Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * ip_vs_ftp.c: IPVS ftp application module | |
3 | * | |
1da177e4 LT |
4 | * Authors: Wensong Zhang <wensong@linuxvirtualserver.org> |
5 | * | |
6 | * Changes: | |
7 | * | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU General Public License | |
11 | * as published by the Free Software Foundation; either version | |
12 | * 2 of the License, or (at your option) any later version. | |
13 | * | |
14 | * Most code here is taken from ip_masq_ftp.c in kernel 2.2. The difference | |
15 | * is that ip_vs_ftp module handles the reverse direction to ip_masq_ftp. | |
16 | * | |
17 | * IP_MASQ_FTP ftp masquerading module | |
18 | * | |
19 | * Version: @(#)ip_masq_ftp.c 0.04 02/05/96 | |
20 | * | |
21 | * Author: Wouter Gadeyne | |
22 | * | |
23 | */ | |
24 | ||
9aada7ac HE |
25 | #define KMSG_COMPONENT "IPVS" |
26 | #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt | |
27 | ||
1da177e4 LT |
28 | #include <linux/module.h> |
29 | #include <linux/moduleparam.h> | |
30 | #include <linux/kernel.h> | |
31 | #include <linux/skbuff.h> | |
32 | #include <linux/in.h> | |
33 | #include <linux/ip.h> | |
af1e1cf0 | 34 | #include <linux/netfilter.h> |
7f1c4075 HE |
35 | #include <net/netfilter/nf_conntrack.h> |
36 | #include <net/netfilter/nf_conntrack_expect.h> | |
7bcbf81a | 37 | #include <net/netfilter/nf_nat.h> |
7f1c4075 | 38 | #include <net/netfilter/nf_nat_helper.h> |
5a0e3ad6 | 39 | #include <linux/gfp.h> |
1da177e4 LT |
40 | #include <net/protocol.h> |
41 | #include <net/tcp.h> | |
96d2ca4e | 42 | #include <asm/unaligned.h> |
1da177e4 LT |
43 | |
44 | #include <net/ip_vs.h> | |
45 | ||
46 | ||
c3aa1bd3 JA |
47 | #define SERVER_STRING "227 " |
48 | #define CLIENT_STRING "PORT" | |
1da177e4 LT |
49 | |
50 | ||
51 | /* | |
52 | * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper | |
53 | * First port is set to the default port. | |
54 | */ | |
52669dfa | 55 | static unsigned int ports_count = 1; |
28b06c38 | 56 | static unsigned short ports[IP_VS_APP_MAX_PORTS] = {21, 0}; |
52669dfa | 57 | module_param_array(ports, ushort, &ports_count, 0444); |
70e76b76 | 58 | MODULE_PARM_DESC(ports, "Ports to monitor for FTP control commands"); |
1da177e4 | 59 | |
1da177e4 LT |
60 | |
61 | /* Dummy variable */ | |
62 | static int ip_vs_ftp_pasv; | |
63 | ||
64 | ||
65 | static int | |
66 | ip_vs_ftp_init_conn(struct ip_vs_app *app, struct ip_vs_conn *cp) | |
67 | { | |
f4bc17cd JA |
68 | /* We use connection tracking for the command connection */ |
69 | cp->flags |= IP_VS_CONN_F_NFCT; | |
1da177e4 LT |
70 | return 0; |
71 | } | |
72 | ||
73 | ||
74 | static int | |
75 | ip_vs_ftp_done_conn(struct ip_vs_app *app, struct ip_vs_conn *cp) | |
76 | { | |
77 | return 0; | |
78 | } | |
79 | ||
80 | ||
81 | /* | |
82 | * Get <addr,port> from the string "xxx.xxx.xxx.xxx,ppp,ppp", started | |
c3aa1bd3 JA |
83 | * with the "pattern", ignoring before "skip" and terminated with |
84 | * the "term" character. | |
1da177e4 LT |
85 | * <addr,port> is in network order. |
86 | */ | |
87 | static int ip_vs_ftp_get_addrport(char *data, char *data_limit, | |
c3aa1bd3 JA |
88 | const char *pattern, size_t plen, |
89 | char skip, char term, | |
014d730d | 90 | __be32 *addr, __be16 *port, |
1da177e4 LT |
91 | char **start, char **end) |
92 | { | |
c3aa1bd3 | 93 | char *s, c; |
1da177e4 LT |
94 | unsigned char p[6]; |
95 | int i = 0; | |
96 | ||
97 | if (data_limit - data < plen) { | |
98 | /* check if there is partial match */ | |
18082746 | 99 | if (strncasecmp(data, pattern, data_limit - data) == 0) |
1da177e4 LT |
100 | return -1; |
101 | else | |
102 | return 0; | |
103 | } | |
104 | ||
18082746 | 105 | if (strncasecmp(data, pattern, plen) != 0) { |
1da177e4 LT |
106 | return 0; |
107 | } | |
c3aa1bd3 JA |
108 | s = data + plen; |
109 | if (skip) { | |
110 | int found = 0; | |
111 | ||
112 | for (;; s++) { | |
113 | if (s == data_limit) | |
114 | return -1; | |
115 | if (!found) { | |
116 | if (*s == skip) | |
117 | found = 1; | |
118 | } else if (*s != skip) { | |
119 | break; | |
120 | } | |
121 | } | |
122 | } | |
1da177e4 | 123 | |
c3aa1bd3 | 124 | for (data = s; ; data++) { |
1da177e4 LT |
125 | if (data == data_limit) |
126 | return -1; | |
c3aa1bd3 JA |
127 | if (*data == term) |
128 | break; | |
1da177e4 LT |
129 | } |
130 | *end = data; | |
131 | ||
132 | memset(p, 0, sizeof(p)); | |
c3aa1bd3 JA |
133 | for (data = s; ; data++) { |
134 | c = *data; | |
135 | if (c == term) | |
136 | break; | |
137 | if (c >= '0' && c <= '9') { | |
138 | p[i] = p[i]*10 + c - '0'; | |
139 | } else if (c == ',' && i < 5) { | |
1da177e4 LT |
140 | i++; |
141 | } else { | |
142 | /* unexpected character */ | |
143 | return -1; | |
144 | } | |
145 | } | |
146 | ||
147 | if (i != 5) | |
148 | return -1; | |
149 | ||
c3aa1bd3 JA |
150 | *start = s; |
151 | *addr = get_unaligned((__be32 *) p); | |
152 | *port = get_unaligned((__be16 *) (p + 4)); | |
1da177e4 LT |
153 | return 1; |
154 | } | |
155 | ||
1da177e4 LT |
156 | /* |
157 | * Look at outgoing ftp packets to catch the response to a PASV command | |
158 | * from the server (inside-to-outside). | |
159 | * When we see one, we build a connection entry with the client address, | |
160 | * client port 0 (unknown at the moment), the server address and the | |
161 | * server port. Mark the current connection entry as a control channel | |
162 | * of the new entry. All this work is just to make the data connection | |
163 | * can be scheduled to the right server later. | |
164 | * | |
165 | * The outgoing packet should be something like | |
166 | * "227 Entering Passive Mode (xxx,xxx,xxx,xxx,ppp,ppp)". | |
167 | * xxx,xxx,xxx,xxx is the server address, ppp,ppp is the server port number. | |
168 | */ | |
169 | static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp, | |
3db05fea | 170 | struct sk_buff *skb, int *diff) |
1da177e4 LT |
171 | { |
172 | struct iphdr *iph; | |
173 | struct tcphdr *th; | |
174 | char *data, *data_limit; | |
175 | char *start, *end; | |
28364a59 | 176 | union nf_inet_addr from; |
014d730d | 177 | __be16 port; |
1da177e4 LT |
178 | struct ip_vs_conn *n_cp; |
179 | char buf[24]; /* xxx.xxx.xxx.xxx,ppp,ppp\000 */ | |
95c96174 | 180 | unsigned int buf_len; |
7f1c4075 HE |
181 | int ret = 0; |
182 | enum ip_conntrack_info ctinfo; | |
183 | struct nf_conn *ct; | |
4a85b96c | 184 | struct net *net; |
1da177e4 | 185 | |
3b05ac38 DC |
186 | *diff = 0; |
187 | ||
a0eb662f JV |
188 | #ifdef CONFIG_IP_VS_IPV6 |
189 | /* This application helper doesn't work with IPv6 yet, | |
190 | * so turn this into a no-op for IPv6 packets | |
191 | */ | |
192 | if (cp->af == AF_INET6) | |
193 | return 1; | |
194 | #endif | |
195 | ||
1da177e4 LT |
196 | /* Only useful for established sessions */ |
197 | if (cp->state != IP_VS_TCP_S_ESTABLISHED) | |
198 | return 1; | |
199 | ||
200 | /* Linear packets are much easier to deal with. */ | |
3db05fea | 201 | if (!skb_make_writable(skb, skb->len)) |
1da177e4 LT |
202 | return 0; |
203 | ||
204 | if (cp->app_data == &ip_vs_ftp_pasv) { | |
3db05fea | 205 | iph = ip_hdr(skb); |
1da177e4 LT |
206 | th = (struct tcphdr *)&(((char *)iph)[iph->ihl*4]); |
207 | data = (char *)th + (th->doff << 2); | |
3db05fea | 208 | data_limit = skb_tail_pointer(skb); |
1da177e4 LT |
209 | |
210 | if (ip_vs_ftp_get_addrport(data, data_limit, | |
211 | SERVER_STRING, | |
c3aa1bd3 JA |
212 | sizeof(SERVER_STRING)-1, |
213 | '(', ')', | |
28364a59 | 214 | &from.ip, &port, |
1da177e4 LT |
215 | &start, &end) != 1) |
216 | return 1; | |
217 | ||
14d5e834 HH |
218 | IP_VS_DBG(7, "PASV response (%pI4:%d) -> %pI4:%d detected\n", |
219 | &from.ip, ntohs(port), &cp->caddr.ip, 0); | |
1da177e4 LT |
220 | |
221 | /* | |
222 | * Now update or create an connection entry for it | |
223 | */ | |
f11017ec SH |
224 | { |
225 | struct ip_vs_conn_param p; | |
6e67e586 HS |
226 | ip_vs_conn_fill_param(ip_vs_conn_net(cp), AF_INET, |
227 | iph->protocol, &from, port, | |
228 | &cp->caddr, 0, &p); | |
f11017ec SH |
229 | n_cp = ip_vs_conn_out_get(&p); |
230 | } | |
1da177e4 | 231 | if (!n_cp) { |
f11017ec | 232 | struct ip_vs_conn_param p; |
6e67e586 HS |
233 | ip_vs_conn_fill_param(ip_vs_conn_net(cp), |
234 | AF_INET, IPPROTO_TCP, &cp->caddr, | |
f11017ec | 235 | 0, &cp->vaddr, port, &p); |
ba38528a AG |
236 | /* As above, this is ipv4 only */ |
237 | n_cp = ip_vs_conn_new(&p, AF_INET, &from, port, | |
f4bc17cd JA |
238 | IP_VS_CONN_F_NO_CPORT | |
239 | IP_VS_CONN_F_NFCT, | |
0e051e68 | 240 | cp->dest, skb->mark); |
1da177e4 LT |
241 | if (!n_cp) |
242 | return 0; | |
243 | ||
244 | /* add its controller */ | |
245 | ip_vs_control_add(n_cp, cp); | |
246 | } | |
247 | ||
248 | /* | |
249 | * Replace the old passive address with the new one | |
250 | */ | |
28364a59 | 251 | from.ip = n_cp->vaddr.ip; |
1da177e4 | 252 | port = n_cp->vport; |
1da05f50 JP |
253 | snprintf(buf, sizeof(buf), "%u,%u,%u,%u,%u,%u", |
254 | ((unsigned char *)&from.ip)[0], | |
255 | ((unsigned char *)&from.ip)[1], | |
256 | ((unsigned char *)&from.ip)[2], | |
257 | ((unsigned char *)&from.ip)[3], | |
258 | ntohs(port) >> 8, | |
259 | ntohs(port) & 0xFF); | |
260 | ||
1da177e4 LT |
261 | buf_len = strlen(buf); |
262 | ||
7f1c4075 | 263 | ct = nf_ct_get(skb, &ctinfo); |
7bcbf81a | 264 | if (ct && !nf_ct_is_untracked(ct) && nfct_nat(ct)) { |
7f1c4075 HE |
265 | /* If mangling fails this function will return 0 |
266 | * which will cause the packet to be dropped. | |
267 | * Mangling can only fail under memory pressure, | |
268 | * hopefully it will succeed on the retransmitted | |
269 | * packet. | |
270 | */ | |
ac69269a | 271 | rcu_read_lock(); |
7f1c4075 | 272 | ret = nf_nat_mangle_tcp_packet(skb, ct, ctinfo, |
051966c0 | 273 | iph->ihl * 4, |
7f1c4075 HE |
274 | start-data, end-start, |
275 | buf, buf_len); | |
ac69269a | 276 | rcu_read_unlock(); |
8b27b10f | 277 | if (ret) { |
f4bc17cd JA |
278 | ip_vs_nfct_expect_related(skb, ct, n_cp, |
279 | IPPROTO_TCP, 0, 0); | |
8b27b10f JA |
280 | if (skb->ip_summed == CHECKSUM_COMPLETE) |
281 | skb->ip_summed = CHECKSUM_UNNECESSARY; | |
282 | /* csum is updated */ | |
283 | ret = 1; | |
284 | } | |
7f1c4075 HE |
285 | } |
286 | ||
1da177e4 | 287 | /* |
7f1c4075 HE |
288 | * Not setting 'diff' is intentional, otherwise the sequence |
289 | * would be adjusted twice. | |
1da177e4 | 290 | */ |
1da177e4 | 291 | |
4a85b96c | 292 | net = skb_net(skb); |
1da177e4 | 293 | cp->app_data = NULL; |
4a85b96c | 294 | ip_vs_tcp_conn_listen(net, n_cp); |
1da177e4 LT |
295 | ip_vs_conn_put(n_cp); |
296 | return ret; | |
297 | } | |
298 | return 1; | |
299 | } | |
300 | ||
301 | ||
302 | /* | |
303 | * Look at incoming ftp packets to catch the PASV/PORT command | |
304 | * (outside-to-inside). | |
305 | * | |
306 | * The incoming packet having the PORT command should be something like | |
307 | * "PORT xxx,xxx,xxx,xxx,ppp,ppp\n". | |
308 | * xxx,xxx,xxx,xxx is the client address, ppp,ppp is the client port number. | |
309 | * In this case, we create a connection entry using the client address and | |
310 | * port, so that the active ftp data connection from the server can reach | |
311 | * the client. | |
312 | */ | |
313 | static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp, | |
3db05fea | 314 | struct sk_buff *skb, int *diff) |
1da177e4 LT |
315 | { |
316 | struct iphdr *iph; | |
317 | struct tcphdr *th; | |
318 | char *data, *data_start, *data_limit; | |
319 | char *start, *end; | |
28364a59 | 320 | union nf_inet_addr to; |
014d730d | 321 | __be16 port; |
1da177e4 | 322 | struct ip_vs_conn *n_cp; |
4a85b96c | 323 | struct net *net; |
1da177e4 | 324 | |
3b05ac38 DC |
325 | /* no diff required for incoming packets */ |
326 | *diff = 0; | |
327 | ||
a0eb662f JV |
328 | #ifdef CONFIG_IP_VS_IPV6 |
329 | /* This application helper doesn't work with IPv6 yet, | |
330 | * so turn this into a no-op for IPv6 packets | |
331 | */ | |
332 | if (cp->af == AF_INET6) | |
333 | return 1; | |
334 | #endif | |
335 | ||
1da177e4 LT |
336 | /* Only useful for established sessions */ |
337 | if (cp->state != IP_VS_TCP_S_ESTABLISHED) | |
338 | return 1; | |
339 | ||
340 | /* Linear packets are much easier to deal with. */ | |
3db05fea | 341 | if (!skb_make_writable(skb, skb->len)) |
1da177e4 LT |
342 | return 0; |
343 | ||
344 | /* | |
345 | * Detecting whether it is passive | |
346 | */ | |
3db05fea | 347 | iph = ip_hdr(skb); |
1da177e4 LT |
348 | th = (struct tcphdr *)&(((char *)iph)[iph->ihl*4]); |
349 | ||
350 | /* Since there may be OPTIONS in the TCP packet and the HLEN is | |
351 | the length of the header in 32-bit multiples, it is accurate | |
352 | to calculate data address by th+HLEN*4 */ | |
353 | data = data_start = (char *)th + (th->doff << 2); | |
3db05fea | 354 | data_limit = skb_tail_pointer(skb); |
1da177e4 LT |
355 | |
356 | while (data <= data_limit - 6) { | |
18082746 | 357 | if (strncasecmp(data, "PASV\r\n", 6) == 0) { |
1da177e4 | 358 | /* Passive mode on */ |
5e7ddac7 | 359 | IP_VS_DBG(7, "got PASV at %td of %td\n", |
1da177e4 LT |
360 | data - data_start, |
361 | data_limit - data_start); | |
362 | cp->app_data = &ip_vs_ftp_pasv; | |
363 | return 1; | |
364 | } | |
365 | data++; | |
366 | } | |
367 | ||
368 | /* | |
369 | * To support virtual FTP server, the scenerio is as follows: | |
370 | * FTP client ----> Load Balancer ----> FTP server | |
371 | * First detect the port number in the application data, | |
372 | * then create a new connection entry for the coming data | |
373 | * connection. | |
374 | */ | |
375 | if (ip_vs_ftp_get_addrport(data_start, data_limit, | |
376 | CLIENT_STRING, sizeof(CLIENT_STRING)-1, | |
c3aa1bd3 | 377 | ' ', '\r', &to.ip, &port, |
1da177e4 LT |
378 | &start, &end) != 1) |
379 | return 1; | |
380 | ||
14d5e834 | 381 | IP_VS_DBG(7, "PORT %pI4:%d detected\n", &to.ip, ntohs(port)); |
1da177e4 LT |
382 | |
383 | /* Passive mode off */ | |
384 | cp->app_data = NULL; | |
385 | ||
386 | /* | |
387 | * Now update or create a connection entry for it | |
388 | */ | |
14d5e834 | 389 | IP_VS_DBG(7, "protocol %s %pI4:%d %pI4:%d\n", |
1da177e4 | 390 | ip_vs_proto_name(iph->protocol), |
14d5e834 | 391 | &to.ip, ntohs(port), &cp->vaddr.ip, 0); |
1da177e4 | 392 | |
f11017ec SH |
393 | { |
394 | struct ip_vs_conn_param p; | |
6e67e586 HS |
395 | ip_vs_conn_fill_param(ip_vs_conn_net(cp), AF_INET, |
396 | iph->protocol, &to, port, &cp->vaddr, | |
397 | htons(ntohs(cp->vport)-1), &p); | |
f11017ec SH |
398 | n_cp = ip_vs_conn_in_get(&p); |
399 | if (!n_cp) { | |
ba38528a AG |
400 | /* This is ipv4 only */ |
401 | n_cp = ip_vs_conn_new(&p, AF_INET, &cp->daddr, | |
f11017ec | 402 | htons(ntohs(cp->dport)-1), |
0e051e68 HS |
403 | IP_VS_CONN_F_NFCT, cp->dest, |
404 | skb->mark); | |
f11017ec SH |
405 | if (!n_cp) |
406 | return 0; | |
1da177e4 | 407 | |
f11017ec SH |
408 | /* add its controller */ |
409 | ip_vs_control_add(n_cp, cp); | |
410 | } | |
1da177e4 LT |
411 | } |
412 | ||
413 | /* | |
414 | * Move tunnel to listen state | |
415 | */ | |
4a85b96c HS |
416 | net = skb_net(skb); |
417 | ip_vs_tcp_conn_listen(net, n_cp); | |
1da177e4 LT |
418 | ip_vs_conn_put(n_cp); |
419 | ||
420 | return 1; | |
421 | } | |
422 | ||
423 | ||
424 | static struct ip_vs_app ip_vs_ftp = { | |
425 | .name = "ftp", | |
426 | .type = IP_VS_APP_TYPE_FTP, | |
427 | .protocol = IPPROTO_TCP, | |
428 | .module = THIS_MODULE, | |
429 | .incs_list = LIST_HEAD_INIT(ip_vs_ftp.incs_list), | |
430 | .init_conn = ip_vs_ftp_init_conn, | |
431 | .done_conn = ip_vs_ftp_done_conn, | |
432 | .bind_conn = NULL, | |
433 | .unbind_conn = NULL, | |
434 | .pkt_out = ip_vs_ftp_out, | |
435 | .pkt_in = ip_vs_ftp_in, | |
436 | }; | |
437 | ||
1da177e4 | 438 | /* |
61b1ab45 | 439 | * per netns ip_vs_ftp initialization |
1da177e4 | 440 | */ |
61b1ab45 | 441 | static int __net_init __ip_vs_ftp_init(struct net *net) |
1da177e4 LT |
442 | { |
443 | int i, ret; | |
c74c0bfe HS |
444 | struct ip_vs_app *app; |
445 | struct netns_ipvs *ipvs = net_ipvs(net); | |
446 | ||
8d08d71c JA |
447 | if (!ipvs) |
448 | return -ENOENT; | |
1da177e4 | 449 | |
be97fdb5 JA |
450 | app = register_ip_vs_app(net, &ip_vs_ftp); |
451 | if (IS_ERR(app)) | |
452 | return PTR_ERR(app); | |
1da177e4 | 453 | |
52669dfa | 454 | for (i = 0; i < ports_count; i++) { |
1da177e4 LT |
455 | if (!ports[i]) |
456 | continue; | |
ab8a5e84 | 457 | ret = register_ip_vs_app_inc(net, app, app->protocol, ports[i]); |
1da177e4 | 458 | if (ret) |
c74c0bfe | 459 | goto err_unreg; |
1e3e238e HE |
460 | pr_info("%s: loaded support on port[%d] = %d\n", |
461 | app->name, i, ports[i]); | |
1da177e4 | 462 | } |
c74c0bfe | 463 | return 0; |
1da177e4 | 464 | |
c74c0bfe | 465 | err_unreg: |
be97fdb5 | 466 | unregister_ip_vs_app(net, &ip_vs_ftp); |
1da177e4 LT |
467 | return ret; |
468 | } | |
61b1ab45 HS |
469 | /* |
470 | * netns exit | |
471 | */ | |
472 | static void __ip_vs_ftp_exit(struct net *net) | |
473 | { | |
be97fdb5 | 474 | unregister_ip_vs_app(net, &ip_vs_ftp); |
61b1ab45 HS |
475 | } |
476 | ||
477 | static struct pernet_operations ip_vs_ftp_ops = { | |
478 | .init = __ip_vs_ftp_init, | |
479 | .exit = __ip_vs_ftp_exit, | |
480 | }; | |
1da177e4 | 481 | |
d5cce208 | 482 | static int __init ip_vs_ftp_init(void) |
61b1ab45 HS |
483 | { |
484 | int rv; | |
485 | ||
486 | rv = register_pernet_subsys(&ip_vs_ftp_ops); | |
363c97d7 | 487 | /* rcu_barrier() is called by netns on error */ |
61b1ab45 HS |
488 | return rv; |
489 | } | |
1da177e4 LT |
490 | |
491 | /* | |
492 | * ip_vs_ftp finish. | |
493 | */ | |
494 | static void __exit ip_vs_ftp_exit(void) | |
495 | { | |
61b1ab45 | 496 | unregister_pernet_subsys(&ip_vs_ftp_ops); |
363c97d7 | 497 | /* rcu_barrier() is called by netns */ |
1da177e4 LT |
498 | } |
499 | ||
500 | ||
501 | module_init(ip_vs_ftp_init); | |
502 | module_exit(ip_vs_ftp_exit); | |
503 | MODULE_LICENSE("GPL"); |