~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c

Version: ~ [ linux-5.5 ] ~ [ linux-5.4.15 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.98 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.167 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.211 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.211 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.81 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 
  2 /* (C) 1999-2001 Paul `Rusty' Russell
  3  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  4  *
  5  * This program is free software; you can redistribute it and/or modify
  6  * it under the terms of the GNU General Public License version 2 as
  7  * published by the Free Software Foundation.
  8  */
  9 
 10 #include <linux/types.h>
 11 #include <linux/ip.h>
 12 #include <linux/netfilter.h>
 13 #include <linux/module.h>
 14 #include <linux/skbuff.h>
 15 #include <linux/icmp.h>
 16 #include <linux/sysctl.h>
 17 #include <net/route.h>
 18 #include <net/ip.h>
 19 
 20 #include <linux/netfilter_ipv4.h>
 21 #include <net/netfilter/nf_conntrack.h>
 22 #include <net/netfilter/nf_conntrack_helper.h>
 23 #include <net/netfilter/nf_conntrack_l4proto.h>
 24 #include <net/netfilter/nf_conntrack_l3proto.h>
 25 #include <net/netfilter/nf_conntrack_zones.h>
 26 #include <net/netfilter/nf_conntrack_core.h>
 27 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 28 #include <net/netfilter/nf_nat_helper.h>
 29 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
 30 #include <net/netfilter/nf_log.h>
 31 
 32 int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
 33                               struct nf_conn *ct,
 34                               enum ip_conntrack_info ctinfo);
 35 EXPORT_SYMBOL_GPL(nf_nat_seq_adjust_hook);
 36 
 37 static bool ipv4_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
 38                               struct nf_conntrack_tuple *tuple)
 39 {
 40         const __be32 *ap;
 41         __be32 _addrs[2];
 42         ap = skb_header_pointer(skb, nhoff + offsetof(struct iphdr, saddr),
 43                                 sizeof(u_int32_t) * 2, _addrs);
 44         if (ap == NULL)
 45                 return false;
 46 
 47         tuple->src.u3.ip = ap[0];
 48         tuple->dst.u3.ip = ap[1];
 49 
 50         return true;
 51 }
 52 
 53 static bool ipv4_invert_tuple(struct nf_conntrack_tuple *tuple,
 54                               const struct nf_conntrack_tuple *orig)
 55 {
 56         tuple->src.u3.ip = orig->dst.u3.ip;
 57         tuple->dst.u3.ip = orig->src.u3.ip;
 58 
 59         return true;
 60 }
 61 
 62 static int ipv4_print_tuple(struct seq_file *s,
 63                             const struct nf_conntrack_tuple *tuple)
 64 {
 65         return seq_printf(s, "src=%pI4 dst=%pI4 ",
 66                           &tuple->src.u3.ip, &tuple->dst.u3.ip);
 67 }
 68 
 69 static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
 70                             unsigned int *dataoff, u_int8_t *protonum)
 71 {
 72         const struct iphdr *iph;
 73         struct iphdr _iph;
 74 
 75         iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
 76         if (iph == NULL)
 77                 return -NF_ACCEPT;
 78 
 79         /* Conntrack defragments packets, we might still see fragments
 80          * inside ICMP packets though. */
 81         if (iph->frag_off & htons(IP_OFFSET))
 82                 return -NF_ACCEPT;
 83 
 84         *dataoff = nhoff + (iph->ihl << 2);
 85         *protonum = iph->protocol;
 86 
 87         /* Check bogus IP headers */
 88         if (*dataoff > skb->len) {
 89                 pr_debug("nf_conntrack_ipv4: bogus IPv4 packet: "
 90                          "nhoff %u, ihl %u, skblen %u\n",
 91                          nhoff, iph->ihl << 2, skb->len);
 92                 return -NF_ACCEPT;
 93         }
 94 
 95         return NF_ACCEPT;
 96 }
 97 
 98 static unsigned int ipv4_confirm(unsigned int hooknum,
 99                                  struct sk_buff *skb,
100                                  const struct net_device *in,
101                                  const struct net_device *out,
102                                  int (*okfn)(struct sk_buff *))
103 {
104         struct nf_conn *ct;
105         enum ip_conntrack_info ctinfo;
106         const struct nf_conn_help *help;
107         const struct nf_conntrack_helper *helper;
108         unsigned int ret;
109 
110         /* This is where we call the helper: as the packet goes out. */
111         ct = nf_ct_get(skb, &ctinfo);
112         if (!ct || ctinfo == IP_CT_RELATED_REPLY)
113                 goto out;
114 
115         help = nfct_help(ct);
116         if (!help)
