xref: /openbmc/linux/net/netfilter/xt_CT.c (revision 11f7aee2) 
1 /*
2  * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  */
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 #include <linux/module.h>
10 #include <linux/gfp.h>
11 #include <linux/skbuff.h>
12 #include <linux/netfilter_ipv4/ip_tables.h>
13 #include <linux/netfilter_ipv6/ip6_tables.h>
14 #include <linux/netfilter/x_tables.h>
15 #include <linux/netfilter/xt_CT.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_l4proto.h>
18 #include <net/netfilter/nf_conntrack_helper.h>
19 #include <net/netfilter/nf_conntrack_ecache.h>
20 #include <net/netfilter/nf_conntrack_timeout.h>
21 #include <net/netfilter/nf_conntrack_zones.h>
22 
23 static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
24 {
25 	/* Previously seen (loopback)? Ignore. */
26 	if (skb->_nfct != 0)
27 		return XT_CONTINUE;
28 
29 	if (ct) {
30 		atomic_inc(&ct->ct_general.use);
31 		nf_ct_set(skb, ct, IP_CT_NEW);
32 	} else {
33 		nf_ct_set(skb, ct, IP_CT_UNTRACKED);
34 	}
35 
36 	return XT_CONTINUE;
37 }
38 
39 static unsigned int xt_ct_target_v0(struct sk_buff *skb,
40 				    const struct xt_action_param *par)
41 {
42 	const struct xt_ct_target_info *info = par->targinfo;
43 	struct nf_conn *ct = info->ct;
44 
45 	return xt_ct_target(skb, ct);
46 }
47 
48 static unsigned int xt_ct_target_v1(struct sk_buff *skb,
49 				    const struct xt_action_param *par)
50 {
51 	const struct xt_ct_target_info_v1 *info = par->targinfo;
52 	struct nf_conn *ct = info->ct;
53 
54 	return xt_ct_target(skb, ct);
55 }
56 
57 static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
58 {
59 	if (par->family == NFPROTO_IPV4) {
60 		const struct ipt_entry *e = par->entryinfo;
61 
62 		if (e->ip.invflags & IPT_INV_PROTO)
63 			return 0;
64 		return e->ip.proto;
65 	} else if (par->family == NFPROTO_IPV6) {
66 		const struct ip6t_entry *e = par->entryinfo;
67 
68 		if (e->ipv6.invflags & IP6T_INV_PROTO)
69 			return 0;
70 		return e->ipv6.proto;
71 	} else
72 		return 0;
73 }
74 
75 static int
76 xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
77 		 const struct xt_tgchk_param *par)
78 {
79 	struct nf_conntrack_helper *helper;
80 	struct nf_conn_help *help;
81 	u8 proto;
82 
83 	proto = xt_ct_find_proto(par);
84 	if (!proto) {
85 		pr_info_ratelimited("You must specify a L4 protocol and not use inversions on it\n");
86 		return -ENOENT;
87 	}
88 
89 	helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
90 						    proto);
91 	if (helper == NULL) {
92 		pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
93 		return -ENOENT;
94 	}
95 
96 	help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
97 	if (help == NULL) {
98 		nf_conntrack_helper_put(helper);
99 		return -ENOMEM;
100 	}
101 
102 	help->helper = helper;
103 	return 0;
104 }
105 
106 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
107 static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
108 {
109 	typeof(nf_ct_timeout_put_hook) timeout_put;
110 
111 	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
112 	if (timeout_put)
113 		timeout_put(timeout);
114 }
115 #endif
116 
117 static int
118 xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
119 		  const char *timeout_name)
120 {
121 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
122 	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
123 	const struct nf_conntrack_l4proto *l4proto;
124 	struct ctnl_timeout *timeout;
125 	struct nf_conn_timeout *timeout_ext;
126 	const char *errmsg = NULL;
127 	int ret = 0;
128 	u8 proto;
129 
130 	rcu_read_lock();
131 	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
132 	if (timeout_find_get == NULL) {
133 		ret = -ENOENT;
134 		errmsg = "Timeout policy base is empty";
135 		goto out;
136 	}
137 
138 	proto = xt_ct_find_proto(par);
139 	if (!proto) {
140 		ret = -EINVAL;
141 		errmsg = "You must specify a L4 protocol and not use inversions on it";
142 		goto out;
143 	}
144 
145 	timeout = timeout_find_get(par->net, timeout_name);
146 	if (timeout == NULL) {
147 		ret = -ENOENT;
148 		pr_info_ratelimited("No such timeout policy \"%s\"\n",
149 				    timeout_name);
150 		goto out;
151 	}
152 
153 	if (timeout->l3num != par->family) {
154 		ret = -EINVAL;
155 		pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
156 				    timeout_name, 3, timeout->l3num);
157 		goto err_put_timeout;
158 	}
159 	/* Make sure the timeout policy matches any existing protocol tracker,
160 	 * otherwise default to generic.
161 	 */
162 	l4proto = __nf_ct_l4proto_find(par->family, proto);
163 	if (timeout->l4proto->l4proto != l4proto->l4proto) {
164 		ret = -EINVAL;
165 		pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
166 				    timeout_name, 4, timeout->l4proto->l4proto);
167 		goto err_put_timeout;
168 	}
169 	timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
170 	if (!timeout_ext) {
171 		ret = -ENOMEM;
172 		goto err_put_timeout;
173 	}
174 
175 	rcu_read_unlock();
176 	return ret;
177 
178 err_put_timeout:
179 	__xt_ct_tg_timeout_put(timeout);
180 out:
181 	rcu_read_unlock();
182 	if (errmsg)
183 		pr_info_ratelimited("%s\n", errmsg);
184 	return ret;
185 #else
186 	return -EOPNOTSUPP;
187 #endif
188 }
189 
190 static u16 xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 *info)
191 {
192 	switch (info->flags & (XT_CT_ZONE_DIR_ORIG |
193 			       XT_CT_ZONE_DIR_REPL)) {
194 	case XT_CT_ZONE_DIR_ORIG:
195 		return NF_CT_ZONE_DIR_ORIG;
196 	case XT_CT_ZONE_DIR_REPL:
197 		return NF_CT_ZONE_DIR_REPL;
198 	default:
199 		return NF_CT_DEFAULT_ZONE_DIR;
200 	}
201 }
202 
203 static int xt_ct_tg_check(const struct xt_tgchk_param *par,
204 			  struct xt_ct_target_info_v1 *info)
205 {
206 	struct nf_conntrack_zone zone;
207 	struct nf_conn_help *help;
208 	struct nf_conn *ct;
209 	int ret = -EOPNOTSUPP;
210 
211 	if (info->flags & XT_CT_NOTRACK) {
212 		ct = NULL;
213 		goto out;
214 	}
215 
216 #ifndef CONFIG_NF_CONNTRACK_ZONES
217 	if (info->zone || info->flags & (XT_CT_ZONE_DIR_ORIG |
218 					 XT_CT_ZONE_DIR_REPL |
219 					 XT_CT_ZONE_MARK))
220 		goto err1;
221 #endif
222 
223 	ret = nf_ct_netns_get(par->net, par->family);
224 	if (ret < 0)
225 		goto err1;
226 
227 	memset(&zone, 0, sizeof(zone));
228 	zone.id = info->zone;
229 	zone.dir = xt_ct_flags_to_dir(info);
230 	if (info->flags & XT_CT_ZONE_MARK)
231 		zone.flags |= NF_CT_FLAG_MARK;
232 
233 	ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL);
234 	if (!ct) {
235 		ret = -ENOMEM;
236 		goto err2;
237 	}
238 
239 	ret = 0;
240 	if ((info->ct_events || info->exp_events) &&
241 	    !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
242 				  GFP_KERNEL)) {
243 		ret = -EINVAL;
244 		goto err3;
245 	}
246 
247 	if (info->helper[0]) {
248 		ret = xt_ct_set_helper(ct, info->helper, par);
249 		if (ret < 0)
250 			goto err3;
251 	}
252 
253 	if (info->timeout[0]) {
254 		ret = xt_ct_set_timeout(ct, par, info->timeout);
255 		if (ret < 0)
256 			goto err4;
257 	}
258 	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
259 	nf_conntrack_get(&ct->ct_general);
260 out:
261 	info->ct = ct;
262 	return 0;
263 
264 err4:
265 	help = nfct_help(ct);
266 	if (help)
267 		nf_conntrack_helper_put(help->helper);
268 err3:
269 	nf_ct_tmpl_free(ct);
270 err2:
271 	nf_ct_netns_put(par->net, par->family);
272 err1:
273 	return ret;
274 }
275 
276 static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
277 {
278 	struct xt_ct_target_info *info = par->targinfo;
279 	struct xt_ct_target_info_v1 info_v1 = {
280 		.flags 		= info->flags,
281 		.zone		= info->zone,
282 		.ct_events	= info->ct_events,
283 		.exp_events	= info->exp_events,
284 	};
285 	int ret;
286 
287 	if (info->flags & ~XT_CT_NOTRACK)
288 		return -EINVAL;
289 
290 	memcpy(info_v1.helper, info->helper, sizeof(info->helper));
291 
292 	ret = xt_ct_tg_check(par, &info_v1);
293 	if (ret < 0)
294 		return ret;
295 
296 	info->ct = info_v1.ct;
297 
298 	return ret;
299 }
300 
301 static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
302 {
303 	struct xt_ct_target_info_v1 *info = par->targinfo;
304 
305 	if (info->flags & ~XT_CT_NOTRACK)
306 		return -EINVAL;
307 
308 	return xt_ct_tg_check(par, par->targinfo);
309 }
310 
311 static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
312 {
313 	struct xt_ct_target_info_v1 *info = par->targinfo;
314 
315 	if (info->flags & ~XT_CT_MASK)
316 		return -EINVAL;
317 
318 	return xt_ct_tg_check(par, par->targinfo);
319 }
320 
321 static void xt_ct_destroy_timeout(struct nf_conn *ct)
322 {
323 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
324 	struct nf_conn_timeout *timeout_ext;
325 	typeof(nf_ct_timeout_put_hook) timeout_put;
326 
327 	rcu_read_lock();
328 	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
329 
330 	if (timeout_put) {
331 		timeout_ext = nf_ct_timeout_find(ct);
332 		if (timeout_ext) {
333 			timeout_put(timeout_ext->timeout);
334 			RCU_INIT_POINTER(timeout_ext->timeout, NULL);
335 		}
336 	}
337 	rcu_read_unlock();
338 #endif
339 }
340 
341 static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
342 			     struct xt_ct_target_info_v1 *info)
343 {
344 	struct nf_conn *ct = info->ct;
345 	struct nf_conn_help *help;
346 
347 	if (ct) {
348 		help = nfct_help(ct);
349 		if (help)
350 			nf_conntrack_helper_put(help->helper);
351 
352 		nf_ct_netns_put(par->net, par->family);
353 
354 		xt_ct_destroy_timeout(ct);
355 		nf_ct_put(info->ct);
356 	}
357 }
358 
359 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
360 {
361 	struct xt_ct_target_info *info = par->targinfo;
362 	struct xt_ct_target_info_v1 info_v1 = {
363 		.flags 		= info->flags,
364 		.zone		= info->zone,
365 		.ct_events	= info->ct_events,
366 		.exp_events	= info->exp_events,
367 		.ct		= info->ct,
368 	};
369 	memcpy(info_v1.helper, info->helper, sizeof(info->helper));
370 
371 	xt_ct_tg_destroy(par, &info_v1);
372 }
373 
374 static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
375 {
376 	xt_ct_tg_destroy(par, par->targinfo);
377 }
378 
379 static struct xt_target xt_ct_tg_reg[] __read_mostly = {
380 	{
381 		.name		= "CT",
382 		.family		= NFPROTO_UNSPEC,
383 		.targetsize	= sizeof(struct xt_ct_target_info),
384 		.usersize	= offsetof(struct xt_ct_target_info, ct),
385 		.checkentry	= xt_ct_tg_check_v0,
386 		.destroy	= xt_ct_tg_destroy_v0,
387 		.target		= xt_ct_target_v0,
388 		.table		= "raw",
389 		.me		= THIS_MODULE,
390 	},
391 	{
392 		.name		= "CT",
393 		.family		= NFPROTO_UNSPEC,
394 		.revision	= 1,
395 		.targetsize	= sizeof(struct xt_ct_target_info_v1),
396 		.usersize	= offsetof(struct xt_ct_target_info, ct),
397 		.checkentry	= xt_ct_tg_check_v1,
398 		.destroy	= xt_ct_tg_destroy_v1,
399 		.target		= xt_ct_target_v1,
400 		.table		= "raw",
401 		.me		= THIS_MODULE,
402 	},
403 	{
404 		.name		= "CT",
405 		.family		= NFPROTO_UNSPEC,
406 		.revision	= 2,
407 		.targetsize	= sizeof(struct xt_ct_target_info_v1),
408 		.usersize	= offsetof(struct xt_ct_target_info, ct),
409 		.checkentry	= xt_ct_tg_check_v2,
410 		.destroy	= xt_ct_tg_destroy_v1,
411 		.target		= xt_ct_target_v1,
412 		.table		= "raw",
413 		.me		= THIS_MODULE,
414 	},
415 };
416 
417 static unsigned int
418 notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
419 {
420 	/* Previously seen (loopback)? Ignore. */
421 	if (skb->_nfct != 0)
422 		return XT_CONTINUE;
423 
424 	nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
425 
426 	return XT_CONTINUE;
427 }
428 
429 static int notrack_chk(const struct xt_tgchk_param *par)
430 {
431 	if (!par->net->xt.notrack_deprecated_warning) {
432 		pr_info("netfilter: NOTRACK target is deprecated, "
433 			"use CT instead or upgrade iptables\n");
434 		par->net->xt.notrack_deprecated_warning = true;
435 	}
436 	return 0;
437 }
438 
439 static struct xt_target notrack_tg_reg __read_mostly = {
440 	.name		= "NOTRACK",
441 	.revision	= 0,
442 	.family		= NFPROTO_UNSPEC,
443 	.checkentry	= notrack_chk,
444 	.target		= notrack_tg,
445 	.table		= "raw",
446 	.me		= THIS_MODULE,
447 };
448 
449 static int __init xt_ct_tg_init(void)
450 {
451 	int ret;
452 
453 	ret = xt_register_target(&notrack_tg_reg);
454 	if (ret < 0)
455 		return ret;
456 
457 	ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
458 	if (ret < 0) {
459 		xt_unregister_target(&notrack_tg_reg);
460 		return ret;
461 	}
462 	return 0;
463 }
464 
465 static void __exit xt_ct_tg_exit(void)
466 {
467 	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
468 	xt_unregister_target(&notrack_tg_reg);
469 }
470 
471 module_init(xt_ct_tg_init);
472 module_exit(xt_ct_tg_exit);
473 
474 MODULE_LICENSE("GPL");
475 MODULE_DESCRIPTION("Xtables: connection tracking target");
476 MODULE_ALIAS("ipt_CT");
477 MODULE_ALIAS("ip6t_CT");
478 MODULE_ALIAS("ipt_NOTRACK");
479 MODULE_ALIAS("ip6t_NOTRACK");
480