~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c

Version: ~ [ linux-5.4-rc3 ] ~ [ linux-5.3.6 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.79 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.149 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.196 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.196 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.75 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (C)2004 USAGI/WIDE Project
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  *
  8  * Author:
  9  *      Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
 10  */
 11 
 12 #include <linux/types.h>
 13 #include <linux/ipv6.h>
 14 #include <linux/in6.h>
 15 #include <linux/netfilter.h>
 16 #include <linux/module.h>
 17 #include <linux/skbuff.h>
 18 #include <linux/icmp.h>
 19 #include <net/ipv6.h>
 20 #include <net/inet_frag.h>
 21 
 22 #include <linux/netfilter_bridge.h>
 23 #include <linux/netfilter_ipv6.h>
 24 #include <linux/netfilter_ipv6/ip6_tables.h>
 25 #include <net/netfilter/nf_conntrack.h>
 26 #include <net/netfilter/nf_conntrack_helper.h>
 27 #include <net/netfilter/nf_conntrack_l4proto.h>
 28 #include <net/netfilter/nf_conntrack_l3proto.h>
 29 #include <net/netfilter/nf_conntrack_core.h>
 30 #include <net/netfilter/nf_conntrack_zones.h>
 31 #include <net/netfilter/nf_conntrack_seqadj.h>
 32 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 33 #include <net/netfilter/nf_nat_helper.h>
 34 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 35 #include <net/netfilter/nf_log.h>
 36 
 37 static int conntrack6_net_id;
 38 static DEFINE_MUTEX(register_ipv6_hooks);
 39 
 40 struct conntrack6_net {
 41         unsigned int users;
 42 };
 43 
 44 static bool ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
 45                               struct nf_conntrack_tuple *tuple)
 46 {
 47         const u_int32_t *ap;
 48         u_int32_t _addrs[8];
 49 
 50         ap = skb_header_pointer(skb, nhoff + offsetof(struct ipv6hdr, saddr),
 51                                 sizeof(_addrs), _addrs);
 52         if (ap == NULL)
 53                 return false;
 54 
 55         memcpy(tuple->src.u3.ip6, ap, sizeof(tuple->src.u3.ip6));
 56         memcpy(tuple->dst.u3.ip6, ap + 4, sizeof(tuple->dst.u3.ip6));
 57 
 58         return true;
 59 }
 60 
 61 static bool ipv6_invert_tuple(struct nf_conntrack_tuple *tuple,
 62                               const struct nf_conntrack_tuple *orig)
 63 {
 64         memcpy(tuple->src.u3.ip6, orig->dst.u3.ip6, sizeof(tuple->src.u3.ip6));
 65         memcpy(tuple->dst.u3.ip6, orig->src.u3.ip6, sizeof(tuple->dst.u3.ip6));
 66 
 67         return true;
 68 }
 69 
 70 static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
 71                             unsigned int *dataoff, u_int8_t *protonum)
 72 {
 73         unsigned int extoff = nhoff + sizeof(struct ipv6hdr);
 74         __be16 frag_off;
 75         int protoff;
 76         u8 nexthdr;
 77 
 78         if (skb_copy_bits(skb, nhoff + offsetof(struct ipv6hdr, nexthdr),
 79                           &nexthdr, sizeof(nexthdr)) != 0) {
 80                 pr_debug("ip6_conntrack_core: can't get nexthdr\n");
 81                 return -NF_ACCEPT;
 82         }
 83         protoff = ipv6_skip_exthdr(skb, extoff, &nexthdr, &frag_off);
 84         /*
 85          * (protoff == skb->len) means the packet has not data, just
 86          * IPv6 and possibly extensions headers, but it is tracked anyway
 87          */
 88         if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
 89                 pr_debug("ip6_conntrack_core: can't find proto in pkt\n");
 90                 return -NF_ACCEPT;
 91         }
 92 
 93         *dataoff = protoff;
 94         *protonum = nexthdr;
 95         return NF_ACCEPT;
 96 }
 97 
 98 static unsigned int ipv6_helper(void *priv,
 99                                 struct sk_buff *skb,
100                                 const struct nf_hook_state *state)
101 {
102         struct nf_conn *ct;
103         const struct nf_conn_help *help;
104         const struct nf_conntrack_helper *helper;
105         enum ip_conntrack_info ctinfo;
106         __be16 frag_off;
107         int protoff;
108         u8 nexthdr;
109 
110         /* This is where we call the helper: as the packet goes out. */
111         ct = nf_ct_get(skb, &ctinfo);
112         if (!ct || ctinfo == IP_CT_RELATED_REPLY)
113                 return NF_ACCEPT;
114 
115         help = nfct_help(ct);
