net/netfilter/xt_CT.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
   4  */
   5 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   6 #include <linux/module.h>
   7 #include <linux/gfp.h>
   8 #include <linux/skbuff.h>
   9 #include <linux/netfilter_ipv4/ip_tables.h>
  10 #include <linux/netfilter_ipv6/ip6_tables.h>
  11 #include <linux/netfilter/x_tables.h>
  12 #include <linux/netfilter/xt_CT.h>
  13 #include <net/netfilter/nf_conntrack.h>
  14 #include <net/netfilter/nf_conntrack_l4proto.h>
  15 #include <net/netfilter/nf_conntrack_helper.h>
  16 #include <net/netfilter/nf_conntrack_ecache.h>
  17 #include <net/netfilter/nf_conntrack_timeout.h>
  18 #include <net/netfilter/nf_conntrack_zones.h>
  19
  20 static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
  21 {
  22         /* Previously seen (loopback)? Ignore. */
  23         if (skb->_nfct != 0)
  24                 return XT_CONTINUE;
  25
  26         if (ct) {
  27                 atomic_inc(&ct->ct_general.use);
  28                 nf_ct_set(skb, ct, IP_CT_NEW);
  29         } else {
  30                 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
  31         }
  32
  33         return XT_CONTINUE;
  34 }
  35
  36 static unsigned int xt_ct_target_v0(struct sk_buff *skb,
  37                                     const struct xt_action_param *par)
  38 {
  39         const struct xt_ct_target_info *info = par->targinfo;
  40         struct nf_conn *ct = info->ct;
  41
  42         return xt_ct_target(skb, ct);
  43 }
  44
  45 static unsigned int xt_ct_target_v1(struct sk_buff *skb,
  46                                     const struct xt_action_param *par)
  47 {
  48         const struct xt_ct_target_info_v1 *info = par->targinfo;
  49         struct nf_conn *ct = info->ct;
  50
  51         return xt_ct_target(skb, ct);
  52 }
  53
  54 static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
  55 {
  56         if (par->family == NFPROTO_IPV4) {
  57                 const struct ipt_entry *e = par->entryinfo;
  58
  59                 if (e->ip.invflags & IPT_INV_PROTO)
  60                         return 0;
  61                 return e->ip.proto;
  62         } else if (par->family == NFPROTO_IPV6) {
  63                 const struct ip6t_entry *e = par->entryinfo;
  64
  65                 if (e->ipv6.invflags & IP6T_INV_PROTO)
  66                         return 0;
  67                 return e->ipv6.proto;
  68         } else
  69                 return 0;
  70 }
  71
  72 static int
  73 xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
  74                  const struct xt_tgchk_param *par)
  75 {
  76         struct nf_conntrack_helper *helper;
  77         struct nf_conn_help *help;
  78         u8 proto;
  79
  80         proto = xt_ct_find_proto(par);
  81         if (!proto) {
  82                 pr_info_ratelimited("You must specify a L4 protocol and not use inversions on it\n");
  83                 return -ENOENT;
  84         }
  85
  86         helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
  87                                                     proto);
  88         if (helper == NULL) {
  89                 pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
  90                 return -ENOENT;
  91         }
  92
  93         help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
  94         if (help == NULL) {
  95                 nf_conntrack_helper_put(helper);
  96                 return -ENOMEM;
  97         }
  98
  99         help->helper = helper;
 100         return 0;
 101 }
 102
 103 static int
 104 xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
 105                   const char *timeout_name)
 106 {
 107 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 108         const struct nf_conntrack_l4proto *l4proto;
 109         u8 proto;
 110
 111         proto = xt_ct_find_proto(par);
 112         if (!proto) {
 113                 pr_info_ratelimited("You must specify a L4 protocol and not "
 114                                     "use inversions on it");
 115                 return -EINVAL;
 116         }
 117         l4proto = nf_ct_l4proto_find(proto);
 118         return nf_ct_set_timeout(par->net, ct, par->family, l4proto->l4proto,
 119                                  timeout_name);
 120
 121 #else
 122         return -EOPNOTSUPP;
 123 #endif
 124 }
 125
 126 static u16 xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 *info)
 127 {
 128         switch (info->flags & (XT_CT_ZONE_DIR_ORIG |
 129                                XT_CT_ZONE_DIR_REPL)) {
 130         case XT_CT_ZONE_DIR_ORIG:
 131                 return NF_CT_ZONE_DIR_ORIG;
 132         case XT_CT_ZONE_DIR_REPL:
 133                 return NF_CT_ZONE_DIR_REPL;
 134         default:
 135                 return NF_CT_DEFAULT_ZONE_DIR;
 136         }
 137 }
 138
 139 static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 140                           struct xt_ct_target_info_v1 *info)
 141 {
 142         struct nf_conntrack_zone zone;
 143         struct nf_conn_help *help;
 144         struct nf_conn *ct;
 145         int ret = -EOPNOTSUPP;
 146
 147         if (info->flags & XT_CT_NOTRACK) {
 148                 ct = NULL;
 149                 goto out;
 150         }
 151
 152 #ifndef CONFIG_NF_CONNTRACK_ZONES
 153         if (info->zone || info->flags & (XT_CT_ZONE_DIR_ORIG |
 154                                          XT_CT_ZONE_DIR_REPL |
 155                                          XT_CT_ZONE_MARK))
 156                 goto err1;
 157 #endif
 158
 159         ret = nf_ct_netns_get(par->net, par->family);
 160         if (ret < 0)
 161                 goto err1;
 162
 163         memset(&zone, 0, sizeof(zone));
 164         zone.id = info->zone;
 165         zone.dir = xt_ct_flags_to_dir(info);
 166         if (info->flags & XT_CT_ZONE_MARK)
 167                 zone.flags |= NF_CT_FLAG_MARK;
 168
 169         ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL);
 170         if (!ct) {
 171                 ret = -ENOMEM;
 172                 goto err2;
 173         }
 174
 175         if ((info->ct_events || info->exp_events) &&
 176             !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
 177                                   GFP_KERNEL)) {
 178                 ret = -EINVAL;
 179                 goto err3;
 180         }
 181
 182         if (info->helper[0]) {
 183                 if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
 184                         ret = -ENAMETOOLONG;
 185                         goto err3;
 186                 }
 187
 188                 ret = xt_ct_set_helper(ct, info->helper, par);
 189                 if (ret < 0)
 190                         goto err3;
 191         }
 192
 193         if (info->timeout[0]) {
 194                 if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
 195                         ret = -ENAMETOOLONG;
 196                         goto err4;
 197                 }
 198
 199                 ret = xt_ct_set_timeout(ct, par, info->timeout);
 200                 if (ret < 0)
 201                         goto err4;
 202         }
 203         __set_bit(IPS_CONFIRMED_BIT, &ct->status);
 204         nf_conntrack_get(&ct->ct_general);
 205 out:
 206         info->ct = ct;
 207         return 0;
 208
 209 err4:
 210         help = nfct_help(ct);
 211         if (help)
 212                 nf_conntrack_helper_put(help->helper);
 213 err3:
 214         nf_ct_tmpl_free(ct);
 215 err2:
 216         nf_ct_netns_put(par->net, par->family);
 217 err1:
 218         return ret;
 219 }
 220
 221 static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
 222 {
 223         struct xt_ct_target_info *info = par->targinfo;
 224         struct xt_ct_target_info_v1 info_v1 = {
 225                 .flags          = info->flags,
 226                 .zone           = info->zone,
 227                 .ct_events      = info->ct_events,
 228                 .exp_events     = info->exp_events,
 229         };
 230         int ret;
 231
 232         if (info->flags & ~XT_CT_NOTRACK)
 233                 return -EINVAL;
 234
 235         memcpy(info_v1.helper, info->helper, sizeof(info->helper));
 236
 237         ret = xt_ct_tg_check(par, &info_v1);
 238         if (ret < 0)
 239                 return ret;
 240
 241         info->ct = info_v1.ct;
 242
 243         return ret;
 244 }
 245
 246 static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
 247 {
 248         struct xt_ct_target_info_v1 *info = par->targinfo;
 249
 250         if (info->flags & ~XT_CT_NOTRACK)
 251                 return -EINVAL;
 252
 253         return xt_ct_tg_check(par, par->targinfo);
 254 }
 255
 256 static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
 257 {
 258         struct xt_ct_target_info_v1 *info = par->targinfo;
 259
 260         if (info->flags & ~XT_CT_MASK)
 261                 return -EINVAL;
 262
 263         return xt_ct_tg_check(par, par->targinfo);
 264 }
 265
 266 static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
 267                              struct xt_ct_target_info_v1 *info)
 268 {
 269         struct nf_conn *ct = info->ct;
 270         struct nf_conn_help *help;
 271
 272         if (ct) {
 273                 help = nfct_help(ct);
 274                 if (help)
 275                         nf_conntrack_helper_put(help->helper);
 276
 277                 nf_ct_netns_put(par->net, par->family);
 278
 279                 nf_ct_destroy_timeout(ct);
 280                 nf_ct_put(info->ct);
 281         }
 282 }
 283
 284 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
 285 {
 286         struct xt_ct_target_info *info = par->targinfo;
 287         struct xt_ct_target_info_v1 info_v1 = {
 288                 .flags          = info->flags,
 289                 .zone           = info->zone,
 290                 .ct_events      = info->ct_events,
 291                 .exp_events     = info->exp_events,
 292                 .ct             = info->ct,
 293         };
 294         memcpy(info_v1.helper, info->helper, sizeof(info->helper));
 295
 296         xt_ct_tg_destroy(par, &info_v1);
 297 }
 298
 299 static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
 300 {
 301         xt_ct_tg_destroy(par, par->targinfo);
 302 }
 303
 304 static struct xt_target xt_ct_tg_reg[] __read_mostly = {
 305         {
 306                 .name           = "CT",
 307                 .family         = NFPROTO_UNSPEC,
 308                 .targetsize     = sizeof(struct xt_ct_target_info),
 309                 .usersize       = offsetof(struct xt_ct_target_info, ct),
 310                 .checkentry     = xt_ct_tg_check_v0,
 311                 .destroy        = xt_ct_tg_destroy_v0,
 312                 .target         = xt_ct_target_v0,
 313                 .table          = "raw",
 314                 .me             = THIS_MODULE,
 315         },
 316         {
 317                 .name           = "CT",
 318                 .family         = NFPROTO_UNSPEC,
 319                 .revision       = 1,
 320                 .targetsize     = sizeof(struct xt_ct_target_info_v1),
 321                 .usersize       = offsetof(struct xt_ct_target_info, ct),
 322                 .checkentry     = xt_ct_tg_check_v1,
 323                 .destroy        = xt_ct_tg_destroy_v1,
 324                 .target         = xt_ct_target_v1,
 325                 .table          = "raw",
 326                 .me             = THIS_MODULE,
 327         },
 328         {
 329                 .name           = "CT",
 330                 .family         = NFPROTO_UNSPEC,
 331                 .revision       = 2,
 332                 .targetsize     = sizeof(struct xt_ct_target_info_v1),
 333                 .usersize       = offsetof(struct xt_ct_target_info, ct),
 334                 .checkentry     = xt_ct_tg_check_v2,
 335                 .destroy        = xt_ct_tg_destroy_v1,
 336                 .target         = xt_ct_target_v1,
 337                 .table          = "raw",
 338                 .me             = THIS_MODULE,
 339         },
 340 };
 341
 342 static unsigned int
 343 notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
 344 {
 345         /* Previously seen (loopback)? Ignore. */
 346         if (skb->_nfct != 0)
 347                 return XT_CONTINUE;
 348
 349         nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
 350
 351         return XT_CONTINUE;
 352 }
 353
 354 static struct xt_target notrack_tg_reg __read_mostly = {
 355         .name           = "NOTRACK",
 356         .revision       = 0,
 357         .family         = NFPROTO_UNSPEC,
 358         .target         = notrack_tg,
 359         .table          = "raw",
 360         .me             = THIS_MODULE,
 361 };
 362
 363 static int __init xt_ct_tg_init(void)
 364 {
 365         int ret;
 366
 367         ret = xt_register_target(&notrack_tg_reg);
 368         if (ret < 0)
 369                 return ret;
 370
 371         ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
 372         if (ret < 0) {
 373                 xt_unregister_target(&notrack_tg_reg);
 374                 return ret;
 375         }
 376         return 0;
 377 }
 378
 379 static void __exit xt_ct_tg_exit(void)
 380 {
 381         xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
 382         xt_unregister_target(&notrack_tg_reg);
 383 }
 384
 385 module_init(xt_ct_tg_init);
 386 module_exit(xt_ct_tg_exit);
 387
 388 MODULE_LICENSE("GPL");
 389 MODULE_DESCRIPTION("Xtables: connection tracking target");
 390 MODULE_ALIAS("ipt_CT");
 391 MODULE_ALIAS("ip6t_CT");
 392 MODULE_ALIAS("ipt_NOTRACK");
 393 MODULE_ALIAS("ip6t_NOTRACK");