Commit | Line | Data |
---|---|---|
84f3bb9a PM |
1 | /* |
2 | * Copyright (c) 2010 Patrick McHardy <kaber@trash.net> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License version 2 as | |
6 | * published by the Free Software Foundation. | |
7 | */ | |
a7fed762 | 8 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
84f3bb9a | 9 | #include <linux/module.h> |
5a0e3ad6 | 10 | #include <linux/gfp.h> |
84f3bb9a | 11 | #include <linux/skbuff.h> |
84f3bb9a PM |
12 | #include <linux/netfilter_ipv4/ip_tables.h> |
13 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
14 | #include <linux/netfilter/x_tables.h> | |
15 | #include <linux/netfilter/xt_CT.h> | |
16 | #include <net/netfilter/nf_conntrack.h> | |
eeb4cb95 | 17 | #include <net/netfilter/nf_conntrack_l4proto.h> |
84f3bb9a PM |
18 | #include <net/netfilter/nf_conntrack_helper.h> |
19 | #include <net/netfilter/nf_conntrack_ecache.h> | |
c1ebd7df | 20 | #include <net/netfilter/nf_conntrack_l4proto.h> |
24de58f4 | 21 | #include <net/netfilter/nf_conntrack_timeout.h> |
5d0aa2cc | 22 | #include <net/netfilter/nf_conntrack_zones.h> |
84f3bb9a | 23 | |
24de58f4 PNA |
24 | static unsigned int xt_ct_target_v0(struct sk_buff *skb, |
25 | const struct xt_action_param *par) | |
84f3bb9a PM |
26 | { |
27 | const struct xt_ct_target_info *info = par->targinfo; | |
28 | struct nf_conn *ct = info->ct; | |
29 | ||
30 | /* Previously seen (loopback)? Ignore. */ | |
31 | if (skb->nfct != NULL) | |
32 | return XT_CONTINUE; | |
33 | ||
34 | atomic_inc(&ct->ct_general.use); | |
35 | skb->nfct = &ct->ct_general; | |
36 | skb->nfctinfo = IP_CT_NEW; | |
37 | ||
38 | return XT_CONTINUE; | |
39 | } | |
40 | ||
24de58f4 PNA |
41 | static unsigned int xt_ct_target_v1(struct sk_buff *skb, |
42 | const struct xt_action_param *par) | |
43 | { | |
44 | const struct xt_ct_target_info_v1 *info = par->targinfo; | |
45 | struct nf_conn *ct = info->ct; | |
46 | ||
47 | /* Previously seen (loopback)? Ignore. */ | |
48 | if (skb->nfct != NULL) | |
49 | return XT_CONTINUE; | |
50 | ||
51 | atomic_inc(&ct->ct_general.use); | |
52 | skb->nfct = &ct->ct_general; | |
53 | skb->nfctinfo = IP_CT_NEW; | |
54 | ||
55 | return XT_CONTINUE; | |
56 | } | |
57 | ||
84f3bb9a PM |
58 | static u8 xt_ct_find_proto(const struct xt_tgchk_param *par) |
59 | { | |
076f7839 | 60 | if (par->family == NFPROTO_IPV4) { |
84f3bb9a PM |
61 | const struct ipt_entry *e = par->entryinfo; |
62 | ||
63 | if (e->ip.invflags & IPT_INV_PROTO) | |
64 | return 0; | |
65 | return e->ip.proto; | |
076f7839 | 66 | } else if (par->family == NFPROTO_IPV6) { |
84f3bb9a PM |
67 | const struct ip6t_entry *e = par->entryinfo; |
68 | ||
69 | if (e->ipv6.invflags & IP6T_INV_PROTO) | |
70 | return 0; | |
71 | return e->ipv6.proto; | |
72 | } else | |
73 | return 0; | |
74 | } | |
75 | ||
24de58f4 | 76 | static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par) |
84f3bb9a PM |
77 | { |
78 | struct xt_ct_target_info *info = par->targinfo; | |
79 | struct nf_conntrack_tuple t; | |
80 | struct nf_conn_help *help; | |
81 | struct nf_conn *ct; | |
4a5a5c73 | 82 | int ret = 0; |
84f3bb9a PM |
83 | u8 proto; |
84 | ||
9bf04646 PNA |
85 | if (info->flags & ~XT_CT_NOTRACK) |
86 | return -EINVAL; | |
84f3bb9a PM |
87 | |
88 | if (info->flags & XT_CT_NOTRACK) { | |
5bfddbd4 | 89 | ct = nf_ct_untracked_get(); |
84f3bb9a PM |
90 | atomic_inc(&ct->ct_general.use); |
91 | goto out; | |
92 | } | |
93 | ||
5d0aa2cc PM |
94 | #ifndef CONFIG_NF_CONNTRACK_ZONES |
95 | if (info->zone) | |
96 | goto err1; | |
97 | #endif | |
98 | ||
4a5a5c73 JE |
99 | ret = nf_ct_l3proto_try_module_get(par->family); |
100 | if (ret < 0) | |
84f3bb9a PM |
101 | goto err1; |
102 | ||
103 | memset(&t, 0, sizeof(t)); | |
5d0aa2cc | 104 | ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL); |
4a5a5c73 | 105 | ret = PTR_ERR(ct); |
84f3bb9a PM |
106 | if (IS_ERR(ct)) |
107 | goto err2; | |
108 | ||
4a5a5c73 | 109 | ret = 0; |
84f3bb9a PM |
110 | if ((info->ct_events || info->exp_events) && |
111 | !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events, | |
112 | GFP_KERNEL)) | |
113 | goto err3; | |
114 | ||
9bf04646 | 115 | if (info->helper[0]) { |
4a5a5c73 | 116 | ret = -ENOENT; |
84f3bb9a | 117 | proto = xt_ct_find_proto(par); |
a7fed762 JE |
118 | if (!proto) { |
119 | pr_info("You must specify a L4 protocol, " | |
120 | "and not use inversions on it.\n"); | |
84f3bb9a | 121 | goto err3; |
a7fed762 | 122 | } |
84f3bb9a | 123 | |
4a5a5c73 | 124 | ret = -ENOMEM; |
84f3bb9a PM |
125 | help = nf_ct_helper_ext_add(ct, GFP_KERNEL); |
126 | if (help == NULL) | |
127 | goto err3; | |
128 | ||
4a5a5c73 | 129 | ret = -ENOENT; |
84f3bb9a PM |
130 | help->helper = nf_conntrack_helper_try_module_get(info->helper, |
131 | par->family, | |
132 | proto); | |
a7fed762 JE |
133 | if (help->helper == NULL) { |
134 | pr_info("No such helper \"%s\"\n", info->helper); | |
84f3bb9a | 135 | goto err3; |
a7fed762 | 136 | } |
84f3bb9a PM |
137 | } |
138 | ||
139 | __set_bit(IPS_TEMPLATE_BIT, &ct->status); | |
140 | __set_bit(IPS_CONFIRMED_BIT, &ct->status); | |
141 | out: | |
142 | info->ct = ct; | |
d6b00a53 | 143 | return 0; |
84f3bb9a PM |
144 | |
145 | err3: | |
146 | nf_conntrack_free(ct); | |
147 | err2: | |
148 | nf_ct_l3proto_module_put(par->family); | |
149 | err1: | |
4a5a5c73 | 150 | return ret; |
84f3bb9a PM |
151 | } |
152 | ||
ee14186f PNA |
153 | #ifdef CONFIG_NF_CONNTRACK_TIMEOUT |
154 | static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout) | |
155 | { | |
156 | typeof(nf_ct_timeout_put_hook) timeout_put; | |
157 | ||
158 | timeout_put = rcu_dereference(nf_ct_timeout_put_hook); | |
159 | if (timeout_put) | |
160 | timeout_put(timeout); | |
161 | } | |
162 | #endif | |
163 | ||
24de58f4 PNA |
164 | static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par) |
165 | { | |
166 | struct xt_ct_target_info_v1 *info = par->targinfo; | |
167 | struct nf_conntrack_tuple t; | |
168 | struct nf_conn_help *help; | |
169 | struct nf_conn *ct; | |
170 | int ret = 0; | |
171 | u8 proto; | |
ee14186f PNA |
172 | #ifdef CONFIG_NF_CONNTRACK_TIMEOUT |
173 | struct ctnl_timeout *timeout; | |
174 | #endif | |
24de58f4 PNA |
175 | if (info->flags & ~XT_CT_NOTRACK) |
176 | return -EINVAL; | |
177 | ||
178 | if (info->flags & XT_CT_NOTRACK) { | |
179 | ct = nf_ct_untracked_get(); | |
180 | atomic_inc(&ct->ct_general.use); | |
181 | goto out; | |
182 | } | |
183 | ||
184 | #ifndef CONFIG_NF_CONNTRACK_ZONES | |
185 | if (info->zone) | |
186 | goto err1; | |
187 | #endif | |
188 | ||
189 | ret = nf_ct_l3proto_try_module_get(par->family); | |
190 | if (ret < 0) | |
191 | goto err1; | |
192 | ||
193 | memset(&t, 0, sizeof(t)); | |
194 | ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL); | |
195 | ret = PTR_ERR(ct); | |
196 | if (IS_ERR(ct)) | |
197 | goto err2; | |
198 | ||
199 | ret = 0; | |
200 | if ((info->ct_events || info->exp_events) && | |
201 | !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events, | |
202 | GFP_KERNEL)) | |
203 | goto err3; | |
204 | ||
205 | if (info->helper[0]) { | |
206 | ret = -ENOENT; | |
207 | proto = xt_ct_find_proto(par); | |
208 | if (!proto) { | |
209 | pr_info("You must specify a L4 protocol, " | |
210 | "and not use inversions on it.\n"); | |
211 | goto err3; | |
212 | } | |
213 | ||
214 | ret = -ENOMEM; | |
215 | help = nf_ct_helper_ext_add(ct, GFP_KERNEL); | |
216 | if (help == NULL) | |
217 | goto err3; | |
218 | ||
219 | ret = -ENOENT; | |
220 | help->helper = nf_conntrack_helper_try_module_get(info->helper, | |
221 | par->family, | |
222 | proto); | |
223 | if (help->helper == NULL) { | |
224 | pr_info("No such helper \"%s\"\n", info->helper); | |
225 | goto err3; | |
226 | } | |
227 | } | |
228 | ||
229 | #ifdef CONFIG_NF_CONNTRACK_TIMEOUT | |
6cf51852 | 230 | if (info->timeout[0]) { |
24de58f4 | 231 | typeof(nf_ct_timeout_find_get_hook) timeout_find_get; |
24de58f4 PNA |
232 | struct nf_conn_timeout *timeout_ext; |
233 | ||
1ac0bf99 | 234 | rcu_read_lock(); |
24de58f4 PNA |
235 | timeout_find_get = |
236 | rcu_dereference(nf_ct_timeout_find_get_hook); | |
237 | ||
238 | if (timeout_find_get) { | |
239 | const struct ipt_entry *e = par->entryinfo; | |
eeb4cb95 | 240 | struct nf_conntrack_l4proto *l4proto; |
24de58f4 PNA |
241 | |
242 | if (e->ip.invflags & IPT_INV_PROTO) { | |
243 | ret = -EINVAL; | |
244 | pr_info("You cannot use inversion on " | |
245 | "L4 protocol\n"); | |
1ac0bf99 | 246 | goto err4; |
24de58f4 PNA |
247 | } |
248 | timeout = timeout_find_get(info->timeout); | |
249 | if (timeout == NULL) { | |
250 | ret = -ENOENT; | |
251 | pr_info("No such timeout policy \"%s\"\n", | |
252 | info->timeout); | |
1ac0bf99 | 253 | goto err4; |
24de58f4 PNA |
254 | } |
255 | if (timeout->l3num != par->family) { | |
256 | ret = -EINVAL; | |
257 | pr_info("Timeout policy `%s' can only be " | |
258 | "used by L3 protocol number %d\n", | |
259 | info->timeout, timeout->l3num); | |
ee14186f | 260 | goto err5; |
24de58f4 | 261 | } |
eeb4cb95 PNA |
262 | /* Make sure the timeout policy matches any existing |
263 | * protocol tracker, otherwise default to generic. | |
264 | */ | |
265 | l4proto = __nf_ct_l4proto_find(par->family, | |
266 | e->ip.proto); | |
267 | if (timeout->l4proto->l4proto != l4proto->l4proto) { | |
24de58f4 PNA |
268 | ret = -EINVAL; |
269 | pr_info("Timeout policy `%s' can only be " | |
270 | "used by L4 protocol number %d\n", | |
c1ebd7df PNA |
271 | info->timeout, |
272 | timeout->l4proto->l4proto); | |
ee14186f | 273 | goto err5; |
24de58f4 PNA |
274 | } |
275 | timeout_ext = nf_ct_timeout_ext_add(ct, timeout, | |
ca53e440 | 276 | GFP_ATOMIC); |
24de58f4 PNA |
277 | if (timeout_ext == NULL) { |
278 | ret = -ENOMEM; | |
ee14186f | 279 | goto err5; |
24de58f4 PNA |
280 | } |
281 | } else { | |
282 | ret = -ENOENT; | |
283 | pr_info("Timeout policy base is empty\n"); | |
1ac0bf99 | 284 | goto err4; |
24de58f4 | 285 | } |
1ac0bf99 | 286 | rcu_read_unlock(); |
24de58f4 PNA |
287 | } |
288 | #endif | |
289 | ||
290 | __set_bit(IPS_TEMPLATE_BIT, &ct->status); | |
291 | __set_bit(IPS_CONFIRMED_BIT, &ct->status); | |
292 | out: | |
293 | info->ct = ct; | |
294 | return 0; | |
295 | ||
44b52bcc | 296 | #ifdef CONFIG_NF_CONNTRACK_TIMEOUT |
ee14186f PNA |
297 | err5: |
298 | __xt_ct_tg_timeout_put(timeout); | |
1ac0bf99 PNA |
299 | err4: |
300 | rcu_read_unlock(); | |
44b52bcc | 301 | #endif |
24de58f4 PNA |
302 | err3: |
303 | nf_conntrack_free(ct); | |
304 | err2: | |
305 | nf_ct_l3proto_module_put(par->family); | |
306 | err1: | |
307 | return ret; | |
308 | } | |
309 | ||
310 | static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par) | |
84f3bb9a PM |
311 | { |
312 | struct xt_ct_target_info *info = par->targinfo; | |
313 | struct nf_conn *ct = info->ct; | |
314 | struct nf_conn_help *help; | |
315 | ||
5bfddbd4 | 316 | if (!nf_ct_is_untracked(ct)) { |
84f3bb9a PM |
317 | help = nfct_help(ct); |
318 | if (help) | |
319 | module_put(help->helper->me); | |
320 | ||
321 | nf_ct_l3proto_module_put(par->family); | |
322 | } | |
323 | nf_ct_put(info->ct); | |
324 | } | |
325 | ||
24de58f4 PNA |
326 | static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par) |
327 | { | |
328 | struct xt_ct_target_info_v1 *info = par->targinfo; | |
329 | struct nf_conn *ct = info->ct; | |
330 | struct nf_conn_help *help; | |
331 | #ifdef CONFIG_NF_CONNTRACK_TIMEOUT | |
332 | struct nf_conn_timeout *timeout_ext; | |
333 | typeof(nf_ct_timeout_put_hook) timeout_put; | |
334 | #endif | |
335 | if (!nf_ct_is_untracked(ct)) { | |
336 | help = nfct_help(ct); | |
337 | if (help) | |
338 | module_put(help->helper->me); | |
339 | ||
340 | nf_ct_l3proto_module_put(par->family); | |
341 | ||
342 | #ifdef CONFIG_NF_CONNTRACK_TIMEOUT | |
1ac0bf99 | 343 | rcu_read_lock(); |
24de58f4 PNA |
344 | timeout_put = rcu_dereference(nf_ct_timeout_put_hook); |
345 | ||
346 | if (timeout_put) { | |
347 | timeout_ext = nf_ct_timeout_find(ct); | |
348 | if (timeout_ext) | |
349 | timeout_put(timeout_ext->timeout); | |
350 | } | |
1ac0bf99 | 351 | rcu_read_unlock(); |
24de58f4 PNA |
352 | #endif |
353 | } | |
354 | nf_ct_put(info->ct); | |
355 | } | |
356 | ||
357 | static struct xt_target xt_ct_tg_reg[] __read_mostly = { | |
358 | { | |
359 | .name = "CT", | |
360 | .family = NFPROTO_UNSPEC, | |
361 | .targetsize = sizeof(struct xt_ct_target_info), | |
362 | .checkentry = xt_ct_tg_check_v0, | |
363 | .destroy = xt_ct_tg_destroy_v0, | |
364 | .target = xt_ct_target_v0, | |
365 | .table = "raw", | |
366 | .me = THIS_MODULE, | |
367 | }, | |
368 | { | |
369 | .name = "CT", | |
370 | .family = NFPROTO_UNSPEC, | |
371 | .revision = 1, | |
372 | .targetsize = sizeof(struct xt_ct_target_info_v1), | |
373 | .checkentry = xt_ct_tg_check_v1, | |
374 | .destroy = xt_ct_tg_destroy_v1, | |
375 | .target = xt_ct_target_v1, | |
376 | .table = "raw", | |
377 | .me = THIS_MODULE, | |
378 | }, | |
84f3bb9a PM |
379 | }; |
380 | ||
381 | static int __init xt_ct_tg_init(void) | |
382 | { | |
24de58f4 | 383 | return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg)); |
84f3bb9a PM |
384 | } |
385 | ||
386 | static void __exit xt_ct_tg_exit(void) | |
387 | { | |
24de58f4 | 388 | xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg)); |
84f3bb9a PM |
389 | } |
390 | ||
391 | module_init(xt_ct_tg_init); | |
392 | module_exit(xt_ct_tg_exit); | |
393 | ||
394 | MODULE_LICENSE("GPL"); | |
395 | MODULE_DESCRIPTION("Xtables: connection tracking target"); | |
396 | MODULE_ALIAS("ipt_CT"); | |
397 | MODULE_ALIAS("ip6t_CT"); |