net/ipv4/netfilter/ip_conntrack_proto_icmp.c

   1 /* (C) 1999-2001 Paul `Rusty' Russell
   2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/types.h>
  10 #include <linux/sched.h>
  11 #include <linux/timer.h>
  12 #include <linux/netfilter.h>
  13 #include <linux/in.h>
  14 #include <linux/icmp.h>
  15 #include <linux/seq_file.h>
  16 #include <linux/skbuff.h>
  17 #include <net/ip.h>
  18 #include <net/checksum.h>
  19 #include <linux/netfilter.h>
  20 #include <linux/netfilter_ipv4.h>
  21 #include <linux/netfilter_ipv4/ip_conntrack.h>
  22 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
  23 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
  24
  25 unsigned long ip_ct_icmp_timeout = 30*HZ;
  26
  27 #if 0
  28 #define DEBUGP printk
  29 #else
  30 #define DEBUGP(format, args...)
  31 #endif
  32
  33 static int icmp_pkt_to_tuple(const struct sk_buff *skb,
  34                              unsigned int dataoff,
  35                              struct ip_conntrack_tuple *tuple)
  36 {
  37         struct icmphdr _hdr, *hp;
  38
  39         hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
  40         if (hp == NULL)
  41                 return 0;
  42
  43         tuple->dst.u.icmp.type = hp->type;
  44         tuple->src.u.icmp.id = hp->un.echo.id;
  45         tuple->dst.u.icmp.code = hp->code;
  46
  47         return 1;
  48 }
  49
  50 /* Add 1; spaces filled with 0. */
  51 static const u_int8_t invmap[] = {
  52         [ICMP_ECHO] = ICMP_ECHOREPLY + 1,
  53         [ICMP_ECHOREPLY] = ICMP_ECHO + 1,
  54         [ICMP_TIMESTAMP] = ICMP_TIMESTAMPREPLY + 1,
  55         [ICMP_TIMESTAMPREPLY] = ICMP_TIMESTAMP + 1,
  56         [ICMP_INFO_REQUEST] = ICMP_INFO_REPLY + 1,
  57         [ICMP_INFO_REPLY] = ICMP_INFO_REQUEST + 1,
  58         [ICMP_ADDRESS] = ICMP_ADDRESSREPLY + 1,
  59         [ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1
  60 };
  61
  62 static int icmp_invert_tuple(struct ip_conntrack_tuple *tuple,
  63                              const struct ip_conntrack_tuple *orig)
  64 {
  65         if (orig->dst.u.icmp.type >= sizeof(invmap)
  66             || !invmap[orig->dst.u.icmp.type])
  67                 return 0;
  68
  69         tuple->src.u.icmp.id = orig->src.u.icmp.id;
  70         tuple->dst.u.icmp.type = invmap[orig->dst.u.icmp.type] - 1;
  71         tuple->dst.u.icmp.code = orig->dst.u.icmp.code;
  72         return 1;
  73 }
  74
  75 /* Print out the per-protocol part of the tuple. */
  76 static int icmp_print_tuple(struct seq_file *s,
  77                             const struct ip_conntrack_tuple *tuple)
  78 {
  79         return seq_printf(s, "type=%u code=%u id=%u ",
  80                           tuple->dst.u.icmp.type,
  81                           tuple->dst.u.icmp.code,
  82                           ntohs(tuple->src.u.icmp.id));
  83 }
  84
  85 /* Print out the private part of the conntrack. */
  86 static int icmp_print_conntrack(struct seq_file *s,
  87                                 const struct ip_conntrack *conntrack)
  88 {
  89         return 0;
  90 }
  91
  92 /* Returns verdict for packet, or -1 for invalid. */
  93 static int icmp_packet(struct ip_conntrack *ct,
  94                        const struct sk_buff *skb,
  95                        enum ip_conntrack_info ctinfo)
  96 {
  97         /* Try to delete connection immediately after all replies:
  98            won't actually vanish as we still have skb, and del_timer
  99            means this will only run once even if count hits zero twice
 100            (theoretically possible with SMP) */
 101         if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
 102                 if (atomic_dec_and_test(&ct->proto.icmp.count)
 103                     && del_timer(&ct->timeout))
 104                         ct->timeout.function((unsigned long)ct);
 105         } else {
 106                 atomic_inc(&ct->proto.icmp.count);
 107                 ip_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
 108                 ip_ct_refresh_acct(ct, ctinfo, skb, ip_ct_icmp_timeout);
 109         }
 110
 111         return NF_ACCEPT;
 112 }
 113
 114 /* Called when a new connection for this protocol found. */
 115 static int icmp_new(struct ip_conntrack *conntrack,
 116                     const struct sk_buff *skb)
 117 {
 118         static const u_int8_t valid_new[] = {
 119                 [ICMP_ECHO] = 1,
 120                 [ICMP_TIMESTAMP] = 1,
 121                 [ICMP_INFO_REQUEST] = 1,
 122                 [ICMP_ADDRESS] = 1
 123         };
 124
 125         if (conntrack->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
 126             || !valid_new[conntrack->tuplehash[0].tuple.dst.u.icmp.type]) {
 127                 /* Can't create a new ICMP `conn' with this. */
 128                 DEBUGP("icmp: can't create new conn with type %u\n",
 129                        conntrack->tuplehash[0].tuple.dst.u.icmp.type);
 130                 DUMP_TUPLE(&conntrack->tuplehash[0].tuple);
