err.no Git - linux-2.6/blob - net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c

   1 /*
   2  * Copyright (C)2004 USAGI/WIDE Project
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Author:
   9  *      Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
  10  */
  11
  12 #include <linux/types.h>
  13 #include <linux/ipv6.h>
  14 #include <linux/in6.h>
  15 #include <linux/netfilter.h>
  16 #include <linux/module.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/icmp.h>
  19 #include <linux/sysctl.h>
  20 #include <net/ipv6.h>
  21
  22 #include <linux/netfilter_ipv6.h>
  23 #include <net/netfilter/nf_conntrack.h>
  24 #include <net/netfilter/nf_conntrack_helper.h>
  25 #include <net/netfilter/nf_conntrack_l4proto.h>
  26 #include <net/netfilter/nf_conntrack_l3proto.h>
  27 #include <net/netfilter/nf_conntrack_core.h>
  28
  29 static int ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
  30                              struct nf_conntrack_tuple *tuple)
  31 {
  32         u_int32_t _addrs[8], *ap;
  33
  34         ap = skb_header_pointer(skb, nhoff + offsetof(struct ipv6hdr, saddr),
  35                                 sizeof(_addrs), _addrs);
  36         if (ap == NULL)
  37                 return 0;
  38
  39         memcpy(tuple->src.u3.ip6, ap, sizeof(tuple->src.u3.ip6));
  40         memcpy(tuple->dst.u3.ip6, ap + 4, sizeof(tuple->dst.u3.ip6));
  41
  42         return 1;
  43 }
  44
  45 static int ipv6_invert_tuple(struct nf_conntrack_tuple *tuple,
  46                              const struct nf_conntrack_tuple *orig)
  47 {
  48         memcpy(tuple->src.u3.ip6, orig->dst.u3.ip6, sizeof(tuple->src.u3.ip6));
  49         memcpy(tuple->dst.u3.ip6, orig->src.u3.ip6, sizeof(tuple->dst.u3.ip6));
  50
  51         return 1;
  52 }
  53
  54 static int ipv6_print_tuple(struct seq_file *s,
  55                             const struct nf_conntrack_tuple *tuple)
  56 {
  57         return seq_printf(s, "src=" NIP6_FMT " dst=" NIP6_FMT " ",
  58                           NIP6(*((struct in6_addr *)tuple->src.u3.ip6)),
  59                           NIP6(*((struct in6_addr *)tuple->dst.u3.ip6)));
  60 }
  61
  62 static int ipv6_print_conntrack(struct seq_file *s,
  63                                 const struct nf_conn *conntrack)
  64 {
  65         return 0;
  66 }
  67
  68 /*
  69  * Based on ipv6_skip_exthdr() in net/ipv6/exthdr.c
  70  *
  71  * This function parses (probably truncated) exthdr set "hdr"
  72  * of length "len". "nexthdrp" initially points to some place,
  73  * where type of the first header can be found.
  74  *
  75  * It skips all well-known exthdrs, and returns pointer to the start
  76  * of unparsable area i.e. the first header with unknown type.
  77  * if success, *nexthdr is updated by type/protocol of this header.
  78  *
  79  * NOTES: - it may return pointer pointing beyond end of packet,
  80  *          if the last recognized header is truncated in the middle.
  81  *        - if packet is truncated, so that all parsed headers are skipped,
  82  *          it returns -1.
  83  *        - if packet is fragmented, return pointer of the fragment header.
  84  *        - ESP is unparsable for now and considered like
  85  *          normal payload protocol.
  86  *        - Note also special handling of AUTH header. Thanks to IPsec wizards.
