1 /* SANE connection tracking helper
2 * (SANE = Scanner Access Now Easy)
3 * For documentation about the SANE network protocol see
4 * http://www.sane-project.org/html/doc015.html
7 /* Copyright (C) 2007 Red Hat, Inc.
8 * Author: Michal Schmidt <mschmidt@redhat.com>
9 * Based on the FTP conntrack helper (net/netfilter/nf_conntrack_ftp.c):
10 * (C) 1999-2001 Paul `Rusty' Russell
11 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
12 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
13 * (C) 2003 Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License version 2 as
17 * published by the Free Software Foundation.
20 #include <linux/module.h>
21 #include <linux/moduleparam.h>
22 #include <linux/netfilter.h>
24 #include <linux/tcp.h>
25 #include <net/netfilter/nf_conntrack.h>
26 #include <net/netfilter/nf_conntrack_helper.h>
27 #include <net/netfilter/nf_conntrack_expect.h>
28 #include <linux/netfilter/nf_conntrack_sane.h>
30 MODULE_LICENSE("GPL");
31 MODULE_AUTHOR("Michal Schmidt <mschmidt@redhat.com>");
32 MODULE_DESCRIPTION("SANE connection tracking helper");
34 static char *sane_buffer
;
36 static DEFINE_SPINLOCK(nf_sane_lock
);
39 static u_int16_t ports
[MAX_PORTS
];
40 static unsigned int ports_c
;
41 module_param_array(ports
, ushort
, &ports_c
, 0400);
46 #define DEBUGP(format, args...)
51 #define SANE_NET_START 7 /* RPC code */
56 struct sane_reply_net_start
{
58 #define SANE_STATUS_SUCCESS 0
62 /* other fields aren't interesting for conntrack */
65 static int help(struct sk_buff
*skb
,
68 enum ip_conntrack_info ctinfo
)
70 unsigned int dataoff
, datalen
;
71 struct tcphdr _tcph
, *th
;
74 int dir
= CTINFO2DIR(ctinfo
);
75 struct nf_ct_sane_master
*ct_sane_info
;
76 struct nf_conntrack_expect
*exp
;
77 struct nf_conntrack_tuple
*tuple
;
78 struct sane_request
*req
;
79 struct sane_reply_net_start
*reply
;
80 int family
= ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.l3num
;
82 ct_sane_info
= &nfct_help(ct
)->help
.ct_sane_info
;
83 /* Until there's been traffic both ways, don't look in packets. */
84 if (ctinfo
!= IP_CT_ESTABLISHED
&&
85 ctinfo
!= IP_CT_ESTABLISHED
+IP_CT_IS_REPLY
)
88 /* Not a full tcp header? */
89 th
= skb_header_pointer(skb
, protoff
, sizeof(_tcph
), &_tcph
);
94 dataoff
= protoff
+ th
->doff
* 4;
95 if (dataoff
>= skb
->len
)
98 datalen
= skb
->len
- dataoff
;
100 spin_lock_bh(&nf_sane_lock
);
101 sb_ptr
= skb_header_pointer(skb
, dataoff
, datalen
, sane_buffer
);
102 BUG_ON(sb_ptr
== NULL
);
104 if (dir
== IP_CT_DIR_ORIGINAL
) {
105 if (datalen
!= sizeof(struct sane_request
))
108 req
= (struct sane_request
*)sb_ptr
;
109 if (req
->RPC_code
!= htonl(SANE_NET_START
)) {
110 /* Not an interesting command */
111 ct_sane_info
->state
= SANE_STATE_NORMAL
;
115 /* We're interested in the next reply */
116 ct_sane_info
->state
= SANE_STATE_START_REQUESTED
;
120 /* Is it a reply to an uninteresting command? */
121 if (ct_sane_info
->state
!= SANE_STATE_START_REQUESTED
)
124 /* It's a reply to SANE_NET_START. */
125 ct_sane_info
->state
= SANE_STATE_NORMAL
;
127 if (datalen
< sizeof(struct sane_reply_net_start
)) {
128 DEBUGP("nf_ct_sane: NET_START reply too short\n");
132 reply
= (struct sane_reply_net_start
*)sb_ptr
;
133 if (reply
->status
!= htonl(SANE_STATUS_SUCCESS
)) {
134 /* saned refused the command */
135 DEBUGP("nf_ct_sane: unsuccessful SANE_STATUS = %u\n",
136 ntohl(reply
->status
));
140 /* Invalid saned reply? Ignore it. */
141 if (reply
->zero
!= 0)
144 exp
= nf_conntrack_expect_alloc(ct
);
150 tuple
= &ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
;
151 nf_conntrack_expect_init(exp
, NF_CT_EXPECT_CLASS_DEFAULT
, family
,
152 &tuple
->src
.u3
, &tuple
->dst
.u3
,
153 IPPROTO_TCP
, NULL
, &reply
->port
);
155 DEBUGP("nf_ct_sane: expect: ");
156 NF_CT_DUMP_TUPLE(&exp
->tuple
);
157 NF_CT_DUMP_TUPLE(&exp
->mask
);
159 /* Can't expect this? Best to drop packet now. */
160 if (nf_conntrack_expect_related(exp
) != 0)
163 nf_conntrack_expect_put(exp
);
166 spin_unlock_bh(&nf_sane_lock
);
170 static struct nf_conntrack_helper sane
[MAX_PORTS
][2];
171 static char sane_names
[MAX_PORTS
][2][sizeof("sane-65535")];
173 static const struct nf_conntrack_expect_policy sane_exp_policy
= {
178 /* don't make this __exit, since it's called from __init ! */
179 static void nf_conntrack_sane_fini(void)
183 for (i
= 0; i
< ports_c
; i
++) {
184 for (j
= 0; j
< 2; j
++) {
185 DEBUGP("nf_ct_sane: unregistering helper for pf: %d "
187 sane
[i
][j
].tuple
.src
.l3num
, ports
[i
]);
188 nf_conntrack_helper_unregister(&sane
[i
][j
]);
195 static int __init
nf_conntrack_sane_init(void)
197 int i
, j
= -1, ret
= 0;
200 sane_buffer
= kmalloc(65536, GFP_KERNEL
);
205 ports
[ports_c
++] = SANE_PORT
;
207 /* FIXME should be configurable whether IPv4 and IPv6 connections
208 are tracked or not - YK */
209 for (i
= 0; i
< ports_c
; i
++) {
210 sane
[i
][0].tuple
.src
.l3num
= PF_INET
;
211 sane
[i
][1].tuple
.src
.l3num
= PF_INET6
;
212 for (j
= 0; j
< 2; j
++) {
213 sane
[i
][j
].tuple
.src
.u
.tcp
.port
= htons(ports
[i
]);
214 sane
[i
][j
].tuple
.dst
.protonum
= IPPROTO_TCP
;
215 sane
[i
][j
].mask
.src
.u
.tcp
.port
= 0xFFFF;
216 sane
[i
][j
].mask
.dst
.protonum
= 0xFF;
217 sane
[i
][j
].expect_policy
= &sane_exp_policy
;
218 sane
[i
][j
].me
= THIS_MODULE
;
219 sane
[i
][j
].help
= help
;
220 tmpname
= &sane_names
[i
][j
][0];
221 if (ports
[i
] == SANE_PORT
)
222 sprintf(tmpname
, "sane");
224 sprintf(tmpname
, "sane-%d", ports
[i
]);
225 sane
[i
][j
].name
= tmpname
;
227 DEBUGP("nf_ct_sane: registering helper for pf: %d "
229 sane
[i
][j
].tuple
.src
.l3num
, ports
[i
]);
230 ret
= nf_conntrack_helper_register(&sane
[i
][j
]);
232 printk(KERN_ERR
"nf_ct_sane: failed to "
233 "register helper for pf: %d port: %d\n",
234 sane
[i
][j
].tuple
.src
.l3num
, ports
[i
]);
235 nf_conntrack_sane_fini();
244 module_init(nf_conntrack_sane_init
);
245 module_exit(nf_conntrack_sane_fini
);