116         if (!help)
117                 return NF_ACCEPT;
118         /* rcu_read_lock()ed by nf_hook_thresh */
119         helper = rcu_dereference(help->helper);
120         if (!helper)
121                 return NF_ACCEPT;
122 
123         nexthdr = ipv6_hdr(skb)->nexthdr;
124         protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
125                                    &frag_off);
126         if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
127                 pr_debug("proto header not found\n");
128                 return NF_ACCEPT;
129         }
130 
131         return helper->help(skb, protoff, ct, ctinfo);
132 }
133 
134 static unsigned int ipv6_confirm(void *priv,
135                                  struct sk_buff *skb,
136                                  const struct nf_hook_state *state)
137 {
138         struct nf_conn *ct;
139         enum ip_conntrack_info ctinfo;
140         unsigned char pnum = ipv6_hdr(skb)->nexthdr;
141         int protoff;
142         __be16 frag_off;
143 
144         ct = nf_ct_get(skb, &ctinfo);
145         if (!ct || ctinfo == IP_CT_RELATED_REPLY)
146                 goto out;
147 
148         protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &pnum,
149                                    &frag_off);
150         if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
151                 pr_debug("proto header not found\n");
152                 goto out;
153         }
154 
155         /* adjust seqs for loopback traffic only in outgoing direction */
156         if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
157             !nf_is_loopback_packet(skb)) {
158                 if (!nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) {
159                         NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
160                         return NF_DROP;
161                 }
162         }
163 out:
164         /* We've seen it coming out the other side: confirm it */
165         return nf_conntrack_confirm(skb);
166 }
167 
168 static unsigned int ipv6_conntrack_in(void *priv,
169                                       struct sk_buff *skb,
170                                       const struct nf_hook_state *state)
171 {
172         return nf_conntrack_in(state->net, PF_INET6, state->hook, skb);
173 }
174 
175 static unsigned int ipv6_conntrack_local(void *priv,
176                                          struct sk_buff *skb,
177                                          const struct nf_hook_state *state)
178 {
179         /* root is playing with raw sockets. */
180         if (skb->len < sizeof(struct ipv6hdr)) {
181                 net_notice_ratelimited("ipv6_conntrack_local: packet too short\n");
182                 return NF_ACCEPT;
183         }
184         return nf_conntrack_in(state->net, PF_INET6, state->hook, skb);
185 }
186 
187 static const struct nf_hook_ops ipv6_conntrack_ops[] = {
188         {
189                 .hook           = ipv6_conntrack_in,
190                 .pf             = NFPROTO_IPV6,
191                 .hooknum        = NF_INET_PRE_ROUTING,
192                 .priority       = NF_IP6_PRI_CONNTRACK,
193         },
194         {
195                 .hook           = ipv6_conntrack_local,
196                 .pf             = NFPROTO_IPV6,
197                 .hooknum        = NF_INET_LOCAL_OUT,
198                 .priority       = NF_IP6_PRI_CONNTRACK,
199         },
200         {
201                 .hook           = ipv6_helper,
202                 .pf             = NFPROTO_IPV6,
203                 .hooknum        = NF_INET_POST_ROUTING,
204                 .priority       = NF_IP6_PRI_CONNTRACK_HELPER,
205         },
206         {
207                 .hook           = ipv6_confirm,
208                 .pf             = NFPROTO_IPV6,
209                 .hooknum        = NF_INET_POST_ROUTING,
210                 .priority       = NF_IP6_PRI_LAST,
211         },
212         {
213                 .hook           = ipv6_helper,
214                 .pf             = NFPROTO_IPV6,
215                 .hooknum        = NF_INET_LOCAL_IN,
216                 .priority       = NF_IP6_PRI_CONNTRACK_HELPER,
217         },
218         {
219                 .hook           = ipv6_confirm,
220                 .pf             = NFPROTO_IPV6,
221                 .hooknum        = NF_INET_LOCAL_IN,
222                 .priority       = NF_IP6_PRI_LAST-1,
223         },
224 };
225 
226 static int
227 ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
