[net-next-2.6.git] / net / netfilter / nf_conntrack_proto_udplite.c

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
 * (C) 2007 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/types.h>
#include <linux/timer.h>
#include <linux/module.h>
#include <linux/udp.h>
#include <linux/seq_file.h>
#include <linux/skbuff.h>
#include <linux/ipv6.h>
#include <net/ip6_checksum.h>
#include <net/checksum.h>

#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter_ipv6.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_log.h>

static unsigned int nf_ct_udplite_timeout __read_mostly = 30*HZ;
static unsigned int nf_ct_udplite_timeout_stream __read_mostly = 180*HZ;

static bool udplite_pkt_to_tuple(const struct sk_buff *skb,
				 unsigned int dataoff,
				 struct nf_conntrack_tuple *tuple)
{
	const struct udphdr *hp;
	struct udphdr _hdr;

	hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
	if (hp == NULL)
		return false;

	tuple->src.u.udp.port = hp->source;
	tuple->dst.u.udp.port = hp->dest;
	return true;
}

static bool udplite_invert_tuple(struct nf_conntrack_tuple *tuple,
				 const struct nf_conntrack_tuple *orig)
{
	tuple->src.u.udp.port = orig->dst.u.udp.port;
	tuple->dst.u.udp.port = orig->src.u.udp.port;
	return true;
}

/* Print out the per-protocol part of the tuple. */
static int udplite_print_tuple(struct seq_file *s,
			       const struct nf_conntrack_tuple *tuple)
{
	return seq_printf(s, "sport=%hu dport=%hu ",
			  ntohs(tuple->src.u.udp.port),
			  ntohs(tuple->dst.u.udp.port));
}

/* Returns verdict for packet, and may modify conntracktype */
static int udplite_packet(struct nf_conn *ct,
			  const struct sk_buff *skb,
			  unsigned int dataoff,
			  enum ip_conntrack_info ctinfo,
			  u_int8_t pf,
			  unsigned int hooknum)
{
	/* If we've seen traffic both ways, this is some kind of UDP
	   stream.  Extend timeout. */
	if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
		nf_ct_refresh_acct(ct, ctinfo, skb,
				   nf_ct_udplite_timeout_stream);
		/* Also, more likely to be important, and not a probe */
		if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
			nf_conntrack_event_cache(IPCT_ASSURED, ct);
	} else
		nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udplite_timeout);

	return NF_ACCEPT;
}

/* Called when a new connection for this protocol found. */
static bool udplite_new(struct nf_conn *ct, const struct sk_buff *skb,
			unsigned int dataoff)
{
	return true;
}

static int udplite_error(struct net *net, struct nf_conn *tmpl,
			 struct sk_buff *skb,
			 unsigned int dataoff,
			 enum ip_conntrack_info *ctinfo,
			 u_int8_t pf,
			 unsigned int hooknum)
{
	unsigned int udplen = skb->len - dataoff;
	const struct udphdr *hdr;
	struct udphdr _hdr;
	unsigned int cscov;

	/* Header is too small? */
	hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
	if (hdr == NULL) {
		if (LOG_INVALID(net, IPPROTO_UDPLITE))
			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
				      "nf_ct_udplite: short packet ");
		return -NF_ACCEPT;
	}

	cscov = ntohs(hdr->len);
	if (cscov == 0)
		cscov = udplen;
	else if (cscov < sizeof(*hdr) || cscov > udplen) {
		if (LOG_INVALID(net, IPPROTO_UDPLITE))
			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
				"nf_ct_udplite: invalid checksum coverage ");
		return -NF_ACCEPT;
	}

	/* UDPLITE mandates checksums */
	if (!hdr->check) {
		if (LOG_INVALID(net, IPPROTO_UDPLITE))
			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
				      "nf_ct_udplite: checksum missing ");
		return -NF_ACCEPT;
	}

