net/netfilter/nfnetlink_osf.c

   1 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   2 #include <linux/module.h>
   3 #include <linux/kernel.h>
   4
   5 #include <linux/capability.h>
   6 #include <linux/if.h>
   7 #include <linux/inetdevice.h>
   8 #include <linux/ip.h>
   9 #include <linux/list.h>
  10 #include <linux/rculist.h>
  11 #include <linux/skbuff.h>
  12 #include <linux/slab.h>
  13 #include <linux/tcp.h>
  14
  15 #include <net/ip.h>
  16 #include <net/tcp.h>
  17
  18 #include <linux/netfilter/nfnetlink.h>
  19 #include <linux/netfilter/x_tables.h>
  20 #include <net/netfilter/nf_log.h>
  21 #include <linux/netfilter/nfnetlink_osf.h>
  22
  23 /*
  24  * Indexed by dont-fragment bit.
  25  * It is the only constant value in the fingerprint.
  26  */
  27 struct list_head nf_osf_fingers[2];
  28 EXPORT_SYMBOL_GPL(nf_osf_fingers);
  29
  30 static inline int nf_osf_ttl(const struct sk_buff *skb,
  31                              int ttl_check, unsigned char f_ttl)
  32 {
  33         struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
  34         const struct iphdr *ip = ip_hdr(skb);
  35         int ret = 0;
  36
  37         if (ttl_check == NF_OSF_TTL_TRUE)
  38                 return ip->ttl == f_ttl;
  39         if (ttl_check == NF_OSF_TTL_NOCHECK)
  40                 return 1;
  41         else if (ip->ttl <= f_ttl)
  42                 return 1;
  43
  44         for_ifa(in_dev) {
  45                 if (inet_ifa_match(ip->saddr, ifa)) {
  46                         ret = (ip->ttl == f_ttl);
  47                         break;
  48                 }
  49         }
  50
  51         endfor_ifa(in_dev);
  52
  53         return ret;
  54 }
  55
  56 struct nf_osf_hdr_ctx {
  57         bool                    df;
  58         u16                     window;
  59         u16                     totlen;
  60         const unsigned char     *optp;
  61         unsigned int            optsize;
  62 };
  63
  64 static bool nf_osf_match_one(const struct sk_buff *skb,
  65                              const struct nf_osf_user_finger *f,
  66                              int ttl_check,
  67                              struct nf_osf_hdr_ctx *ctx)
  68 {
  69         unsigned int check_WSS = 0;
  70         int fmatch = FMATCH_WRONG;
  71         int foptsize, optnum;
  72         u16 mss = 0;
  73
  74         if (ctx->totlen != f->ss || !nf_osf_ttl(skb, ttl_check, f->ttl))
  75                 return false;
  76
  77         /*
  78          * Should not happen if userspace parser was written correctly.
  79          */
  80         if (f->wss.wc >= OSF_WSS_MAX)
  81                 return false;
  82
  83         /* Check options */
  84
  85         foptsize = 0;
  86         for (optnum = 0; optnum < f->opt_num; ++optnum)
  87                 foptsize += f->opt[optnum].length;
  88
  89         if (foptsize > MAX_IPOPTLEN ||
  90             ctx->optsize > MAX_IPOPTLEN ||
  91             ctx->optsize != foptsize)
  92                 return false;
  93
  94         check_WSS = f->wss.wc;
  95
  96         for (optnum = 0; optnum < f->opt_num; ++optnum) {
  97                 if (f->opt[optnum].kind == *ctx->optp) {
  98                         __u32 len = f->opt[optnum].length;
  99                         const __u8 *optend = ctx->optp + len;
 100
 101                         fmatch = FMATCH_OK;
 102
 103                         switch (*ctx->optp) {
 104                         case OSFOPT_MSS:
 105                                 mss = ctx->optp[3];
 106                                 mss <<= 8;
 107                                 mss |= ctx->optp[2];
 108
 109                                 mss = ntohs((__force __be16)mss);
 110                                 break;
 111                         case OSFOPT_TS:
 112                                 break;
 113                         }
 114
 115                         ctx->optp = optend;
 116                 } else
 117                         fmatch = FMATCH_OPT_WRONG;
 118
 119                 if (fmatch != FMATCH_OK)
 120                         break;
 121         }
 122
 123         if (fmatch != FMATCH_OPT_WRONG) {
 124                 fmatch = FMATCH_WRONG;
 125
 126                 switch (check_WSS) {
 127                 case OSF_WSS_PLAIN:
 128                         if (f->wss.val == 0 || ctx->window == f->wss.val)
 129                                 fmatch = FMATCH_OK;
 130                         break;
 131                 case OSF_WSS_MSS:
 132                         /*
 133                          * Some smart modems decrease mangle MSS to
 134                          * SMART_MSS_2, so we check standard, decreased
 135                          * and the one provided in the fingerprint MSS
 136                          * values.
