~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/xt_CT.c

Version: ~ [ linux-5.6-rc1 ] ~ [ linux-5.5.2 ] ~ [ linux-5.4.17 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.102 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.170 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.213 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.213 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.81 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  */
  8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  9 #include <linux/module.h>
 10 #include <linux/gfp.h>
 11 #include <linux/skbuff.h>
 12 #include <linux/netfilter_ipv4/ip_tables.h>
 13 #include <linux/netfilter_ipv6/ip6_tables.h>
 14 #include <linux/netfilter/x_tables.h>
 15 #include <linux/netfilter/xt_CT.h>
 16 #include <net/netfilter/nf_conntrack.h>
 17 #include <net/netfilter/nf_conntrack_l4proto.h>
 18 #include <net/netfilter/nf_conntrack_helper.h>
 19 #include <net/netfilter/nf_conntrack_ecache.h>
 20 #include <net/netfilter/nf_conntrack_timeout.h>
 21 #include <net/netfilter/nf_conntrack_zones.h>
 22 
 23 static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
 24 {
 25         /* Previously seen (loopback)? Ignore. */
 26         if (skb->_nfct != 0)
 27                 return XT_CONTINUE;
 28 
 29         if (ct) {
 30                 atomic_inc(&ct->ct_general.use);
 31                 nf_ct_set(skb, ct, IP_CT_NEW);
 32         } else {
 33                 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
 34         }
 35 
 36         return XT_CONTINUE;
 37 }
 38 
 39 static unsigned int xt_ct_target_v0(struct sk_buff *skb,
 40                                     const struct xt_action_param *par)
 41 {
 42         const struct xt_ct_target_info *info = par->targinfo;
 43         struct nf_conn *ct = info->ct;
 44 
 45         return xt_ct_target(skb, ct);
 46 }
 47 
 48 static unsigned int xt_ct_target_v1(struct sk_buff *skb,
 49                                     const struct xt_action_param *par)
 50 {
 51         const struct xt_ct_target_info_v1 *info = par->targinfo;
 52         struct nf_conn *ct = info->ct;
 53 
 54         return xt_ct_target(skb, ct);
 55 }
 56 
 57 static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
 58 {
 59         if (par->family == NFPROTO_IPV4) {
 60                 const struct ipt_entry *e = par->entryinfo;
 61 
 62                 if (e->ip.invflags & IPT_INV_PROTO)
 63                         return 0;
 64                 return e->ip.proto;
 65         } else if (par->family == NFPROTO_IPV6) {
 66                 const struct ip6t_entry *e = par->entryinfo;
 67 
 68                 if (e->ipv6.invflags & IP6T_INV_PROTO)
 69                         return 0;
 70                 return e->ipv6.proto;
 71         } else
 72                 return 0;
 73 }
 74 
 75 static int
 76 xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
 77                  const struct xt_tgchk_param *par)
 78 {
 79         struct nf_conntrack_helper *helper;
 80         struct nf_conn_help *help;
 81         u8 proto;
 82 
 83         proto = xt_ct_find_proto(par);
 84         if (!proto) {
 85                 pr_info_ratelimited("You must specify a L4 protocol and not use inversions on it\n");
 86                 return -ENOENT;
 87         }
 88 
 89         helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
 90                                                     proto);
 91         if (helper == NULL) {
 92                 pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
 93                 return -ENOENT;
 94         }
 95 
 96         help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
 97         if (help == NULL) {
 98                 nf_conntrack_helper_put(helper);
 99                 return -ENOMEM;
100         }
101 
102         help->helper = helper;
103         return 0;
104 }
105 
106 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
107 static void __xt_ct_tg_timeout_put(struct nf_ct_timeout *timeout)
108 {
109         typeof(nf_ct_timeout_put_hook) timeout_put;
110 
111         timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
112         if (timeout_put)
113                 timeout_put(timeout);
114 }
115 #endif
116 
117 static int
118 xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