117                 goto out;
118 
119         /* rcu_read_lock()ed by nf_hook_slow */
120         helper = rcu_dereference(help->helper);
121         if (!helper)
122                 goto out;
123 
124         ret = helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),
125                            ct, ctinfo);
126         if (ret != NF_ACCEPT) {
127                 nf_log_packet(NFPROTO_IPV4, hooknum, skb, in, out, NULL,
128                               "nf_ct_%s: dropping packet", helper->name);
129                 return ret;
130         }
131 
132         /* adjust seqs for loopback traffic only in outgoing direction */
133         if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
134             !nf_is_loopback_packet(skb)) {
135                 typeof(nf_nat_seq_adjust_hook) seq_adjust;
136 
137                 seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
138                 if (!seq_adjust || !seq_adjust(skb, ct, ctinfo)) {
139                         NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
140                         return NF_DROP;
141                 }
142         }
143 out:
144         /* We've seen it coming out the other side: confirm it */
145         return nf_conntrack_confirm(skb);
146 }
147 
148 static unsigned int ipv4_conntrack_in(unsigned int hooknum,
149                                       struct sk_buff *skb,
150                                       const struct net_device *in,
151                                       const struct net_device *out,
152                                       int (*okfn)(struct sk_buff *))
153 {
154         return nf_conntrack_in(dev_net(in), PF_INET, hooknum, skb);
155 }
156 
157 static unsigned int ipv4_conntrack_local(unsigned int hooknum,
158                                          struct sk_buff *skb,
159                                          const struct net_device *in,
160                                          const struct net_device *out,
161                                          int (*okfn)(struct sk_buff *))
162 {
163         /* root is playing with raw sockets. */
164         if (skb->len < sizeof(struct iphdr) ||
165             ip_hdrlen(skb) < sizeof(struct iphdr))
166                 return NF_ACCEPT;
167         return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb);
168 }
169 
170 /* Connection tracking may drop packets, but never alters them, so
171    make it the first hook. */
172 static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
173         {
174                 .hook           = ipv4_conntrack_in,
175                 .owner          = THIS_MODULE,
176                 .pf             = NFPROTO_IPV4,
177                 .hooknum        = NF_INET_PRE_ROUTING,
178                 .priority       = NF_IP_PRI_CONNTRACK,
179         },
180         {
181                 .hook           = ipv4_conntrack_local,
182                 .owner          = THIS_MODULE,
183                 .pf             = NFPROTO_IPV4,
184                 .hooknum        = NF_INET_LOCAL_OUT,
185                 .priority       = NF_IP_PRI_CONNTRACK,
186         },
187         {
188                 .hook           = ipv4_confirm,
189                 .owner          = THIS_MODULE,
190                 .pf             = NFPROTO_IPV4,
191                 .hooknum        = NF_INET_POST_ROUTING,
192                 .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
193         },
194         {
195                 .hook           = ipv4_confirm,
196                 .owner          = THIS_MODULE,
197                 .pf             = NFPROTO_IPV4,
198                 .hooknum        = NF_INET_LOCAL_IN,
199                 .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
200         },
201 };
202 
203 #if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
204 static int log_invalid_proto_min = 0;
205 static int log_invalid_proto_max = 255;
206 
207 static ctl_table ip_ct_sysctl_table[] = {
208         {
209                 .procname       = "ip_conntrack_max",
210                 .data           = &nf_conntrack_max,
211                 .maxlen         = sizeof(int),
212                 .mode           = 0644,
213                 .proc_handler   = proc_dointvec,
214         },
215         {
216                 .procname       = "ip_conntrack_count",
217                 .data           = &init_net.ct.count,
218                 .maxlen         = sizeof(int),
219                 .mode           = 0444,
220                 .proc_handler   = proc_dointvec,
221         },
222         {
223                 .procname       = "ip_conntrack_buckets",
224                 .data           = &init_net.ct.htable_size,
225                 .maxlen         = sizeof(unsigned int),
226                 .mode           = 0444,
227                 .proc_handler   = proc_dointvec,
228         },
229         {
230                 .procname       = "ip_conntrack_checksum",
231                 .data           = &init_net.ct.sysctl_checksum,
232                 .maxlen         = sizeof(int),
233                 .mode           = 0644,
234                 .proc_handler   = proc_dointvec,
235         },
236         {
237                 .procname       = "ip_conntrack_log_invalid",
238                 .data           = &init_net.ct.sysctl_log_invalid,
239                 .maxlen         = sizeof(unsigned int),
240                 .mode           = 0644,
241                 .proc_handler   = proc_dointvec_minmax,
242                 .extra1         = &log_invalid_proto_min,
243                 .extra2         = &log_invalid_proto_max,
244         },
245         { }
246 };
247 #endif /* CONFIG_SYSCTL && CONFIG_NF_CONNTRACK_PROC_COMPAT */
248 
249 /* Fast function for those who don't want to parse /proc (and I don't
250    blame them). */
251 /* Reversing the socket's dst/src point of view gives us the reply
252    mapping. */
253 static int
254 getorigdst(struct sock *sk, int optval, void __user *user, int *len)
255 {
256         const struct inet_sock *inet = inet_sk(sk);
257         const struct nf_conntrack_tuple_hash *h;
258         struct nf_conntrack_tuple tuple;
259 
260         memset(&tuple, 0, sizeof(tuple));
261         tuple.src.u3.ip = inet->inet_rcv_saddr;
262         tuple.src.u.tcp.port = inet->inet_sport;
263         tuple.dst.u3.ip = inet->inet_daddr;
264         tuple.dst.u.tcp.port = inet->inet_dport;
265         tuple.src.l3num = PF_INET;
266         tuple.dst.protonum = sk->sk_protocol;
267 
268         /* We only do TCP and SCTP at the moment: is there a better way? */
269         if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) {
270                 pr_debug("SO_ORIGINAL_DST: Not a TCP/SCTP socket\n");
271                 return -ENOPROTOOPT;
272         }
273 
274         if ((unsigned int) *len < sizeof(struct sockaddr_in)) {
275                 pr_debug("SO_ORIGINAL_DST: len %d not %Zu\n",
276                          *len, sizeof(struct sockaddr_in));
277                 return -EINVAL;
278         }
279 
280         h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);
281         if (h) {
282                 struct sockaddr_in sin;
283                 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
284 
285                 sin.sin_family = AF_INET;
286                 sin.sin_port = ct->tuplehash[IP_CT_DIR_ORIGINAL]
287                         .tuple.dst.u.tcp.port;
288                 sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
289                         .tuple.dst.u3.ip;
290                 memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
291 
292                 pr_debug("SO_ORIGINAL_DST: %pI4 %u\n",
293                          &sin.sin_addr.s_addr, ntohs(sin.sin_port));
294                 nf_ct_put(ct);
295                 if (copy_to_user(user, &sin, sizeof(sin)) != 0)
296                         return -EFAULT;
297                 else
298                         return 0;
299         }
300         pr_debug("SO_ORIGINAL_DST: Can't find %pI4/%u-%pI4/%u.\n",
301                  &tuple.src.u3.ip, ntohs(tuple.src.u.tcp.port),
302                  &tuple.dst.u3.ip, ntohs(tuple.dst.u.tcp.port));
303         return -ENOENT;
304 }
305 
306 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
307 
308 #include <linux/netfilter/nfnetlink.h>
309 #include <linux/netfilter/nfnetlink_conntrack.h>
310 
311 static int ipv4_tuple_to_nlattr(struct sk_buff *skb,
312                                 const struct nf_conntrack_tuple *tuple)
313 {
314         if (nla_put_be32(skb, CTA_IP_V4_SRC, tuple->src.u3.ip) ||
315             nla_put_be32(skb, CTA_IP_V4_DST, tuple->dst.u3.ip))
316                 goto nla_put_failure;
317         return 0;
318 
319 nla_put_failure:
320         return -1;
321 }
322 
323 static const struct nla_policy ipv4_nla_policy[CTA_IP_MAX+1] = {
324         [CTA_IP_V4_SRC] = { .type = NLA_U32 },
325         [CTA_IP_V4_DST] = { .type = NLA_U32 },
326 };
327 
328 static int ipv4_nlattr_to_tuple(struct nlattr *tb[],
329                                 struct nf_conntrack_tuple *t)
330 {
331         if (!tb[CTA_IP_V4_SRC] || !tb[CTA_IP_V4_DST])
332                 return -EINVAL;
333 
334         t->src.u3.ip = nla_get_be32(tb[CTA_IP_V4_SRC]);
335         t->dst.u3.ip = nla_get_be32(tb[CTA_IP_V4_DST]);
336 
337         return 0;
338 }
339 
340 static int ipv4_nlattr_tuple_size(void)
341 {
342         return nla_policy_len(ipv4_nla_policy, CTA_IP_MAX + 1);
343 }
344 #endif
345 
346 static struct nf_sockopt_ops so_getorigdst = {
347         .pf             = PF_INET,
348         .get_optmin     = SO_ORIGINAL_DST,
349         .get_optmax     = SO_ORIGINAL_DST+1,
350         .get            = &getorigdst,
351         .owner          = THIS_MODULE,
352 };
353 
354 struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
355         .l3proto         = PF_INET,
356         .name            = "ipv4",
357         .pkt_to_tuple    = ipv4_pkt_to_tuple,
358         .invert_tuple    = ipv4_invert_tuple,
359         .print_tuple     = ipv4_print_tuple,
360         .get_l4proto     = ipv4_get_l4proto,
361 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
362         .tuple_to_nlattr = ipv4_tuple_to_nlattr,
363         .nlattr_tuple_size = ipv4_nlattr_tuple_size,
364         .nlattr_to_tuple = ipv4_nlattr_to_tuple,
365         .nla_policy      = ipv4_nla_policy,
366 #endif
367 #if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
368         .ctl_table_path  = "net/ipv4/netfilter",
369         .ctl_table       = ip_ct_sysctl_table,
370 #endif
371         .me              = THIS_MODULE,
372 };
373 
374 module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,
375                   &nf_conntrack_htable_size, 0600);
376 
377 MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET));
378 MODULE_ALIAS("ip_conntrack");
379 MODULE_LICENSE("GPL");
380 
381 static int __init nf_conntrack_l3proto_ipv4_init(void)
382 {
383         int ret = 0;
384 
385         need_conntrack();
386         nf_defrag_ipv4_enable();
387 
388         ret = nf_register_sockopt(&so_getorigdst);
389         if (ret < 0) {
390                 printk(KERN_ERR "Unable to register netfilter socket option\n");
391                 return ret;
392         }
393 
394         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_tcp4);
395         if (ret < 0) {
396                 pr_err("nf_conntrack_ipv4: can't register tcp.\n");
397                 goto cleanup_sockopt;
398         }
399 
400         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udp4);
401         if (ret < 0) {
402                 pr_err("nf_conntrack_ipv4: can't register udp.\n");
403                 goto cleanup_tcp;
404         }
405 
406         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_icmp);
407         if (ret < 0) {
408                 pr_err("nf_conntrack_ipv4: can't register icmp.\n");
409                 goto cleanup_udp;
410         }
411 
412         ret = nf_conntrack_l3proto_register(&nf_conntrack_l3proto_ipv4);
413         if (ret < 0) {
414                 pr_err("nf_conntrack_ipv4: can't register ipv4\n");
415                 goto cleanup_icmp;
416         }
417 
418         ret = nf_register_hooks(ipv4_conntrack_ops,
419                                 ARRAY_SIZE(ipv4_conntrack_ops));
420         if (ret < 0) {
421                 pr_err("nf_conntrack_ipv4: can't register hooks.\n");
422                 goto cleanup_ipv4;
423         }
424 #if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
425         ret = nf_conntrack_ipv4_compat_init();
426         if (ret < 0)
427                 goto cleanup_hooks;
428 #endif
429         return ret;
430 #if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
431  cleanup_hooks:
432         nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
433 #endif
434  cleanup_ipv4:
435         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
436  cleanup_icmp:
437         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmp);
438  cleanup_udp:
439         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp4);
440  cleanup_tcp:
441         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp4);
442  cleanup_sockopt:
443         nf_unregister_sockopt(&so_getorigdst);
444         return ret;
445 }
446 
447 static void __exit nf_conntrack_l3proto_ipv4_fini(void)
448 {
449         synchronize_net();
450 #if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
451         nf_conntrack_ipv4_compat_fini();
452 #endif
453         nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
454         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
455         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmp);
456         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp4);
457         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp4);
458         nf_unregister_sockopt(&so_getorigdst);
459 }
460 
461 module_init(nf_conntrack_l3proto_ipv4_init);
462 module_exit(nf_conntrack_l3proto_ipv4_fini);
463 
464 void need_ipv4_conntrack(void)
465 {
466         return;
467 }
468 EXPORT_SYMBOL_GPL(need_ipv4_conntrack);
469 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp