~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c

Version: ~ [ linux-5.4-rc7 ] ~ [ linux-5.3.10 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.83 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.153 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.200 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.200 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.76 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (C)2004 USAGI/WIDE Project
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  *
  8  * Author:
  9  *      Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
 10  */
 11 
 12 #include <linux/types.h>
 13 #include <linux/ipv6.h>
 14 #include <linux/in6.h>
 15 #include <linux/netfilter.h>
 16 #include <linux/module.h>
 17 #include <linux/skbuff.h>
 18 #include <linux/icmp.h>
 19 #include <net/ipv6.h>
 20 #include <net/inet_frag.h>
 21 
 22 #include <linux/netfilter_bridge.h>
 23 #include <linux/netfilter_ipv6.h>
 24 #include <linux/netfilter_ipv6/ip6_tables.h>
 25 #include <net/netfilter/nf_conntrack.h>
 26 #include <net/netfilter/nf_conntrack_helper.h>
 27 #include <net/netfilter/nf_conntrack_l4proto.h>
 28 #include <net/netfilter/nf_conntrack_l3proto.h>
 29 #include <net/netfilter/nf_conntrack_core.h>
 30 #include <net/netfilter/nf_conntrack_zones.h>
 31 #include <net/netfilter/nf_conntrack_seqadj.h>
 32 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 33 #include <net/netfilter/nf_nat_helper.h>
 34 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 35 #include <net/netfilter/nf_log.h>
 36 
 37 static bool ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
 38                               struct nf_conntrack_tuple *tuple)
 39 {
 40         const u_int32_t *ap;
 41         u_int32_t _addrs[8];
 42 
 43         ap = skb_header_pointer(skb, nhoff + offsetof(struct ipv6hdr, saddr),
 44                                 sizeof(_addrs), _addrs);
 45         if (ap == NULL)
 46                 return false;
 47 
 48         memcpy(tuple->src.u3.ip6, ap, sizeof(tuple->src.u3.ip6));
 49         memcpy(tuple->dst.u3.ip6, ap + 4, sizeof(tuple->dst.u3.ip6));
 50 
 51         return true;
 52 }
 53 
 54 static bool ipv6_invert_tuple(struct nf_conntrack_tuple *tuple,
 55                               const struct nf_conntrack_tuple *orig)
 56 {
 57         memcpy(tuple->src.u3.ip6, orig->dst.u3.ip6, sizeof(tuple->src.u3.ip6));
 58         memcpy(tuple->dst.u3.ip6, orig->src.u3.ip6, sizeof(tuple->dst.u3.ip6));
 59 
 60         return true;
 61 }
 62 
 63 static void ipv6_print_tuple(struct seq_file *s,
 64                             const struct nf_conntrack_tuple *tuple)
 65 {
 66         seq_printf(s, "src=%pI6 dst=%pI6 ",
 67                    tuple->src.u3.ip6, tuple->dst.u3.ip6);
 68 }
 69 
 70 static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
 71                             unsigned int *dataoff, u_int8_t *protonum)
 72 {
 73         unsigned int extoff = nhoff + sizeof(struct ipv6hdr);
 74         __be16 frag_off;
 75         int protoff;
 76         u8 nexthdr;
 77 
 78         if (skb_copy_bits(skb, nhoff + offsetof(struct ipv6hdr, nexthdr),
 79                           &nexthdr, sizeof(nexthdr)) != 0) {
 80                 pr_debug("ip6_conntrack_core: can't get nexthdr\n");
 81                 return -NF_ACCEPT;
 82         }
 83         protoff = ipv6_skip_exthdr(skb, extoff, &nexthdr, &frag_off);
 84         /*
 85          * (protoff == skb->len) means the packet has not data, just
 86          * IPv6 and possibly extensions headers, but it is tracked anyway
 87          */
 88         if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
 89                 pr_debug("ip6_conntrack_core: can't find proto in pkt\n");
 90                 return -NF_ACCEPT;
 91         }
 92 
 93         *dataoff = protoff;