119                   const char *timeout_name)
120 {
121 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
122         typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
123         const struct nf_conntrack_l4proto *l4proto;
124         struct nf_ct_timeout *timeout;
125         struct nf_conn_timeout *timeout_ext;
126         const char *errmsg = NULL;
127         int ret = 0;
128         u8 proto;
129 
130         rcu_read_lock();
131         timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
132         if (timeout_find_get == NULL) {
133                 ret = -ENOENT;
134                 errmsg = "Timeout policy base is empty";
135                 goto out;
136         }
137 
138         proto = xt_ct_find_proto(par);
139         if (!proto) {
140                 ret = -EINVAL;
141                 errmsg = "You must specify a L4 protocol and not use inversions on it";
142                 goto out;
143         }
144 
145         timeout = timeout_find_get(par->net, timeout_name);
146         if (timeout == NULL) {
147                 ret = -ENOENT;
148                 pr_info_ratelimited("No such timeout policy \"%s\"\n",
149                                     timeout_name);
150                 goto out;
151         }
152 
153         if (timeout->l3num != par->family) {
154                 ret = -EINVAL;
155                 pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
156                                     timeout_name, 3, timeout->l3num);
157                 goto err_put_timeout;
158         }
159         /* Make sure the timeout policy matches any existing protocol tracker,
160          * otherwise default to generic.
161          */
162         l4proto = __nf_ct_l4proto_find(proto);
163         if (timeout->l4proto->l4proto != l4proto->l4proto) {
164                 ret = -EINVAL;
165                 pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
166                                     timeout_name, 4, timeout->l4proto->l4proto);
167                 goto err_put_timeout;
168         }
169         timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
170         if (!timeout_ext) {
171                 ret = -ENOMEM;
172                 goto err_put_timeout;
173         }
174 
175         rcu_read_unlock();
176         return ret;
177 
178 err_put_timeout:
179         __xt_ct_tg_timeout_put(timeout);
180 out:
181         rcu_read_unlock();
182         if (errmsg)
183                 pr_info_ratelimited("%s\n", errmsg);
184         return ret;
185 #else
186         return -EOPNOTSUPP;
187 #endif
188 }
189 
190 static u16 xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 *info)
191 {
192         switch (info->flags & (XT_CT_ZONE_DIR_ORIG |
193                                XT_CT_ZONE_DIR_REPL)) {
194         case XT_CT_ZONE_DIR_ORIG:
195                 return NF_CT_ZONE_DIR_ORIG;
196         case XT_CT_ZONE_DIR_REPL:
197                 return NF_CT_ZONE_DIR_REPL;
198         default:
199                 return NF_CT_DEFAULT_ZONE_DIR;
200         }
201 }
202 
203 static int xt_ct_tg_check(const struct xt_tgchk_param *par,
204                           struct xt_ct_target_info_v1 *info)
205 {
206         struct nf_conntrack_zone zone;
207         struct nf_conn_help *help;
208         struct nf_conn *ct;
209         int ret = -EOPNOTSUPP;
210 
211         if (info->flags & XT_CT_NOTRACK) {
212                 ct = NULL;
213                 goto out;
214         }
215 
216 #ifndef CONFIG_NF_CONNTRACK_ZONES
217         if (info->zone || info->flags & (XT_CT_ZONE_DIR_ORIG |
218                                          XT_CT_ZONE_DIR_REPL |
219                                          XT_CT_ZONE_MARK))
220                 goto err1;
221 #endif
222 
223         ret = nf_ct_netns_get(par->net, par->family);
224         if (ret < 0)
225                 goto err1;
226 
227         memset(&zone, 0, sizeof(zone));
228         zone.id = info->zone;
229         zone.dir = xt_ct_flags_to_dir(info);
230         if (info->flags & XT_CT_ZONE_MARK)
231                 zone.flags |= NF_CT_FLAG_MARK;
232 
233         ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL);
234         if (!ct) {
235                 ret = -ENOMEM;
236                 goto err2;
237         }
238 
239         ret = 0;
240         if ((info->ct_events || info->exp_events) &&
241             !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
242                                   GFP_KERNEL)) {
243                 ret = -EINVAL;
244                 goto err3;
245         }
246 
247         if (info->helper[0]) {
248                 if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
249                         ret = -ENAMETOOLONG;
250                         goto err3;
251                 }
252 
253                 ret = xt_ct_set_helper(ct, info->helper, par);
254                 if (ret < 0)
255                         goto err3;
256         }
257 
258         if (info->timeout[0]) {
259                 if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
260                         ret = -ENAMETOOLONG;
261                         goto err4;
262                 }
263 
264                 ret = xt_ct_set_timeout(ct, par, info->timeout);
265                 if (ret < 0)
266                         goto err4;
267         }
268         __set_bit(IPS_CONFIRMED_BIT, &ct->status);
269         nf_conntrack_get(&ct->ct_general);
270 out:
271         info->ct = ct;
272         return 0;
273 
274 err4:
275         help = nfct_help(ct);
276         if (help)
277                 nf_conntrack_helper_put(help->helper);
278 err3:
279         nf_ct_tmpl_free(ct);
280 err2:
281         nf_ct_netns_put(par->net, par->family);
282 err1:
283         return ret;
284 }
285 
286 static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
287 {
288         struct xt_ct_target_info *info = par->targinfo;
289         struct xt_ct_target_info_v1 info_v1 = {
290                 .flags          = info->flags,
291                 .zone           = info->zone,
292                 .ct_events      = info->ct_events,
293                 .exp_events     = info->exp_events,
294         };
295         int ret;
296 
297         if (info->flags & ~XT_CT_NOTRACK)
298                 return -EINVAL;
299 
300         memcpy(info_v1.helper, info->helper, sizeof(info->helper));
301 
302         ret = xt_ct_tg_check(par, &info_v1);
303         if (ret < 0)
304                 return ret;
305 
306         info->ct = info_v1.ct;
307 
308         return ret;
309 }
310 
311 static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
312 {
313         struct xt_ct_target_info_v1 *info = par->targinfo;
314 
315         if (info->flags & ~XT_CT_NOTRACK)
316                 return -EINVAL;
317 
318         return xt_ct_tg_check(par, par->targinfo);
319 }
320 
321 static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
322 {
323         struct xt_ct_target_info_v1 *info = par->targinfo;
324 
325         if (info->flags & ~XT_CT_MASK)
326                 return -EINVAL;
327 
328         return xt_ct_tg_check(par, par->targinfo);
329 }
330 
331 static void xt_ct_destroy_timeout(struct nf_conn *ct)
332 {
333 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
334         struct nf_conn_timeout *timeout_ext;
335         typeof(nf_ct_timeout_put_hook) timeout_put;
336 
337         rcu_read_lock();
338         timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
339 
340         if (timeout_put) {
341                 timeout_ext = nf_ct_timeout_find(ct);
342                 if (timeout_ext) {
343                         timeout_put(timeout_ext->timeout);
344                         RCU_INIT_POINTER(timeout_ext->timeout, NULL);
345                 }
346         }
347         rcu_read_unlock();
348 #endif
349 }
350 
351 static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
352                              struct xt_ct_target_info_v1 *info)
353 {
354         struct nf_conn *ct = info->ct;
355         struct nf_conn_help *help;
356 
357         if (ct) {
358                 help = nfct_help(ct);
359                 if (help)
360                         nf_conntrack_helper_put(help->helper);
361 
362                 nf_ct_netns_put(par->net, par->family);
363 
364                 xt_ct_destroy_timeout(ct);
365                 nf_ct_put(info->ct);
366         }
367 }
368 
369 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
370 {
371         struct xt_ct_target_info *info = par->targinfo;
372         struct xt_ct_target_info_v1 info_v1 = {
373                 .flags          = info->flags,
374                 .zone           = info->zone,
375                 .ct_events      = info->ct_events,
376                 .exp_events     = info->exp_events,
377                 .ct             = info->ct,
378         };
379         memcpy(info_v1.helper, info->helper, sizeof(info->helper));
380 
381         xt_ct_tg_destroy(par, &info_v1);
382 }
383 
384 static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
385 {
386         xt_ct_tg_destroy(par, par->targinfo);
387 }
388 
389 static struct xt_target xt_ct_tg_reg[] __read_mostly = {
390         {
391                 .name           = "CT",
392                 .family         = NFPROTO_UNSPEC,
393                 .targetsize     = sizeof(struct xt_ct_target_info),
394                 .usersize       = offsetof(struct xt_ct_target_info, ct),
395                 .checkentry     = xt_ct_tg_check_v0,
396                 .destroy        = xt_ct_tg_destroy_v0,
397                 .target         = xt_ct_target_v0,
398                 .table          = "raw",
399                 .me             = THIS_MODULE,
400         },
401         {
402                 .name           = "CT",
403                 .family         = NFPROTO_UNSPEC,
404                 .revision       = 1,
405                 .targetsize     = sizeof(struct xt_ct_target_info_v1),
406                 .usersize       = offsetof(struct xt_ct_target_info, ct),
407                 .checkentry     = xt_ct_tg_check_v1,
408                 .destroy        = xt_ct_tg_destroy_v1,
409                 .target         = xt_ct_target_v1,
410                 .table          = "raw",
411                 .me             = THIS_MODULE,
412         },
413         {
414                 .name           = "CT",
415                 .family         = NFPROTO_UNSPEC,
416                 .revision       = 2,
417                 .targetsize     = sizeof(struct xt_ct_target_info_v1),
418                 .usersize       = offsetof(struct xt_ct_target_info, ct),
419                 .checkentry     = xt_ct_tg_check_v2,
420                 .destroy        = xt_ct_tg_destroy_v1,
421                 .target         = xt_ct_target_v1,
422                 .table          = "raw",
423                 .me             = THIS_MODULE,
424         },
425 };
426 
427 static unsigned int
428 notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
429 {
430         /* Previously seen (loopback)? Ignore. */
431         if (skb->_nfct != 0)
432                 return XT_CONTINUE;
433 
434         nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
435 
436         return XT_CONTINUE;
437 }
438 
439 static int notrack_chk(const struct xt_tgchk_param *par)
440 {
441         if (!par->net->xt.notrack_deprecated_warning) {
442                 pr_info("netfilter: NOTRACK target is deprecated, "
443                         "use CT instead or upgrade iptables\n");
444                 par->net->xt.notrack_deprecated_warning = true;
445         }
446         return 0;
447 }
448 
449 static struct xt_target notrack_tg_reg __read_mostly = {
450         .name           = "NOTRACK",
451         .revision       = 0,
452         .family         = NFPROTO_UNSPEC,
453         .checkentry     = notrack_chk,
454         .target         = notrack_tg,
455         .table          = "raw",
456         .me             = THIS_MODULE,
457 };
458 
459 static int __init xt_ct_tg_init(void)
460 {
461         int ret;
462 
463         ret = xt_register_target(&notrack_tg_reg);
464         if (ret < 0)
465                 return ret;
466 
467         ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
468         if (ret < 0) {
469                 xt_unregister_target(&notrack_tg_reg);
470                 return ret;
471         }
472         return 0;
473 }
474 
475 static void __exit xt_ct_tg_exit(void)
476 {
477         xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
478         xt_unregister_target(&notrack_tg_reg);
479 }
480 
481 module_init(xt_ct_tg_init);
482 module_exit(xt_ct_tg_exit);
483 
484 MODULE_LICENSE("GPL");
485 MODULE_DESCRIPTION("Xtables: connection tracking target");
486 MODULE_ALIAS("ipt_CT");
487 MODULE_ALIAS("ip6t_CT");
488 MODULE_ALIAS("ipt_NOTRACK");
489 MODULE_ALIAS("ip6t_NOTRACK");
490 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp