | memset(&t, 0, sizeof(t)); | |
204 | ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL); | |
205 | ret = PTR_ERR(ct); | |
206 | if (IS_ERR(ct)) | |
207 | goto err2; | |
208 | ||
209 | ret = 0; | |
210 | if ((info->ct_events || info->exp_events) && | |
211 | !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events, | |
212 | GFP_KERNEL)) | |
213 | goto err3; | |
214 | ||
215 | if (info->helper[0]) { | |
236df005 PNA |
216 | ret = xt_ct_set_helper(ct, info->helper, par); |
217 | if (ret < 0) | |
1afc5679 | 218 | goto err3; |
24de58f4 PNA |
219 | } |
220 | ||
6cf51852 | 221 | if (info->timeout[0]) { |
236df005 PNA |
222 | ret = xt_ct_set_timeout(ct, par, info->timeout); |
223 | if (ret < 0) | |
224 | goto err3; | |
24de58f4 | 225 | } |
24de58f4 PNA |
226 | |
227 | __set_bit(IPS_TEMPLATE_BIT, &ct->status); | |
228 | __set_bit(IPS_CONFIRMED_BIT, &ct->status); | |
252b3e8c PNA |
229 | |
230 | /* Overload tuple linked list to put us in template list. */ | |
231 | hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode, | |
232 | &par->net->ct.tmpl); | |
24de58f4 PNA |
233 | out: |
234 | info->ct = ct; | |
235 | return 0; | |
236 | ||
237 | err3: | |
238 | nf_conntrack_free(ct); | |
239 | err2: | |
240 | nf_ct_l3proto_module_put(par->family); | |
241 | err1: | |
242 | return ret; | |
243 | } | |
244 | ||
d52ed437 | 245 | static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par) |
84f3bb9a PM |
246 | { |
247 | struct xt_ct_target_info *info = par->targinfo; | |
d52ed437 PNA |
248 | struct xt_ct_target_info_v1 info_v1 = { |
249 | .flags = info->flags, | |
250 | .zone = info->zone, | |
251 | .ct_events = info->ct_events, | |
252 | .exp_events = info->exp_events, | |
253 | }; | |
254 | int ret; | |
84f3bb9a | 255 | |
5474f57f PNA |
256 | if (info->flags & ~XT_CT_NOTRACK) |
257 | return -EINVAL; | |
258 | ||
d52ed437 | 259 | memcpy(info_v1.helper, info->helper, sizeof(info->helper)); |
84f3bb9a | 260 | |
d52ed437 PNA |
261 | ret = xt_ct_tg_check(par, &info_v1); |
262 | if (ret < 0) | |
263 | return ret; | |
264 | ||
265 | info->ct = info_v1.ct; | |
266 | ||
267 | return ret; | |
268 | } | |
269 | ||
270 | static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par) | |
271 | { | |
5474f57f PNA |
272 | struct xt_ct_target_info_v1 *info = par->targinfo; |
273 | ||
274 | if (info->flags & ~XT_CT_NOTRACK) | |
275 | return -EINVAL; | |
276 | ||
277 | return xt_ct_tg_check(par, par->targinfo); | |
278 | } | |
279 | ||
280 | static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par) | |
281 | { | |
282 | struct xt_ct_target_info_v1 *info = par->targinfo; | |
283 | ||
284 | if (info->flags & ~XT_CT_MASK) | |
285 | return -EINVAL; | |
286 | ||
d52ed437 | 287 | return xt_ct_tg_check(par, par->targinfo); |
84f3bb9a PM |
288 | } |
289 | ||
236df005 | 290 | static void xt_ct_destroy_timeout(struct nf_conn *ct) |
24de58f4 | 291 | { |
24de58f4 PNA |
292 | #ifdef CONFIG_NF_CONNTRACK_TIMEOUT |
293 | struct nf_conn_timeout *timeout_ext; | |
294 | typeof(nf_ct_timeout_put_hook) timeout_put; | |
236df005 PNA |
295 | |
296 | rcu_read_lock(); | |
297 | timeout_put = rcu_dereference(nf_ct_timeout_put_hook); | |
298 | ||
299 | if (timeout_put) { | |
300 | timeout_ext = nf_ct_timeout_find(ct); | |
301 | if (timeout_ext) | |
302 | timeout_put(timeout_ext->timeout); | |
303 | } | |
304 | rcu_read_unlock(); | |
24de58f4 | 305 | #endif |
236df005 PNA |
306 | } |
307 | ||
d52ed437 PNA |
308 | static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par, |
309 | struct xt_ct_target_info_v1 *info) | |
236df005 | 310 | { |
236df005 PNA |
311 | struct nf_conn *ct = info->ct; |
312 | struct nf_conn_help *help; | |
313 | ||
24de58f4 PNA |
314 | if (!nf_ct_is_untracked(ct)) { |
315 | help = nfct_help(ct); | |
316 | if (help) | |
317 | module_put(help->helper->me); | |
318 | ||
319 | nf_ct_l3proto_module_put(par->family); | |
320 | ||
236df005 | 321 | xt_ct_destroy_timeout(ct); |
24de58f4 PNA |
322 | } |
323 | nf_ct_put(info->ct); | |
d52ed437 PNA |
324 | } |
325 | ||
326 | static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par) | |
327 | { | |
328 | struct xt_ct_target_info *info = par->targinfo; | |
329 | struct xt_ct_target_info_v1 info_v1 = { | |
330 | .flags = info->flags, | |
331 | .zone = info->zone, | |
332 | .ct_events = info->ct_events, | |
333 | .exp_events = info->exp_events, | |
334 | .ct = info->ct, | |
335 | }; | |
336 | memcpy(info_v1.helper, info->helper, sizeof(info->helper)); | |
337 | ||
338 | xt_ct_tg_destroy(par, &info_v1); | |
339 | } | |
340 | ||
341 | static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par) | |
342 | { | |
343 | xt_ct_tg_destroy(par, par->targinfo); | |
24de58f4 PNA |
344 | } |
345 | ||
346 | static struct xt_target xt_ct_tg_reg[] __read_mostly = { | |
347 | { | |
348 | .name = "CT", | |
349 | .family = NFPROTO_UNSPEC, | |
350 | .targetsize = sizeof(struct xt_ct_target_info), | |
351 | .checkentry = xt_ct_tg_check_v0, | |
352 | .destroy = xt_ct_tg_destroy_v0, | |
353 | .target = xt_ct_target_v0, | |
354 | .table = "raw", | |
355 | .me = THIS_MODULE, | |
356 | }, | |
357 | { | |
358 | .name = "CT", | |
359 | .family = NFPROTO_UNSPEC, | |
360 | .revision = 1, | |
361 | .targetsize = sizeof(struct xt_ct_target_info_v1), | |
362 | .checkentry = xt_ct_tg_check_v1, | |
363 | .destroy = xt_ct_tg_destroy_v1, | |
364 | .target = xt_ct_target_v1, | |
365 | .table = "raw", | |
366 | .me = THIS_MODULE, | |
367 | }, | |
5474f57f PNA |
368 | { |
369 | .name = "CT", | |
370 | .family = NFPROTO_UNSPEC, | |
371 | .revision = 2, | |
372 | .targetsize = sizeof(struct xt_ct_target_info_v1), | |
373 | .checkentry = xt_ct_tg_check_v2, | |
374 | .destroy = xt_ct_tg_destroy_v1, | |
375 | .target = xt_ct_target_v1, | |
376 | .table = "raw", | |
377 | .me = THIS_MODULE, | |
378 | }, | |
84f3bb9a PM |
379 | }; |
380 | ||
10db9069 PNA |
381 | static unsigned int |
382 | notrack_tg(struct sk_buff *skb, const struct xt_action_param *par) | |
383 | { | |
384 | /* Previously seen (loopback)? Ignore. */ | |
385 | if (skb->nfct != NULL) | |
386 | return XT_CONTINUE; | |
387 | ||
388 | skb->nfct = &nf_ct_untracked_get()->ct_general; | |
389 | skb->nfctinfo = IP_CT_NEW; | |
390 | nf_conntrack_get(skb->nfct); | |
391 | ||
392 | return XT_CONTINUE; | |
393 | } | |
394 | ||
395 | static int notrack_chk(const struct xt_tgchk_param *par) | |
396 | { | |
397 | if (!par->net->xt.notrack_deprecated_warning) { | |
398 | pr_info("netfilter: NOTRACK target is deprecated, " | |
399 | "use CT instead or upgrade iptables\n"); | |
400 | par->net->xt.notrack_deprecated_warning = true; | |
401 | } | |
402 | return 0; | |
403 | } | |
404 | ||
405 | static struct xt_target notrack_tg_reg __read_mostly = { | |
406 | .name = "NOTRACK", | |
407 | .revision = 0, | |
408 | .family = NFPROTO_UNSPEC, | |
409 | .checkentry = notrack_chk, | |
410 | .target = notrack_tg, | |
411 | .table = "raw", | |
412 | .me = THIS_MODULE, | |
413 | }; | |
414 | ||
84f3bb9a PM |
415 | static int __init xt_ct_tg_init(void) |
416 | { | |
10db9069 PNA |
417 | int ret; |
418 | ||
419 | ret = xt_register_target(¬rack_tg_reg); | |
420 | if (ret < 0) | |
421 | return ret; | |
422 | ||
423 | ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg)); | |
424 | if (ret < 0) { | |
425 | xt_unregister_target(¬rack_tg_reg); | |
426 | return ret; | |
427 | } | |
428 | return 0; | |
84f3bb9a PM |
429 | } |
430 | ||
431 | static void __exit xt_ct_tg_exit(void) | |
432 | { | |
24de58f4 | 433 | xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg)); |
10db9069 | 434 | xt_unregister_target(¬rack_tg_reg); |
84f3bb9a PM |
435 | } |
436 | ||
437 | module_init(xt_ct_tg_init); | |
438 | module_exit(xt_ct_tg_exit); | |
439 | ||
440 | MODULE_LICENSE("GPL"); | |
441 | MODULE_DESCRIPTION("Xtables: connection tracking target"); | |
442 | MODULE_ALIAS("ipt_CT"); | |
443 | MODULE_ALIAS("ip6t_CT"); | |
10db9069 PNA |
444 | MODULE_ALIAS("ipt_NOTRACK"); |
445 | MODULE_ALIAS("ip6t_NOTRACK"); |