1 /* IRC extension for IP connection tracking, Version 1.21
2 * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
3 * based on RR's ip_conntrack_ftp.c
4 * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/moduleparam.h>
14 #include <linux/skbuff.h>
17 #include <linux/tcp.h>
18 #include <linux/netfilter.h>
19 #include <linux/slab.h>
21 #include <net/netfilter/nf_conntrack.h>
22 #include <net/netfilter/nf_conntrack_expect.h>
23 #include <net/netfilter/nf_conntrack_helper.h>
24 #include <linux/netfilter/nf_conntrack_irc.h>
27 static unsigned short ports
[MAX_PORTS
];
28 static unsigned int ports_c
;
29 static unsigned int max_dcc_channels
= 8;
30 static unsigned int dcc_timeout __read_mostly
= 300;
31 /* This is slow, but it's simple. --RR */
32 static char *irc_buffer
;
33 static DEFINE_SPINLOCK(irc_buffer_lock
);
35 unsigned int (*nf_nat_irc_hook
)(struct sk_buff
*skb
,
36 enum ip_conntrack_info ctinfo
,
38 unsigned int matchoff
,
39 unsigned int matchlen
,
40 struct nf_conntrack_expect
*exp
) __read_mostly
;
41 EXPORT_SYMBOL_GPL(nf_nat_irc_hook
);
43 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
44 MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
45 MODULE_LICENSE("GPL");
46 MODULE_ALIAS("ip_conntrack_irc");
47 MODULE_ALIAS_NFCT_HELPER("irc");
49 module_param_array(ports
, ushort
, &ports_c
, 0400);
50 MODULE_PARM_DESC(ports
, "port numbers of IRC servers");
51 module_param(max_dcc_channels
, uint
, 0400);
52 MODULE_PARM_DESC(max_dcc_channels
, "max number of expected DCC channels per "
54 module_param(dcc_timeout
, uint
, 0400);
55 MODULE_PARM_DESC(dcc_timeout
, "timeout on for unestablished DCC channels");
57 static const char *const dccprotos
[] = {
58 "SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT "
63 /* tries to get the ip_addr and port out of a dcc command
64 * return value: -1 on failure, 0 on success
65 * data pointer to first byte of DCC command data
66 * data_end pointer to last byte of dcc command data
67 * ip returns parsed ip of dcc command
68 * port returns parsed port of dcc command
69 * ad_beg_p returns pointer to first byte of addr data
70 * ad_end_p returns pointer to last byte of addr data
72 static int parse_dcc(char *data
, const char *data_end
, __be32
*ip
,
73 u_int16_t
*port
, char **ad_beg_p
, char **ad_end_p
)
77 /* at least 12: "AAAAAAAA P\1\n" */
78 while (*data
++ != ' ')
79 if (data
> data_end
- 12)
82 /* Make sure we have a newline character within the packet boundaries
83 * because simple_strtoul parses until the first invalid character. */
84 for (tmp
= data
; tmp
<= data_end
; tmp
++)
87 if (tmp
> data_end
|| *tmp
!= '\n')
91 *ip
= cpu_to_be32(simple_strtoul(data
, &data
, 10));
93 /* skip blanks between ip and port */
94 while (*data
== ' ') {
100 *port
= simple_strtoul(data
, &data
, 10);
106 static int help(struct sk_buff
*skb
, unsigned int protoff
,
107 struct nf_conn
*ct
, enum ip_conntrack_info ctinfo
)
109 unsigned int dataoff
;
110 const struct iphdr
*iph
;
111 const struct tcphdr
*th
;
113 const char *data_limit
;
115 int dir
= CTINFO2DIR(ctinfo
);
116 struct nf_conntrack_expect
*exp
;
117 struct nf_conntrack_tuple
*tuple
;
121 int i
, ret
= NF_ACCEPT
;
122 char *addr_beg_p
, *addr_end_p
;
123 typeof(nf_nat_irc_hook
) nf_nat_irc
;
125 /* If packet is coming from IRC server */
126 if (dir
== IP_CT_DIR_REPLY
)
129 /* Until there's been traffic both ways, don't look in packets. */
130 if (ctinfo
!= IP_CT_ESTABLISHED
&& ctinfo
!= IP_CT_ESTABLISHED_REPLY
)
133 /* Not a full tcp header? */
134 th
= skb_header_pointer(skb
, protoff
, sizeof(_tcph
), &_tcph
);
139 dataoff
= protoff
+ th
->doff
*4;
140 if (dataoff
>= skb
->len
)
143 spin_lock_bh(&irc_buffer_lock
);
144 ib_ptr
= skb_header_pointer(skb
, dataoff
, skb
->len
- dataoff
,
146 BUG_ON(ib_ptr
== NULL
);
149 data_limit
= ib_ptr
+ skb
->len
- dataoff
;
151 /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
152 * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
153 while (data
< data_limit
- (19 + MINMATCHLEN
)) {
154 if (memcmp(data
, "\1DCC ", 5)) {
159 /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
162 pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
163 &iph
->saddr
, ntohs(th
->source
),
164 &iph
->daddr
, ntohs(th
->dest
));
166 for (i
= 0; i
< ARRAY_SIZE(dccprotos
); i
++) {
167 if (memcmp(data
, dccprotos
[i
], strlen(dccprotos
[i
]))) {
171 data
+= strlen(dccprotos
[i
]);
172 pr_debug("DCC %s detected\n", dccprotos
[i
]);
175 * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
176 * data left (== 14/13 bytes) */
177 if (parse_dcc(data
, data_limit
, &dcc_ip
,
178 &dcc_port
, &addr_beg_p
, &addr_end_p
)) {
179 pr_debug("unable to parse dcc command\n");
183 pr_debug("DCC bound ip/port: %pI4:%u\n",
186 /* dcc_ip can be the internal OR external (NAT'ed) IP */
187 tuple
= &ct
->tuplehash
[dir
].tuple
;
188 if (tuple
->src
.u3
.ip
!= dcc_ip
&&
189 tuple
->dst
.u3
.ip
!= dcc_ip
) {
190 net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
196 exp
= nf_ct_expect_alloc(ct
);
198 nf_ct_helper_log(skb
, ct
,
199 "cannot alloc expectation");
203 tuple
= &ct
->tuplehash
[!dir
].tuple
;
204 port
= htons(dcc_port
);
205 nf_ct_expect_init(exp
, NF_CT_EXPECT_CLASS_DEFAULT
,
207 NULL
, &tuple
->dst
.u3
,
208 IPPROTO_TCP
, NULL
, &port
);
210 nf_nat_irc
= rcu_dereference(nf_nat_irc_hook
);
211 if (nf_nat_irc
&& ct
->status
& IPS_NAT_MASK
)
212 ret
= nf_nat_irc(skb
, ctinfo
, protoff
,
214 addr_end_p
- addr_beg_p
,
216 else if (nf_ct_expect_related(exp
) != 0) {
217 nf_ct_helper_log(skb
, ct
,
218 "cannot add expectation");
221 nf_ct_expect_put(exp
);
226 spin_unlock_bh(&irc_buffer_lock
);
230 static struct nf_conntrack_helper irc
[MAX_PORTS
] __read_mostly
;
231 static struct nf_conntrack_expect_policy irc_exp_policy
;
233 static void nf_conntrack_irc_fini(void);
235 static int __init
nf_conntrack_irc_init(void)
239 if (max_dcc_channels
< 1) {
240 printk(KERN_ERR
"nf_ct_irc: max_dcc_channels must not be zero\n");
244 irc_exp_policy
.max_expected
= max_dcc_channels
;
245 irc_exp_policy
.timeout
= dcc_timeout
;
247 irc_buffer
= kmalloc(65536, GFP_KERNEL
);
251 /* If no port given, default to standard irc port */
253 ports
[ports_c
++] = IRC_PORT
;
255 for (i
= 0; i
< ports_c
; i
++) {
256 irc
[i
].tuple
.src
.l3num
= AF_INET
;
257 irc
[i
].tuple
.src
.u
.tcp
.port
= htons(ports
[i
]);
258 irc
[i
].tuple
.dst
.protonum
= IPPROTO_TCP
;
259 irc
[i
].expect_policy
= &irc_exp_policy
;
260 irc
[i
].me
= THIS_MODULE
;
263 if (ports
[i
] == IRC_PORT
)
264 sprintf(irc
[i
].name
, "irc");
266 sprintf(irc
[i
].name
, "irc-%u", i
);
268 ret
= nf_conntrack_helper_register(&irc
[i
]);
270 printk(KERN_ERR
"nf_ct_irc: failed to register helper "
271 "for pf: %u port: %u\n",
272 irc
[i
].tuple
.src
.l3num
, ports
[i
]);
273 nf_conntrack_irc_fini();
280 /* This function is intentionally _NOT_ defined as __exit, because
281 * it is needed by the init function */
282 static void nf_conntrack_irc_fini(void)
286 for (i
= 0; i
< ports_c
; i
++)
287 nf_conntrack_helper_unregister(&irc
[i
]);
291 module_init(nf_conntrack_irc_init
);
292 module_exit(nf_conntrack_irc_fini
);