1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Helper handling for netfilter. */ 3 4 /* (C) 1999-2001 Paul `Rusty' Russell 5 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 6 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org> 7 * (C) 2006-2012 Patrick McHardy <kaber@trash.net> 8 */ 9 10 #include <linux/types.h> 11 #include <linux/netfilter.h> 12 #include <linux/module.h> 13 #include <linux/skbuff.h> 14 #include <linux/vmalloc.h> 15 #include <linux/stddef.h> 16 #include <linux/random.h> 17 #include <linux/err.h> 18 #include <linux/kernel.h> 19 #include <linux/netdevice.h> 20 #include <linux/rculist.h> 21 #include <linux/rtnetlink.h> 22 23 #include <net/netfilter/nf_conntrack.h> 24 #include <net/netfilter/nf_conntrack_core.h> 25 #include <net/netfilter/nf_conntrack_ecache.h> 26 #include <net/netfilter/nf_conntrack_extend.h> 27 #include <net/netfilter/nf_conntrack_helper.h> 28 #include <net/netfilter/nf_conntrack_l4proto.h> 29 #include <net/netfilter/nf_conntrack_seqadj.h> 30 #include <net/netfilter/nf_log.h> 31 #include <net/ip.h> 32 33 static DEFINE_MUTEX(nf_ct_helper_mutex); 34 struct hlist_head *nf_ct_helper_hash __read_mostly; 35 EXPORT_SYMBOL_GPL(nf_ct_helper_hash); 36 unsigned int nf_ct_helper_hsize __read_mostly; 37 EXPORT_SYMBOL_GPL(nf_ct_helper_hsize); 38 static unsigned int nf_ct_helper_count __read_mostly; 39 40 static DEFINE_MUTEX(nf_ct_nat_helpers_mutex); 41 static struct list_head nf_ct_nat_helpers __read_mostly; 42 43 /* Stupid hash, but collision free for the default registrations of the 44 * helpers currently in the kernel. */ 45 static unsigned int helper_hash(const struct nf_conntrack_tuple *tuple) 46 { 47 return (((tuple->src.l3num << 8) | tuple->dst.protonum) ^ 48 (__force __u16)tuple->src.u.all) % nf_ct_helper_hsize; 49 } 50 51 struct nf_conntrack_helper * 52 __nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum) 53 { 54 struct nf_conntrack_helper *h; 55 unsigned int i; 56 57 for (i = 0; i < nf_ct_helper_hsize; i++) { 58 hlist_for_each_entry_rcu(h, &nf_ct_helper_hash[i], hnode) { 59 if (strcmp(h->name, name)) 60 continue; 61 62 if (h->tuple.src.l3num != NFPROTO_UNSPEC && 63 h->tuple.src.l3num != l3num) 64 continue; 65 66 if (h->tuple.dst.protonum == protonum) 67 return h; 68 } 69 } 70 return NULL; 71 } 72 EXPORT_SYMBOL_GPL(__nf_conntrack_helper_find); 73 74 struct nf_conntrack_helper * 75 nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum) 76 { 77 struct nf_conntrack_helper *h; 78 79 rcu_read_lock(); 80 81 h = __nf_conntrack_helper_find(name, l3num, protonum); 82 #ifdef CONFIG_MODULES 83 if (h == NULL) { 84 rcu_read_unlock(); 85 if (request_module("nfct-helper-%s", name) == 0) { 86 rcu_read_lock(); 87 h = __nf_conntrack_helper_find(name, l3num, protonum); 88 } else { 89 return h; 90 } 91 } 92 #endif 93 if (h != NULL && !try_module_get(h->me)) 94 h = NULL; 95 if (h != NULL && !refcount_inc_not_zero(&h->refcnt)) { 96 module_put(h->me); 97 h = NULL; 98 } 99 100 rcu_read_unlock(); 101 102 return h; 103 } 104 EXPORT_SYMBOL_GPL(nf_conntrack_helper_try_module_get); 105 106 void nf_conntrack_helper_put(struct nf_conntrack_helper *helper) 107 { 108 refcount_dec(&helper->refcnt); 109 module_put(helper->me); 110 } 111 EXPORT_SYMBOL_GPL(nf_conntrack_helper_put); 112 113 static struct nf_conntrack_nat_helper * 114 nf_conntrack_nat_helper_find(const char *mod_name) 115 { 116 struct nf_conntrack_nat_helper *cur; 117 bool found = false; 118 119 list_for_each_entry_rcu(cur, &nf_ct_nat_helpers, list) { 120 if (!strcmp(cur->mod_name, mod_name)) { 121 found = true; 122 break; 123 } 124 } 125 return found ? cur : NULL; 126 } 127 128 int 129 nf_nat_helper_try_module_get(const char *name, u16 l3num, u8 protonum) 130 { 131 struct nf_conntrack_helper *h; 132 struct nf_conntrack_nat_helper *nat; 133 char mod_name[NF_CT_HELPER_NAME_LEN]; 134 int ret = 0; 135 136 rcu_read_lock(); 137 h = __nf_conntrack_helper_find(name, l3num, protonum); 138 if (!h) { 139 rcu_read_unlock(); 140 return -ENOENT; 141 } 142 143 nat = nf_conntrack_nat_helper_find(h->nat_mod_name); 144 if (!nat) { 145 snprintf(mod_name, sizeof(mod_name), "%s", h->nat_mod_name); 146 rcu_read_unlock(); 147 request_module("%s", mod_name); 148 149 rcu_read_lock(); 150 nat = nf_conntrack_nat_helper_find(mod_name); 151 if (!nat) { 152 rcu_read_unlock(); 153 return -ENOENT; 154 } 155 } 156 157 if (!try_module_get(nat->module)) 158 ret = -ENOENT; 159 160 rcu_read_unlock(); 161 return ret; 162 } 163 EXPORT_SYMBOL_GPL(nf_nat_helper_try_module_get); 164 165 void nf_nat_helper_put(struct nf_conntrack_helper *helper) 166 { 167 struct nf_conntrack_nat_helper *nat; 168 169 nat = nf_conntrack_nat_helper_find(helper->nat_mod_name); 170 if (WARN_ON_ONCE(!nat)) 171 return; 172 173 module_put(nat->module); 174 } 175 EXPORT_SYMBOL_GPL(nf_nat_helper_put); 176 177 struct nf_conn_help * 178 nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp) 179 { 180 struct nf_conn_help *help; 181 182 help = nf_ct_ext_add(ct, NF_CT_EXT_HELPER, gfp); 183 if (help) 184 INIT_HLIST_HEAD(&help->expectations); 185 else 186 pr_debug("failed to add helper extension area"); 187 return help; 188 } 189 EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add); 190 191 int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl, 192 gfp_t flags) 193 { 194 struct nf_conntrack_helper *helper = NULL; 195 struct nf_conn_help *help; 196 197 /* We already got a helper explicitly attached. The function 198 * nf_conntrack_alter_reply - in case NAT is in use - asks for looking 199 * the helper up again. Since now the user is in full control of 200 * making consistent helper configurations, skip this automatic 201 * re-lookup, otherwise we'll lose the helper. 202 */ 203 if (test_bit(IPS_HELPER_BIT, &ct->status)) 204 return 0; 205 206 if (WARN_ON_ONCE(!tmpl)) 207 return 0; 208 209 help = nfct_help(tmpl); 210 if (help != NULL) { 211 helper = rcu_dereference(help->helper); 212 set_bit(IPS_HELPER_BIT, &ct->status); 213 } 214 215 help = nfct_help(ct); 216 217 if (helper == NULL) { 218 if (help) 219 RCU_INIT_POINTER(help->helper, NULL); 220 return 0; 221 } 222 223 if (help == NULL) { 224 help = nf_ct_helper_ext_add(ct, flags); 225 if (help == NULL) 226 return -ENOMEM; 227 } else { 228 /* We only allow helper re-assignment of the same sort since 229 * we cannot reallocate the helper extension area. 230 */ 231 struct nf_conntrack_helper *tmp = rcu_dereference(help->helper); 232 233 if (tmp && tmp->help != helper->help) { 234 RCU_INIT_POINTER(help->helper, NULL); 235 return 0; 236 } 237 } 238 239 rcu_assign_pointer(help->helper, helper); 240 241 return 0; 242 } 243 EXPORT_SYMBOL_GPL(__nf_ct_try_assign_helper); 244 245 /* appropriate ct lock protecting must be taken by caller */ 246 static int unhelp(struct nf_conn *ct, void *me) 247 { 248 struct nf_conn_help *help = nfct_help(ct); 249 250 if (help && rcu_dereference_raw(help->helper) == me) { 251 nf_conntrack_event(IPCT_HELPER, ct); 252 RCU_INIT_POINTER(help->helper, NULL); 253 } 254 255 /* We are not intended to delete this conntrack. */ 256 return 0; 257 } 258 259 void nf_ct_helper_destroy(struct nf_conn *ct) 260 { 261 struct nf_conn_help *help = nfct_help(ct); 262 struct nf_conntrack_helper *helper; 263 264 if (help) { 265 rcu_read_lock(); 266 helper = rcu_dereference(help->helper); 267 if (helper && helper->destroy) 268 helper->destroy(ct); 269 rcu_read_unlock(); 270 } 271 } 272 273 static LIST_HEAD(nf_ct_helper_expectfn_list); 274 275 void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n) 276 { 277 spin_lock_bh(&nf_conntrack_expect_lock); 278 list_add_rcu(&n->head, &nf_ct_helper_expectfn_list); 279 spin_unlock_bh(&nf_conntrack_expect_lock); 280 } 281 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_register); 282 283 void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n) 284 { 285 spin_lock_bh(&nf_conntrack_expect_lock); 286 list_del_rcu(&n->head); 287 spin_unlock_bh(&nf_conntrack_expect_lock); 288 } 289 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_unregister); 290 291 /* Caller should hold the rcu lock */ 292 struct nf_ct_helper_expectfn * 293 nf_ct_helper_expectfn_find_by_name(const char *name) 294 { 295 struct nf_ct_helper_expectfn *cur; 296 bool found = false; 297 298 list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) { 299 if (!strcmp(cur->name, name)) { 300 found = true; 301 break; 302 } 303 } 304 return found ? cur : NULL; 305 } 306 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_name); 307 308 /* Caller should hold the rcu lock */ 309 struct nf_ct_helper_expectfn * 310 nf_ct_helper_expectfn_find_by_symbol(const void *symbol) 311 { 312 struct nf_ct_helper_expectfn *cur; 313 bool found = false; 314 315 list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) { 316 if (cur->expectfn == symbol) { 317 found = true; 318 break; 319 } 320 } 321 return found ? cur : NULL; 322 } 323 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_symbol); 324 325 __printf(3, 4) 326 void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct, 327 const char *fmt, ...) 328 { 329 const struct nf_conn_help *help; 330 const struct nf_conntrack_helper *helper; 331 struct va_format vaf; 332 va_list args; 333 334 va_start(args, fmt); 335 336 vaf.fmt = fmt; 337 vaf.va = &args; 338 339 /* Called from the helper function, this call never fails */ 340 help = nfct_help(ct); 341 342 /* rcu_read_lock()ed by nf_hook_thresh */ 343 helper = rcu_dereference(help->helper); 344 345 nf_log_packet(nf_ct_net(ct), nf_ct_l3num(ct), 0, skb, NULL, NULL, NULL, 346 "nf_ct_%s: dropping packet: %pV ", helper->name, &vaf); 347 348 va_end(args); 349 } 350 EXPORT_SYMBOL_GPL(nf_ct_helper_log); 351 352 int nf_conntrack_helper_register(struct nf_conntrack_helper *me) 353 { 354 struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) }; 355 unsigned int h = helper_hash(&me->tuple); 356 struct nf_conntrack_helper *cur; 357 int ret = 0, i; 358 359 BUG_ON(me->expect_policy == NULL); 360 BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES); 361 BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1); 362 363 if (me->expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) 364 return -EINVAL; 365 366 mutex_lock(&nf_ct_helper_mutex); 367 for (i = 0; i < nf_ct_helper_hsize; i++) { 368 hlist_for_each_entry(cur, &nf_ct_helper_hash[i], hnode) { 369 if (!strcmp(cur->name, me->name) && 370 (cur->tuple.src.l3num == NFPROTO_UNSPEC || 371 cur->tuple.src.l3num == me->tuple.src.l3num) && 372 cur->tuple.dst.protonum == me->tuple.dst.protonum) { 373 ret = -EEXIST; 374 goto out; 375 } 376 } 377 } 378 379 /* avoid unpredictable behaviour for auto_assign_helper */ 380 if (!(me->flags & NF_CT_HELPER_F_USERSPACE)) { 381 hlist_for_each_entry(cur, &nf_ct_helper_hash[h], hnode) { 382 if (nf_ct_tuple_src_mask_cmp(&cur->tuple, &me->tuple, 383 &mask)) { 384 ret = -EEXIST; 385 goto out; 386 } 387 } 388 } 389 refcount_set(&me->refcnt, 1); 390 hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]); 391 nf_ct_helper_count++; 392 out: 393 mutex_unlock(&nf_ct_helper_mutex); 394 return ret; 395 } 396 EXPORT_SYMBOL_GPL(nf_conntrack_helper_register); 397 398 static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data) 399 { 400 struct nf_conn_help *help = nfct_help(exp->master); 401 const struct nf_conntrack_helper *me = data; 402 const struct nf_conntrack_helper *this; 403 404 if (exp->helper == me) 405 return true; 406 407 this = rcu_dereference_protected(help->helper, 408 lockdep_is_held(&nf_conntrack_expect_lock)); 409 return this == me; 410 } 411 412 void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) 413 { 414 mutex_lock(&nf_ct_helper_mutex); 415 hlist_del_rcu(&me->hnode); 416 nf_ct_helper_count--; 417 mutex_unlock(&nf_ct_helper_mutex); 418 419 /* Make sure every nothing is still using the helper unless its a 420 * connection in the hash. 421 */ 422 synchronize_rcu(); 423 424 nf_ct_expect_iterate_destroy(expect_iter_me, NULL); 425 nf_ct_iterate_destroy(unhelp, me); 426 } 427 EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister); 428 429 void nf_ct_helper_init(struct nf_conntrack_helper *helper, 430 u16 l3num, u16 protonum, const char *name, 431 u16 default_port, u16 spec_port, u32 id, 432 const struct nf_conntrack_expect_policy *exp_pol, 433 u32 expect_class_max, 434 int (*help)(struct sk_buff *skb, unsigned int protoff, 435 struct nf_conn *ct, 436 enum ip_conntrack_info ctinfo), 437 int (*from_nlattr)(struct nlattr *attr, 438 struct nf_conn *ct), 439 struct module *module) 440 { 441 helper->tuple.src.l3num = l3num; 442 helper->tuple.dst.protonum = protonum; 443 helper->tuple.src.u.all = htons(spec_port); 444 helper->expect_policy = exp_pol; 445 helper->expect_class_max = expect_class_max; 446 helper->help = help; 447 helper->from_nlattr = from_nlattr; 448 helper->me = module; 449 snprintf(helper->nat_mod_name, sizeof(helper->nat_mod_name), 450 NF_NAT_HELPER_PREFIX "%s", name); 451 452 if (spec_port == default_port) 453 snprintf(helper->name, sizeof(helper->name), "%s", name); 454 else 455 snprintf(helper->name, sizeof(helper->name), "%s-%u", name, id); 456 } 457 EXPORT_SYMBOL_GPL(nf_ct_helper_init); 458 459 int nf_conntrack_helpers_register(struct nf_conntrack_helper *helper, 460 unsigned int n) 461 { 462 unsigned int i; 463 int err = 0; 464 465 for (i = 0; i < n; i++) { 466 err = nf_conntrack_helper_register(&helper[i]); 467 if (err < 0) 468 goto err; 469 } 470 471 return err; 472 err: 473 if (i > 0) 474 nf_conntrack_helpers_unregister(helper, i); 475 return err; 476 } 477 EXPORT_SYMBOL_GPL(nf_conntrack_helpers_register); 478 479 void nf_conntrack_helpers_unregister(struct nf_conntrack_helper *helper, 480 unsigned int n) 481 { 482 while (n-- > 0) 483 nf_conntrack_helper_unregister(&helper[n]); 484 } 485 EXPORT_SYMBOL_GPL(nf_conntrack_helpers_unregister); 486 487 void nf_nat_helper_register(struct nf_conntrack_nat_helper *nat) 488 { 489 mutex_lock(&nf_ct_nat_helpers_mutex); 490 list_add_rcu(&nat->list, &nf_ct_nat_helpers); 491 mutex_unlock(&nf_ct_nat_helpers_mutex); 492 } 493 EXPORT_SYMBOL_GPL(nf_nat_helper_register); 494 495 void nf_nat_helper_unregister(struct nf_conntrack_nat_helper *nat) 496 { 497 mutex_lock(&nf_ct_nat_helpers_mutex); 498 list_del_rcu(&nat->list); 499 mutex_unlock(&nf_ct_nat_helpers_mutex); 500 } 501 EXPORT_SYMBOL_GPL(nf_nat_helper_unregister); 502 503 int nf_conntrack_helper_init(void) 504 { 505 nf_ct_helper_hsize = 1; /* gets rounded up to use one page */ 506 nf_ct_helper_hash = 507 nf_ct_alloc_hashtable(&nf_ct_helper_hsize, 0); 508 if (!nf_ct_helper_hash) 509 return -ENOMEM; 510 511 INIT_LIST_HEAD(&nf_ct_nat_helpers); 512 return 0; 513 } 514 515 void nf_conntrack_helper_fini(void) 516 { 517 kvfree(nf_ct_helper_hash); 518 } 519