1 /* SANE connection tracking helper
2 * (SANE = Scanner Access Now Easy)
3 * For documentation about the SANE network protocol see
4 * http://www.sane-project.org/html/doc015.html
7 /* Copyright (C) 2007 Red Hat, Inc.
8 * Author: Michal Schmidt <mschmidt@redhat.com>
9 * Based on the FTP conntrack helper (net/netfilter/nf_conntrack_ftp.c):
10 * (C) 1999-2001 Paul `Rusty' Russell
11 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
12 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
13 * (C) 2003 Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License version 2 as
17 * published by the Free Software Foundation.
20 #include <linux/module.h>
21 #include <linux/moduleparam.h>
22 #include <linux/netfilter.h>
24 #include <linux/tcp.h>
25 #include <net/netfilter/nf_conntrack.h>
26 #include <net/netfilter/nf_conntrack_helper.h>
27 #include <net/netfilter/nf_conntrack_expect.h>
28 #include <linux/netfilter/nf_conntrack_sane.h>
30 MODULE_LICENSE("GPL");
31 MODULE_AUTHOR("Michal Schmidt <mschmidt@redhat.com>");
32 MODULE_DESCRIPTION("SANE connection tracking helper");
34 static char *sane_buffer
;
36 static DEFINE_SPINLOCK(nf_sane_lock
);
39 static u_int16_t ports
[MAX_PORTS
];
40 static unsigned int ports_c
;
41 module_param_array(ports
, ushort
, &ports_c
, 0400);
46 #define DEBUGP(format, args...)
51 #define SANE_NET_START 7 /* RPC code */
56 struct sane_reply_net_start
{
58 #define SANE_STATUS_SUCCESS 0
62 /* other fields aren't interesting for conntrack */
65 static int help(struct sk_buff
**pskb
,
68 enum ip_conntrack_info ctinfo
)
70 unsigned int dataoff
, datalen
;
71 struct tcphdr _tcph
, *th
;
74 int dir
= CTINFO2DIR(ctinfo
);
75 struct nf_ct_sane_master
*ct_sane_info
;
76 struct nf_conntrack_expect
*exp
;
77 struct nf_conntrack_tuple
*tuple
;
78 struct sane_request
*req
;
79 struct sane_reply_net_start
*reply
;
80 int family
= ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.l3num
;
82 ct_sane_info
= &nfct_help(ct
)->help
.ct_sane_info
;
83 /* Until there's been traffic both ways, don't look in packets. */
84 if (ctinfo
!= IP_CT_ESTABLISHED
&&
85 ctinfo
!= IP_CT_ESTABLISHED
+IP_CT_IS_REPLY
)
88 /* Not a full tcp header? */
89 th
= skb_header_pointer(*pskb
, protoff
, sizeof(_tcph
), &_tcph
);
94 dataoff
= protoff
+ th
->doff
* 4;
95 if (dataoff
>= (*pskb
)->len
)
98 datalen
= (*pskb
)->len
- dataoff
;
100 spin_lock_bh(&nf_sane_lock
);
101 sb_ptr
= skb_header_pointer(*pskb
, dataoff
, datalen
, sane_buffer
);
102 BUG_ON(sb_ptr
== NULL
);
104 if (dir
== IP_CT_DIR_ORIGINAL
) {
105 if (datalen
!= sizeof(struct sane_request
))
108 req
= (struct sane_request
*)sb_ptr
;
109 if (req
->RPC_code
!= htonl(SANE_NET_START
)) {
110 /* Not an interesting command */
111 ct_sane_info
->state
= SANE_STATE_NORMAL
;
115 /* We're interested in the next reply */
116 ct_sane_info
->state
= SANE_STATE_START_REQUESTED
;
120 /* Is it a reply to an uninteresting command? */
121 if (ct_sane_info
->state
!= SANE_STATE_START_REQUESTED
)
124 /* It's a reply to SANE_NET_START. */
125 ct_sane_info
->state
= SANE_STATE_NORMAL
;
127 if (datalen
< sizeof(struct sane_reply_net_start
)) {
128 DEBUGP("nf_ct_sane: NET_START reply too short\n");
132 reply
= (struct sane_reply_net_start
*)sb_ptr
;
133 if (reply
->status
!= htonl(SANE_STATUS_SUCCESS
)) {
134 /* saned refused the command */
135 DEBUGP("nf_ct_sane: unsuccessful SANE_STATUS = %u\n",
136 ntohl(reply
->status
));
140 /* Invalid saned reply? Ignore it. */
141 if (reply
->zero
!= 0)
144 exp
= nf_conntrack_expect_alloc(ct
);
150 tuple
= &ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
;
151 nf_conntrack_expect_init(exp
, family
,
152 &tuple
->src
.u3
, &tuple
->dst
.u3
,
156 DEBUGP("nf_ct_sane: expect: ");
157 NF_CT_DUMP_TUPLE(&exp
->tuple
);
158 NF_CT_DUMP_TUPLE(&exp
->mask
);
160 /* Can't expect this? Best to drop packet now. */
161 if (nf_conntrack_expect_related(exp
) != 0)
164 nf_conntrack_expect_put(exp
);
167 spin_unlock_bh(&nf_sane_lock
);
171 static struct nf_conntrack_helper sane
[MAX_PORTS
][2];
172 static char sane_names
[MAX_PORTS
][2][sizeof("sane-65535")];
174 /* don't make this __exit, since it's called from __init ! */
175 static void nf_conntrack_sane_fini(void)
179 for (i
= 0; i
< ports_c
; i
++) {
180 for (j
= 0; j
< 2; j
++) {
181 DEBUGP("nf_ct_sane: unregistering helper for pf: %d "
183 sane
[i
][j
].tuple
.src
.l3num
, ports
[i
]);
184 nf_conntrack_helper_unregister(&sane
[i
][j
]);
191 static int __init
nf_conntrack_sane_init(void)
193 int i
, j
= -1, ret
= 0;
196 sane_buffer
= kmalloc(65536, GFP_KERNEL
);
201 ports
[ports_c
++] = SANE_PORT
;
203 /* FIXME should be configurable whether IPv4 and IPv6 connections
204 are tracked or not - YK */
205 for (i
= 0; i
< ports_c
; i
++) {
206 sane
[i
][0].tuple
.src
.l3num
= PF_INET
;
207 sane
[i
][1].tuple
.src
.l3num
= PF_INET6
;
208 for (j
= 0; j
< 2; j
++) {
209 sane
[i
][j
].tuple
.src
.u
.tcp
.port
= htons(ports
[i
]);
210 sane
[i
][j
].tuple
.dst
.protonum
= IPPROTO_TCP
;
211 sane
[i
][j
].mask
.src
.u
.tcp
.port
= 0xFFFF;
212 sane
[i
][j
].mask
.dst
.protonum
= 0xFF;
213 sane
[i
][j
].max_expected
= 1;
214 sane
[i
][j
].timeout
= 5 * 60; /* 5 Minutes */
215 sane
[i
][j
].me
= THIS_MODULE
;
216 sane
[i
][j
].help
= help
;
217 tmpname
= &sane_names
[i
][j
][0];
218 if (ports
[i
] == SANE_PORT
)
219 sprintf(tmpname
, "sane");
221 sprintf(tmpname
, "sane-%d", ports
[i
]);
222 sane
[i
][j
].name
= tmpname
;
224 DEBUGP("nf_ct_sane: registering helper for pf: %d "
226 sane
[i
][j
].tuple
.src
.l3num
, ports
[i
]);
227 ret
= nf_conntrack_helper_register(&sane
[i
][j
]);
229 printk(KERN_ERR
"nf_ct_sane: failed to "
230 "register helper for pf: %d port: %d\n",
231 sane
[i
][j
].tuple
.src
.l3num
, ports
[i
]);
232 nf_conntrack_sane_fini();
241 module_init(nf_conntrack_sane_init
);
242 module_exit(nf_conntrack_sane_fini
);