  87  */
  88
  89 int nf_ct_ipv6_skip_exthdr(struct sk_buff *skb, int start, u8 *nexthdrp,
  90                            int len)
  91 {
  92         u8 nexthdr = *nexthdrp;
  93
  94         while (ipv6_ext_hdr(nexthdr)) {
  95                 struct ipv6_opt_hdr hdr;
  96                 int hdrlen;
  97
  98                 if (len < (int)sizeof(struct ipv6_opt_hdr))
  99                         return -1;
 100                 if (nexthdr == NEXTHDR_NONE)
 101                         break;
 102                 if (nexthdr == NEXTHDR_FRAGMENT)
 103                         break;
 104                 if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
 105                         BUG();
 106                 if (nexthdr == NEXTHDR_AUTH)
 107                         hdrlen = (hdr.hdrlen+2)<<2;
 108                 else
 109                         hdrlen = ipv6_optlen(&hdr);
 110
 111                 nexthdr = hdr.nexthdr;
 112                 len -= hdrlen;
 113                 start += hdrlen;
 114         }
 115
 116         *nexthdrp = nexthdr;
 117         return start;
 118 }
 119
 120 static int
 121 ipv6_prepare(struct sk_buff **pskb, unsigned int hooknum, unsigned int *dataoff,
 122              u_int8_t *protonum)
 123 {
 124         unsigned int extoff = (u8 *)(ipv6_hdr(*pskb) + 1) - (*pskb)->data;
 125         unsigned char pnum = ipv6_hdr(*pskb)->nexthdr;
 126         int protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum,
 127                                              (*pskb)->len - extoff);
 128         /*
 129          * (protoff == (*pskb)->len) mean that the packet doesn't have no data
 130          * except of IPv6 & ext headers. but it's tracked anyway. - YK
 131          */
 132         if ((protoff < 0) || (protoff > (*pskb)->len)) {
 133                 pr_debug("ip6_conntrack_core: can't find proto in pkt\n");
 134                 NF_CT_STAT_INC_ATOMIC(error);
 135                 NF_CT_STAT_INC_ATOMIC(invalid);
 136                 return -NF_ACCEPT;
 137         }
 138
 139         *dataoff = protoff;
 140         *protonum = pnum;
 141         return NF_ACCEPT;
 142 }
 143
 144 static unsigned int ipv6_confirm(unsigned int hooknum,
 145                                  struct sk_buff **pskb,
 146                                  const struct net_device *in,
 147                                  const struct net_device *out,
 148                                  int (*okfn)(struct sk_buff *))
 149 {
 150         struct nf_conn *ct;
 151         struct nf_conn_help *help;
 152         struct nf_conntrack_helper *helper;
 153         enum ip_conntrack_info ctinfo;
 154         unsigned int ret, protoff;
 155         unsigned int extoff = (u8 *)(ipv6_hdr(*pskb) + 1) - (*pskb)->data;
 156         unsigned char pnum = ipv6_hdr(*pskb)->nexthdr;
 157
 158
 159         /* This is where we call the helper: as the packet goes out. */
 160         ct = nf_ct_get(*pskb, &ctinfo);
 161         if (!ct || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)
 162                 goto out;
 163
 164         help = nfct_help(ct);
 165         if (!help)
 166                 goto out;
 167         /* rcu_read_lock()ed by nf_hook_slow */
 168         helper = rcu_dereference(help->helper);
 169         if (!helper)
 170                 goto out;
 171
 172         protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum,
 173                                          (*pskb)->len - extoff);
 174         if (protoff > (*pskb)->len || pnum == NEXTHDR_FRAGMENT) {
 175                 pr_debug("proto header not found\n");
 176                 return NF_ACCEPT;
 177         }
 178
 179         ret = helper->help(pskb, protoff, ct, ctinfo);
 180         if (ret != NF_ACCEPT)
 181                 return ret;
 182 out:
 183         /* We've seen it coming out the other side: confirm it */
 184         return nf_conntrack_confirm(pskb);
 185 }
 186
 187 static unsigned int ipv6_defrag(unsigned int hooknum,
 188                                 struct sk_buff **pskb,
 189                                 const struct net_device *in,
 190                                 const struct net_device *out,
 191                                 int (*okfn)(struct sk_buff *))
 192 {
 193         struct sk_buff *reasm;
 194
 195         /* Previously seen (loopback)?  */
 196         if ((*pskb)->nfct)
 197                 return NF_ACCEPT;
 198
 199         reasm = nf_ct_frag6_gather(*pskb);
 200
 201         /* queued */
 202         if (reasm == NULL)
 203                 return NF_STOLEN;
 204
 205         /* error occured or not fragmented */
 206         if (reasm == *pskb)
 207                 return NF_ACCEPT;
 208
 209         nf_ct_frag6_output(hooknum, reasm, (struct net_device *)in,
 210                            (struct net_device *)out, okfn);
 211
 212         return NF_STOLEN;
 213 }
 214
 215 static unsigned int ipv6_conntrack_in(unsigned int hooknum,
 216                                       struct sk_buff **pskb,
 217                                       const struct net_device *in,
 218                                       const struct net_device *out,
 219                                       int (*okfn)(struct sk_buff *))
 220 {
 221         struct sk_buff *reasm = (*pskb)->nfct_reasm;
 222
 223         /* This packet is fragmented and has reassembled packet. */
 224         if (reasm) {
 225                 /* Reassembled packet isn't parsed yet ? */
 226                 if (!reasm->nfct) {
 227                         unsigned int ret;
 228
 229                         ret = nf_conntrack_in(PF_INET6, hooknum, &reasm);
 230                         if (ret != NF_ACCEPT)
 231                                 return ret;
 232                 }
 233                 nf_conntrack_get(reasm->nfct);
 234                 (*pskb)->nfct = reasm->nfct;
 235                 (*pskb)->nfctinfo = reasm->nfctinfo;
 236                 return NF_ACCEPT;
 237         }
 238
 239         return nf_conntrack_in(PF_INET6, hooknum, pskb);
 240 }
 241
 242 static unsigned int ipv6_conntrack_local(unsigned int hooknum,
 243                                          struct sk_buff **pskb,
 244                                          const struct net_device *in,
 245                                          const struct net_device *out,
 246                                          int (*okfn)(struct sk_buff *))
 247 {
 248         /* root is playing with raw sockets. */
 249         if ((*pskb)->len < sizeof(struct ipv6hdr)) {
 250                 if (net_ratelimit())
 251                         printk("ipv6_conntrack_local: packet too short\n");
 252                 return NF_ACCEPT;
 253         }
 254         return ipv6_conntrack_in(hooknum, pskb, in, out, okfn);
 255 }
 256
 257 static struct nf_hook_ops ipv6_conntrack_ops[] = {
 258         {
 259                 .hook           = ipv6_defrag,
 260                 .owner          = THIS_MODULE,
 261                 .pf             = PF_INET6,
 262                 .hooknum        = NF_IP6_PRE_ROUTING,
 263                 .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
 264         },
 265         {
 266                 .hook           = ipv6_conntrack_in,
 267                 .owner          = THIS_MODULE,
 268                 .pf             = PF_INET6,
 269                 .hooknum        = NF_IP6_PRE_ROUTING,
 270                 .priority       = NF_IP6_PRI_CONNTRACK,
 271         },
 272         {
 273                 .hook           = ipv6_conntrack_local,
 274                 .owner          = THIS_MODULE,
 275                 .pf             = PF_INET6,
 276                 .hooknum        = NF_IP6_LOCAL_OUT,
 277                 .priority       = NF_IP6_PRI_CONNTRACK,
 278         },
 279         {
 280                 .hook           = ipv6_defrag,
 281                 .owner          = THIS_MODULE,
 282                 .pf             = PF_INET6,
 283                 .hooknum        = NF_IP6_LOCAL_OUT,
 284                 .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
 285         },
 286         {
 287                 .hook           = ipv6_confirm,
 288                 .owner          = THIS_MODULE,
 289                 .pf             = PF_INET6,
 290                 .hooknum        = NF_IP6_POST_ROUTING,
 291                 .priority       = NF_IP6_PRI_LAST,
 292         },
 293         {
 294                 .hook           = ipv6_confirm,
 295                 .owner          = THIS_MODULE,
 296                 .pf             = PF_INET6,
 297                 .hooknum        = NF_IP6_LOCAL_IN,
 298                 .priority       = NF_IP6_PRI_LAST-1,
 299         },
 300 };
 301
 302 #ifdef CONFIG_SYSCTL
 303 static ctl_table nf_ct_ipv6_sysctl_table[] = {
 304         {
 305                 .ctl_name       = NET_NF_CONNTRACK_FRAG6_TIMEOUT,
 306                 .procname       = "nf_conntrack_frag6_timeout",
 307                 .data           = &nf_ct_frag6_timeout,
 308                 .maxlen         = sizeof(unsigned int),
 309                 .mode           = 0644,
 310                 .proc_handler   = &proc_dointvec_jiffies,
 311         },
 312         {
 313                 .ctl_name       = NET_NF_CONNTRACK_FRAG6_LOW_THRESH,
 314                 .procname       = "nf_conntrack_frag6_low_thresh",
 315                 .data           = &nf_ct_frag6_low_thresh,
 316                 .maxlen         = sizeof(unsigned int),
 317                 .mode           = 0644,
 318                 .proc_handler   = &proc_dointvec,
 319         },
 320         {
 321                 .ctl_name       = NET_NF_CONNTRACK_FRAG6_HIGH_THRESH,
 322                 .procname       = "nf_conntrack_frag6_high_thresh",
 323                 .data           = &nf_ct_frag6_high_thresh,
 324                 .maxlen         = sizeof(unsigned int),
 325                 .mode           = 0644,
 326                 .proc_handler   = &proc_dointvec,
 327         },
 328         { .ctl_name = 0 }
 329 };
 330 #endif
 331
 332 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 333
 334 #include <linux/netfilter/nfnetlink.h>
 335 #include <linux/netfilter/nfnetlink_conntrack.h>
 336
 337 static int ipv6_tuple_to_nfattr(struct sk_buff *skb,
 338                                 const struct nf_conntrack_tuple *tuple)
 339 {
 340         NFA_PUT(skb, CTA_IP_V6_SRC, sizeof(u_int32_t) * 4,
 341                 &tuple->src.u3.ip6);
 342         NFA_PUT(skb, CTA_IP_V6_DST, sizeof(u_int32_t) * 4,
 343                 &tuple->dst.u3.ip6);
 344         return 0;
 345
 346 nfattr_failure:
 347         return -1;
 348 }
 349
 350 static const size_t cta_min_ip[CTA_IP_MAX] = {
 351         [CTA_IP_V6_SRC-1]       = sizeof(u_int32_t)*4,
 352         [CTA_IP_V6_DST-1]       = sizeof(u_int32_t)*4,
 353 };
 354
 355 static int ipv6_nfattr_to_tuple(struct nfattr *tb[],
 356                                 struct nf_conntrack_tuple *t)
 357 {
 358         if (!tb[CTA_IP_V6_SRC-1] || !tb[CTA_IP_V6_DST-1])
 359                 return -EINVAL;
 360
 361         if (nfattr_bad_size(tb, CTA_IP_MAX, cta_min_ip))
 362                 return -EINVAL;
 363
 364         memcpy(&t->src.u3.ip6, NFA_DATA(tb[CTA_IP_V6_SRC-1]),
 365                sizeof(u_int32_t) * 4);
 366         memcpy(&t->dst.u3.ip6, NFA_DATA(tb[CTA_IP_V6_DST-1]),
 367                sizeof(u_int32_t) * 4);
 368
 369         return 0;
 370 }
 371 #endif
 372
 373 struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 = {
 374         .l3proto                = PF_INET6,
 375         .name                   = "ipv6",
 376         .pkt_to_tuple           = ipv6_pkt_to_tuple,
 377         .invert_tuple           = ipv6_invert_tuple,
 378         .print_tuple            = ipv6_print_tuple,
 379         .print_conntrack        = ipv6_print_conntrack,
 380         .prepare                = ipv6_prepare,
 381 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 382         .tuple_to_nfattr        = ipv6_tuple_to_nfattr,
 383         .nfattr_to_tuple        = ipv6_nfattr_to_tuple,
 384 #endif
 385 #ifdef CONFIG_SYSCTL
 386         .ctl_table_path         = nf_net_netfilter_sysctl_path,
 387         .ctl_table              = nf_ct_ipv6_sysctl_table,
 388 #endif
 389         .me                     = THIS_MODULE,
 390 };
 391
 392 MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET6));
 393 MODULE_LICENSE("GPL");
 394 MODULE_AUTHOR("Yasuyuki KOZAKAI @USAGI <yasuyuki.kozakai@toshiba.co.jp>");
 395
 396 static int __init nf_conntrack_l3proto_ipv6_init(void)
 397 {
 398         int ret = 0;
 399
 400         need_conntrack();
 401
 402         ret = nf_ct_frag6_init();
 403         if (ret < 0) {
 404                 printk("nf_conntrack_ipv6: can't initialize frag6.\n");
 405                 return ret;
 406         }
 407         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_tcp6);
 408         if (ret < 0) {
 409                 printk("nf_conntrack_ipv6: can't register tcp.\n");
 410                 goto cleanup_frag6;
 411         }
 412
 413         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udp6);
 414         if (ret < 0) {
 415                 printk("nf_conntrack_ipv6: can't register udp.\n");
 416                 goto cleanup_tcp;
 417         }
 418
 419         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_icmpv6);
 420         if (ret < 0) {
 421                 printk("nf_conntrack_ipv6: can't register icmpv6.\n");
 422                 goto cleanup_udp;
 423         }
 424
 425         ret = nf_conntrack_l3proto_register(&nf_conntrack_l3proto_ipv6);
 426         if (ret < 0) {
 427                 printk("nf_conntrack_ipv6: can't register ipv6\n");
 428                 goto cleanup_icmpv6;
 429         }
 430
 431         ret = nf_register_hooks(ipv6_conntrack_ops,
 432                                 ARRAY_SIZE(ipv6_conntrack_ops));
 433         if (ret < 0) {
 434                 printk("nf_conntrack_ipv6: can't register pre-routing defrag "
 435                        "hook.\n");
 436                 goto cleanup_ipv6;
 437         }
 438         return ret;
 439
 440  cleanup_ipv6:
 441         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
 442  cleanup_icmpv6:
 443         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmpv6);
 444  cleanup_udp:
 445         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp6);
 446  cleanup_tcp:
 447         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
 448  cleanup_frag6:
 449         nf_ct_frag6_cleanup();
 450         return ret;
 451 }
 452
 453 static void __exit nf_conntrack_l3proto_ipv6_fini(void)
 454 {
 455         synchronize_net();
 456         nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
 457         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
 458         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmpv6);
 459         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp6);
 460         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
 461         nf_ct_frag6_cleanup();
 462 }
 463
 464 module_init(nf_conntrack_l3proto_ipv6_init);
 465 module_exit(nf_conntrack_l3proto_ipv6_fini);