1d2912cb1SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
26fecd198SMichal Schmidt /* SANE connection tracking helper
36fecd198SMichal Schmidt * (SANE = Scanner Access Now Easy)
46fecd198SMichal Schmidt * For documentation about the SANE network protocol see
56fecd198SMichal Schmidt * http://www.sane-project.org/html/doc015.html
66fecd198SMichal Schmidt */
76fecd198SMichal Schmidt
86fecd198SMichal Schmidt /* Copyright (C) 2007 Red Hat, Inc.
96fecd198SMichal Schmidt * Author: Michal Schmidt <mschmidt@redhat.com>
106fecd198SMichal Schmidt * Based on the FTP conntrack helper (net/netfilter/nf_conntrack_ftp.c):
116fecd198SMichal Schmidt * (C) 1999-2001 Paul `Rusty' Russell
126fecd198SMichal Schmidt * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
136fecd198SMichal Schmidt * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
146fecd198SMichal Schmidt * (C) 2003 Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
156fecd198SMichal Schmidt */
166fecd198SMichal Schmidt
17ad6d9503SPablo Neira Ayuso #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
18ad6d9503SPablo Neira Ayuso
196fecd198SMichal Schmidt #include <linux/module.h>
206fecd198SMichal Schmidt #include <linux/moduleparam.h>
216fecd198SMichal Schmidt #include <linux/netfilter.h>
225a0e3ad6STejun Heo #include <linux/slab.h>
236fecd198SMichal Schmidt #include <linux/in.h>
246fecd198SMichal Schmidt #include <linux/tcp.h>
256fecd198SMichal Schmidt #include <net/netfilter/nf_conntrack.h>
266fecd198SMichal Schmidt #include <net/netfilter/nf_conntrack_helper.h>
276fecd198SMichal Schmidt #include <net/netfilter/nf_conntrack_expect.h>
286fecd198SMichal Schmidt #include <linux/netfilter/nf_conntrack_sane.h>
296fecd198SMichal Schmidt
3008010a21SFlavio Leitner #define HELPER_NAME "sane"
3108010a21SFlavio Leitner
326fecd198SMichal Schmidt MODULE_LICENSE("GPL");
336fecd198SMichal Schmidt MODULE_AUTHOR("Michal Schmidt <mschmidt@redhat.com>");
346fecd198SMichal Schmidt MODULE_DESCRIPTION("SANE connection tracking helper");
3508010a21SFlavio Leitner MODULE_ALIAS_NFCT_HELPER(HELPER_NAME);
366fecd198SMichal Schmidt
376fecd198SMichal Schmidt #define MAX_PORTS 8
386fecd198SMichal Schmidt static u_int16_t ports[MAX_PORTS];
396fecd198SMichal Schmidt static unsigned int ports_c;
406fecd198SMichal Schmidt module_param_array(ports, ushort, &ports_c, 0400);
416fecd198SMichal Schmidt
426fecd198SMichal Schmidt struct sane_request {
436fecd198SMichal Schmidt __be32 RPC_code;
446fecd198SMichal Schmidt #define SANE_NET_START 7 /* RPC code */
456fecd198SMichal Schmidt
466fecd198SMichal Schmidt __be32 handle;
476fecd198SMichal Schmidt };
486fecd198SMichal Schmidt
496fecd198SMichal Schmidt struct sane_reply_net_start {
506fecd198SMichal Schmidt __be32 status;
516fecd198SMichal Schmidt #define SANE_STATUS_SUCCESS 0
526fecd198SMichal Schmidt
536fecd198SMichal Schmidt __be16 zero;
546fecd198SMichal Schmidt __be16 port;
556fecd198SMichal Schmidt /* other fields aren't interesting for conntrack */
566fecd198SMichal Schmidt };
576fecd198SMichal Schmidt
help(struct sk_buff * skb,unsigned int protoff,struct nf_conn * ct,enum ip_conntrack_info ctinfo)583db05feaSHerbert Xu static int help(struct sk_buff *skb,
596fecd198SMichal Schmidt unsigned int protoff,
606fecd198SMichal Schmidt struct nf_conn *ct,
616fecd198SMichal Schmidt enum ip_conntrack_info ctinfo)
626fecd198SMichal Schmidt {
636fecd198SMichal Schmidt unsigned int dataoff, datalen;
6402e23f40SJan Engelhardt const struct tcphdr *th;
6502e23f40SJan Engelhardt struct tcphdr _tcph;
666fecd198SMichal Schmidt int ret = NF_ACCEPT;
676fecd198SMichal Schmidt int dir = CTINFO2DIR(ctinfo);
681afc5679SPablo Neira Ayuso struct nf_ct_sane_master *ct_sane_info = nfct_help_data(ct);
696fecd198SMichal Schmidt struct nf_conntrack_expect *exp;
706fecd198SMichal Schmidt struct nf_conntrack_tuple *tuple;
716fecd198SMichal Schmidt struct sane_reply_net_start *reply;
72*a664375dSFlorian Westphal union {
73*a664375dSFlorian Westphal struct sane_request req;
74*a664375dSFlorian Westphal struct sane_reply_net_start repl;
75*a664375dSFlorian Westphal } buf;
766fecd198SMichal Schmidt
776fecd198SMichal Schmidt /* Until there's been traffic both ways, don't look in packets. */
786fecd198SMichal Schmidt if (ctinfo != IP_CT_ESTABLISHED &&
79fb048833SEric Dumazet ctinfo != IP_CT_ESTABLISHED_REPLY)
806fecd198SMichal Schmidt return NF_ACCEPT;
816fecd198SMichal Schmidt
826fecd198SMichal Schmidt /* Not a full tcp header? */
833db05feaSHerbert Xu th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
846fecd198SMichal Schmidt if (th == NULL)
856fecd198SMichal Schmidt return NF_ACCEPT;
866fecd198SMichal Schmidt
876fecd198SMichal Schmidt /* No data? */
886fecd198SMichal Schmidt dataoff = protoff + th->doff * 4;
893db05feaSHerbert Xu if (dataoff >= skb->len)
906fecd198SMichal Schmidt return NF_ACCEPT;
916fecd198SMichal Schmidt
923db05feaSHerbert Xu datalen = skb->len - dataoff;
93*a664375dSFlorian Westphal if (dir == IP_CT_DIR_ORIGINAL) {
94*a664375dSFlorian Westphal const struct sane_request *req;
956fecd198SMichal Schmidt
96*a664375dSFlorian Westphal if (datalen != sizeof(struct sane_request))
97*a664375dSFlorian Westphal return NF_ACCEPT;
98*a664375dSFlorian Westphal
99*a664375dSFlorian Westphal req = skb_header_pointer(skb, dataoff, datalen, &buf.req);
100*a664375dSFlorian Westphal if (!req)
101*a664375dSFlorian Westphal return NF_ACCEPT;
102*a664375dSFlorian Westphal
103*a664375dSFlorian Westphal if (req->RPC_code != htonl(SANE_NET_START)) {
104*a664375dSFlorian Westphal /* Not an interesting command */
105*a664375dSFlorian Westphal WRITE_ONCE(ct_sane_info->state, SANE_STATE_NORMAL);
106198ad973SPablo Neira Ayuso return NF_ACCEPT;
107198ad973SPablo Neira Ayuso }
1086fecd198SMichal Schmidt
1096fecd198SMichal Schmidt /* We're interested in the next reply */
110*a664375dSFlorian Westphal WRITE_ONCE(ct_sane_info->state, SANE_STATE_START_REQUESTED);
111*a664375dSFlorian Westphal return NF_ACCEPT;
1126fecd198SMichal Schmidt }
1136fecd198SMichal Schmidt
114*a664375dSFlorian Westphal /* IP_CT_DIR_REPLY */
115*a664375dSFlorian Westphal
1166fecd198SMichal Schmidt /* Is it a reply to an uninteresting command? */
117*a664375dSFlorian Westphal if (READ_ONCE(ct_sane_info->state) != SANE_STATE_START_REQUESTED)
118*a664375dSFlorian Westphal return NF_ACCEPT;
1196fecd198SMichal Schmidt
1206fecd198SMichal Schmidt /* It's a reply to SANE_NET_START. */
121*a664375dSFlorian Westphal WRITE_ONCE(ct_sane_info->state, SANE_STATE_NORMAL);
1226fecd198SMichal Schmidt
1236fecd198SMichal Schmidt if (datalen < sizeof(struct sane_reply_net_start)) {
124ad6d9503SPablo Neira Ayuso pr_debug("NET_START reply too short\n");
125*a664375dSFlorian Westphal return NF_ACCEPT;
1266fecd198SMichal Schmidt }
1276fecd198SMichal Schmidt
128*a664375dSFlorian Westphal datalen = sizeof(struct sane_reply_net_start);
129*a664375dSFlorian Westphal
130*a664375dSFlorian Westphal reply = skb_header_pointer(skb, dataoff, datalen, &buf.repl);
131*a664375dSFlorian Westphal if (!reply)
132*a664375dSFlorian Westphal return NF_ACCEPT;
133*a664375dSFlorian Westphal
1346fecd198SMichal Schmidt if (reply->status != htonl(SANE_STATUS_SUCCESS)) {
1356fecd198SMichal Schmidt /* saned refused the command */
136ad6d9503SPablo Neira Ayuso pr_debug("unsuccessful SANE_STATUS = %u\n",
1376fecd198SMichal Schmidt ntohl(reply->status));
138*a664375dSFlorian Westphal return NF_ACCEPT;
1396fecd198SMichal Schmidt }
1406fecd198SMichal Schmidt
1416fecd198SMichal Schmidt /* Invalid saned reply? Ignore it. */
1426fecd198SMichal Schmidt if (reply->zero != 0)
143*a664375dSFlorian Westphal return NF_ACCEPT;
1446fecd198SMichal Schmidt
1456823645dSPatrick McHardy exp = nf_ct_expect_alloc(ct);
1466fecd198SMichal Schmidt if (exp == NULL) {
147b20ab9ccSPablo Neira Ayuso nf_ct_helper_log(skb, ct, "cannot alloc expectation");
148*a664375dSFlorian Westphal return NF_DROP;
1496fecd198SMichal Schmidt }
1506fecd198SMichal Schmidt
1516fecd198SMichal Schmidt tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
1525e8fbe2aSPatrick McHardy nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
1536002f266SPatrick McHardy &tuple->src.u3, &tuple->dst.u3,
1546823645dSPatrick McHardy IPPROTO_TCP, NULL, &reply->port);
1556fecd198SMichal Schmidt
156ad6d9503SPablo Neira Ayuso pr_debug("expect: ");
1573c9fba65SJan Engelhardt nf_ct_dump_tuple(&exp->tuple);
1586fecd198SMichal Schmidt
1596fecd198SMichal Schmidt /* Can't expect this? Best to drop packet now. */
1603c00fb0bSxiao ruizhu if (nf_ct_expect_related(exp, 0) != 0) {
161b20ab9ccSPablo Neira Ayuso nf_ct_helper_log(skb, ct, "cannot add expectation");
1626fecd198SMichal Schmidt ret = NF_DROP;
163b20ab9ccSPablo Neira Ayuso }
1646fecd198SMichal Schmidt
1656823645dSPatrick McHardy nf_ct_expect_put(exp);
1666fecd198SMichal Schmidt return ret;
1676fecd198SMichal Schmidt }
1686fecd198SMichal Schmidt
16982de0be6SGao Feng static struct nf_conntrack_helper sane[MAX_PORTS * 2] __read_mostly;
1706fecd198SMichal Schmidt
1716002f266SPatrick McHardy static const struct nf_conntrack_expect_policy sane_exp_policy = {
1726002f266SPatrick McHardy .max_expected = 1,
1736002f266SPatrick McHardy .timeout = 5 * 60,
1746002f266SPatrick McHardy };
1756002f266SPatrick McHardy
nf_conntrack_sane_fini(void)17635341a61STaehee Yoo static void __exit nf_conntrack_sane_fini(void)
1776fecd198SMichal Schmidt {
17882de0be6SGao Feng nf_conntrack_helpers_unregister(sane, ports_c * 2);
1796fecd198SMichal Schmidt }
1806fecd198SMichal Schmidt
nf_conntrack_sane_init(void)1816fecd198SMichal Schmidt static int __init nf_conntrack_sane_init(void)
1826fecd198SMichal Schmidt {
18382de0be6SGao Feng int i, ret = 0;
1846fecd198SMichal Schmidt
185dcf67740SFlorian Westphal NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_sane_master));
186dcf67740SFlorian Westphal
1876fecd198SMichal Schmidt if (ports_c == 0)
1886fecd198SMichal Schmidt ports[ports_c++] = SANE_PORT;
1896fecd198SMichal Schmidt
1906fecd198SMichal Schmidt /* FIXME should be configurable whether IPv4 and IPv6 connections
1916fecd198SMichal Schmidt are tracked or not - YK */
1926fecd198SMichal Schmidt for (i = 0; i < ports_c; i++) {
19308010a21SFlavio Leitner nf_ct_helper_init(&sane[2 * i], AF_INET, IPPROTO_TCP,
19408010a21SFlavio Leitner HELPER_NAME, SANE_PORT, ports[i], ports[i],
1959f0f3ebeSFlorian Westphal &sane_exp_policy, 0, help, NULL,
19682de0be6SGao Feng THIS_MODULE);
19708010a21SFlavio Leitner nf_ct_helper_init(&sane[2 * i + 1], AF_INET6, IPPROTO_TCP,
19808010a21SFlavio Leitner HELPER_NAME, SANE_PORT, ports[i], ports[i],
1999f0f3ebeSFlorian Westphal &sane_exp_policy, 0, help, NULL,
20082de0be6SGao Feng THIS_MODULE);
20182de0be6SGao Feng }
2026fecd198SMichal Schmidt
20382de0be6SGao Feng ret = nf_conntrack_helpers_register(sane, ports_c * 2);
20482de0be6SGao Feng if (ret < 0) {
20582de0be6SGao Feng pr_err("failed to register helpers\n");
2066fecd198SMichal Schmidt return ret;
2076fecd198SMichal Schmidt }
2086fecd198SMichal Schmidt
2096fecd198SMichal Schmidt return 0;
2106fecd198SMichal Schmidt }
2116fecd198SMichal Schmidt
2126fecd198SMichal Schmidt module_init(nf_conntrack_sane_init);
2136fecd198SMichal Schmidt module_exit(nf_conntrack_sane_fini);
214