228 {
229         struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 };
230         const struct ipv6_pinfo *inet6 = inet6_sk(sk);
231         const struct inet_sock *inet = inet_sk(sk);
232         const struct nf_conntrack_tuple_hash *h;
233         struct sockaddr_in6 sin6;
234         struct nf_conn *ct;
235         __be32 flow_label;
236         int bound_dev_if;
237 
238         lock_sock(sk);
239         tuple.src.u3.in6 = sk->sk_v6_rcv_saddr;
240         tuple.src.u.tcp.port = inet->inet_sport;
241         tuple.dst.u3.in6 = sk->sk_v6_daddr;
242         tuple.dst.u.tcp.port = inet->inet_dport;
243         tuple.dst.protonum = sk->sk_protocol;
244         bound_dev_if = sk->sk_bound_dev_if;
245         flow_label = inet6->flow_label;
246         release_sock(sk);
247 
248         if (tuple.dst.protonum != IPPROTO_TCP &&
249             tuple.dst.protonum != IPPROTO_SCTP)
250                 return -ENOPROTOOPT;
251 
252         if (*len < 0 || (unsigned int) *len < sizeof(sin6))
253                 return -EINVAL;
254 
255         h = nf_conntrack_find_get(sock_net(sk), &nf_ct_zone_dflt, &tuple);
256         if (!h) {
257                 pr_debug("IP6T_SO_ORIGINAL_DST: Can't find %pI6c/%u-%pI6c/%u.\n",
258                          &tuple.src.u3.ip6, ntohs(tuple.src.u.tcp.port),
259                          &tuple.dst.u3.ip6, ntohs(tuple.dst.u.tcp.port));
260                 return -ENOENT;
261         }
262 
263         ct = nf_ct_tuplehash_to_ctrack(h);
264 
265         sin6.sin6_family = AF_INET6;
266         sin6.sin6_port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
267         sin6.sin6_flowinfo = flow_label & IPV6_FLOWINFO_MASK;
268         memcpy(&sin6.sin6_addr,
269                 &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6,
270                                         sizeof(sin6.sin6_addr));
271 
272         nf_ct_put(ct);
273         sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr, bound_dev_if);
274         return copy_to_user(user, &sin6, sizeof(sin6)) ? -EFAULT : 0;
275 }
276 
277 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
278 
279 #include <linux/netfilter/nfnetlink.h>
280 #include <linux/netfilter/nfnetlink_conntrack.h>
281 
282 static int ipv6_tuple_to_nlattr(struct sk_buff *skb,
283                                 const struct nf_conntrack_tuple *tuple)
284 {
285         if (nla_put_in6_addr(skb, CTA_IP_V6_SRC, &tuple->src.u3.in6) ||
286             nla_put_in6_addr(skb, CTA_IP_V6_DST, &tuple->dst.u3.in6))
287                 goto nla_put_failure;
288         return 0;
289 
290 nla_put_failure:
291         return -1;
292 }
293 
294 static const struct nla_policy ipv6_nla_policy[CTA_IP_MAX+1] = {
295         [CTA_IP_V6_SRC] = { .len = sizeof(u_int32_t)*4 },
296         [CTA_IP_V6_DST] = { .len = sizeof(u_int32_t)*4 },
297 };
298 
299 static int ipv6_nlattr_to_tuple(struct nlattr *tb[],
300                                 struct nf_conntrack_tuple *t)
301 {
302         if (!tb[CTA_IP_V6_SRC] || !tb[CTA_IP_V6_DST])
303                 return -EINVAL;
304 
305         t->src.u3.in6 = nla_get_in6_addr(tb[CTA_IP_V6_SRC]);
306         t->dst.u3.in6 = nla_get_in6_addr(tb[CTA_IP_V6_DST]);
307 
308         return 0;
309 }
310 #endif
311 
312 static int ipv6_hooks_register(struct net *net)
313 {
314         struct conntrack6_net *cnet = net_generic(net, conntrack6_net_id);
315         int err = 0;
316 
317         mutex_lock(&register_ipv6_hooks);
318         cnet->users++;
319         if (cnet->users > 1)
320                 goto out_unlock;
321 
322         err = nf_defrag_ipv6_enable(net);
323         if (err < 0) {
324                 cnet->users = 0;
325                 goto out_unlock;
326         }
327 
328         err = nf_register_net_hooks(net, ipv6_conntrack_ops,
329                                     ARRAY_SIZE(ipv6_conntrack_ops));
330         if (err)
331                 cnet->users = 0;
332  out_unlock:
333         mutex_unlock(&register_ipv6_hooks);
334         return err;
335 }
336 
337 static void ipv6_hooks_unregister(struct net *net)
338 {
339         struct conntrack6_net *cnet = net_generic(net, conntrack6_net_id);
340 
341         mutex_lock(&register_ipv6_hooks);
342         if (cnet->users && (--cnet->users == 0))
343                 nf_unregister_net_hooks(net, ipv6_conntrack_ops,
344                                         ARRAY_SIZE(ipv6_conntrack_ops));
345         mutex_unlock(&register_ipv6_hooks);
346 }
347 