 94         *protonum = nexthdr;
 95         return NF_ACCEPT;
 96 }
 97 
 98 static unsigned int ipv6_helper(const struct nf_hook_ops *ops,
 99                                 struct sk_buff *skb,
100                                 const struct nf_hook_state *state)
101 {
102         struct nf_conn *ct;
103         const struct nf_conn_help *help;
104         const struct nf_conntrack_helper *helper;
105         enum ip_conntrack_info ctinfo;
106         __be16 frag_off;
107         int protoff;
108         u8 nexthdr;
109 
110         /* This is where we call the helper: as the packet goes out. */
111         ct = nf_ct_get(skb, &ctinfo);
112         if (!ct || ctinfo == IP_CT_RELATED_REPLY)
113                 return NF_ACCEPT;
114 
115         help = nfct_help(ct);
116         if (!help)
117                 return NF_ACCEPT;
118         /* rcu_read_lock()ed by nf_hook_slow */
119         helper = rcu_dereference(help->helper);
120         if (!helper)
121                 return NF_ACCEPT;
122 
123         nexthdr = ipv6_hdr(skb)->nexthdr;
124         protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
125                                    &frag_off);
126         if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
127                 pr_debug("proto header not found\n");
128                 return NF_ACCEPT;
129         }
130 
131         return helper->help(skb, protoff, ct, ctinfo);
132 }
133 
134 static unsigned int ipv6_confirm(const struct nf_hook_ops *ops,
135                                  struct sk_buff *skb,
136                                  const struct nf_hook_state *state)
137 {
138         struct nf_conn *ct;
139         enum ip_conntrack_info ctinfo;
140         unsigned char pnum = ipv6_hdr(skb)->nexthdr;
141         int protoff;
142         __be16 frag_off;
143 
144         ct = nf_ct_get(skb, &ctinfo);
145         if (!ct || ctinfo == IP_CT_RELATED_REPLY)
146                 goto out;
147 
148         protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &pnum,
149                                    &frag_off);
150         if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
151                 pr_debug("proto header not found\n");
152                 goto out;
153         }
154 
155         /* adjust seqs for loopback traffic only in outgoing direction */
156         if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
157             !nf_is_loopback_packet(skb)) {
158                 if (!nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) {
159                         NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
160                         return NF_DROP;
161                 }
162         }
163 out:
164         /* We've seen it coming out the other side: confirm it */
165         return nf_conntrack_confirm(skb);
166 }
167 
168 static unsigned int ipv6_conntrack_in(const struct nf_hook_ops *ops,
169                                       struct sk_buff *skb,
170                                       const struct nf_hook_state *state)
171 {
172         return nf_conntrack_in(dev_net(state->in), PF_INET6, ops->hooknum, skb);
173 }
174 
175 static unsigned int ipv6_conntrack_local(const struct nf_hook_ops *ops,
176                                          struct sk_buff *skb,
177                                          const struct nf_hook_state *state)
178 {
179         /* root is playing with raw sockets. */
180         if (skb->len < sizeof(struct ipv6hdr)) {
181                 net_notice_ratelimited("ipv6_conntrack_local: packet too short\n");
182                 return NF_ACCEPT;
183         }
184         return nf_conntrack_in(dev_net(state->out), PF_INET6, ops->hooknum, skb);
185 }
186 
187 static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
188         {
189                 .hook           = ipv6_conntrack_in,
190                 .owner          = THIS_MODULE,
191                 .pf             = NFPROTO_IPV6,
192                 .hooknum        = NF_INET_PRE_ROUTING,
193                 .priority       = NF_IP6_PRI_CONNTRACK,
194         },
195         {
196                 .hook           = ipv6_conntrack_local,
197                 .owner          = THIS_MODULE,
198                 .pf             = NFPROTO_IPV6,
199                 .hooknum        = NF_INET_LOCAL_OUT,
200                 .priority       = NF_IP6_PRI_CONNTRACK,
201         },
202         {
203                 .hook           = ipv6_helper,
204                 .owner          = THIS_MODULE,
205                 .pf             = NFPROTO_IPV6,
206                 .hooknum        = NF_INET_POST_ROUTING,
207                 .priority       = NF_IP6_PRI_CONNTRACK_HELPER,
208         },
209         {
210                 .hook           = ipv6_confirm,
211                 .owner          = THIS_MODULE,
212                 .pf             = NFPROTO_IPV6,
213                 .hooknum        = NF_INET_POST_ROUTING,
214                 .priority       = NF_IP6_PRI_LAST,
215         },
216         {
217                 .hook           = ipv6_helper,
218                 .owner          = THIS_MODULE,
219                 .pf             = NFPROTO_IPV6,
220                 .hooknum        = NF_INET_LOCAL_IN,
221                 .priority       = NF_IP6_PRI_CONNTRACK_HELPER,
222         },
223         {
224                 .hook           = ipv6_confirm,
225                 .owner          = THIS_MODULE,
226                 .pf             = NFPROTO_IPV6,
227                 .hooknum        = NF_INET_LOCAL_IN,
228                 .priority       = NF_IP6_PRI_LAST-1,
229         },
230 };
231 
232 static int
233 ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
234 {
235         struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 };
236         const struct ipv6_pinfo *inet6 = inet6_sk(sk);
237         const struct inet_sock *inet = inet_sk(sk);
238         const struct nf_conntrack_tuple_hash *h;
239         struct sockaddr_in6 sin6;
240         struct nf_conn *ct;
241         __be32 flow_label;
242         int bound_dev_if;
243 
244         lock_sock(sk);
245         tuple.src.u3.in6 = sk->sk_v6_rcv_saddr;
246         tuple.src.u.tcp.port = inet->inet_sport;
247         tuple.dst.u3.in6 = sk->sk_v6_daddr;
248         tuple.dst.u.tcp.port = inet->inet_dport;
249         tuple.dst.protonum = sk->sk_protocol;
250         bound_dev_if = sk->sk_bound_dev_if;
251         flow_label = inet6->flow_label;
252         release_sock(sk);
253 
254         if (tuple.dst.protonum != IPPROTO_TCP &&
255             tuple.dst.protonum != IPPROTO_SCTP)
256                 return -ENOPROTOOPT;
257 
258         if (*len < 0 || (unsigned int) *len < sizeof(sin6))
259                 return -EINVAL;
260 
261         h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);
262         if (!h) {
263                 pr_debug("IP6T_SO_ORIGINAL_DST: Can't find %pI6c/%u-%pI6c/%u.\n",
264                          &tuple.src.u3.ip6, ntohs(tuple.src.u.tcp.port),
265                          &tuple.dst.u3.ip6, ntohs(tuple.dst.u.tcp.port));
266                 return -ENOENT;
267         }
268 
269         ct = nf_ct_tuplehash_to_ctrack(h);
270 
271         sin6.sin6_family = AF_INET6;
272         sin6.sin6_port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
273         sin6.sin6_flowinfo = flow_label & IPV6_FLOWINFO_MASK;
274         memcpy(&sin6.sin6_addr,
275                 &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6,
276                                         sizeof(sin6.sin6_addr));
277 
278         nf_ct_put(ct);
279         sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr, bound_dev_if);
280         return copy_to_user(user, &sin6, sizeof(sin6)) ? -EFAULT : 0;
281 }
282 
283 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
284 
285 #include <linux/netfilter/nfnetlink.h>
286 #include <linux/netfilter/nfnetlink_conntrack.h>
287 
288 static int ipv6_tuple_to_nlattr(struct sk_buff *skb,
289                                 const struct nf_conntrack_tuple *tuple)
290 {
291         if (nla_put_in6_addr(skb, CTA_IP_V6_SRC, &tuple->src.u3.in6) ||
292             nla_put_in6_addr(skb, CTA_IP_V6_DST, &tuple->dst.u3.in6))
293                 goto nla_put_failure;
294         return 0;
295 
296 nla_put_failure:
297         return -1;
298 }
299 
300 static const struct nla_policy ipv6_nla_policy[CTA_IP_MAX+1] = {
301         [CTA_IP_V6_SRC] = { .len = sizeof(u_int32_t)*4 },
302         [CTA_IP_V6_DST] = { .len = sizeof(u_int32_t)*4 },
303 };
304 
305 static int ipv6_nlattr_to_tuple(struct nlattr *tb[],
306                                 struct nf_conntrack_tuple *t)
307 {
308         if (!tb[CTA_IP_V6_SRC] || !tb[CTA_IP_V6_DST])
309                 return -EINVAL;
310 
311         t->src.u3.in6 = nla_get_in6_addr(tb[CTA_IP_V6_SRC]);
312         t->dst.u3.in6 = nla_get_in6_addr(tb[CTA_IP_V6_DST]);
313 
314         return 0;
315 }
316 
317 static int ipv6_nlattr_tuple_size(void)
318 {
319         return nla_policy_len(ipv6_nla_policy, CTA_IP_MAX + 1);
320 }
321 #endif
322 
323 struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 __read_mostly = {
324         .l3proto                = PF_INET6,
325         .name                   = "ipv6",
326         .pkt_to_tuple           = ipv6_pkt_to_tuple,
327         .invert_tuple           = ipv6_invert_tuple,
328         .print_tuple            = ipv6_print_tuple,
329         .get_l4proto            = ipv6_get_l4proto,
330 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
331         .tuple_to_nlattr        = ipv6_tuple_to_nlattr,
332         .nlattr_tuple_size      = ipv6_nlattr_tuple_size,
333         .nlattr_to_tuple        = ipv6_nlattr_to_tuple,
334         .nla_policy             = ipv6_nla_policy,
335 #endif
336         .me                     = THIS_MODULE,
337 };
338 
339 MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET6));
340 MODULE_LICENSE("GPL");
341 MODULE_AUTHOR("Yasuyuki KOZAKAI @USAGI <yasuyuki.kozakai@toshiba.co.jp>");
342 
343 static struct nf_sockopt_ops so_getorigdst6 = {
344         .pf             = NFPROTO_IPV6,
345         .get_optmin     = IP6T_SO_ORIGINAL_DST,
346         .get_optmax     = IP6T_SO_ORIGINAL_DST + 1,
347         .get            = ipv6_getorigdst,
348         .owner          = THIS_MODULE,
349 };
350 
351 static int ipv6_net_init(struct net *net)
352 {
353         int ret = 0;
354 
355         ret = nf_ct_l4proto_pernet_register(net, &nf_conntrack_l4proto_tcp6);
356         if (ret < 0) {
357                 pr_err("nf_conntrack_tcp6: pernet registration failed\n");
358                 goto out;
359         }
360         ret = nf_ct_l4proto_pernet_register(net, &nf_conntrack_l4proto_udp6);
361         if (ret < 0) {
362                 pr_err("nf_conntrack_udp6: pernet registration failed\n");
363                 goto cleanup_tcp6;
364         }
365         ret = nf_ct_l4proto_pernet_register(net, &nf_conntrack_l4proto_icmpv6);
366         if (ret < 0) {
367                 pr_err("nf_conntrack_icmp6: pernet registration failed\n");
368                 goto cleanup_udp6;
369         }
370         ret = nf_ct_l3proto_pernet_register(net, &nf_conntrack_l3proto_ipv6);
371         if (ret < 0) {
372                 pr_err("nf_conntrack_ipv6: pernet registration failed.\n");
373                 goto cleanup_icmpv6;
374         }
375         return 0;
376  cleanup_icmpv6:
377         nf_ct_l4proto_pernet_unregister(net, &nf_conntrack_l4proto_icmpv6);
378  cleanup_udp6:
379         nf_ct_l4proto_pernet_unregister(net, &nf_conntrack_l4proto_udp6);
380  cleanup_tcp6:
381         nf_ct_l4proto_pernet_unregister(net, &nf_conntrack_l4proto_tcp6);
382  out:
383         return ret;
384 }
385 
386 static void ipv6_net_exit(struct net *net)
387 {
388         nf_ct_l3proto_pernet_unregister(net, &nf_conntrack_l3proto_ipv6);
389         nf_ct_l4proto_pernet_unregister(net, &nf_conntrack_l4proto_icmpv6);
390         nf_ct_l4proto_pernet_unregister(net, &nf_conntrack_l4proto_udp6);
391         nf_ct_l4proto_pernet_unregister(net, &nf_conntrack_l4proto_tcp6);
392 }
393 
394 static struct pernet_operations ipv6_net_ops = {
395         .init = ipv6_net_init,
396         .exit = ipv6_net_exit,
397 };
398 
399 static int __init nf_conntrack_l3proto_ipv6_init(void)
400 {
401         int ret = 0;
402 
403         need_conntrack();
404         nf_defrag_ipv6_enable();
405 
406         ret = nf_register_sockopt(&so_getorigdst6);
407         if (ret < 0) {
408                 pr_err("Unable to register netfilter socket option\n");
409                 return ret;
410         }
411 
412         ret = register_pernet_subsys(&ipv6_net_ops);
413         if (ret < 0)
414                 goto cleanup_sockopt;
415 
416         ret = nf_register_hooks(ipv6_conntrack_ops,
417                                 ARRAY_SIZE(ipv6_conntrack_ops));
418         if (ret < 0) {
419                 pr_err("nf_conntrack_ipv6: can't register pre-routing defrag "
420                        "hook.\n");
421                 goto cleanup_pernet;
422         }
423 
424         ret = nf_ct_l4proto_register(&nf_conntrack_l4proto_tcp6);
425         if (ret < 0) {
426                 pr_err("nf_conntrack_ipv6: can't register tcp6 proto.\n");
427                 goto cleanup_hooks;
428         }
429 
430         ret = nf_ct_l4proto_register(&nf_conntrack_l4proto_udp6);
431         if (ret < 0) {
432                 pr_err("nf_conntrack_ipv6: can't register udp6 proto.\n");
433                 goto cleanup_tcp6;
434         }
435 
436         ret = nf_ct_l4proto_register(&nf_conntrack_l4proto_icmpv6);
437         if (ret < 0) {
438                 pr_err("nf_conntrack_ipv6: can't register icmpv6 proto.\n");
439                 goto cleanup_udp6;
440         }
441 
442         ret = nf_ct_l3proto_register(&nf_conntrack_l3proto_ipv6);
443         if (ret < 0) {
444                 pr_err("nf_conntrack_ipv6: can't register ipv6 proto.\n");
445                 goto cleanup_icmpv6;
446         }
447         return ret;
448 
449  cleanup_icmpv6:
450         nf_ct_l4proto_unregister(&nf_conntrack_l4proto_icmpv6);
451  cleanup_udp6:
452         nf_ct_l4proto_unregister(&nf_conntrack_l4proto_udp6);
453  cleanup_tcp6:
454         nf_ct_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
455  cleanup_hooks:
456         nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
457  cleanup_pernet:
458         unregister_pernet_subsys(&ipv6_net_ops);
459  cleanup_sockopt:
460         nf_unregister_sockopt(&so_getorigdst6);
461         return ret;
462 }
463 
464 static void __exit nf_conntrack_l3proto_ipv6_fini(void)
465 {
466         synchronize_net();
467         nf_ct_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
468         nf_ct_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
469         nf_ct_l4proto_unregister(&nf_conntrack_l4proto_udp6);
470         nf_ct_l4proto_unregister(&nf_conntrack_l4proto_icmpv6);
471         nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
472         unregister_pernet_subsys(&ipv6_net_ops);
473         nf_unregister_sockopt(&so_getorigdst6);
474 }
475 
476 module_init(nf_conntrack_l3proto_ipv6_init);
477 module_exit(nf_conntrack_l3proto_ipv6_fini);
478 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp