1 /* IRC extension for IP connection tracking, Version 1.21
2 * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
3 * based on RR's ip_conntrack_ftp.c
4 * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14 #include <linux/module.h>
15 #include <linux/moduleparam.h>
16 #include <linux/skbuff.h>
19 #include <linux/tcp.h>
20 #include <linux/netfilter.h>
21 #include <linux/slab.h>
23 #include <net/netfilter/nf_conntrack.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
25 #include <net/netfilter/nf_conntrack_helper.h>
26 #include <linux/netfilter/nf_conntrack_irc.h>
29 static unsigned short ports
[MAX_PORTS
];
30 static unsigned int ports_c
;
31 static unsigned int max_dcc_channels
= 8;
32 static unsigned int dcc_timeout __read_mostly
= 300;
33 /* This is slow, but it's simple. --RR */
34 static char *irc_buffer
;
35 static DEFINE_SPINLOCK(irc_buffer_lock
);
37 unsigned int (*nf_nat_irc_hook
)(struct sk_buff
*skb
,
38 enum ip_conntrack_info ctinfo
,
40 unsigned int matchoff
,
41 unsigned int matchlen
,
42 struct nf_conntrack_expect
*exp
) __read_mostly
;
43 EXPORT_SYMBOL_GPL(nf_nat_irc_hook
);
45 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
46 MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
47 MODULE_LICENSE("GPL");
48 MODULE_ALIAS("ip_conntrack_irc");
49 MODULE_ALIAS_NFCT_HELPER("irc");
51 module_param_array(ports
, ushort
, &ports_c
, 0400);
52 MODULE_PARM_DESC(ports
, "port numbers of IRC servers");
53 module_param(max_dcc_channels
, uint
, 0400);
54 MODULE_PARM_DESC(max_dcc_channels
, "max number of expected DCC channels per "
56 module_param(dcc_timeout
, uint
, 0400);
57 MODULE_PARM_DESC(dcc_timeout
, "timeout on for unestablished DCC channels");
59 static const char *const dccprotos
[] = {
60 "SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT "
65 /* tries to get the ip_addr and port out of a dcc command
66 * return value: -1 on failure, 0 on success
67 * data pointer to first byte of DCC command data
68 * data_end pointer to last byte of dcc command data
69 * ip returns parsed ip of dcc command
70 * port returns parsed port of dcc command
71 * ad_beg_p returns pointer to first byte of addr data
72 * ad_end_p returns pointer to last byte of addr data
74 static int parse_dcc(char *data
, const char *data_end
, __be32
*ip
,
75 u_int16_t
*port
, char **ad_beg_p
, char **ad_end_p
)
79 /* at least 12: "AAAAAAAA P\1\n" */
80 while (*data
++ != ' ')
81 if (data
> data_end
- 12)
84 /* Make sure we have a newline character within the packet boundaries
85 * because simple_strtoul parses until the first invalid character. */
86 for (tmp
= data
; tmp
<= data_end
; tmp
++)
89 if (tmp
> data_end
|| *tmp
!= '\n')
93 *ip
= cpu_to_be32(simple_strtoul(data
, &data
, 10));
95 /* skip blanks between ip and port */
96 while (*data
== ' ') {
102 *port
= simple_strtoul(data
, &data
, 10);
108 static int help(struct sk_buff
*skb
, unsigned int protoff
,
109 struct nf_conn
*ct
, enum ip_conntrack_info ctinfo
)
111 unsigned int dataoff
;
112 const struct iphdr
*iph
;
113 const struct tcphdr
*th
;
115 const char *data_limit
;
117 int dir
= CTINFO2DIR(ctinfo
);
118 struct nf_conntrack_expect
*exp
;
119 struct nf_conntrack_tuple
*tuple
;
123 int i
, ret
= NF_ACCEPT
;
124 char *addr_beg_p
, *addr_end_p
;
125 typeof(nf_nat_irc_hook
) nf_nat_irc
;
127 /* If packet is coming from IRC server */
128 if (dir
== IP_CT_DIR_REPLY
)
131 /* Until there's been traffic both ways, don't look in packets. */
132 if (ctinfo
!= IP_CT_ESTABLISHED
&& ctinfo
!= IP_CT_ESTABLISHED_REPLY
)
135 /* Not a full tcp header? */
136 th
= skb_header_pointer(skb
, protoff
, sizeof(_tcph
), &_tcph
);
141 dataoff
= protoff
+ th
->doff
*4;
142 if (dataoff
>= skb
->len
)
145 spin_lock_bh(&irc_buffer_lock
);
146 ib_ptr
= skb_header_pointer(skb
, dataoff
, skb
->len
- dataoff
,
148 BUG_ON(ib_ptr
== NULL
);
151 data_limit
= ib_ptr
+ skb
->len
- dataoff
;
153 /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
154 * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
155 while (data
< data_limit
- (19 + MINMATCHLEN
)) {
156 if (memcmp(data
, "\1DCC ", 5)) {
161 /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
164 pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
165 &iph
->saddr
, ntohs(th
->source
),
166 &iph
->daddr
, ntohs(th
->dest
));
168 for (i
= 0; i
< ARRAY_SIZE(dccprotos
); i
++) {
169 if (memcmp(data
, dccprotos
[i
], strlen(dccprotos
[i
]))) {
173 data
+= strlen(dccprotos
[i
]);
174 pr_debug("DCC %s detected\n", dccprotos
[i
]);
177 * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
178 * data left (== 14/13 bytes) */
179 if (parse_dcc(data
, data_limit
, &dcc_ip
,
180 &dcc_port
, &addr_beg_p
, &addr_end_p
)) {
181 pr_debug("unable to parse dcc command\n");
185 pr_debug("DCC bound ip/port: %pI4:%u\n",
188 /* dcc_ip can be the internal OR external (NAT'ed) IP */
189 tuple
= &ct
->tuplehash
[dir
].tuple
;
190 if (tuple
->src
.u3
.ip
!= dcc_ip
&&
191 tuple
->dst
.u3
.ip
!= dcc_ip
) {
192 net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
198 exp
= nf_ct_expect_alloc(ct
);
200 nf_ct_helper_log(skb
, ct
,
201 "cannot alloc expectation");
205 tuple
= &ct
->tuplehash
[!dir
].tuple
;
206 port
= htons(dcc_port
);
207 nf_ct_expect_init(exp
, NF_CT_EXPECT_CLASS_DEFAULT
,
209 NULL
, &tuple
->dst
.u3
,
210 IPPROTO_TCP
, NULL
, &port
);
212 nf_nat_irc
= rcu_dereference(nf_nat_irc_hook
);
213 if (nf_nat_irc
&& ct
->status
& IPS_NAT_MASK
)
214 ret
= nf_nat_irc(skb
, ctinfo
, protoff
,
216 addr_end_p
- addr_beg_p
,
218 else if (nf_ct_expect_related(exp
) != 0) {
219 nf_ct_helper_log(skb
, ct
,
220 "cannot add expectation");
223 nf_ct_expect_put(exp
);
228 spin_unlock_bh(&irc_buffer_lock
);
232 static struct nf_conntrack_helper irc
[MAX_PORTS
] __read_mostly
;
233 static struct nf_conntrack_expect_policy irc_exp_policy
;
235 static void nf_conntrack_irc_fini(void);
237 static int __init
nf_conntrack_irc_init(void)
241 if (max_dcc_channels
< 1) {
242 pr_err("max_dcc_channels must not be zero\n");
246 if (max_dcc_channels
> NF_CT_EXPECT_MAX_CNT
) {
247 pr_err("max_dcc_channels must not be more than %u\n",
248 NF_CT_EXPECT_MAX_CNT
);
252 irc_exp_policy
.max_expected
= max_dcc_channels
;
253 irc_exp_policy
.timeout
= dcc_timeout
;
255 irc_buffer
= kmalloc(65536, GFP_KERNEL
);
259 /* If no port given, default to standard irc port */
261 ports
[ports_c
++] = IRC_PORT
;
263 for (i
= 0; i
< ports_c
; i
++) {
264 nf_ct_helper_init(&irc
[i
], AF_INET
, IPPROTO_TCP
, "irc",
265 IRC_PORT
, ports
[i
], i
, &irc_exp_policy
,
266 0, help
, NULL
, THIS_MODULE
);
269 ret
= nf_conntrack_helpers_register(&irc
[0], ports_c
);
271 pr_err("failed to register helpers\n");
279 /* This function is intentionally _NOT_ defined as __exit, because
280 * it is needed by the init function */
281 static void nf_conntrack_irc_fini(void)
283 nf_conntrack_helpers_unregister(irc
, ports_c
);
287 module_init(nf_conntrack_irc_init
);
288 module_exit(nf_conntrack_irc_fini
);