348 const struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 = {
349         .l3proto                = PF_INET6,
350         .pkt_to_tuple           = ipv6_pkt_to_tuple,
351         .invert_tuple           = ipv6_invert_tuple,
352         .get_l4proto            = ipv6_get_l4proto,
353 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
354         .tuple_to_nlattr        = ipv6_tuple_to_nlattr,
355         .nlattr_to_tuple        = ipv6_nlattr_to_tuple,
356         .nla_policy             = ipv6_nla_policy,
357         .nla_size               = NLA_ALIGN(NLA_HDRLEN + sizeof(u32[4])) +
358                                   NLA_ALIGN(NLA_HDRLEN + sizeof(u32[4])),
359 #endif
360         .net_ns_get             = ipv6_hooks_register,
361         .net_ns_put             = ipv6_hooks_unregister,
362         .me                     = THIS_MODULE,
363 };
364 
365 MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET6));
366 MODULE_LICENSE("GPL");
367 MODULE_AUTHOR("Yasuyuki KOZAKAI @USAGI <yasuyuki.kozakai@toshiba.co.jp>");
368 
369 static struct nf_sockopt_ops so_getorigdst6 = {
370         .pf             = NFPROTO_IPV6,
371         .get_optmin     = IP6T_SO_ORIGINAL_DST,
372         .get_optmax     = IP6T_SO_ORIGINAL_DST + 1,
373         .get            = ipv6_getorigdst,
374         .owner          = THIS_MODULE,
375 };
376 
377 static struct nf_conntrack_l4proto *builtin_l4proto6[] = {
378         &nf_conntrack_l4proto_tcp6,
379         &nf_conntrack_l4proto_udp6,
380         &nf_conntrack_l4proto_icmpv6,
381 #ifdef CONFIG_NF_CT_PROTO_DCCP
382         &nf_conntrack_l4proto_dccp6,
383 #endif
384 #ifdef CONFIG_NF_CT_PROTO_SCTP
385         &nf_conntrack_l4proto_sctp6,
386 #endif
387 #ifdef CONFIG_NF_CT_PROTO_UDPLITE
388         &nf_conntrack_l4proto_udplite6,
389 #endif
390 };
391 
392 static int ipv6_net_init(struct net *net)
393 {
394         return nf_ct_l4proto_pernet_register(net, builtin_l4proto6,
395                                              ARRAY_SIZE(builtin_l4proto6));
396 }
397 
398 static void ipv6_net_exit(struct net *net)
399 {
400         nf_ct_l4proto_pernet_unregister(net, builtin_l4proto6,
401                                         ARRAY_SIZE(builtin_l4proto6));
402 }
403 
404 static struct pernet_operations ipv6_net_ops = {
405         .init = ipv6_net_init,
406         .exit = ipv6_net_exit,
407         .id = &conntrack6_net_id,
408         .size = sizeof(struct conntrack6_net),
409 };
410 
411 static int __init nf_conntrack_l3proto_ipv6_init(void)
412 {
413         int ret = 0;
414 
415         need_conntrack();
416 
417 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
418         if (WARN_ON(nla_policy_len(ipv6_nla_policy, CTA_IP_MAX + 1) !=
419             nf_conntrack_l3proto_ipv6.nla_size))
420                 return -EINVAL;
421 #endif
422 
423         ret = nf_register_sockopt(&so_getorigdst6);
424         if (ret < 0) {
425                 pr_err("Unable to register netfilter socket option\n");
426                 return ret;
427         }
428 
429         ret = register_pernet_subsys(&ipv6_net_ops);
430         if (ret < 0)
431                 goto cleanup_sockopt;
432 
433         ret = nf_ct_l4proto_register(builtin_l4proto6,
434                                      ARRAY_SIZE(builtin_l4proto6));
435         if (ret < 0)
436                 goto cleanup_pernet;
437 
438         ret = nf_ct_l3proto_register(&nf_conntrack_l3proto_ipv6);
439         if (ret < 0) {
440                 pr_err("nf_conntrack_ipv6: can't register ipv6 proto.\n");
441                 goto cleanup_l4proto;
442         }
443         return ret;
444 cleanup_l4proto:
445         nf_ct_l4proto_unregister(builtin_l4proto6,
446                                  ARRAY_SIZE(builtin_l4proto6));
447  cleanup_pernet:
448         unregister_pernet_subsys(&ipv6_net_ops);
449  cleanup_sockopt:
450         nf_unregister_sockopt(&so_getorigdst6);
451         return ret;
452 }
453 
454 static void __exit nf_conntrack_l3proto_ipv6_fini(void)
455 {
456         synchronize_net();
457         nf_ct_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
458         nf_ct_l4proto_unregister(builtin_l4proto6,
459                                  ARRAY_SIZE(builtin_l4proto6));
460         unregister_pernet_subsys(&ipv6_net_ops);
461         nf_unregister_sockopt(&so_getorigdst6);
462 }
463 
464 module_init(nf_conntrack_l3proto_ipv6_init);
465 module_exit(nf_conntrack_l3proto_ipv6_fini);
466 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp