net/netfilter/ipvs/ip_vs_ftp.c

   1 /*
   2  * ip_vs_ftp.c: IPVS ftp application module
   3  *
   4  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   5  *
   6  * Changes:
   7  *
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  *
  14  * Most code here is taken from ip_masq_ftp.c in kernel 2.2. The difference
  15  * is that ip_vs_ftp module handles the reverse direction to ip_masq_ftp.
  16  *
  17  *              IP_MASQ_FTP ftp masquerading module
  18  *
  19  * Version:     @(#)ip_masq_ftp.c 0.04   02/05/96
  20  *
  21  * Author:      Wouter Gadeyne
  22  *
  23  *
  24  * Code for ip_vs_expect_related and ip_vs_expect_callback is taken from
  25  * http://www.ssi.bg/~ja/nfct/:
  26  *
  27  * ip_vs_nfct.c:        Netfilter connection tracking support for IPVS
  28  *
  29  * Portions Copyright (C) 2001-2002
  30  * Antefacto Ltd, 181 Parnell St, Dublin 1, Ireland.
  31  *
  32  * Portions Copyright (C) 2003-2008
  33  * Julian Anastasov
  34  */
  35
  36 #define KMSG_COMPONENT "IPVS"
  37 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  38
  39 #include <linux/module.h>
  40 #include <linux/moduleparam.h>
  41 #include <linux/kernel.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/in.h>
  44 #include <linux/ip.h>
  45 #include <linux/netfilter.h>
  46 #include <net/netfilter/nf_conntrack.h>
  47 #include <net/netfilter/nf_conntrack_expect.h>
  48 #include <net/netfilter/nf_nat_helper.h>
  49 #include <linux/gfp.h>
  50 #include <net/protocol.h>
  51 #include <net/tcp.h>
  52 #include <asm/unaligned.h>
  53
  54 #include <net/ip_vs.h>
  55
  56
  57 #define SERVER_STRING "227 Entering Passive Mode ("
  58 #define CLIENT_STRING "PORT "
  59
  60 #define FMT_TUPLE       "%pI4:%u->%pI4:%u/%u"
  61 #define ARG_TUPLE(T)    &(T)->src.u3.ip, ntohs((T)->src.u.all), \
  62                         &(T)->dst.u3.ip, ntohs((T)->dst.u.all), \
  63                         (T)->dst.protonum
  64
  65 #define FMT_CONN        "%pI4:%u->%pI4:%u->%pI4:%u/%u:%u"
  66 #define ARG_CONN(C)     &((C)->caddr.ip), ntohs((C)->cport), \
  67                         &((C)->vaddr.ip), ntohs((C)->vport), \
  68                         &((C)->daddr.ip), ntohs((C)->dport), \
  69                         (C)->protocol, (C)->state
  70
  71 /*
  72  * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
  73  * First port is set to the default port.
  74  */
  75 static unsigned short ports[IP_VS_APP_MAX_PORTS] = {21, 0};
  76 module_param_array(ports, ushort, NULL, 0);
  77 MODULE_PARM_DESC(ports, "Ports to monitor for FTP control commands");
  78
  79
  80 /*      Dummy variable */
  81 static int ip_vs_ftp_pasv;
  82
  83
  84 static int
  85 ip_vs_ftp_init_conn(struct ip_vs_app *app, struct ip_vs_conn *cp)
  86 {
  87         return 0;
  88 }
  89
  90
  91 static int
  92 ip_vs_ftp_done_conn(struct ip_vs_app *app, struct ip_vs_conn *cp)
  93 {
  94         return 0;
  95 }
  96
  97
  98 /*
  99  * Get <addr,port> from the string "xxx.xxx.xxx.xxx,ppp,ppp", started
 100  * with the "pattern" and terminated with the "term" character.
 101  * <addr,port> is in network order.
 102  */
 103 static int ip_vs_ftp_get_addrport(char *data, char *data_limit,
 104                                   const char *pattern, size_t plen, char term,
 105                                   __be32 *addr, __be16 *port,
 106                                   char **start, char **end)
 107 {
 108         unsigned char p[6];
 109         int i = 0;
 110
 111         if (data_limit - data < plen) {
 112                 /* check if there is partial match */
 113                 if (strnicmp(data, pattern, data_limit - data) == 0)
 114                         return -1;
 115                 else
 116                         return 0;
 117         }
 118
 119         if (strnicmp(data, pattern, plen) != 0) {
 120                 return 0;
 121         }
 122         *start = data + plen;
 123
 124         for (data = *start; *data != term; data++) {
 125                 if (data == data_limit)
 126                         return -1;
 127         }
 128         *end = data;
 129
 130         memset(p, 0, sizeof(p));
 131         for (data = *start; data != *end; data++) {
 132                 if (*data >= '0' && *data <= '9') {
 133                         p[i] = p[i]*10 + *data - '0';
 134                 } else if (*data == ',' && i < 5) {
 135                         i++;
 136                 } else {
 137                         /* unexpected character */
 138                         return -1;
 139                 }
 140         }
 141
 142         if (i != 5)
 143                 return -1;
 144
 145         *addr = get_unaligned((__be32 *)p);
 146         *port = get_unaligned((__be16 *)(p + 4));
 147         return 1;
 148 }
 149
 150 /*
 151  * Called from init_conntrack() as expectfn handler.
 152  */
 153 static void
 154 ip_vs_expect_callback(struct nf_conn *ct,
 155                       struct nf_conntrack_expect *exp)
 156 {
 157         struct nf_conntrack_tuple *orig, new_reply;
 158         struct ip_vs_conn *cp;
 159
 160         if (exp->tuple.src.l3num != PF_INET)
 161                 return;
 162
 163         /*
 164          * We assume that no NF locks are held before this callback.
 165          * ip_vs_conn_out_get and ip_vs_conn_in_get should match their
 166          * expectations even if they use wildcard values, now we provide the
 167          * actual values from the newly created original conntrack direction.
 168          * The conntrack is confirmed when packet reaches IPVS hooks.
 169          */
 170
 171         /* RS->CLIENT */
 172         orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
 173         cp = ip_vs_conn_out_get(exp->tuple.src.l3num, orig->dst.protonum,
 174                                 &orig->src.u3, orig->src.u.tcp.port,
 175                                 &orig->dst.u3, orig->dst.u.tcp.port);
 176         if (cp) {
 177                 /* Change reply CLIENT->RS to CLIENT->VS */
 178                 new_reply = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
 179                 IP_VS_DBG(7, "%s(): ct=%p, status=0x%lX, tuples=" FMT_TUPLE ", "
 180                           FMT_TUPLE ", found inout cp=" FMT_CONN "\n",
 181                           __func__, ct, ct->status,
 182                           ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
 183                           ARG_CONN(cp));
 184                 new_reply.dst.u3 = cp->vaddr;
 185                 new_reply.dst.u.tcp.port = cp->vport;
 186                 IP_VS_DBG(7, "%s(): ct=%p, new tuples=" FMT_TUPLE ", " FMT_TUPLE
 187                           ", inout cp=" FMT_CONN "\n",
 188                           __func__, ct,
 189                           ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
 190                           ARG_CONN(cp));
 191                 goto alter;
 192         }
 193
 194         /* CLIENT->VS */
 195         cp = ip_vs_conn_in_get(exp->tuple.src.l3num, orig->dst.protonum,
 196                                &orig->src.u3, orig->src.u.tcp.port,
 197                                &orig->dst.u3, orig->dst.u.tcp.port);
 198         if (cp) {
 199                 /* Change reply VS->CLIENT to RS->CLIENT */
 200                 new_reply = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
 201                 IP_VS_DBG(7, "%s(): ct=%p, status=0x%lX, tuples=" FMT_TUPLE ", "
 202                           FMT_TUPLE ", found outin cp=" FMT_CONN "\n",
 203                           __func__, ct, ct->status,
 204                           ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
 205                           ARG_CONN(cp));
 206                 new_reply.src.u3 = cp->daddr;
 207                 new_reply.src.u.tcp.port = cp->dport;
 208                 IP_VS_DBG(7, "%s(): ct=%p, new tuples=" FMT_TUPLE ", "
 209                           FMT_TUPLE ", outin cp=" FMT_CONN "\n",
 210                           __func__, ct,
 211                           ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
 212                           ARG_CONN(cp));
 213                 goto alter;
 214         }
 215
 216         IP_VS_DBG(7, "%s(): ct=%p, status=0x%lX, tuple=" FMT_TUPLE
 217                   " - unknown expect\n",
 218                   __func__, ct, ct->status, ARG_TUPLE(orig));
 219         return;
 220
 221 alter:
 222         /* Never alter conntrack for non-NAT conns */
 223         if (IP_VS_FWD_METHOD(cp) == IP_VS_CONN_F_MASQ)
 224                 nf_conntrack_alter_reply(ct, &new_reply);
 225         ip_vs_conn_put(cp);
 226         return;
 227 }
 228
 229 /*
 230  * Create NF conntrack expectation with wildcard (optional) source port.
 231  * Then the default callback function will alter the reply and will confirm
 232  * the conntrack entry when the first packet comes.
 233  */
 234 static void
 235 ip_vs_expect_related(struct sk_buff *skb, struct nf_conn *ct,
 236                      struct ip_vs_conn *cp, u_int8_t proto,
 237                      const __be16 *port, int from_rs)
 238 {
 239         struct nf_conntrack_expect *exp;
 240
 241         BUG_ON(!ct || ct == &nf_conntrack_untracked);
 242
 243         exp = nf_ct_expect_alloc(ct);
 244         if (!exp)
 245                 return;
 246
 247         if (from_rs)
 248                 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
 249                                   nf_ct_l3num(ct), &cp->daddr, &cp->caddr,
 250                                   proto, port, &cp->cport);
 251         else
 252                 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
 253                                   nf_ct_l3num(ct), &cp->caddr, &cp->vaddr,
 254                                   proto, port, &cp->vport);
 255
 256         exp->expectfn = ip_vs_expect_callback;
 257
 258         IP_VS_DBG(7, "%s(): ct=%p, expect tuple=" FMT_TUPLE "\n",
 259                   __func__, ct, ARG_TUPLE(&exp->tuple));
 260         nf_ct_expect_related(exp);
 261         nf_ct_expect_put(exp);
 262 }
 263
 264 /*
 265  * Look at outgoing ftp packets to catch the response to a PASV command
 266  * from the server (inside-to-outside).
 267  * When we see one, we build a connection entry with the client address,
 268  * client port 0 (unknown at the moment), the server address and the
 269  * server port.  Mark the current connection entry as a control channel
 270  * of the new entry. All this work is just to make the data connection
 271  * can be scheduled to the right server later.
 272  *
 273  * The outgoing packet should be something like
 274  *   "227 Entering Passive Mode (xxx,xxx,xxx,xxx,ppp,ppp)".
 275  * xxx,xxx,xxx,xxx is the server address, ppp,ppp is the server port number.
 276  */
 277 static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
 278                          struct sk_buff *skb, int *diff)
 279 {
 280         struct iphdr *iph;
 281         struct tcphdr *th;
 282         char *data, *data_limit;
 283         char *start, *end;
 284         union nf_inet_addr from;
 285         __be16 port;
 286         struct ip_vs_conn *n_cp;
 287         char buf[24];           /* xxx.xxx.xxx.xxx,ppp,ppp\000 */
 288         unsigned buf_len;
 289         int ret = 0;
 290         enum ip_conntrack_info ctinfo;
 291         struct nf_conn *ct;
 292
 293 #ifdef CONFIG_IP_VS_IPV6
 294         /* This application helper doesn't work with IPv6 yet,
 295          * so turn this into a no-op for IPv6 packets
 296          */
 297         if (cp->af == AF_INET6)
 298                 return 1;
 299 #endif
 300
 301         *diff = 0;
 302
 303         /* Only useful for established sessions */
 304         if (cp->state != IP_VS_TCP_S_ESTABLISHED)
 305                 return 1;
 306
 307         /* Linear packets are much easier to deal with. */
 308         if (!skb_make_writable(skb, skb->len))
 309                 return 0;
 310
 311         if (cp->app_data == &ip_vs_ftp_pasv) {
 312                 iph = ip_hdr(skb);
 313                 th = (struct tcphdr *)&(((char *)iph)[iph->ihl*4]);
 314                 data = (char *)th + (th->doff << 2);
 315                 data_limit = skb_tail_pointer(skb);
 316
 317                 if (ip_vs_ftp_get_addrport(data, data_limit,
 318                                            SERVER_STRING,
 319                                            sizeof(SERVER_STRING)-1, ')',
 320                                            &from.ip, &port,
 321                                            &start, &end) != 1)
 322                         return 1;
 323
 324                 IP_VS_DBG(7, "PASV response (%pI4:%d) -> %pI4:%d detected\n",
 325                           &from.ip, ntohs(port), &cp->caddr.ip, 0);
 326
 327                 /*
 328                  * Now update or create an connection entry for it
 329                  */
 330                 n_cp = ip_vs_conn_out_get(AF_INET, iph->protocol, &from, port,
 331                                           &cp->caddr, 0);
 332                 if (!n_cp) {
 333                         n_cp = ip_vs_conn_new(AF_INET, IPPROTO_TCP,
 334                                               &cp->caddr, 0,
 335                                               &cp->vaddr, port,
 336                                               &from, port,
 337                                               IP_VS_CONN_F_NO_CPORT,
 338                                               cp->dest);
 339                         if (!n_cp)
 340                                 return 0;
 341
 342                         /* add its controller */
 343                         ip_vs_control_add(n_cp, cp);
 344                 }
 345
 346                 /*
 347                  * Replace the old passive address with the new one
 348                  */
 349                 from.ip = n_cp->vaddr.ip;
 350                 port = n_cp->vport;
 351                 snprintf(buf, sizeof(buf), "%u,%u,%u,%u,%u,%u",
 352                          ((unsigned char *)&from.ip)[0],
 353                          ((unsigned char *)&from.ip)[1],
 354                          ((unsigned char *)&from.ip)[2],
 355                          ((unsigned char *)&from.ip)[3],
 356                          ntohs(port) >> 8,
 357                          ntohs(port) & 0xFF);
 358
 359                 buf_len = strlen(buf);
 360
 361                 ct = nf_ct_get(skb, &ctinfo);
 362                 if (ct && !nf_ct_is_untracked(ct)) {
 363                         /* If mangling fails this function will return 0
 364                          * which will cause the packet to be dropped.
 365                          * Mangling can only fail under memory pressure,
 366                          * hopefully it will succeed on the retransmitted
 367                          * packet.
 368                          */
 369                         ret = nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
 370                                                        start-data, end-start,
 371                                                        buf, buf_len);
 372                         if (ret)
 373                                 ip_vs_expect_related(skb, ct, n_cp,
 374                                                      IPPROTO_TCP, NULL, 0);
 375                 }
 376
 377                 /*
 378                  * Not setting 'diff' is intentional, otherwise the sequence
 379                  * would be adjusted twice.
 380                  */
 381
 382                 cp->app_data = NULL;
 383                 ip_vs_tcp_conn_listen(n_cp);
 384                 ip_vs_conn_put(n_cp);
 385                 return ret;
 386         }
 387         return 1;
 388 }
 389
 390
 391 /*
 392  * Look at incoming ftp packets to catch the PASV/PORT command
 393  * (outside-to-inside).
 394  *
 395  * The incoming packet having the PORT command should be something like
 396  *      "PORT xxx,xxx,xxx,xxx,ppp,ppp\n".
 397  * xxx,xxx,xxx,xxx is the client address, ppp,ppp is the client port number.
 398  * In this case, we create a connection entry using the client address and
 399  * port, so that the active ftp data connection from the server can reach
 400  * the client.
 401  */
 402 static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
 403                         struct sk_buff *skb, int *diff)
 404 {
 405         struct iphdr *iph;
 406         struct tcphdr *th;
 407         char *data, *data_start, *data_limit;
 408         char *start, *end;
 409         union nf_inet_addr to;
 410         __be16 port;
 411         struct ip_vs_conn *n_cp;
 412         struct nf_conn *ct;
 413
 414 #ifdef CONFIG_IP_VS_IPV6
 415         /* This application helper doesn't work with IPv6 yet,
 416          * so turn this into a no-op for IPv6 packets
 417          */
 418         if (cp->af == AF_INET6)
 419                 return 1;
 420 #endif
 421
 422         /* no diff required for incoming packets */
 423         *diff = 0;
 424
 425         /* Only useful for established sessions */
 426         if (cp->state != IP_VS_TCP_S_ESTABLISHED)
 427                 return 1;
 428
 429         /* Linear packets are much easier to deal with. */
 430         if (!skb_make_writable(skb, skb->len))
 431                 return 0;
 432
 433         /*
 434          * Detecting whether it is passive
 435          */
 436         iph = ip_hdr(skb);
 437         th = (struct tcphdr *)&(((char *)iph)[iph->ihl*4]);
 438
 439         /* Since there may be OPTIONS in the TCP packet and the HLEN is
 440            the length of the header in 32-bit multiples, it is accurate
 441            to calculate data address by th+HLEN*4 */
 442         data = data_start = (char *)th + (th->doff << 2);
 443         data_limit = skb_tail_pointer(skb);
 444
 445         while (data <= data_limit - 6) {
 446                 if (strnicmp(data, "PASV\r\n", 6) == 0) {
 447                         /* Passive mode on */
 448                         IP_VS_DBG(7, "got PASV at %td of %td\n",
 449                                   data - data_start,
 450                                   data_limit - data_start);
 451                         cp->app_data = &ip_vs_ftp_pasv;
 452                         return 1;
 453                 }
 454                 data++;
 455         }
 456
 457         /*
 458          * To support virtual FTP server, the scenerio is as follows:
 459          *       FTP client ----> Load Balancer ----> FTP server
 460          * First detect the port number in the application data,
 461          * then create a new connection entry for the coming data
 462          * connection.
 463          */
 464         if (ip_vs_ftp_get_addrport(data_start, data_limit,
 465                                    CLIENT_STRING, sizeof(CLIENT_STRING)-1,
 466                                    '\r', &to.ip, &port,
 467                                    &start, &end) != 1)
 468                 return 1;
 469
 470         IP_VS_DBG(7, "PORT %pI4:%d detected\n", &to.ip, ntohs(port));
 471
 472         /* Passive mode off */
 473         cp->app_data = NULL;
 474
 475         /*
 476          * Now update or create a connection entry for it
 477          */
 478         IP_VS_DBG(7, "protocol %s %pI4:%d %pI4:%d\n",
 479                   ip_vs_proto_name(iph->protocol),
 480                   &to.ip, ntohs(port), &cp->vaddr.ip, 0);
 481
 482         n_cp = ip_vs_conn_in_get(AF_INET, iph->protocol,
 483                                  &to, port,
 484                                  &cp->vaddr, htons(ntohs(cp->vport)-1));
 485         if (!n_cp) {
 486                 n_cp = ip_vs_conn_new(AF_INET, IPPROTO_TCP,
 487                                       &to, port,
 488                                       &cp->vaddr, htons(ntohs(cp->vport)-1),
 489                                       &cp->daddr, htons(ntohs(cp->dport)-1),
 490                                       0,
 491                                       cp->dest);
 492                 if (!n_cp)
 493                         return 0;
 494
 495                 /* add its controller */
 496                 ip_vs_control_add(n_cp, cp);
 497         }
 498
 499         ct = (struct nf_conn *)skb->nfct;
 500         if (ct && ct != &nf_conntrack_untracked)
 501                 ip_vs_expect_related(skb, ct, n_cp,
 502                                      IPPROTO_TCP, &n_cp->dport, 1);
 503
 504         /*
 505          *      Move tunnel to listen state
 506          */
 507         ip_vs_tcp_conn_listen(n_cp);
 508         ip_vs_conn_put(n_cp);
 509
 510         return 1;
 511 }
 512
 513
 514 static struct ip_vs_app ip_vs_ftp = {
 515         .name =         "ftp",
 516         .type =         IP_VS_APP_TYPE_FTP,
 517         .protocol =     IPPROTO_TCP,
 518         .module =       THIS_MODULE,
 519         .incs_list =    LIST_HEAD_INIT(ip_vs_ftp.incs_list),
 520         .init_conn =    ip_vs_ftp_init_conn,
 521         .done_conn =    ip_vs_ftp_done_conn,
 522         .bind_conn =    NULL,
 523         .unbind_conn =  NULL,
 524         .pkt_out =      ip_vs_ftp_out,
 525         .pkt_in =       ip_vs_ftp_in,
 526 };
 527
 528
 529 /*
 530  *      ip_vs_ftp initialization
 531  */
 532 static int __init ip_vs_ftp_init(void)
 533 {
 534         int i, ret;
 535         struct ip_vs_app *app = &ip_vs_ftp;
 536
 537         ret = register_ip_vs_app(app);
 538         if (ret)
 539                 return ret;
 540
 541         for (i=0; i<IP_VS_APP_MAX_PORTS; i++) {
 542                 if (!ports[i])
 543                         continue;
 544                 ret = register_ip_vs_app_inc(app, app->protocol, ports[i]);
 545                 if (ret)
 546                         break;
 547                 pr_info("%s: loaded support on port[%d] = %d\n",
 548                         app->name, i, ports[i]);
 549         }
 550
 551         if (ret)
 552                 unregister_ip_vs_app(app);
 553
 554         return ret;
 555 }
 556
 557
 558 /*
 559  *      ip_vs_ftp finish.
 560  */
 561 static void __exit ip_vs_ftp_exit(void)
 562 {
 563         unregister_ip_vs_app(&ip_vs_ftp);
 564 }
 565
 566
 567 module_init(ip_vs_ftp_init);
 568 module_exit(ip_vs_ftp_exit);
 569 MODULE_LICENSE("GPL");