 137                          */
 138 #define SMART_MSS_1     1460
 139 #define SMART_MSS_2     1448
 140                         if (ctx->window == f->wss.val * mss ||
 141                             ctx->window == f->wss.val * SMART_MSS_1 ||
 142                             ctx->window == f->wss.val * SMART_MSS_2)
 143                                 fmatch = FMATCH_OK;
 144                         break;
 145                 case OSF_WSS_MTU:
 146                         if (ctx->window == f->wss.val * (mss + 40) ||
 147                             ctx->window == f->wss.val * (SMART_MSS_1 + 40) ||
 148                             ctx->window == f->wss.val * (SMART_MSS_2 + 40))
 149                                 fmatch = FMATCH_OK;
 150                         break;
 151                 case OSF_WSS_MODULO:
 152                         if ((ctx->window % f->wss.val) == 0)
 153                                 fmatch = FMATCH_OK;
 154                         break;
 155                 }
 156         }
 157
 158         return fmatch == FMATCH_OK;
 159 }
 160
 161 static const struct tcphdr *nf_osf_hdr_ctx_init(struct nf_osf_hdr_ctx *ctx,
 162                                                 const struct sk_buff *skb,
 163                                                 const struct iphdr *ip,
 164                                                 unsigned char *opts)
 165 {
 166         const struct tcphdr *tcp;
 167         struct tcphdr _tcph;
 168
 169         tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), &_tcph);
 170         if (!tcp)
 171                 return NULL;
 172
 173         if (!tcp->syn)
 174                 return NULL;
 175
 176         ctx->totlen = ntohs(ip->tot_len);
 177         ctx->df = ntohs(ip->frag_off) & IP_DF;
 178         ctx->window = ntohs(tcp->window);
 179
 180         if (tcp->doff * 4 > sizeof(struct tcphdr)) {
 181                 ctx->optsize = tcp->doff * 4 - sizeof(struct tcphdr);
 182
 183                 ctx->optp = skb_header_pointer(skb, ip_hdrlen(skb) +
 184                                 sizeof(struct tcphdr), ctx->optsize, opts);
 185         }
 186
 187         return tcp;
 188 }
 189
 190 bool
 191 nf_osf_match(const struct sk_buff *skb, u_int8_t family,
 192              int hooknum, struct net_device *in, struct net_device *out,
 193              const struct nf_osf_info *info, struct net *net,
 194              const struct list_head *nf_osf_fingers)
 195 {
 196         const struct iphdr *ip = ip_hdr(skb);
 197         const struct nf_osf_user_finger *f;
 198         unsigned char opts[MAX_IPOPTLEN];
 199         const struct nf_osf_finger *kf;
 200         int fcount = 0, ttl_check;
 201         int fmatch = FMATCH_WRONG;
 202         struct nf_osf_hdr_ctx ctx;
 203         const struct tcphdr *tcp;
 204
 205         memset(&ctx, 0, sizeof(ctx));
 206
 207         tcp = nf_osf_hdr_ctx_init(&ctx, skb, ip, opts);
 208         if (!tcp)
 209                 return false;
 210
 211         ttl_check = (info->flags & NF_OSF_TTL) ? info->ttl : 0;
 212
 213         list_for_each_entry_rcu(kf, &nf_osf_fingers[ctx.df], finger_entry) {
 214
 215                 f = &kf->finger;
 216
 217                 if (!(info->flags & NF_OSF_LOG) && strcmp(info->genre, f->genre))
 218                         continue;
 219
 220                 if (!nf_osf_match_one(skb, f, ttl_check, &ctx))
 221                         continue;
 222
 223                 fmatch = FMATCH_OK;
 224
 225                 fcount++;
 226
 227                 if (info->flags & NF_OSF_LOG)
 228                         nf_log_packet(net, family, hooknum, skb,
 229                                       in, out, NULL,
 230                                       "%s [%s:%s] : %pI4:%d -> %pI4:%d hops=%d\n",
 231                                       f->genre, f->version, f->subtype,
 232                                       &ip->saddr, ntohs(tcp->source),
 233                                       &ip->daddr, ntohs(tcp->dest),
 234                                       f->ttl - ip->ttl);
 235
 236                 if ((info->flags & NF_OSF_LOG) &&
 237                     info->loglevel == NF_OSF_LOGLEVEL_FIRST)
 238                         break;
 239         }
 240
 241         if (!fcount && (info->flags & NF_OSF_LOG))
 242                 nf_log_packet(net, family, hooknum, skb, in, out, NULL,
 243                               "Remote OS is not known: %pI4:%u -> %pI4:%u\n",
 244                               &ip->saddr, ntohs(tcp->source),
 245                               &ip->daddr, ntohs(tcp->dest));
 246
 247         if (fcount)
 248                 fmatch = FMATCH_OK;
 249
 250         return fmatch == FMATCH_OK;
 251 }
 252 EXPORT_SYMBOL_GPL(nf_osf_match);
 253
 254 const char *nf_osf_find(const struct sk_buff *skb,
 255                         const struct list_head *nf_osf_fingers,
 256                         const int ttl_check)
 257 {
 258         const struct iphdr *ip = ip_hdr(skb);
 259         const struct nf_osf_user_finger *f;
 260         unsigned char opts[MAX_IPOPTLEN];
 261         const struct nf_osf_finger *kf;
 262         struct nf_osf_hdr_ctx ctx;
 263         const struct tcphdr *tcp;
 264         const char *genre = NULL;
 265
 266         memset(&ctx, 0, sizeof(ctx));
 267
 268         tcp = nf_osf_hdr_ctx_init(&ctx, skb, ip, opts);
 269         if (!tcp)
 270                 return NULL;
 271
 272         list_for_each_entry_rcu(kf, &nf_osf_fingers[ctx.df], finger_entry) {
 273                 f = &kf->finger;
 274                 if (!nf_osf_match_one(skb, f, ttl_check, &ctx))
 275                         continue;
 276
 277                 genre = f->genre;
 278                 break;
 279         }
 280
 281         return genre;
 282 }
 283 EXPORT_SYMBOL_GPL(nf_osf_find);
 284
 285 static const struct nla_policy nfnl_osf_policy[OSF_ATTR_MAX + 1] = {
 286         [OSF_ATTR_FINGER]       = { .len = sizeof(struct nf_osf_user_finger) },
 287 };
 288
 289 static int nfnl_osf_add_callback(struct net *net, struct sock *ctnl,
 290                                  struct sk_buff *skb, const struct nlmsghdr *nlh,
 291                                  const struct nlattr * const osf_attrs[],
 292                                  struct netlink_ext_ack *extack)
 293 {
 294         struct nf_osf_user_finger *f;
 295         struct nf_osf_finger *kf = NULL, *sf;
 296         int err = 0;
 297
 298         if (!capable(CAP_NET_ADMIN))
 299                 return -EPERM;
 300
 301         if (!osf_attrs[OSF_ATTR_FINGER])
 302                 return -EINVAL;
 303
 304         if (!(nlh->nlmsg_flags & NLM_F_CREATE))
 305                 return -EINVAL;
 306
 307         f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
 308
 309         kf = kmalloc(sizeof(struct nf_osf_finger), GFP_KERNEL);
 310         if (!kf)
 311                 return -ENOMEM;
 312
 313         memcpy(&kf->finger, f, sizeof(struct nf_osf_user_finger));
 314
 315         list_for_each_entry(sf, &nf_osf_fingers[!!f->df], finger_entry) {
 316                 if (memcmp(&sf->finger, f, sizeof(struct nf_osf_user_finger)))
 317                         continue;
 318
 319                 kfree(kf);
 320                 kf = NULL;
 321
 322                 if (nlh->nlmsg_flags & NLM_F_EXCL)
 323                         err = -EEXIST;
 324                 break;
 325         }
 326
 327         /*
 328          * We are protected by nfnl mutex.
 329          */
 330         if (kf)
 331                 list_add_tail_rcu(&kf->finger_entry, &nf_osf_fingers[!!f->df]);
 332
 333         return err;
 334 }
 335
 336 static int nfnl_osf_remove_callback(struct net *net, struct sock *ctnl,
 337                                     struct sk_buff *skb,
 338                                     const struct nlmsghdr *nlh,
 339                                     const struct nlattr * const osf_attrs[],
 340                                     struct netlink_ext_ack *extack)
 341 {
 342         struct nf_osf_user_finger *f;
 343         struct nf_osf_finger *sf;
 344         int err = -ENOENT;
 345
 346         if (!capable(CAP_NET_ADMIN))
 347                 return -EPERM;
 348
 349         if (!osf_attrs[OSF_ATTR_FINGER])
 350                 return -EINVAL;
 351
 352         f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
 353
 354         list_for_each_entry(sf, &nf_osf_fingers[!!f->df], finger_entry) {
 355                 if (memcmp(&sf->finger, f, sizeof(struct nf_osf_user_finger)))
 356                         continue;
 357
 358                 /*
 359                  * We are protected by nfnl mutex.
 360                  */
 361                 list_del_rcu(&sf->finger_entry);
 362                 kfree_rcu(sf, rcu_head);
 363
 364                 err = 0;
 365                 break;
 366         }
 367
 368         return err;
 369 }
 370
 371 static const struct nfnl_callback nfnl_osf_callbacks[OSF_MSG_MAX] = {
 372         [OSF_MSG_ADD]   = {
 373                 .call           = nfnl_osf_add_callback,
 374                 .attr_count     = OSF_ATTR_MAX,
 375                 .policy         = nfnl_osf_policy,
 376         },
 377         [OSF_MSG_REMOVE]        = {
 378                 .call           = nfnl_osf_remove_callback,
 379                 .attr_count     = OSF_ATTR_MAX,
 380                 .policy         = nfnl_osf_policy,
 381         },
 382 };
 383
 384 static const struct nfnetlink_subsystem nfnl_osf_subsys = {
 385         .name                   = "osf",
 386         .subsys_id              = NFNL_SUBSYS_OSF,
 387         .cb_count               = OSF_MSG_MAX,
 388         .cb                     = nfnl_osf_callbacks,
 389 };
 390
 391 static int __init nfnl_osf_init(void)
 392 {
 393         int err = -EINVAL;
 394         int i;
 395
 396         for (i = 0; i < ARRAY_SIZE(nf_osf_fingers); ++i)
 397                 INIT_LIST_HEAD(&nf_osf_fingers[i]);
 398
 399         err = nfnetlink_subsys_register(&nfnl_osf_subsys);
 400         if (err < 0) {
 401                 pr_err("Failed to register OSF nsfnetlink helper (%d)\n", err);
 402                 goto err_out_exit;
 403         }
 404         return 0;
 405
 406 err_out_exit:
 407         return err;
 408 }
 409
 410 static void __exit nfnl_osf_fini(void)
 411 {
 412         struct nf_osf_finger *f;
 413         int i;
 414
 415         nfnetlink_subsys_unregister(&nfnl_osf_subsys);
 416
 417         rcu_read_lock();
 418         for (i = 0; i < ARRAY_SIZE(nf_osf_fingers); ++i) {
 419                 list_for_each_entry_rcu(f, &nf_osf_fingers[i], finger_entry) {
 420                         list_del_rcu(&f->finger_entry);
 421                         kfree_rcu(f, rcu_head);
 422                 }
 423         }
 424         rcu_read_unlock();
 425
 426         rcu_barrier();
 427 }
 428
 429 module_init(nfnl_osf_init);
 430 module_exit(nfnl_osf_fini);
 431
 432 MODULE_LICENSE("GPL");