SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c

   1 /*
   2  * Copyright (C)2004 USAGI/WIDE Project
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Author:
   9  *      Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
  10  */
  11
  12 #include <linux/types.h>
  13 #include <linux/ipv6.h>
  14 #include <linux/in6.h>
  15 #include <linux/netfilter.h>
  16 #include <linux/module.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/icmp.h>
  19 #include <linux/sysctl.h>
  20 #include <net/ipv6.h>
  21 #include <net/inet_frag.h>
  22
  23 #include <linux/netfilter_ipv6.h>
  24 #include <net/netfilter/nf_conntrack.h>
  25 #include <net/netfilter/nf_conntrack_helper.h>
  26 #include <net/netfilter/nf_conntrack_l4proto.h>
  27 #include <net/netfilter/nf_conntrack_l3proto.h>
  28 #include <net/netfilter/nf_conntrack_core.h>
  29
  30 static int ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
  31                              struct nf_conntrack_tuple *tuple)
  32 {
  33         u_int32_t _addrs[8], *ap;
  34
  35         ap = skb_header_pointer(skb, nhoff + offsetof(struct ipv6hdr, saddr),
  36                                 sizeof(_addrs), _addrs);
  37         if (ap == NULL)
  38                 return 0;
  39
  40         memcpy(tuple->src.u3.ip6, ap, sizeof(tuple->src.u3.ip6));
  41         memcpy(tuple->dst.u3.ip6, ap + 4, sizeof(tuple->dst.u3.ip6));
  42
  43         return 1;
  44 }
  45
  46 static int ipv6_invert_tuple(struct nf_conntrack_tuple *tuple,
  47                              const struct nf_conntrack_tuple *orig)
  48 {
  49         memcpy(tuple->src.u3.ip6, orig->dst.u3.ip6, sizeof(tuple->src.u3.ip6));
  50         memcpy(tuple->dst.u3.ip6, orig->src.u3.ip6, sizeof(tuple->dst.u3.ip6));
  51
  52         return 1;
  53 }
  54
  55 static int ipv6_print_tuple(struct seq_file *s,
  56                             const struct nf_conntrack_tuple *tuple)
  57 {
  58         return seq_printf(s, "src=" NIP6_FMT " dst=" NIP6_FMT " ",
  59                           NIP6(*((struct in6_addr *)tuple->src.u3.ip6)),
  60                           NIP6(*((struct in6_addr *)tuple->dst.u3.ip6)));
  61 }
  62
  63 static int ipv6_print_conntrack(struct seq_file *s,
  64                                 const struct nf_conn *conntrack)
  65 {
  66         return 0;
  67 }
  68
  69 /*
  70  * Based on ipv6_skip_exthdr() in net/ipv6/exthdr.c
  71  *
  72  * This function parses (probably truncated) exthdr set "hdr"
  73  * of length "len". "nexthdrp" initially points to some place,
  74  * where type of the first header can be found.
  75  *
  76  * It skips all well-known exthdrs, and returns pointer to the start
  77  * of unparsable area i.e. the first header with unknown type.
  78  * if success, *nexthdr is updated by type/protocol of this header.
  79  *
  80  * NOTES: - it may return pointer pointing beyond end of packet,
  81  *          if the last recognized header is truncated in the middle.
  82  *        - if packet is truncated, so that all parsed headers are skipped,
  83  *          it returns -1.
  84  *        - if packet is fragmented, return pointer of the fragment header.
  85  *        - ESP is unparsable for now and considered like
  86  *          normal payload protocol.
  87  *        - Note also special handling of AUTH header. Thanks to IPsec wizards.
  88  */
  89
  90 static int nf_ct_ipv6_skip_exthdr(const struct sk_buff *skb, int start,
  91                                   u8 *nexthdrp, int len)
  92 {
  93         u8 nexthdr = *nexthdrp;
  94
  95         while (ipv6_ext_hdr(nexthdr)) {
  96                 struct ipv6_opt_hdr hdr;
  97                 int hdrlen;
  98
  99                 if (len < (int)sizeof(struct ipv6_opt_hdr))
 100                         return -1;
 101                 if (nexthdr == NEXTHDR_NONE)
 102                         break;
 103                 if (nexthdr == NEXTHDR_FRAGMENT)
 104                         break;
 105                 if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
 106                         BUG();
 107                 if (nexthdr == NEXTHDR_AUTH)
 108                         hdrlen = (hdr.hdrlen+2)<<2;
 109                 else
 110                         hdrlen = ipv6_optlen(&hdr);
 111
 112                 nexthdr = hdr.nexthdr;
 113                 len -= hdrlen;
 114                 start += hdrlen;
 115         }
 116
 117         *nexthdrp = nexthdr;
 118         return start;
 119 }
 120
 121 static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
 122                             unsigned int *dataoff, u_int8_t *protonum)
 123 {
 124         unsigned int extoff = nhoff + sizeof(struct ipv6hdr);
 125         unsigned char pnum;
 126         int protoff;
 127
 128         if (skb_copy_bits(skb, nhoff + offsetof(struct ipv6hdr, nexthdr),
 129                           &pnum, sizeof(pnum)) != 0) {
 130                 pr_debug("ip6_conntrack_core: can't get nexthdr\n");
 131                 return -NF_ACCEPT;
 132         }
 133         protoff = nf_ct_ipv6_skip_exthdr(skb, extoff, &pnum, skb->len - extoff);
 134         /*
 135          * (protoff == skb->len) mean that the packet doesn't have no data
 136          * except of IPv6 & ext headers. but it's tracked anyway. - YK
 137          */
 138         if ((protoff < 0) || (protoff > skb->len)) {
 139                 pr_debug("ip6_conntrack_core: can't find proto in pkt\n");
 140                 return -NF_ACCEPT;
 141         }
 142
 143         *dataoff = protoff;
 144         *protonum = pnum;
 145         return NF_ACCEPT;
 146 }
 147
 148 static unsigned int ipv6_confirm(unsigned int hooknum,
 149                                  struct sk_buff *skb,
 150                                  const struct net_device *in,
 151                                  const struct net_device *out,
 152                                  int (*okfn)(struct sk_buff *))
 153 {
 154         struct nf_conn *ct;
 155         struct nf_conn_help *help;
 156         struct nf_conntrack_helper *helper;
 157         enum ip_conntrack_info ctinfo;
 158         unsigned int ret, protoff;
 159         unsigned int extoff = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
 160         unsigned char pnum = ipv6_hdr(skb)->nexthdr;
 161
 162
 163         /* This is where we call the helper: as the packet goes out. */
 164         ct = nf_ct_get(skb, &ctinfo);
 165         if (!ct || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)
 166                 goto out;
 167
 168         help = nfct_help(ct);
 169         if (!help)
 170                 goto out;
 171         /* rcu_read_lock()ed by nf_hook_slow */
 172         helper = rcu_dereference(help->helper);
 173         if (!helper)
 174                 goto out;
 175
 176         protoff = nf_ct_ipv6_skip_exthdr(skb, extoff, &pnum,
 177                                          skb->len - extoff);
 178         if (protoff > skb->len || pnum == NEXTHDR_FRAGMENT) {
 179                 pr_debug("proto header not found\n");
 180                 return NF_ACCEPT;
 181         }
 182
 183         ret = helper->help(skb, protoff, ct, ctinfo);
 184         if (ret != NF_ACCEPT)
 185                 return ret;
 186 out:
 187         /* We've seen it coming out the other side: confirm it */
 188         return nf_conntrack_confirm(skb);
 189 }
 190
 191 static unsigned int ipv6_defrag(unsigned int hooknum,
 192                                 struct sk_buff *skb,
 193                                 const struct net_device *in,
 194                                 const struct net_device *out,
 195                                 int (*okfn)(struct sk_buff *))
 196 {
 197         struct sk_buff *reasm;
 198
 199         /* Previously seen (loopback)?  */
 200         if (skb->nfct)
 201                 return NF_ACCEPT;
 202
 203         reasm = nf_ct_frag6_gather(skb);
 204
 205         /* queued */
 206         if (reasm == NULL)
 207                 return NF_STOLEN;
 208
 209         /* error occured or not fragmented */
 210         if (reasm == skb)
 211                 return NF_ACCEPT;
 212
 213         nf_ct_frag6_output(hooknum, reasm, (struct net_device *)in,
 214                            (struct net_device *)out, okfn);
 215
 216         return NF_STOLEN;
 217 }
 218
 219 static unsigned int ipv6_conntrack_in(unsigned int hooknum,
 220                                       struct sk_buff *skb,
 221                                       const struct net_device *in,
 222                                       const struct net_device *out,
 223                                       int (*okfn)(struct sk_buff *))
 224 {
 225         struct sk_buff *reasm = skb->nfct_reasm;
 226
 227         /* This packet is fragmented and has reassembled packet. */
 228         if (reasm) {
 229                 /* Reassembled packet isn't parsed yet ? */
 230                 if (!reasm->nfct) {
 231                         unsigned int ret;
 232
 233                         ret = nf_conntrack_in(PF_INET6, hooknum, reasm);
 234                         if (ret != NF_ACCEPT)
 235                                 return ret;
 236                 }
 237                 nf_conntrack_get(reasm->nfct);
 238                 skb->nfct = reasm->nfct;
 239                 skb->nfctinfo = reasm->nfctinfo;
 240                 return NF_ACCEPT;
 241         }
 242
 243         return nf_conntrack_in(PF_INET6, hooknum, skb);
 244 }
 245
 246 static unsigned int ipv6_conntrack_local(unsigned int hooknum,
 247                                          struct sk_buff *skb,
 248                                          const struct net_device *in,
 249                                          const struct net_device *out,
 250                                          int (*okfn)(struct sk_buff *))
 251 {
 252         /* root is playing with raw sockets. */
 253         if (skb->len < sizeof(struct ipv6hdr)) {
 254                 if (net_ratelimit())
 255                         printk("ipv6_conntrack_local: packet too short\n");
 256                 return NF_ACCEPT;
 257         }
 258         return ipv6_conntrack_in(hooknum, skb, in, out, okfn);
 259 }
 260
 261 static struct nf_hook_ops ipv6_conntrack_ops[] = {
 262         {
 263                 .hook           = ipv6_defrag,
 264                 .owner          = THIS_MODULE,
 265                 .pf             = PF_INET6,
 266                 .hooknum        = NF_INET_PRE_ROUTING,
 267                 .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
 268         },
 269         {
 270                 .hook           = ipv6_conntrack_in,
 271                 .owner          = THIS_MODULE,
 272                 .pf             = PF_INET6,
 273                 .hooknum        = NF_INET_PRE_ROUTING,
 274                 .priority       = NF_IP6_PRI_CONNTRACK,
 275         },
 276         {
 277                 .hook           = ipv6_conntrack_local,
 278                 .owner          = THIS_MODULE,
 279                 .pf             = PF_INET6,
 280                 .hooknum        = NF_INET_LOCAL_OUT,
 281                 .priority       = NF_IP6_PRI_CONNTRACK,
 282         },
 283         {
 284                 .hook           = ipv6_defrag,
 285                 .owner          = THIS_MODULE,
 286                 .pf             = PF_INET6,
 287                 .hooknum        = NF_INET_LOCAL_OUT,
 288                 .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
 289         },
 290         {
 291                 .hook           = ipv6_confirm,
 292                 .owner          = THIS_MODULE,
 293                 .pf             = PF_INET6,
 294                 .hooknum        = NF_INET_POST_ROUTING,
 295                 .priority       = NF_IP6_PRI_LAST,
 296         },
 297         {
 298                 .hook           = ipv6_confirm,
 299                 .owner          = THIS_MODULE,
 300                 .pf             = PF_INET6,
 301                 .hooknum        = NF_INET_LOCAL_IN,
 302                 .priority       = NF_IP6_PRI_LAST-1,
 303         },
 304 };
 305
 306 #ifdef CONFIG_SYSCTL
 307 static ctl_table nf_ct_ipv6_sysctl_table[] = {
 308         {
 309                 .procname       = "nf_conntrack_frag6_timeout",
 310                 .data           = &nf_frags_ctl.timeout,
 311                 .maxlen         = sizeof(unsigned int),
 312                 .mode           = 0644,
 313                 .proc_handler   = &proc_dointvec_jiffies,
 314         },
 315         {
 316                 .ctl_name       = NET_NF_CONNTRACK_FRAG6_LOW_THRESH,
 317                 .procname       = "nf_conntrack_frag6_low_thresh",
 318                 .data           = &nf_frags_ctl.low_thresh,
 319                 .maxlen         = sizeof(unsigned int),
 320                 .mode           = 0644,
 321                 .proc_handler   = &proc_dointvec,
 322         },
 323         {
 324                 .ctl_name       = NET_NF_CONNTRACK_FRAG6_HIGH_THRESH,
 325                 .procname       = "nf_conntrack_frag6_high_thresh",
 326                 .data           = &nf_frags_ctl.high_thresh,
 327                 .maxlen         = sizeof(unsigned int),
 328                 .mode           = 0644,
 329                 .proc_handler   = &proc_dointvec,
 330         },
 331         { .ctl_name = 0 }
 332 };
 333 #endif
 334
 335 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 336
 337 #include <linux/netfilter/nfnetlink.h>
 338 #include <linux/netfilter/nfnetlink_conntrack.h>
 339
 340 static int ipv6_tuple_to_nlattr(struct sk_buff *skb,
 341                                 const struct nf_conntrack_tuple *tuple)
 342 {
 343         NLA_PUT(skb, CTA_IP_V6_SRC, sizeof(u_int32_t) * 4,
 344                 &tuple->src.u3.ip6);
 345         NLA_PUT(skb, CTA_IP_V6_DST, sizeof(u_int32_t) * 4,
 346                 &tuple->dst.u3.ip6);
 347         return 0;
 348
 349 nla_put_failure:
 350         return -1;
 351 }
 352
 353 static const struct nla_policy ipv6_nla_policy[CTA_IP_MAX+1] = {
 354         [CTA_IP_V6_SRC] = { .len = sizeof(u_int32_t)*4 },
 355         [CTA_IP_V6_DST] = { .len = sizeof(u_int32_t)*4 },
 356 };
 357
 358 static int ipv6_nlattr_to_tuple(struct nlattr *tb[],
 359                                 struct nf_conntrack_tuple *t)
 360 {
 361         if (!tb[CTA_IP_V6_SRC] || !tb[CTA_IP_V6_DST])
 362                 return -EINVAL;
 363
 364         memcpy(&t->src.u3.ip6, nla_data(tb[CTA_IP_V6_SRC]),
 365                sizeof(u_int32_t) * 4);
 366         memcpy(&t->dst.u3.ip6, nla_data(tb[CTA_IP_V6_DST]),
 367                sizeof(u_int32_t) * 4);
 368
 369         return 0;
 370 }
 371 #endif
 372
 373 struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 __read_mostly = {
 374         .l3proto                = PF_INET6,
 375         .name                   = "ipv6",
 376         .pkt_to_tuple           = ipv6_pkt_to_tuple,
 377         .invert_tuple           = ipv6_invert_tuple,
 378         .print_tuple            = ipv6_print_tuple,
 379         .print_conntrack        = ipv6_print_conntrack,
 380         .get_l4proto            = ipv6_get_l4proto,
 381 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 382         .tuple_to_nlattr        = ipv6_tuple_to_nlattr,
 383         .nlattr_to_tuple        = ipv6_nlattr_to_tuple,
 384         .nla_policy             = ipv6_nla_policy,
 385 #endif
 386 #ifdef CONFIG_SYSCTL
 387         .ctl_table_path         = nf_net_netfilter_sysctl_path,
 388         .ctl_table              = nf_ct_ipv6_sysctl_table,
 389 #endif
 390         .me                     = THIS_MODULE,
 391 };
 392
 393 MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET6));
 394 MODULE_LICENSE("GPL");
 395 MODULE_AUTHOR("Yasuyuki KOZAKAI @USAGI <yasuyuki.kozakai@toshiba.co.jp>");
 396
 397 static int __init nf_conntrack_l3proto_ipv6_init(void)
 398 {
 399         int ret = 0;
 400
 401         need_conntrack();
 402
 403         ret = nf_ct_frag6_init();
 404         if (ret < 0) {
 405                 printk("nf_conntrack_ipv6: can't initialize frag6.\n");
 406                 return ret;
 407         }
 408         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_tcp6);
 409         if (ret < 0) {
 410                 printk("nf_conntrack_ipv6: can't register tcp.\n");
 411                 goto cleanup_frag6;
 412         }
 413
 414         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udp6);
 415         if (ret < 0) {
 416                 printk("nf_conntrack_ipv6: can't register udp.\n");
 417                 goto cleanup_tcp;
 418         }
 419
 420         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_icmpv6);
 421         if (ret < 0) {
 422                 printk("nf_conntrack_ipv6: can't register icmpv6.\n");
 423                 goto cleanup_udp;
 424         }
 425
 426         ret = nf_conntrack_l3proto_register(&nf_conntrack_l3proto_ipv6);
 427         if (ret < 0) {
 428                 printk("nf_conntrack_ipv6: can't register ipv6\n");
 429                 goto cleanup_icmpv6;
 430         }
 431
 432         ret = nf_register_hooks(ipv6_conntrack_ops,
 433                                 ARRAY_SIZE(ipv6_conntrack_ops));
 434         if (ret < 0) {
 435                 printk("nf_conntrack_ipv6: can't register pre-routing defrag "
 436                        "hook.\n");
 437                 goto cleanup_ipv6;
 438         }
 439         return ret;
 440
 441  cleanup_ipv6:
 442         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
 443  cleanup_icmpv6:
 444         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmpv6);
 445  cleanup_udp:
 446         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp6);
 447  cleanup_tcp:
 448         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
 449  cleanup_frag6:
 450         nf_ct_frag6_cleanup();
 451         return ret;
 452 }
 453
 454 static void __exit nf_conntrack_l3proto_ipv6_fini(void)
 455 {
 456         synchronize_net();
 457         nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
 458         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
 459         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmpv6);
 460         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp6);
 461         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
 462         nf_ct_frag6_cleanup();
 463 }
 464
 465 module_init(nf_conntrack_l3proto_ipv6_init);
 466 module_exit(nf_conntrack_l3proto_ipv6_fini);