1 /* SANE connection tracking helper
2 * (SANE = Scanner Access Now Easy)
3 * For documentation about the SANE network protocol see
4 * http://www.sane-project.org/html/doc015.html
7 /* Copyright (C) 2007 Red Hat, Inc.
8 * Author: Michal Schmidt <mschmidt@redhat.com>
9 * Based on the FTP conntrack helper (net/netfilter/nf_conntrack_ftp.c):
10 * (C) 1999-2001 Paul `Rusty' Russell
11 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
12 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
13 * (C) 2003 Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License version 2 as
17 * published by the Free Software Foundation.
20 #include <linux/module.h>
21 #include <linux/moduleparam.h>
22 #include <linux/netfilter.h>
23 #include <linux/slab.h>
25 #include <linux/tcp.h>
26 #include <net/netfilter/nf_conntrack.h>
27 #include <net/netfilter/nf_conntrack_helper.h>
28 #include <net/netfilter/nf_conntrack_expect.h>
29 #include <linux/netfilter/nf_conntrack_sane.h>
31 MODULE_LICENSE("GPL");
32 MODULE_AUTHOR("Michal Schmidt <mschmidt@redhat.com>");
33 MODULE_DESCRIPTION("SANE connection tracking helper");
34 MODULE_ALIAS_NFCT_HELPER("sane");
36 static char *sane_buffer
;
38 static DEFINE_SPINLOCK(nf_sane_lock
);
41 static u_int16_t ports
[MAX_PORTS
];
42 static unsigned int ports_c
;
43 module_param_array(ports
, ushort
, &ports_c
, 0400);
47 #define SANE_NET_START 7 /* RPC code */
52 struct sane_reply_net_start
{
54 #define SANE_STATUS_SUCCESS 0
58 /* other fields aren't interesting for conntrack */
61 static int help(struct sk_buff
*skb
,
64 enum ip_conntrack_info ctinfo
)
66 unsigned int dataoff
, datalen
;
67 const struct tcphdr
*th
;
71 int dir
= CTINFO2DIR(ctinfo
);
72 struct nf_ct_sane_master
*ct_sane_info
= nfct_help_data(ct
);
73 struct nf_conntrack_expect
*exp
;
74 struct nf_conntrack_tuple
*tuple
;
75 struct sane_request
*req
;
76 struct sane_reply_net_start
*reply
;
78 /* Until there's been traffic both ways, don't look in packets. */
79 if (ctinfo
!= IP_CT_ESTABLISHED
&&
80 ctinfo
!= IP_CT_ESTABLISHED_REPLY
)
83 /* Not a full tcp header? */
84 th
= skb_header_pointer(skb
, protoff
, sizeof(_tcph
), &_tcph
);
89 dataoff
= protoff
+ th
->doff
* 4;
90 if (dataoff
>= skb
->len
)
93 datalen
= skb
->len
- dataoff
;
95 spin_lock_bh(&nf_sane_lock
);
96 sb_ptr
= skb_header_pointer(skb
, dataoff
, datalen
, sane_buffer
);
97 BUG_ON(sb_ptr
== NULL
);
99 if (dir
== IP_CT_DIR_ORIGINAL
) {
100 if (datalen
!= sizeof(struct sane_request
))
104 if (req
->RPC_code
!= htonl(SANE_NET_START
)) {
105 /* Not an interesting command */
106 ct_sane_info
->state
= SANE_STATE_NORMAL
;
110 /* We're interested in the next reply */
111 ct_sane_info
->state
= SANE_STATE_START_REQUESTED
;
115 /* Is it a reply to an uninteresting command? */
116 if (ct_sane_info
->state
!= SANE_STATE_START_REQUESTED
)
119 /* It's a reply to SANE_NET_START. */
120 ct_sane_info
->state
= SANE_STATE_NORMAL
;
122 if (datalen
< sizeof(struct sane_reply_net_start
)) {
123 pr_debug("nf_ct_sane: NET_START reply too short\n");
128 if (reply
->status
!= htonl(SANE_STATUS_SUCCESS
)) {
129 /* saned refused the command */
130 pr_debug("nf_ct_sane: unsuccessful SANE_STATUS = %u\n",
131 ntohl(reply
->status
));
135 /* Invalid saned reply? Ignore it. */
136 if (reply
->zero
!= 0)
139 exp
= nf_ct_expect_alloc(ct
);
141 nf_ct_helper_log(skb
, ct
, "cannot alloc expectation");
146 tuple
= &ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
;
147 nf_ct_expect_init(exp
, NF_CT_EXPECT_CLASS_DEFAULT
, nf_ct_l3num(ct
),
148 &tuple
->src
.u3
, &tuple
->dst
.u3
,
149 IPPROTO_TCP
, NULL
, &reply
->port
);
151 pr_debug("nf_ct_sane: expect: ");
152 nf_ct_dump_tuple(&exp
->tuple
);
154 /* Can't expect this? Best to drop packet now. */
155 if (nf_ct_expect_related(exp
) != 0) {
156 nf_ct_helper_log(skb
, ct
, "cannot add expectation");
160 nf_ct_expect_put(exp
);
163 spin_unlock_bh(&nf_sane_lock
);
167 static struct nf_conntrack_helper sane
[MAX_PORTS
][2] __read_mostly
;
169 static const struct nf_conntrack_expect_policy sane_exp_policy
= {
174 /* don't make this __exit, since it's called from __init ! */
175 static void nf_conntrack_sane_fini(void)
179 for (i
= 0; i
< ports_c
; i
++) {
180 for (j
= 0; j
< 2; j
++) {
181 pr_debug("nf_ct_sane: unregistering helper for pf: %d "
183 sane
[i
][j
].tuple
.src
.l3num
, ports
[i
]);
184 nf_conntrack_helper_unregister(&sane
[i
][j
]);
191 static int __init
nf_conntrack_sane_init(void)
193 int i
, j
= -1, ret
= 0;
195 sane_buffer
= kmalloc(65536, GFP_KERNEL
);
200 ports
[ports_c
++] = SANE_PORT
;
202 /* FIXME should be configurable whether IPv4 and IPv6 connections
203 are tracked or not - YK */
204 for (i
= 0; i
< ports_c
; i
++) {
205 sane
[i
][0].tuple
.src
.l3num
= PF_INET
;
206 sane
[i
][1].tuple
.src
.l3num
= PF_INET6
;
207 for (j
= 0; j
< 2; j
++) {
208 sane
[i
][j
].data_len
= sizeof(struct nf_ct_sane_master
);
209 sane
[i
][j
].tuple
.src
.u
.tcp
.port
= htons(ports
[i
]);
210 sane
[i
][j
].tuple
.dst
.protonum
= IPPROTO_TCP
;
211 sane
[i
][j
].expect_policy
= &sane_exp_policy
;
212 sane
[i
][j
].me
= THIS_MODULE
;
213 sane
[i
][j
].help
= help
;
214 if (ports
[i
] == SANE_PORT
)
215 sprintf(sane
[i
][j
].name
, "sane");
217 sprintf(sane
[i
][j
].name
, "sane-%d", ports
[i
]);
219 pr_debug("nf_ct_sane: registering helper for pf: %d "
221 sane
[i
][j
].tuple
.src
.l3num
, ports
[i
]);
222 ret
= nf_conntrack_helper_register(&sane
[i
][j
]);
224 printk(KERN_ERR
"nf_ct_sane: failed to "
225 "register helper for pf: %d port: %d\n",
226 sane
[i
][j
].tuple
.src
.l3num
, ports
[i
]);
227 nf_conntrack_sane_fini();
236 module_init(nf_conntrack_sane_init
);
237 module_exit(nf_conntrack_sane_fini
);