 131                 return 0;
 132         }
 133         atomic_set(&conntrack->proto.icmp.count, 0);
 134         return 1;
 135 }
 136
 137 static int
 138 icmp_error_message(struct sk_buff *skb,
 139                    enum ip_conntrack_info *ctinfo,
 140                    unsigned int hooknum)
 141 {
 142         struct ip_conntrack_tuple innertuple, origtuple;
 143         struct {
 144                 struct icmphdr icmp;
 145                 struct iphdr ip;
 146         } _in, *inside;
 147         struct ip_conntrack_protocol *innerproto;
 148         struct ip_conntrack_tuple_hash *h;
 149         int dataoff;
 150
 151         IP_NF_ASSERT(skb->nfct == NULL);
 152
 153         /* Not enough header? */
 154         inside = skb_header_pointer(skb, skb->nh.iph->ihl*4, sizeof(_in), &_in);
 155         if (inside == NULL)
 156                 return -NF_ACCEPT;
 157
 158         /* Ignore ICMP's containing fragments (shouldn't happen) */
 159         if (inside->ip.frag_off & htons(IP_OFFSET)) {
 160                 DEBUGP("icmp_error_track: fragment of proto %u\n",
 161                        inside->ip.protocol);
 162                 return -NF_ACCEPT;
 163         }
 164
 165         innerproto = ip_conntrack_proto_find_get(inside->ip.protocol);
 166         dataoff = skb->nh.iph->ihl*4 + sizeof(inside->icmp) + inside->ip.ihl*4;
 167         /* Are they talking about one of our connections? */
 168         if (!ip_ct_get_tuple(&inside->ip, skb, dataoff, &origtuple, innerproto)) {
 169                 DEBUGP("icmp_error: ! get_tuple p=%u", inside->ip.protocol);
 170                 ip_conntrack_proto_put(innerproto);
 171                 return -NF_ACCEPT;
 172         }
 173
 174         /* Ordinarily, we'd expect the inverted tupleproto, but it's
 175            been preserved inside the ICMP. */
 176         if (!ip_ct_invert_tuple(&innertuple, &origtuple, innerproto)) {
 177                 DEBUGP("icmp_error_track: Can't invert tuple\n");
 178                 ip_conntrack_proto_put(innerproto);
 179                 return -NF_ACCEPT;
 180         }
 181         ip_conntrack_proto_put(innerproto);
 182
 183         *ctinfo = IP_CT_RELATED;
 184
 185         h = ip_conntrack_find_get(&innertuple, NULL);
 186         if (!h) {
 187                 /* Locally generated ICMPs will match inverted if they
 188                    haven't been SNAT'ed yet */
 189                 /* FIXME: NAT code has to handle half-done double NAT --RR */
 190                 if (hooknum == NF_IP_LOCAL_OUT)
 191                         h = ip_conntrack_find_get(&origtuple, NULL);
 192
 193                 if (!h) {
 194                         DEBUGP("icmp_error_track: no match\n");
 195                         return -NF_ACCEPT;
 196                 }
 197                 /* Reverse direction from that found */
 198                 if (DIRECTION(h) != IP_CT_DIR_REPLY)
 199                         *ctinfo += IP_CT_IS_REPLY;
 200         } else {
 201                 if (DIRECTION(h) == IP_CT_DIR_REPLY)
 202                         *ctinfo += IP_CT_IS_REPLY;
 203         }
 204
 205         /* Update skb to refer to this connection */
 206         skb->nfct = &tuplehash_to_ctrack(h)->ct_general;
 207         skb->nfctinfo = *ctinfo;
 208         return -NF_ACCEPT;
 209 }
 210
 211 /* Small and modified version of icmp_rcv */
 212 static int
 213 icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 214            unsigned int hooknum)
 215 {
 216         struct icmphdr _ih, *icmph;
 217
 218         /* Not enough header? */
 219         icmph = skb_header_pointer(skb, skb->nh.iph->ihl*4, sizeof(_ih), &_ih);
 220         if (icmph == NULL) {
 221                 if (LOG_INVALID(IPPROTO_ICMP))
 222                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
 223                                       "ip_ct_icmp: short packet ");
 224                 return -NF_ACCEPT;
 225         }
 226
 227         /* See ip_conntrack_proto_tcp.c */
 228         if (hooknum != NF_IP_PRE_ROUTING)
 229                 goto checksum_skipped;
 230
 231         switch (skb->ip_summed) {
 232         case CHECKSUM_HW:
 233                 if (!(u16)csum_fold(skb->csum))
 234                         break;
 235                 /* fall through */
 236         case CHECKSUM_NONE:
 237                 skb->csum = 0;
 238                 if (__skb_checksum_complete(skb)) {
 239                         if (LOG_INVALID(IPPROTO_ICMP))
 240                                 nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
 241                                               "ip_ct_icmp: bad ICMP checksum ");
 242                         return -NF_ACCEPT;
 243                 }
 244         }
 245
 246 checksum_skipped:
 247         /*
 248          *      18 is the highest 'known' ICMP type. Anything else is a mystery
 249          *
 250          *      RFC 1122: 3.2.2  Unknown ICMP messages types MUST be silently
 251          *                discarded.
 252          */
 253         if (icmph->type > NR_ICMP_TYPES) {
 254                 if (LOG_INVALID(IPPROTO_ICMP))
 255                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
 256                                       "ip_ct_icmp: invalid ICMP type ");
 257                 return -NF_ACCEPT;
 258         }
 259
 260         /* Need to track icmp error message? */
 261         if (icmph->type != ICMP_DEST_UNREACH
 262             && icmph->type != ICMP_SOURCE_QUENCH
 263             && icmph->type != ICMP_TIME_EXCEEDED
 264             && icmph->type != ICMP_PARAMETERPROB
 265             && icmph->type != ICMP_REDIRECT)
 266                 return NF_ACCEPT;
 267
 268         return icmp_error_message(skb, ctinfo, hooknum);
 269 }
 270
 271 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
 272     defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
 273 static int icmp_tuple_to_nfattr(struct sk_buff *skb,
 274                                 const struct ip_conntrack_tuple *t)
 275 {
 276         NFA_PUT(skb, CTA_PROTO_ICMP_ID, sizeof(u_int16_t),
 277                 &t->src.u.icmp.id);
 278         NFA_PUT(skb, CTA_PROTO_ICMP_TYPE, sizeof(u_int8_t),
 279                 &t->dst.u.icmp.type);
 280         NFA_PUT(skb, CTA_PROTO_ICMP_CODE, sizeof(u_int8_t),
 281                 &t->dst.u.icmp.code);
 282
 283         return 0;
 284
 285 nfattr_failure:
 286         return -1;
 287 }
 288
 289 static int icmp_nfattr_to_tuple(struct nfattr *tb[],
 290                                 struct ip_conntrack_tuple *tuple)
 291 {
 292         if (!tb[CTA_PROTO_ICMP_TYPE-1]
 293             || !tb[CTA_PROTO_ICMP_CODE-1]
 294             || !tb[CTA_PROTO_ICMP_ID-1])
 295                 return -EINVAL;
 296
 297         tuple->dst.u.icmp.type =
 298                         *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_TYPE-1]);
 299         tuple->dst.u.icmp.code =
 300                         *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_CODE-1]);
 301         tuple->src.u.icmp.id =
 302                         *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_ICMP_ID-1]);
 303
 304         if (tuple->dst.u.icmp.type >= sizeof(invmap)
 305             || !invmap[tuple->dst.u.icmp.type])
 306                 return -EINVAL;
 307
 308         return 0;
 309 }
 310 #endif
 311
 312 struct ip_conntrack_protocol ip_conntrack_protocol_icmp =
 313 {
 314         .proto                  = IPPROTO_ICMP,
 315         .name                   = "icmp",
 316         .pkt_to_tuple           = icmp_pkt_to_tuple,
 317         .invert_tuple           = icmp_invert_tuple,
 318         .print_tuple            = icmp_print_tuple,
 319         .print_conntrack        = icmp_print_conntrack,
 320         .packet                 = icmp_packet,
 321         .new                    = icmp_new,
 322         .error                  = icmp_error,
 323 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
 324     defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
 325         .tuple_to_nfattr        = icmp_tuple_to_nfattr,
 326         .nfattr_to_tuple        = icmp_nfattr_to_tuple,
 327 #endif
 328 };