Commit | Line | Data |
---|---|---|
64eb12f9 JE |
1 | /* |
2 | * xt_conntrack - Netfilter module to match connection tracking | |
3 | * information. (Superset of Rusty's minimalistic state match.) | |
1da177e4 | 4 | * |
64eb12f9 JE |
5 | * (C) 2001 Marc Boucher (marc@mbsi.ca). |
6 | * Copyright © CC Computer Consultants GmbH, 2007 - 2008 | |
1da177e4 | 7 | * |
64eb12f9 JE |
8 | * This program is free software; you can redistribute it and/or modify |
9 | * it under the terms of the GNU General Public License version 2 as | |
10 | * published by the Free Software Foundation. | |
1da177e4 LT |
11 | */ |
12 | ||
13 | #include <linux/module.h> | |
14 | #include <linux/skbuff.h> | |
64eb12f9 | 15 | #include <net/ipv6.h> |
2e4e6a17 HW |
16 | #include <linux/netfilter/x_tables.h> |
17 | #include <linux/netfilter/xt_conntrack.h> | |
587aa641 | 18 | #include <net/netfilter/nf_conntrack.h> |
1da177e4 LT |
19 | |
20 | MODULE_LICENSE("GPL"); | |
21 | MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>"); | |
b4164998 | 22 | MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>"); |
2ae15b64 | 23 | MODULE_DESCRIPTION("Xtables: connection tracking state match"); |
2e4e6a17 | 24 | MODULE_ALIAS("ipt_conntrack"); |
64eb12f9 | 25 | MODULE_ALIAS("ip6t_conntrack"); |
1da177e4 | 26 | |
1d93a9cb | 27 | static bool |
f7108a20 | 28 | conntrack_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par) |
9fb9cbb1 | 29 | { |
f7108a20 | 30 | const struct xt_conntrack_info *sinfo = par->matchinfo; |
a47362a2 | 31 | const struct nf_conn *ct; |
9fb9cbb1 YK |
32 | enum ip_conntrack_info ctinfo; |
33 | unsigned int statebit; | |
34 | ||
a47362a2 | 35 | ct = nf_ct_get(skb, &ctinfo); |
9fb9cbb1 | 36 | |
e79ec50b | 37 | #define FWINV(bool, invflg) ((bool) ^ !!(sinfo->invflags & (invflg))) |
9fb9cbb1 YK |
38 | |
39 | if (ct == &nf_conntrack_untracked) | |
2e4e6a17 | 40 | statebit = XT_CONNTRACK_STATE_UNTRACKED; |
9fb9cbb1 | 41 | else if (ct) |
601e68e1 YH |
42 | statebit = XT_CONNTRACK_STATE_BIT(ctinfo); |
43 | else | |
44 | statebit = XT_CONNTRACK_STATE_INVALID; | |
45 | ||
50b9f1d5 | 46 | if (sinfo->flags & XT_CONNTRACK_STATE) { |
9fb9cbb1 | 47 | if (ct) { |
50b9f1d5 | 48 | if (test_bit(IPS_SRC_NAT_BIT, &ct->status)) |
2e4e6a17 | 49 | statebit |= XT_CONNTRACK_STATE_SNAT; |
50b9f1d5 | 50 | if (test_bit(IPS_DST_NAT_BIT, &ct->status)) |
2e4e6a17 | 51 | statebit |= XT_CONNTRACK_STATE_DNAT; |
9fb9cbb1 | 52 | } |
50b9f1d5 PM |
53 | if (FWINV((statebit & sinfo->statemask) == 0, |
54 | XT_CONNTRACK_STATE)) | |
1d93a9cb | 55 | return false; |
9fb9cbb1 YK |
56 | } |
57 | ||
50b9f1d5 PM |
58 | if (ct == NULL) { |
59 | if (sinfo->flags & ~XT_CONNTRACK_STATE) | |
1d93a9cb JE |
60 | return false; |
61 | return true; | |
9fb9cbb1 YK |
62 | } |
63 | ||
50b9f1d5 | 64 | if (sinfo->flags & XT_CONNTRACK_PROTO && |
5e8fbe2a | 65 | FWINV(nf_ct_protonum(ct) != |
601e68e1 | 66 | sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum, |
50b9f1d5 | 67 | XT_CONNTRACK_PROTO)) |
1d93a9cb | 68 | return false; |
50b9f1d5 PM |
69 | |
70 | if (sinfo->flags & XT_CONNTRACK_ORIGSRC && | |
71 | FWINV((ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip & | |
601e68e1 | 72 | sinfo->sipmsk[IP_CT_DIR_ORIGINAL].s_addr) != |
50b9f1d5 PM |
73 | sinfo->tuple[IP_CT_DIR_ORIGINAL].src.ip, |
74 | XT_CONNTRACK_ORIGSRC)) | |
1d93a9cb | 75 | return false; |
9fb9cbb1 | 76 | |
50b9f1d5 PM |
77 | if (sinfo->flags & XT_CONNTRACK_ORIGDST && |
78 | FWINV((ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.ip & | |
601e68e1 | 79 | sinfo->dipmsk[IP_CT_DIR_ORIGINAL].s_addr) != |
50b9f1d5 PM |
80 | sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.ip, |
81 | XT_CONNTRACK_ORIGDST)) | |
1d93a9cb | 82 | return false; |
9fb9cbb1 | 83 | |
50b9f1d5 PM |
84 | if (sinfo->flags & XT_CONNTRACK_REPLSRC && |
85 | FWINV((ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip & | |
601e68e1 | 86 | sinfo->sipmsk[IP_CT_DIR_REPLY].s_addr) != |
50b9f1d5 PM |
87 | sinfo->tuple[IP_CT_DIR_REPLY].src.ip, |
88 | XT_CONNTRACK_REPLSRC)) | |
1d93a9cb | 89 | return false; |
9fb9cbb1 | 90 | |
50b9f1d5 PM |
91 | if (sinfo->flags & XT_CONNTRACK_REPLDST && |
92 | FWINV((ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip & | |
601e68e1 | 93 | sinfo->dipmsk[IP_CT_DIR_REPLY].s_addr) != |
50b9f1d5 PM |
94 | sinfo->tuple[IP_CT_DIR_REPLY].dst.ip, |
95 | XT_CONNTRACK_REPLDST)) | |
1d93a9cb | 96 | return false; |
9fb9cbb1 | 97 | |
50b9f1d5 PM |
98 | if (sinfo->flags & XT_CONNTRACK_STATUS && |
99 | FWINV((ct->status & sinfo->statusmask) == 0, | |
601e68e1 | 100 | XT_CONNTRACK_STATUS)) |
1d93a9cb | 101 | return false; |
9fb9cbb1 | 102 | |
50b9f1d5 PM |
103 | if(sinfo->flags & XT_CONNTRACK_EXPIRES) { |
104 | unsigned long expires = timer_pending(&ct->timeout) ? | |
105 | (ct->timeout.expires - jiffies)/HZ : 0; | |
9fb9cbb1 | 106 | |
50b9f1d5 PM |
107 | if (FWINV(!(expires >= sinfo->expires_min && |
108 | expires <= sinfo->expires_max), | |
109 | XT_CONNTRACK_EXPIRES)) | |
1d93a9cb | 110 | return false; |
9fb9cbb1 | 111 | } |
1d93a9cb | 112 | return true; |
e79ec50b | 113 | #undef FWINV |
9fb9cbb1 YK |
114 | } |
115 | ||
64eb12f9 JE |
116 | static bool |
117 | conntrack_addrcmp(const union nf_inet_addr *kaddr, | |
118 | const union nf_inet_addr *uaddr, | |
119 | const union nf_inet_addr *umask, unsigned int l3proto) | |
120 | { | |
ee999d8b | 121 | if (l3proto == NFPROTO_IPV4) |
6556874d | 122 | return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0; |
ee999d8b | 123 | else if (l3proto == NFPROTO_IPV6) |
64eb12f9 JE |
124 | return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6, |
125 | &uaddr->in6) == 0; | |
126 | else | |
127 | return false; | |
128 | } | |
129 | ||
130 | static inline bool | |
131 | conntrack_mt_origsrc(const struct nf_conn *ct, | |
132 | const struct xt_conntrack_mtinfo1 *info, | |
76108cea | 133 | u_int8_t family) |
64eb12f9 JE |
134 | { |
135 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3, | |
136 | &info->origsrc_addr, &info->origsrc_mask, family); | |
137 | } | |
138 | ||
139 | static inline bool | |
140 | conntrack_mt_origdst(const struct nf_conn *ct, | |
141 | const struct xt_conntrack_mtinfo1 *info, | |
76108cea | 142 | u_int8_t family) |
64eb12f9 JE |
143 | { |
144 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3, | |
145 | &info->origdst_addr, &info->origdst_mask, family); | |
146 | } | |
147 | ||
148 | static inline bool | |
149 | conntrack_mt_replsrc(const struct nf_conn *ct, | |
150 | const struct xt_conntrack_mtinfo1 *info, | |
76108cea | 151 | u_int8_t family) |
64eb12f9 JE |
152 | { |
153 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3, | |
154 | &info->replsrc_addr, &info->replsrc_mask, family); | |
155 | } | |
156 | ||
157 | static inline bool | |
158 | conntrack_mt_repldst(const struct nf_conn *ct, | |
159 | const struct xt_conntrack_mtinfo1 *info, | |
76108cea | 160 | u_int8_t family) |
64eb12f9 JE |
161 | { |
162 | return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3, | |
163 | &info->repldst_addr, &info->repldst_mask, family); | |
164 | } | |
165 | ||
b4164998 JE |
166 | static inline bool |
167 | ct_proto_port_check(const struct xt_conntrack_mtinfo1 *info, | |
168 | const struct nf_conn *ct) | |
169 | { | |
170 | const struct nf_conntrack_tuple *tuple; | |
171 | ||
172 | tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; | |
173 | if ((info->match_flags & XT_CONNTRACK_PROTO) && | |
5e8fbe2a | 174 | (nf_ct_protonum(ct) == info->l4proto) ^ |
b4164998 JE |
175 | !(info->invert_flags & XT_CONNTRACK_PROTO)) |
176 | return false; | |
177 | ||
178 | /* Shortcut to match all recognized protocols by using ->src.all. */ | |
179 | if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) && | |
180 | (tuple->src.u.all == info->origsrc_port) ^ | |
181 | !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT)) | |
182 | return false; | |
183 | ||
184 | if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) && | |
185 | (tuple->dst.u.all == info->origdst_port) ^ | |
186 | !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT)) | |
187 | return false; | |
188 | ||
189 | tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; | |
190 | ||
191 | if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) && | |
192 | (tuple->src.u.all == info->replsrc_port) ^ | |
193 | !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT)) | |
194 | return false; | |
195 | ||
196 | if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) && | |
197 | (tuple->dst.u.all == info->repldst_port) ^ | |
198 | !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT)) | |
199 | return false; | |
200 | ||
201 | return true; | |
202 | } | |
203 | ||
64eb12f9 | 204 | static bool |
f7108a20 | 205 | conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par) |
64eb12f9 | 206 | { |
f7108a20 | 207 | const struct xt_conntrack_mtinfo1 *info = par->matchinfo; |
64eb12f9 JE |
208 | enum ip_conntrack_info ctinfo; |
209 | const struct nf_conn *ct; | |
210 | unsigned int statebit; | |
211 | ||
212 | ct = nf_ct_get(skb, &ctinfo); | |
213 | ||
214 | if (ct == &nf_conntrack_untracked) | |
215 | statebit = XT_CONNTRACK_STATE_UNTRACKED; | |
216 | else if (ct != NULL) | |
217 | statebit = XT_CONNTRACK_STATE_BIT(ctinfo); | |
218 | else | |
219 | statebit = XT_CONNTRACK_STATE_INVALID; | |
220 | ||
221 | if (info->match_flags & XT_CONNTRACK_STATE) { | |
222 | if (ct != NULL) { | |
223 | if (test_bit(IPS_SRC_NAT_BIT, &ct->status)) | |
224 | statebit |= XT_CONNTRACK_STATE_SNAT; | |
225 | if (test_bit(IPS_DST_NAT_BIT, &ct->status)) | |
226 | statebit |= XT_CONNTRACK_STATE_DNAT; | |
227 | } | |
d61f89e9 | 228 | if (!!(info->state_mask & statebit) ^ |
64eb12f9 JE |
229 | !(info->invert_flags & XT_CONNTRACK_STATE)) |
230 | return false; | |
231 | } | |
232 | ||
233 | if (ct == NULL) | |
234 | return info->match_flags & XT_CONNTRACK_STATE; | |
b4164998 JE |
235 | if ((info->match_flags & XT_CONNTRACK_DIRECTION) && |
236 | (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^ | |
237 | !!(info->invert_flags & XT_CONNTRACK_DIRECTION)) | |
64eb12f9 JE |
238 | return false; |
239 | ||
240 | if (info->match_flags & XT_CONNTRACK_ORIGSRC) | |
92f3b2b1 | 241 | if (conntrack_mt_origsrc(ct, info, par->family) ^ |
64eb12f9 JE |
242 | !(info->invert_flags & XT_CONNTRACK_ORIGSRC)) |
243 | return false; | |
244 | ||
245 | if (info->match_flags & XT_CONNTRACK_ORIGDST) | |
92f3b2b1 | 246 | if (conntrack_mt_origdst(ct, info, par->family) ^ |
64eb12f9 JE |
247 | !(info->invert_flags & XT_CONNTRACK_ORIGDST)) |
248 | return false; | |
249 | ||
250 | if (info->match_flags & XT_CONNTRACK_REPLSRC) | |
92f3b2b1 | 251 | if (conntrack_mt_replsrc(ct, info, par->family) ^ |
64eb12f9 JE |
252 | !(info->invert_flags & XT_CONNTRACK_REPLSRC)) |
253 | return false; | |
254 | ||
255 | if (info->match_flags & XT_CONNTRACK_REPLDST) | |
92f3b2b1 | 256 | if (conntrack_mt_repldst(ct, info, par->family) ^ |
64eb12f9 JE |
257 | !(info->invert_flags & XT_CONNTRACK_REPLDST)) |
258 | return false; | |
259 | ||
b4164998 JE |
260 | if (!ct_proto_port_check(info, ct)) |
261 | return false; | |
262 | ||
64eb12f9 JE |
263 | if ((info->match_flags & XT_CONNTRACK_STATUS) && |
264 | (!!(info->status_mask & ct->status) ^ | |
265 | !(info->invert_flags & XT_CONNTRACK_STATUS))) | |
266 | return false; | |
267 | ||
268 | if (info->match_flags & XT_CONNTRACK_EXPIRES) { | |
269 | unsigned long expires = 0; | |
270 | ||
271 | if (timer_pending(&ct->timeout)) | |
272 | expires = (ct->timeout.expires - jiffies) / HZ; | |
273 | if ((expires >= info->expires_min && | |
274 | expires <= info->expires_max) ^ | |
275 | !(info->invert_flags & XT_CONNTRACK_EXPIRES)) | |
276 | return false; | |
277 | } | |
278 | return true; | |
279 | } | |
280 | ||
9b4fce7a | 281 | static bool conntrack_mt_check(const struct xt_mtchk_param *par) |
b9f78f9f | 282 | { |
92f3b2b1 | 283 | if (nf_ct_l3proto_try_module_get(par->family) < 0) { |
fe0b9294 | 284 | printk(KERN_WARNING "can't load conntrack support for " |
92f3b2b1 | 285 | "proto=%u\n", par->family); |
ccb79bdc | 286 | return false; |
b9f78f9f | 287 | } |
ccb79bdc | 288 | return true; |
b9f78f9f PNA |
289 | } |
290 | ||
6be3d859 | 291 | static void conntrack_mt_destroy(const struct xt_mtdtor_param *par) |
b9f78f9f | 292 | { |
92f3b2b1 | 293 | nf_ct_l3proto_module_put(par->family); |
b9f78f9f PNA |
294 | } |
295 | ||
da0dd231 PM |
296 | #ifdef CONFIG_COMPAT |
297 | struct compat_xt_conntrack_info | |
298 | { | |
299 | compat_uint_t statemask; | |
300 | compat_uint_t statusmask; | |
301 | struct ip_conntrack_old_tuple tuple[IP_CT_DIR_MAX]; | |
302 | struct in_addr sipmsk[IP_CT_DIR_MAX]; | |
303 | struct in_addr dipmsk[IP_CT_DIR_MAX]; | |
304 | compat_ulong_t expires_min; | |
305 | compat_ulong_t expires_max; | |
306 | u_int8_t flags; | |
307 | u_int8_t invflags; | |
308 | }; | |
309 | ||
64eb12f9 | 310 | static void conntrack_mt_compat_from_user_v0(void *dst, void *src) |
da0dd231 | 311 | { |
a47362a2 | 312 | const struct compat_xt_conntrack_info *cm = src; |
da0dd231 PM |
313 | struct xt_conntrack_info m = { |
314 | .statemask = cm->statemask, | |
315 | .statusmask = cm->statusmask, | |
316 | .expires_min = cm->expires_min, | |
317 | .expires_max = cm->expires_max, | |
318 | .flags = cm->flags, | |
319 | .invflags = cm->invflags, | |
320 | }; | |
321 | memcpy(m.tuple, cm->tuple, sizeof(m.tuple)); | |
322 | memcpy(m.sipmsk, cm->sipmsk, sizeof(m.sipmsk)); | |
323 | memcpy(m.dipmsk, cm->dipmsk, sizeof(m.dipmsk)); | |
324 | memcpy(dst, &m, sizeof(m)); | |
325 | } | |
326 | ||
64eb12f9 | 327 | static int conntrack_mt_compat_to_user_v0(void __user *dst, void *src) |
da0dd231 | 328 | { |
a47362a2 | 329 | const struct xt_conntrack_info *m = src; |
da0dd231 PM |
330 | struct compat_xt_conntrack_info cm = { |
331 | .statemask = m->statemask, | |
332 | .statusmask = m->statusmask, | |
333 | .expires_min = m->expires_min, | |
334 | .expires_max = m->expires_max, | |
335 | .flags = m->flags, | |
336 | .invflags = m->invflags, | |
337 | }; | |
338 | memcpy(cm.tuple, m->tuple, sizeof(cm.tuple)); | |
339 | memcpy(cm.sipmsk, m->sipmsk, sizeof(cm.sipmsk)); | |
340 | memcpy(cm.dipmsk, m->dipmsk, sizeof(cm.dipmsk)); | |
341 | return copy_to_user(dst, &cm, sizeof(cm)) ? -EFAULT : 0; | |
342 | } | |
343 | #endif | |
344 | ||
64eb12f9 JE |
345 | static struct xt_match conntrack_mt_reg[] __read_mostly = { |
346 | { | |
347 | .name = "conntrack", | |
348 | .revision = 0, | |
ee999d8b | 349 | .family = NFPROTO_IPV4, |
64eb12f9 JE |
350 | .match = conntrack_mt_v0, |
351 | .checkentry = conntrack_mt_check, | |
352 | .destroy = conntrack_mt_destroy, | |
353 | .matchsize = sizeof(struct xt_conntrack_info), | |
354 | .me = THIS_MODULE, | |
da0dd231 | 355 | #ifdef CONFIG_COMPAT |
64eb12f9 JE |
356 | .compatsize = sizeof(struct compat_xt_conntrack_info), |
357 | .compat_from_user = conntrack_mt_compat_from_user_v0, | |
358 | .compat_to_user = conntrack_mt_compat_to_user_v0, | |
da0dd231 | 359 | #endif |
64eb12f9 JE |
360 | }, |
361 | { | |
362 | .name = "conntrack", | |
363 | .revision = 1, | |
92f3b2b1 | 364 | .family = NFPROTO_UNSPEC, |
64eb12f9 JE |
365 | .matchsize = sizeof(struct xt_conntrack_mtinfo1), |
366 | .match = conntrack_mt, | |
367 | .checkentry = conntrack_mt_check, | |
368 | .destroy = conntrack_mt_destroy, | |
369 | .me = THIS_MODULE, | |
370 | }, | |
1da177e4 LT |
371 | }; |
372 | ||
d3c5ee6d | 373 | static int __init conntrack_mt_init(void) |
1da177e4 | 374 | { |
64eb12f9 JE |
375 | return xt_register_matches(conntrack_mt_reg, |
376 | ARRAY_SIZE(conntrack_mt_reg)); | |
1da177e4 LT |
377 | } |
378 | ||
d3c5ee6d | 379 | static void __exit conntrack_mt_exit(void) |
1da177e4 | 380 | { |
64eb12f9 | 381 | xt_unregister_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg)); |
1da177e4 LT |
382 | } |
383 | ||
d3c5ee6d JE |
384 | module_init(conntrack_mt_init); |
385 | module_exit(conntrack_mt_exit); |