net/netfilter/xt_CT.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
   4  */
   5 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   6 #include <linux/module.h>
   7 #include <linux/gfp.h>
   8 #include <linux/skbuff.h>
   9 #include <linux/netfilter_ipv4/ip_tables.h>
  10 #include <linux/netfilter_ipv6/ip6_tables.h>
  11 #include <linux/netfilter/x_tables.h>
  12 #include <linux/netfilter/xt_CT.h>
  13 #include <net/netfilter/nf_conntrack.h>
  14 #include <net/netfilter/nf_conntrack_l4proto.h>
  15 #include <net/netfilter/nf_conntrack_helper.h>
  16 #include <net/netfilter/nf_conntrack_ecache.h>
  17 #include <net/netfilter/nf_conntrack_timeout.h>
  18 #include <net/netfilter/nf_conntrack_zones.h>
  19
  20 static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
  21 {
  22         /* Previously seen (loopback)? Ignore. */
  23         if (skb->_nfct != 0)
  24                 return XT_CONTINUE;
  25
  26         if (ct) {
  27                 refcount_inc(&ct->ct_general.use);
  28                 nf_ct_set(skb, ct, IP_CT_NEW);
  29         } else {
  30                 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
  31         }
  32
  33         return XT_CONTINUE;
  34 }
  35
  36 static unsigned int xt_ct_target_v0(struct sk_buff *skb,
  37                                     const struct xt_action_param *par)
  38 {
  39         const struct xt_ct_target_info *info = par->targinfo;
  40         struct nf_conn *ct = info->ct;
  41
  42         return xt_ct_target(skb, ct);
  43 }
  44
  45 static unsigned int xt_ct_target_v1(struct sk_buff *skb,
  46                                     const struct xt_action_param *par)
  47 {
  48         const struct xt_ct_target_info_v1 *info = par->targinfo;
  49         struct nf_conn *ct = info->ct;
  50
  51         return xt_ct_target(skb, ct);
  52 }
  53
  54 static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
  55 {
  56         if (par->family == NFPROTO_IPV4) {
  57                 const struct ipt_entry *e = par->entryinfo;
  58
  59                 if (e->ip.invflags & IPT_INV_PROTO)
  60                         return 0;
  61                 return e->ip.proto;
  62         } else if (par->family == NFPROTO_IPV6) {
  63                 const struct ip6t_entry *e = par->entryinfo;
  64
  65                 if (e->ipv6.invflags & IP6T_INV_PROTO)
  66                         return 0;
  67                 return e->ipv6.proto;
  68         } else
  69                 return 0;
  70 }
  71
  72 static int
  73 xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
  74                  const struct xt_tgchk_param *par)
  75 {
  76         struct nf_conntrack_helper *helper;
  77         struct nf_conn_help *help;
  78         u8 proto;
  79
  80         proto = xt_ct_find_proto(par);
  81         if (!proto) {
  82                 pr_info_ratelimited("You must specify a L4 protocol and not use inversions on it\n");
  83                 return -ENOENT;
  84         }
  85
  86         helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
  87                                                     proto);
  88         if (helper == NULL) {
  89                 pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
  90                 return -ENOENT;
  91         }
  92
  93         help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
  94         if (help == NULL) {
  95                 nf_conntrack_helper_put(helper);
  96                 return -ENOMEM;
  97         }
  98
  99         rcu_assign_pointer(help->helper, helper);
 100         return 0;
 101 }
 102
 103 static int
 104 xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
 105                   const char *timeout_name)
 106 {
 107 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 108         const struct nf_conntrack_l4proto *l4proto;
 109         u8 proto;
 110
 111         proto = xt_ct_find_proto(par);
 112         if (!proto) {
 113                 pr_info_ratelimited("You must specify a L4 protocol and not "
 114                                     "use inversions on it");
 115                 return -EINVAL;
 116         }
 117         l4proto = nf_ct_l4proto_find(proto);
 118         return nf_ct_set_timeout(par->net, ct, par->family, l4proto->l4proto,
 119                                  timeout_name);
 120
 121 #else
 122         return -EOPNOTSUPP;
 123 #endif
 124 }
 125
 126 static u16 xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 *info)
 127 {
 128         switch (info->flags & (XT_CT_ZONE_DIR_ORIG |
 129                                XT_CT_ZONE_DIR_REPL)) {
 130         case XT_CT_ZONE_DIR_ORIG:
 131                 return NF_CT_ZONE_DIR_ORIG;
 132         case XT_CT_ZONE_DIR_REPL:
 133                 return NF_CT_ZONE_DIR_REPL;
 134         default:
 135                 return NF_CT_DEFAULT_ZONE_DIR;
 136         }
 137 }
 138
 139 static void xt_ct_put_helper(struct nf_conn_help *help)
 140 {
 141         struct nf_conntrack_helper *helper;
 142
 143         if (!help)
 144                 return;
 145
 146         /* not yet exposed to other cpus, or ruleset
 147          * already detached (post-replacement).
 148          */
 149         helper = rcu_dereference_raw(help->helper);
 150         if (helper)
 151                 nf_conntrack_helper_put(helper);
 152 }
 153
 154 static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 155                           struct xt_ct_target_info_v1 *info)
 156 {
 157         struct nf_conntrack_zone zone;
 158         struct nf_conn_help *help;
 159         struct nf_conn *ct;
 160         int ret = -EOPNOTSUPP;
 161
 162         if (info->flags & XT_CT_NOTRACK) {
 163                 ct = NULL;
 164                 goto out;
 165         }
 166
 167 #ifndef CONFIG_NF_CONNTRACK_ZONES
 168         if (info->zone || info->flags & (XT_CT_ZONE_DIR_ORIG |
 169                                          XT_CT_ZONE_DIR_REPL |
 170                                          XT_CT_ZONE_MARK))
 171                 goto err1;
 172 #endif
 173
 174         ret = nf_ct_netns_get(par->net, par->family);
 175         if (ret < 0)
 176                 goto err1;
 177
 178         memset(&zone, 0, sizeof(zone));
 179         zone.id = info->zone;
 180         zone.dir = xt_ct_flags_to_dir(info);
 181         if (info->flags & XT_CT_ZONE_MARK)
 182                 zone.flags |= NF_CT_FLAG_MARK;
 183
 184         ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL);
 185         if (!ct) {
 186                 ret = -ENOMEM;
 187                 goto err2;
 188         }
 189
 190         if ((info->ct_events || info->exp_events) &&
 191             !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
 192                                   GFP_KERNEL)) {
 193                 ret = -EINVAL;
 194                 goto err3;
 195         }
 196
 197         if (info->helper[0]) {
 198                 if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
 199                         ret = -ENAMETOOLONG;
 200                         goto err3;
 201                 }
 202
 203                 ret = xt_ct_set_helper(ct, info->helper, par);
 204                 if (ret < 0)
 205                         goto err3;
 206         }
 207
 208         if (info->timeout[0]) {
 209                 if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
 210                         ret = -ENAMETOOLONG;
 211                         goto err4;
 212                 }
 213
 214                 ret = xt_ct_set_timeout(ct, par, info->timeout);
 215                 if (ret < 0)
 216                         goto err4;
 217         }
 218         __set_bit(IPS_CONFIRMED_BIT, &ct->status);
 219 out:
 220         info->ct = ct;
 221         return 0;
 222
 223 err4:
 224         help = nfct_help(ct);
 225         xt_ct_put_helper(help);
 226 err3:
 227         nf_ct_tmpl_free(ct);
 228 err2:
 229         nf_ct_netns_put(par->net, par->family);
 230 err1:
 231         return ret;
 232 }
 233
 234 static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
 235 {
 236         struct xt_ct_target_info *info = par->targinfo;
 237         struct xt_ct_target_info_v1 info_v1 = {
 238                 .flags          = info->flags,
 239                 .zone           = info->zone,
 240                 .ct_events      = info->ct_events,
 241                 .exp_events     = info->exp_events,
 242         };
 243         int ret;
 244
 245         if (info->flags & ~XT_CT_NOTRACK)
 246                 return -EINVAL;
 247
 248         memcpy(info_v1.helper, info->helper, sizeof(info->helper));
 249
 250         ret = xt_ct_tg_check(par, &info_v1);
 251         if (ret < 0)
 252                 return ret;
 253
 254         info->ct = info_v1.ct;
 255
 256         return ret;
 257 }
 258
 259 static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
 260 {
 261         struct xt_ct_target_info_v1 *info = par->targinfo;
 262
 263         if (info->flags & ~XT_CT_NOTRACK)
 264                 return -EINVAL;
 265
 266         return xt_ct_tg_check(par, par->targinfo);
 267 }
 268
 269 static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
 270 {
 271         struct xt_ct_target_info_v1 *info = par->targinfo;
 272
 273         if (info->flags & ~XT_CT_MASK)
 274                 return -EINVAL;
 275
 276         return xt_ct_tg_check(par, par->targinfo);
 277 }
 278
 279 static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
 280                              struct xt_ct_target_info_v1 *info)
 281 {
 282         struct nf_conn *ct = info->ct;
 283         struct nf_conn_help *help;
 284
 285         if (ct) {
 286                 help = nfct_help(ct);
 287                 xt_ct_put_helper(help);
 288
 289                 nf_ct_netns_put(par->net, par->family);
 290
 291                 nf_ct_destroy_timeout(ct);
 292                 nf_ct_put(info->ct);
 293         }
 294 }
 295
 296 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
 297 {
 298         struct xt_ct_target_info *info = par->targinfo;
 299         struct xt_ct_target_info_v1 info_v1 = {
 300                 .flags          = info->flags,
 301                 .zone           = info->zone,
 302                 .ct_events      = info->ct_events,
 303                 .exp_events     = info->exp_events,
 304                 .ct             = info->ct,
 305         };
 306         memcpy(info_v1.helper, info->helper, sizeof(info->helper));
 307
 308         xt_ct_tg_destroy(par, &info_v1);
 309 }
 310
 311 static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
 312 {
 313         xt_ct_tg_destroy(par, par->targinfo);
 314 }
 315
 316 static unsigned int
 317 notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
 318 {
 319         /* Previously seen (loopback)? Ignore. */
 320         if (skb->_nfct != 0)
 321                 return XT_CONTINUE;
 322
 323         nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
 324
 325         return XT_CONTINUE;
 326 }
 327
 328 static struct xt_target xt_ct_tg_reg[] __read_mostly = {
 329         {
 330                 .name           = "NOTRACK",
 331                 .revision       = 0,
 332                 .family         = NFPROTO_IPV4,
 333                 .target         = notrack_tg,
 334                 .table          = "raw",
 335                 .me             = THIS_MODULE,
 336         },
 337         {
 338                 .name           = "CT",
 339                 .family         = NFPROTO_IPV4,
 340                 .targetsize     = sizeof(struct xt_ct_target_info),
 341                 .usersize       = offsetof(struct xt_ct_target_info, ct),
 342                 .checkentry     = xt_ct_tg_check_v0,
 343                 .destroy        = xt_ct_tg_destroy_v0,
 344                 .target         = xt_ct_target_v0,
 345                 .table          = "raw",
 346                 .me             = THIS_MODULE,
 347         },
 348         {
 349                 .name           = "CT",
 350                 .family         = NFPROTO_IPV4,
 351                 .revision       = 1,
 352                 .targetsize     = sizeof(struct xt_ct_target_info_v1),
 353                 .usersize       = offsetof(struct xt_ct_target_info, ct),
 354                 .checkentry     = xt_ct_tg_check_v1,
 355                 .destroy        = xt_ct_tg_destroy_v1,
 356                 .target         = xt_ct_target_v1,
 357                 .table          = "raw",
 358                 .me             = THIS_MODULE,
 359         },
 360         {
 361                 .name           = "CT",
 362                 .family         = NFPROTO_IPV4,
 363                 .revision       = 2,
 364                 .targetsize     = sizeof(struct xt_ct_target_info_v1),
 365                 .usersize       = offsetof(struct xt_ct_target_info, ct),
 366                 .checkentry     = xt_ct_tg_check_v2,
 367                 .destroy        = xt_ct_tg_destroy_v1,
 368                 .target         = xt_ct_target_v1,
 369                 .table          = "raw",
 370                 .me             = THIS_MODULE,
 371         },
 372 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
 373         {
 374                 .name           = "NOTRACK",
 375                 .revision       = 0,
 376                 .family         = NFPROTO_IPV6,
 377                 .target         = notrack_tg,
 378                 .table          = "raw",
 379                 .me             = THIS_MODULE,
 380         },
 381         {
 382                 .name           = "CT",
 383                 .family         = NFPROTO_IPV6,
 384                 .targetsize     = sizeof(struct xt_ct_target_info),
 385                 .usersize       = offsetof(struct xt_ct_target_info, ct),
 386                 .checkentry     = xt_ct_tg_check_v0,
 387                 .destroy        = xt_ct_tg_destroy_v0,
 388                 .target         = xt_ct_target_v0,
 389                 .table          = "raw",
 390                 .me             = THIS_MODULE,
 391         },
 392         {
 393                 .name           = "CT",
 394                 .family         = NFPROTO_IPV6,
 395                 .revision       = 1,
 396                 .targetsize     = sizeof(struct xt_ct_target_info_v1),
 397                 .usersize       = offsetof(struct xt_ct_target_info, ct),
 398                 .checkentry     = xt_ct_tg_check_v1,
 399                 .destroy        = xt_ct_tg_destroy_v1,
 400                 .target         = xt_ct_target_v1,
 401                 .table          = "raw",
 402                 .me             = THIS_MODULE,
 403         },
 404         {
 405                 .name           = "CT",
 406                 .family         = NFPROTO_IPV6,
 407                 .revision       = 2,
 408                 .targetsize     = sizeof(struct xt_ct_target_info_v1),
 409                 .usersize       = offsetof(struct xt_ct_target_info, ct),
 410                 .checkentry     = xt_ct_tg_check_v2,
 411                 .destroy        = xt_ct_tg_destroy_v1,
 412                 .target         = xt_ct_target_v1,
 413                 .table          = "raw",
 414                 .me             = THIS_MODULE,
 415         },
 416 #endif
 417 };
 418
 419 static int __init xt_ct_tg_init(void)
 420 {
 421         return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
 422 }
 423
 424 static void __exit xt_ct_tg_exit(void)
 425 {
 426         xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
 427 }
 428
 429 module_init(xt_ct_tg_init);
 430 module_exit(xt_ct_tg_exit);
 431
 432 MODULE_LICENSE("GPL");
 433 MODULE_DESCRIPTION("Xtables: connection tracking target");
 434 MODULE_ALIAS("ipt_CT");
 435 MODULE_ALIAS("ip6t_CT");
 436 MODULE_ALIAS("ipt_NOTRACK");
 437 MODULE_ALIAS("ip6t_NOTRACK");