[deliverable/linux.git] / net / ipv4 / netfilter / ip_conntrack_ftp.c

/* FTP extension for IP connection tracking. */

/* (C) 1999-2001 Paul `Rusty' Russell  
 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/config.h>
#include <linux/module.h>
#include <linux/netfilter.h>
#include <linux/ip.h>
#include <linux/ctype.h>
#include <net/checksum.h>
#include <net/tcp.h>

#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
#include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
#include <linux/moduleparam.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
MODULE_DESCRIPTION("ftp connection tracking helper");

/* This is slow, but it's simple. --RR */
static char ftp_buffer[65536];

static DEFINE_SPINLOCK(ip_ftp_lock);

#define MAX_PORTS 8
static int ports[MAX_PORTS];
static int ports_c;
module_param_array(ports, int, &ports_c, 0400);

static int loose;
module_param(loose, int, 0600);

unsigned int (*ip_nat_ftp_hook)(struct sk_buff **pskb,
				enum ip_conntrack_info ctinfo,
				enum ip_ct_ftp_type type,
				unsigned int matchoff,
				unsigned int matchlen,
				struct ip_conntrack_expect *exp,
				u32 *seq);
EXPORT_SYMBOL_GPL(ip_nat_ftp_hook);

#if 0
#define DEBUGP printk
#else
#define DEBUGP(format, args...)
#endif

static int try_rfc959(const char *, size_t, u_int32_t [], char);
static int try_eprt(const char *, size_t, u_int32_t [], char);
static int try_epsv_response(const char *, size_t, u_int32_t [], char);

static struct ftp_search {
	enum ip_conntrack_dir dir;
	const char *pattern;
	size_t plen;
	char skip;
	char term;
	enum ip_ct_ftp_type ftptype;
	int (*getnum)(const char *, size_t, u_int32_t[], char);
} search[] = {
	{
		IP_CT_DIR_ORIGINAL,
		"PORT",	sizeof("PORT") - 1, ' ', '\r',
		IP_CT_FTP_PORT,
		try_rfc959,
	},
	{
		IP_CT_DIR_REPLY,
		"227 ",	sizeof("227 ") - 1, '(', ')',
		IP_CT_FTP_PASV,
		try_rfc959,
	},
	{
		IP_CT_DIR_ORIGINAL,
		"EPRT", sizeof("EPRT") - 1, ' ', '\r',
		IP_CT_FTP_EPRT,
		try_eprt,
	},
	{
		IP_CT_DIR_REPLY,
		"229 ", sizeof("229 ") - 1, '(', ')',
		IP_CT_FTP_EPSV,
		try_epsv_response,
	},
};

static int try_number(const char *data, size_t dlen, u_int32_t array[],
		      int array_size, char sep, char term)
{
	u_int32_t i, len;

	memset(array, 0, sizeof(array[0])*array_size);

	/* Keep data pointing at next char. */
	for (i = 0, len = 0; len < dlen && i < array_size; len++, data++) {
		if (*data >= '0' && *data <= '9') {
			array[i] = array[i]*10 + *data - '0';
		}
		else if (*data == sep)
			i++;
		else {
			/* Unexpected character; true if it's the
			   terminator and we're finished. */
			if (*data == term && i == array_size - 1)
				return len;

			DEBUGP("Char %u (got %u nums) `%u' unexpected\n",
			       len, i, *data);
			return 0;
		}
	}
	DEBUGP("Failed to fill %u numbers separated by %c\n", array_size, sep);

	return 0;
}

/* Returns 0, or length of numbers: 192,168,1,1,5,6 */
static int try_rfc959(const char *data, size_t dlen, u_int32_t array[6],
		       char term)
{
	return try_number(data, dlen, array, 6, ',', term);
}

/* Grab port: number up to delimiter */
static int get_port(const char *data, int start, size_t dlen, char delim,
		    u_int32_t array[2])
{
	u_int16_t port = 0;
	int i;

	for (i = start; i < dlen; i++) {
		/* Finished? */
		if (data[i] == delim) {
			if (port == 0)
				break;
			array[0] = port >> 8;
			array[1] = port;
			return i + 1;
		}
		else if (data[i] >= '0' && data[i] <= '9')
			port = port*10 + data[i] - '0';
		else /* Some other crap */
			break;
	}
	return 0;
}

/* Returns 0, or length of numbers: |1|132.235.1.2|6275| */
static int try_eprt(const char *data, size_t dlen, u_int32_t array[6],
		    char term)
{
	char delim;
	int length;

	/* First character is delimiter, then "1" for IPv4, then
           delimiter again. */
	if (dlen <= 3) return 0;
	delim = data[0];
	if (isdigit(delim) || delim < 33 || delim > 126
	    || data[1] != '1' || data[2] != delim)
		return 0;

	DEBUGP("EPRT: Got |1|!\n");
	/* Now we have IP address. */
	length = try_number(data + 3, dlen - 3, array, 4, '.', delim);
	if (length == 0)
		return 0;

	DEBUGP("EPRT: Got IP address!\n");
	/* Start offset includes initial "|1|", and trailing delimiter */
	return get_port(data, 3 + length + 1, dlen, delim, array+4);
}

/* Returns 0, or length of numbers: |||6446| */
static int try_epsv_response(const char *data, size_t dlen, u_int32_t array[6],
			     char term)
{
	char delim;

	/* Three delimiters. */
	if (dlen <= 3) return 0;
	delim = data[0];
	if (isdigit(delim) || delim < 33 || delim > 126
	    || data[1] != delim || data[2] != delim)
		return 0;

	return get_port(data, 3, dlen, delim, array+4);
}

/* Return 1 for match, 0 for accept, -1 for partial. */
static int find_pattern(const char *data, size_t dlen,
			const char *pattern, size_t plen,
			char skip, char term,
			unsigned int *numoff,
			unsigned int *numlen,
			u_int32_t array[6],
			int (*getnum)(const char *, size_t, u_int32_t[], char))
{
	size_t i;

	DEBUGP("find_pattern `%s': dlen = %u\n", pattern, dlen);
	if (dlen == 0)
		return 0;

	if (dlen <= plen) {
		/* Short packet: try for partial? */
		if (strnicmp(data, pattern, dlen) == 0)
			return -1;
		else return 0;
	}

	if (strnicmp(data, pattern, plen) != 0) {
#if 0
		size_t i;

		DEBUGP("ftp: string mismatch\n");
		for (i = 0; i < plen; i++) {
			DEBUGP("ftp:char %u `%c'(%u) vs `%c'(%u)\n",
				i, data[i], data[i],
				pattern[i], pattern[i]);
		}
#endif
		return 0;
	}

	DEBUGP("Pattern matches!\n");
	/* Now we've found the constant string, try to skip
	   to the 'skip' character */
	for (i = plen; data[i] != skip; i++)
		if (i == dlen - 1) return -1;

	/* Skip over the last character */
	i++;

	DEBUGP("Skipped up to `%c'!\n", skip);

	*numoff = i;
	*numlen = getnum(data + i, dlen - i, array, term);
	if (!*numlen)
		return -1;

	DEBUGP("Match succeeded!\n");
	return 1;
}

/* Look up to see if we're just after a \n. */
static int find_nl_seq(u32 seq, const struct ip_ct_ftp_master *info, int dir)
{
	unsigned int i;

	for (i = 0; i < info->seq_aft_nl_num[dir]; i++)
		if (info->seq_aft_nl[dir][i] == seq)
			return 1;
	return 0;
}

/* We don't update if it's older than what we have. */
static void update_nl_seq(u32 nl_seq, struct ip_ct_ftp_master *info, int dir,
			  struct sk_buff *skb)
{
	unsigned int i, oldest = NUM_SEQ_TO_REMEMBER;

	/* Look for oldest: if we find exact match, we're done. */
	for (i = 0; i < info->seq_aft_nl_num[dir]; i++) {
		if (info->seq_aft_nl[dir][i] == nl_seq)
			return;

		if (oldest == info->seq_aft_nl_num[dir]
		    || before(info->seq_aft_nl[dir][i], oldest))
			oldest = i;
	}

	if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
		info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
		ip_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
	} else if (oldest != NUM_SEQ_TO_REMEMBER) {
		info->seq_aft_nl[dir][oldest] = nl_seq;
		ip_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
	}
}

static int help(struct sk_buff **pskb,
		struct ip_conntrack *ct,
		enum ip_conntrack_info ctinfo)
{
	unsigned int dataoff, datalen;
	struct tcphdr _tcph, *th;
	char *fb_ptr;
	int ret;
	u32 seq, array[6] = { 0 };
	int dir = CTINFO2DIR(ctinfo);
	unsigned int matchlen, matchoff;
	struct ip_ct_ftp_master *ct_ftp_info = &ct->help.ct_ftp_info;
	struct ip_conntrack_expect *exp;
	unsigned int i;
	int found = 0, ends_in_nl;

	/* Until there's been traffic both ways, don't look in packets. */
	if (ctinfo != IP_CT_ESTABLISHED
	    && ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY) {
		DEBUGP("ftp: Conntrackinfo = %u\n", ctinfo);
		return NF_ACCEPT;
	}

	th = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl*4,
				sizeof(_tcph), &_tcph);
	if (th == NULL)
		return NF_ACCEPT;

	dataoff = (*pskb)->nh.iph->ihl*4 + th->doff*4;
	/* No data? */
	if (dataoff >= (*pskb)->len) {
		DEBUGP("ftp: pskblen = %u\n", (*pskb)->len);
		return NF_ACCEPT;
	}
	datalen = (*pskb)->len - dataoff;

	spin_lock_bh(&ip_ftp_lock);
	fb_ptr = skb_header_pointer(*pskb, dataoff,
				    (*pskb)->len - dataoff, ftp_buffer);
	BUG_ON(fb_ptr == NULL);

	ends_in_nl = (fb_ptr[datalen - 1] == '\n');
	seq = ntohl(th->seq) + datalen;

	/* Look up to see if we're just after a \n. */
	if (!find_nl_seq(ntohl(th->seq), ct_ftp_info, dir)) {
		/* Now if this ends in \n, update ftp info. */
		DEBUGP("ip_conntrack_ftp_help: wrong seq pos %s(%u) or %s(%u)\n",
		       ct_ftp_info->seq_aft_nl[0][dir] 
		       old_seq_aft_nl_set ? "":"(UNSET) ", old_seq_aft_nl);
		ret = NF_ACCEPT;
		goto out_update_nl;
	}

	/* Initialize IP array to expected address (it's not mentioned
           in EPSV responses) */
	array[0] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 24) & 0xFF;
	array[1] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 16) & 0xFF;
	array[2] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 8) & 0xFF;
	array[3] = ntohl(ct->tuplehash[dir].tuple.src.ip) & 0xFF;

	for (i = 0; i < ARRAY_SIZE(search); i++) {
		if (search[i].dir != dir) continue;

		found = find_pattern(fb_ptr, (*pskb)->len - dataoff,
				     search[i].pattern,
				     search[i].plen,
				     search[i].skip,
				     search[i].term,
				     &matchoff, &matchlen,
				     array,
				     search[i].getnum);
		if (found) break;
	}
	if (found == -1) {
		/* We don't usually drop packets.  After all, this is
		   connection tracking, not packet filtering.
		   However, it is necessary for accurate tracking in
		   this case. */
		if (net_ratelimit())
			printk("conntrack_ftp: partial %s %u+%u\n",
			       search[i].pattern,
			       ntohl(th->seq), datalen);
		ret = NF_DROP;
		goto out;
	} else if (found == 0) { /* No match */
		ret = NF_ACCEPT;
		goto out_update_nl;
	}

	DEBUGP("conntrack_ftp: match `%s' (%u bytes at %u)\n",
	       fb_ptr + matchoff, matchlen, ntohl(th->seq) + matchoff);
			 
	/* Allocate expectation which will be inserted */
	exp = ip_conntrack_expect_alloc(ct);
	if (exp == NULL) {
		ret = NF_DROP;
		goto out;
	}

	/* We refer to the reverse direction ("!dir") tuples here,
	 * because we're expecting something in the other direction.
	 * Doesn't matter unless NAT is happening.  */
	exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;

	if (htonl((array[0] << 24) | (array[1] << 16) | (array[2] << 8) | array[3])
	    != ct->tuplehash[dir].tuple.src.ip) {
		/* Enrico Scholz's passive FTP to partially RNAT'd ftp
		   server: it really wants us to connect to a
		   different IP address.  Simply don't record it for
		   NAT. */
		DEBUGP("conntrack_ftp: NOT RECORDING: %u,%u,%u,%u != %u.%u.%u.%u\n",
		       array[0], array[1], array[2], array[3],
		       NIPQUAD(ct->tuplehash[dir].tuple.src.ip));

		/* Thanks to Cristiano Lincoln Mattos
		   <lincoln@cesar.org.br> for reporting this potential
		   problem (DMZ machines opening holes to internal
		   networks, or the packet filter itself). */
		if (!loose) {
			ret = NF_ACCEPT;
			goto out_put_expect;
		}
		exp->tuple.dst.ip = htonl((array[0] << 24) | (array[1] << 16)
					 | (array[2] << 8) | array[3]);
	}

	exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
	exp->tuple.dst.u.tcp.port = htons(array[4] << 8 | array[5]);
	exp->tuple.src.u.tcp.port = 0; /* Don't care. */
	exp->tuple.dst.protonum = IPPROTO_TCP;
	exp->mask = ((struct ip_conntrack_tuple)
		{ { 0xFFFFFFFF, { 0 } },
		  { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});

	exp->expectfn = NULL;

	/* Now, NAT might want to mangle the packet, and register the
	 * (possibly changed) expectation itself. */
	if (ip_nat_ftp_hook)
		ret = ip_nat_ftp_hook(pskb, ctinfo, search[i].ftptype,
				      matchoff, matchlen, exp, &seq);
	else {
		/* Can't expect this?  Best to drop packet now. */
		if (ip_conntrack_expect_related(exp) != 0)
			ret = NF_DROP;
		else
			ret = NF_ACCEPT;
	}

out_put_expect:
	ip_conntrack_expect_put(exp);

out_update_nl:
	/* Now if this ends in \n, update ftp info.  Seq may have been
	 * adjusted by NAT code. */
	if (ends_in_nl)
		update_nl_seq(seq, ct_ftp_info,dir, *pskb);
 out:
	spin_unlock_bh(&ip_ftp_lock);
	return ret;
}

static struct ip_conntrack_helper ftp[MAX_PORTS];
static char ftp_names[MAX_PORTS][10];

/* Not __exit: called from init() */
static void fini(void)
{
	int i;
	for (i = 0; i < ports_c; i++) {
		DEBUGP("ip_ct_ftp: unregistering helper for port %d\n",
				ports[i]);
		ip_conntrack_helper_unregister(&ftp[i]);
	}
}

static int __init init(void)
{
	int i, ret;
	char *tmpname;

	if (ports_c == 0)
		ports[ports_c++] = FTP_PORT;

	for (i = 0; i < ports_c; i++) {
		ftp[i].tuple.src.u.tcp.port = htons(ports[i]);
		ftp[i].tuple.dst.protonum = IPPROTO_TCP;
		ftp[i].mask.src.u.tcp.port = 0xFFFF;
		ftp[i].mask.dst.protonum = 0xFF;
		ftp[i].max_expected = 1;
		ftp[i].timeout = 5 * 60; /* 5 minutes */
		ftp[i].me = THIS_MODULE;
		ftp[i].help = help;

		tmpname = &ftp_names[i][0];
		if (ports[i] == FTP_PORT)
			sprintf(tmpname, "ftp");
		else
			sprintf(tmpname, "ftp-%d", ports[i]);
		ftp[i].name = tmpname;

		DEBUGP("ip_ct_ftp: registering helper for port %d\n", 
				ports[i]);
		ret = ip_conntrack_helper_register(&ftp[i]);

		if (ret) {
			fini();
			return ret;
		}
	}
	return 0;
}

module_init(init);
module_exit(fini);
Commit	Line	Data
1da177e4 LT	1	/* FTP extension for IP connection tracking. */
	2
	3	/* (C) 1999-2001 Paul `Rusty' Russell
	4	* (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/config.h>
	12	#include <linux/module.h>
	13	#include <linux/netfilter.h>
	14	#include <linux/ip.h>
	15	#include <linux/ctype.h>
	16	#include <net/checksum.h>
	17	#include <net/tcp.h>
	18
1da177e4 LT	19	#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
	20	#include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
	21	#include <linux/moduleparam.h>
	22
	23	MODULE_LICENSE("GPL");
	24	MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
	25	MODULE_DESCRIPTION("ftp connection tracking helper");
	26
	27	/* This is slow, but it's simple. --RR */
	28	static char ftp_buffer[65536];
	29
e45b1be8	30	static DEFINE_SPINLOCK(ip_ftp_lock);
1da177e4 LT	31
	32	#define MAX_PORTS 8
	33	static int ports[MAX_PORTS];
	34	static int ports_c;
	35	module_param_array(ports, int, &ports_c, 0400);
	36
	37	static int loose;
	38	module_param(loose, int, 0600);
	39
	40	unsigned int (ip_nat_ftp_hook)(struct sk_buff *pskb,
	41	enum ip_conntrack_info ctinfo,
	42	enum ip_ct_ftp_type type,
	43	unsigned int matchoff,
	44	unsigned int matchlen,
	45	struct ip_conntrack_expect *exp,
	46	u32 *seq);
	47	EXPORT_SYMBOL_GPL(ip_nat_ftp_hook);
	48
	49	#if 0
	50	#define DEBUGP printk
	51	#else
	52	#define DEBUGP(format, args...)
	53	#endif
	54
	55	static int try_rfc959(const char *, size_t, u_int32_t [], char);
	56	static int try_eprt(const char *, size_t, u_int32_t [], char);
	57	static int try_epsv_response(const char *, size_t, u_int32_t [], char);
	58
	59	static struct ftp_search {
	60	enum ip_conntrack_dir dir;
	61	const char *pattern;
	62	size_t plen;
	63	char skip;
	64	char term;
	65	enum ip_ct_ftp_type ftptype;
	66	int (getnum)(const char , size_t, u_int32_t[], char);
	67	} search[] = {
	68	{
	69	IP_CT_DIR_ORIGINAL,
	70	"PORT", sizeof("PORT") - 1, ' ', '\r',
	71	IP_CT_FTP_PORT,
	72	try_rfc959,
	73	},
	74	{
	75	IP_CT_DIR_REPLY,
	76	"227 ", sizeof("227 ") - 1, '(', ')',
	77	IP_CT_FTP_PASV,
	78	try_rfc959,
	79	},
	80	{
	81	IP_CT_DIR_ORIGINAL,
	82	"EPRT", sizeof("EPRT") - 1, ' ', '\r',
	83	IP_CT_FTP_EPRT,
	84	try_eprt,
	85	},
	86	{
	87	IP_CT_DIR_REPLY,
	88	"229 ", sizeof("229 ") - 1, '(', ')',
	89	IP_CT_FTP_EPSV,
	90	try_epsv_response,
	91	},
	92	};
	93
	94	static int try_number(const char *data, size_t dlen, u_int32_t array[],
95	int array_size, char sep, char term)
96	{
97	u_int32_t i, len;
98
99	memset(array, 0, sizeof(array[0])*array_size);
100
101	/* Keep data pointing at next char. */
102	for (i = 0, len = 0; len < dlen && i < array_size; len++, data++) {
103	if (data >= '0' && data <= '9') {
104	array[i] = array[i]10 + data - '0';
105	}
106	else if (*data == sep)
107	i++;
108	else {
109	/* Unexpected character; true if it's the
110	terminator and we're finished. */
111	if (*data == term && i == array_size - 1)
112	return len;
113
114	DEBUGP("Char %u (got %u nums) `%u' unexpected\n",
115	len, i, *data);
116	return 0;
117	}
118	}
119	DEBUGP("Failed to fill %u numbers separated by %c\n", array_size, sep);
120
121	return 0;
122	}
123
124	/* Returns 0, or length of numbers: 192,168,1,1,5,6 */
125	static int try_rfc959(const char *data, size_t dlen, u_int32_t array[6],
126	char term)
127	{
128	return try_number(data, dlen, array, 6, ',', term);
129	}
130
131	/* Grab port: number up to delimiter */
132	static int get_port(const char *data, int start, size_t dlen, char delim,
133	u_int32_t array[2])
134	{
135	u_int16_t port = 0;
136	int i;
137
138	for (i = start; i < dlen; i++) {
139	/* Finished? */
140	if (data[i] == delim) {
141	if (port == 0)
142	break;
143	array[0] = port >> 8;
144	array[1] = port;
145	return i + 1;
146	}
147	else if (data[i] >= '0' && data[i] <= '9')
148	port = port*10 + data[i] - '0';
149	else /* Some other crap */
150	break;
151	}
152	return 0;
153	}
154
155	/* Returns 0, or length of numbers: \|1\|132.235.1.2\|6275\| */
156	static int try_eprt(const char *data, size_t dlen, u_int32_t array[6],
157	char term)
158	{
159	char delim;
160	int length;
161
162	/* First character is delimiter, then "1" for IPv4, then
163	delimiter again. */
164	if (dlen <= 3) return 0;
165	delim = data[0];
166	if (isdigit(delim) \|\| delim < 33 \|\| delim > 126
167	\|\| data[1] != '1' \|\| data[2] != delim)
168	return 0;
169
170	DEBUGP("EPRT: Got \|1\|!\n");
171	/* Now we have IP address. */
172	length = try_number(data + 3, dlen - 3, array, 4, '.', delim);
173	if (length == 0)
174	return 0;
175
176	DEBUGP("EPRT: Got IP address!\n");
177	/* Start offset includes initial "\|1\|", and trailing delimiter */
178	return get_port(data, 3 + length + 1, dlen, delim, array+4);
179	}
180
181	/* Returns 0, or length of numbers: \|\|\|6446\| */
182	static int try_epsv_response(const char *data, size_t dlen, u_int32_t array[6],
183	char term)
184	{
185	char delim;
186
187	/* Three delimiters. */
188	if (dlen <= 3) return 0;
189	delim = data[0];
190	if (isdigit(delim) \|\| delim < 33 \|\| delim > 126
191	\|\| data[1] != delim \|\| data[2] != delim)
192	return 0;
193
194	return get_port(data, 3, dlen, delim, array+4);
195	}
196
197	/* Return 1 for match, 0 for accept, -1 for partial. */
198	static int find_pattern(const char *data, size_t dlen,
199	const char *pattern, size_t plen,
200	char skip, char term,
201	unsigned int *numoff,
202	unsigned int *numlen,
203	u_int32_t array[6],
204	int (getnum)(const char , size_t, u_int32_t[], char))
205	{
206	size_t i;
207
208	DEBUGP("find_pattern `%s': dlen = %u\n", pattern, dlen);
209	if (dlen == 0)
210	return 0;
211
212	if (dlen <= plen) {
213	/* Short packet: try for partial? */
214	if (strnicmp(data, pattern, dlen) == 0)
215	return -1;
216	else return 0;
217	}
218
219	if (strnicmp(data, pattern, plen) != 0) {
220	#if 0
221	size_t i;
222
223	DEBUGP("ftp: string mismatch\n");
224	for (i = 0; i < plen; i++) {
225	DEBUGP("ftp:char %u `%c'(%u) vs `%c'(%u)\n",
226	i, data[i], data[i],
227	pattern[i], pattern[i]);
228	}
229	#endif
230	return 0;
231	}
232
233	DEBUGP("Pattern matches!\n");
234	/* Now we've found the constant string, try to skip
235	to the 'skip' character */
236	for (i = plen; data[i] != skip; i++)
237	if (i == dlen - 1) return -1;
238
239	/* Skip over the last character */
240	i++;
241
242	DEBUGP("Skipped up to `%c'!\n", skip);
243
244	*numoff = i;
245	*numlen = getnum(data + i, dlen - i, array, term);
246	if (!*numlen)
247	return -1;
248
249	DEBUGP("Match succeeded!\n");
250	return 1;
251	}
252
253	/* Look up to see if we're just after a \n. */
f649a3bf	254	static int find_nl_seq(u32 seq, const struct ip_ct_ftp_master *info, int dir)
1da177e4 LT	255	{
	256	unsigned int i;
	257
	258	for (i = 0; i < info->seq_aft_nl_num[dir]; i++)
	259	if (info->seq_aft_nl[dir][i] == seq)
	260	return 1;
	261	return 0;
	262	}
	263
	264	/* We don't update if it's older than what we have. */
ac3247ba HW	265	static void update_nl_seq(u32 nl_seq, struct ip_ct_ftp_master *info, int dir,
ac3247ba HW	266	struct sk_buff *skb)
1da177e4 LT	267	{
	268	unsigned int i, oldest = NUM_SEQ_TO_REMEMBER;
	269
	270	/* Look for oldest: if we find exact match, we're done. */
	271	for (i = 0; i < info->seq_aft_nl_num[dir]; i++) {
	272	if (info->seq_aft_nl[dir][i] == nl_seq)
	273	return;
	274
	275	if (oldest == info->seq_aft_nl_num[dir]
	276	\|\| before(info->seq_aft_nl[dir][i], oldest))
	277	oldest = i;
	278	}
	279
ac3247ba	280	if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
1da177e4	281	info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
ac3247ba HW	282	ip_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
ac3247ba HW	283	} else if (oldest != NUM_SEQ_TO_REMEMBER) {
1da177e4	284	info->seq_aft_nl[dir][oldest] = nl_seq;
ac3247ba HW	285	ip_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
ac3247ba HW	286	}
1da177e4 LT	287	}
	288
	289	static int help(struct sk_buff **pskb,
	290	struct ip_conntrack *ct,
	291	enum ip_conntrack_info ctinfo)
	292	{
	293	unsigned int dataoff, datalen;
	294	struct tcphdr _tcph, *th;
	295	char *fb_ptr;
	296	int ret;
	297	u32 seq, array[6] = { 0 };
	298	int dir = CTINFO2DIR(ctinfo);
	299	unsigned int matchlen, matchoff;
	300	struct ip_ct_ftp_master *ct_ftp_info = &ct->help.ct_ftp_info;
	301	struct ip_conntrack_expect *exp;
	302	unsigned int i;
	303	int found = 0, ends_in_nl;
	304
	305	/* Until there's been traffic both ways, don't look in packets. */
	306	if (ctinfo != IP_CT_ESTABLISHED
	307	&& ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY) {
	308	DEBUGP("ftp: Conntrackinfo = %u\n", ctinfo);
	309	return NF_ACCEPT;
	310	}
	311
	312	th = skb_header_pointer(pskb, (pskb)->nh.iph->ihl*4,
	313	sizeof(_tcph), &_tcph);
	314	if (th == NULL)
	315	return NF_ACCEPT;
	316
	317	dataoff = (pskb)->nh.iph->ihl4 + th->doff*4;
	318	/* No data? */
	319	if (dataoff >= (*pskb)->len) {
	320	DEBUGP("ftp: pskblen = %u\n", (*pskb)->len);
	321	return NF_ACCEPT;
	322	}
	323	datalen = (*pskb)->len - dataoff;
	324
e45b1be8	325	spin_lock_bh(&ip_ftp_lock);
1da177e4 LT	326	fb_ptr = skb_header_pointer(*pskb, dataoff,
	327	(*pskb)->len - dataoff, ftp_buffer);
	328	BUG_ON(fb_ptr == NULL);
	329
	330	ends_in_nl = (fb_ptr[datalen - 1] == '\n');
	331	seq = ntohl(th->seq) + datalen;
	332
	333	/* Look up to see if we're just after a \n. */
	334	if (!find_nl_seq(ntohl(th->seq), ct_ftp_info, dir)) {
	335	/* Now if this ends in \n, update ftp info. */
	336	DEBUGP("ip_conntrack_ftp_help: wrong seq pos %s(%u) or %s(%u)\n",
	337	ct_ftp_info->seq_aft_nl[0][dir]
	338	old_seq_aft_nl_set ? "":"(UNSET) ", old_seq_aft_nl);
	339	ret = NF_ACCEPT;
	340	goto out_update_nl;
	341	}
	342
	343	/* Initialize IP array to expected address (it's not mentioned
	344	in EPSV responses) */
	345	array[0] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 24) & 0xFF;
	346	array[1] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 16) & 0xFF;
	347	array[2] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 8) & 0xFF;
	348	array[3] = ntohl(ct->tuplehash[dir].tuple.src.ip) & 0xFF;
	349
	350	for (i = 0; i < ARRAY_SIZE(search); i++) {
	351	if (search[i].dir != dir) continue;
	352
	353	found = find_pattern(fb_ptr, (*pskb)->len - dataoff,
	354	search[i].pattern,
	355	search[i].plen,
	356	search[i].skip,
	357	search[i].term,
	358	&matchoff, &matchlen,
	359	array,
	360	search[i].getnum);
	361	if (found) break;
	362	}
	363	if (found == -1) {
	364	/* We don't usually drop packets. After all, this is
	365	connection tracking, not packet filtering.
	366	However, it is necessary for accurate tracking in
	367	this case. */
	368	if (net_ratelimit())
	369	printk("conntrack_ftp: partial %s %u+%u\n",
	370	search[i].pattern,
	371	ntohl(th->seq), datalen);
	372	ret = NF_DROP;
	373	goto out;
	374	} else if (found == 0) { /* No match */
	375	ret = NF_ACCEPT;
	376	goto out_update_nl;
	377	}
	378
	379	DEBUGP("conntrack_ftp: match `%s' (%u bytes at %u)\n",
	380	fb_ptr + matchoff, matchlen, ntohl(th->seq) + matchoff);
	381
	382	/* Allocate expectation which will be inserted */
4acdbdbe	383	exp = ip_conntrack_expect_alloc(ct);
1da177e4 LT	384	if (exp == NULL) {
	385	ret = NF_DROP;
	386	goto out;
	387	}
	388
	389	/* We refer to the reverse direction ("!dir") tuples here,
	390	* because we're expecting something in the other direction.
	391	* Doesn't matter unless NAT is happening. */
	392	exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
	393
	394	if (htonl((array[0] << 24) \| (array[1] << 16) \| (array[2] << 8) \| array[3])
	395	!= ct->tuplehash[dir].tuple.src.ip) {
	396	/* Enrico Scholz's passive FTP to partially RNAT'd ftp
	397	server: it really wants us to connect to a
	398	different IP address. Simply don't record it for
	399	NAT. */
	400	DEBUGP("conntrack_ftp: NOT RECORDING: %u,%u,%u,%u != %u.%u.%u.%u\n",
	401	array[0], array[1], array[2], array[3],
	402	NIPQUAD(ct->tuplehash[dir].tuple.src.ip));
	403
	404	/* Thanks to Cristiano Lincoln Mattos
	405	<lincoln@cesar.org.br> for reporting this potential
	406	problem (DMZ machines opening holes to internal
	407	networks, or the packet filter itself). */
	408	if (!loose) {
	409	ret = NF_ACCEPT;
4acdbdbe	410	goto out_put_expect;
1da177e4 LT	411	}
	412	exp->tuple.dst.ip = htonl((array[0] << 24) \| (array[1] << 16)
	413	\| (array[2] << 8) \| array[3]);
	414	}
	415
	416	exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
	417	exp->tuple.dst.u.tcp.port = htons(array[4] << 8 \| array[5]);
	418	exp->tuple.src.u.tcp.port = 0; /* Don't care. */
	419	exp->tuple.dst.protonum = IPPROTO_TCP;
	420	exp->mask = ((struct ip_conntrack_tuple)
	421	{ { 0xFFFFFFFF, { 0 } },
	422	{ 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});
	423
	424	exp->expectfn = NULL;
1da177e4 LT	425
	426	/* Now, NAT might want to mangle the packet, and register the
	427	* (possibly changed) expectation itself. */
	428	if (ip_nat_ftp_hook)
	429	ret = ip_nat_ftp_hook(pskb, ctinfo, search[i].ftptype,
	430	matchoff, matchlen, exp, &seq);
	431	else {
	432	/* Can't expect this? Best to drop packet now. */
4acdbdbe	433	if (ip_conntrack_expect_related(exp) != 0)
1da177e4	434	ret = NF_DROP;
4acdbdbe	435	else
1da177e4 LT	436	ret = NF_ACCEPT;
	437	}
	438
4acdbdbe RR	439	out_put_expect:
	440	ip_conntrack_expect_put(exp);
	441
1da177e4 LT	442	out_update_nl:
	443	/* Now if this ends in \n, update ftp info. Seq may have been
	444	* adjusted by NAT code. */
	445	if (ends_in_nl)
ac3247ba	446	update_nl_seq(seq, ct_ftp_info,dir, *pskb);
1da177e4	447	out:
e45b1be8	448	spin_unlock_bh(&ip_ftp_lock);
1da177e4 LT	449	return ret;
	450	}
	451
	452	static struct ip_conntrack_helper ftp[MAX_PORTS];
	453	static char ftp_names[MAX_PORTS][10];
	454
	455	/* Not __exit: called from init() */
	456	static void fini(void)
	457	{
	458	int i;
	459	for (i = 0; i < ports_c; i++) {
	460	DEBUGP("ip_ct_ftp: unregistering helper for port %d\n",
	461	ports[i]);
	462	ip_conntrack_helper_unregister(&ftp[i]);
	463	}
	464	}
	465
	466	static int __init init(void)
	467	{
	468	int i, ret;
	469	char *tmpname;
	470
	471	if (ports_c == 0)
	472	ports[ports_c++] = FTP_PORT;
	473
	474	for (i = 0; i < ports_c; i++) {
	475	ftp[i].tuple.src.u.tcp.port = htons(ports[i]);
	476	ftp[i].tuple.dst.protonum = IPPROTO_TCP;
	477	ftp[i].mask.src.u.tcp.port = 0xFFFF;
	478	ftp[i].mask.dst.protonum = 0xFF;
	479	ftp[i].max_expected = 1;
	480	ftp[i].timeout = 5 * 60; /* 5 minutes */
	481	ftp[i].me = THIS_MODULE;
	482	ftp[i].help = help;
	483
	484	tmpname = &ftp_names[i][0];
	485	if (ports[i] == FTP_PORT)
	486	sprintf(tmpname, "ftp");
	487	else
	488	sprintf(tmpname, "ftp-%d", ports[i]);
	489	ftp[i].name = tmpname;
	490
	491	DEBUGP("ip_ct_ftp: registering helper for port %d\n",
	492	ports[i]);
	493	ret = ip_conntrack_helper_register(&ftp[i]);
	494
	495	if (ret) {
	496	fini();
	497	return ret;
	498	}
	499	}
	500	return 0;
	501	}
	502
	503	module_init(init);
	504	module_exit(fini);