	/* Checksum invalid? Ignore. */
	if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
	    nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_UDP,
	    			pf)) {
		if (LOG_INVALID(net, IPPROTO_UDPLITE))
			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
				      "nf_ct_udplite: bad UDPLite checksum ");
		return -NF_ACCEPT;
	}

	return NF_ACCEPT;
}

#ifdef CONFIG_SYSCTL
static unsigned int udplite_sysctl_table_users;
static struct ctl_table_header *udplite_sysctl_header;
static struct ctl_table udplite_sysctl_table[] = {
	{
		.procname	= "nf_conntrack_udplite_timeout",
		.data		= &nf_ct_udplite_timeout,
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_jiffies,
	},
	{
		.procname	= "nf_conntrack_udplite_timeout_stream",
		.data		= &nf_ct_udplite_timeout_stream,
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_jiffies,
	},
	{ }
};
#endif /* CONFIG_SYSCTL */

static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 __read_mostly =
{
	.l3proto		= PF_INET,
	.l4proto		= IPPROTO_UDPLITE,
	.name			= "udplite",
	.pkt_to_tuple		= udplite_pkt_to_tuple,
	.invert_tuple		= udplite_invert_tuple,
	.print_tuple		= udplite_print_tuple,
	.packet			= udplite_packet,
	.new			= udplite_new,
	.error			= udplite_error,
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
	.nlattr_tuple_size	= nf_ct_port_nlattr_tuple_size,
	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
	.nla_policy		= nf_ct_port_nla_policy,
#endif
#ifdef CONFIG_SYSCTL
	.ctl_table_users	= &udplite_sysctl_table_users,
	.ctl_table_header	= &udplite_sysctl_header,
	.ctl_table		= udplite_sysctl_table,
#endif
};

static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 __read_mostly =
{
	.l3proto		= PF_INET6,
	.l4proto		= IPPROTO_UDPLITE,
	.name			= "udplite",
	.pkt_to_tuple		= udplite_pkt_to_tuple,
	.invert_tuple		= udplite_invert_tuple,
	.print_tuple		= udplite_print_tuple,
	.packet			= udplite_packet,
	.new			= udplite_new,
	.error			= udplite_error,
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
	.nlattr_tuple_size	= nf_ct_port_nlattr_tuple_size,
	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
	.nla_policy		= nf_ct_port_nla_policy,
#endif
#ifdef CONFIG_SYSCTL
	.ctl_table_users	= &udplite_sysctl_table_users,
	.ctl_table_header	= &udplite_sysctl_header,
	.ctl_table		= udplite_sysctl_table,
#endif
};

static int __init nf_conntrack_proto_udplite_init(void)
{
	int err;

	err = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udplite4);
	if (err < 0)
		goto err1;
	err = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udplite6);
	if (err < 0)
		goto err2;
	return 0;
err2:
	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udplite4);
err1:
	return err;
}

static void __exit nf_conntrack_proto_udplite_exit(void)
{
	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udplite6);
	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udplite4);
}

module_init(nf_conntrack_proto_udplite_init);
module_exit(nf_conntrack_proto_udplite_exit);

MODULE_LICENSE("GPL");
Commit	Line	Data
59eecdfb PM	1	/* (C) 1999-2001 Paul `Rusty' Russell
	2	* (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
	3	* (C) 2007 Patrick McHardy <kaber@trash.net>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*/
	9
	10	#include <linux/types.h>
	11	#include <linux/timer.h>
	12	#include <linux/module.h>
59eecdfb PM	13	#include <linux/udp.h>
	14	#include <linux/seq_file.h>
	15	#include <linux/skbuff.h>
	16	#include <linux/ipv6.h>
	17	#include <net/ip6_checksum.h>
	18	#include <net/checksum.h>
	19
	20	#include <linux/netfilter.h>
	21	#include <linux/netfilter_ipv4.h>
	22	#include <linux/netfilter_ipv6.h>
	23	#include <net/netfilter/nf_conntrack_l4proto.h>
	24	#include <net/netfilter/nf_conntrack_ecache.h>
f01ffbd6	25	#include <net/netfilter/nf_log.h>
59eecdfb PM	26
	27	static unsigned int nf_ct_udplite_timeout __read_mostly = 30*HZ;
	28	static unsigned int nf_ct_udplite_timeout_stream __read_mostly = 180*HZ;
	29
09f263cd JE	30	static bool udplite_pkt_to_tuple(const struct sk_buff *skb,
	31	unsigned int dataoff,
	32	struct nf_conntrack_tuple *tuple)
59eecdfb	33	{
da3f13c9 JE	34	const struct udphdr *hp;
da3f13c9 JE	35	struct udphdr _hdr;
59eecdfb PM	36
	37	hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
	38	if (hp == NULL)
09f263cd	39	return false;
59eecdfb PM	40
	41	tuple->src.u.udp.port = hp->source;
	42	tuple->dst.u.udp.port = hp->dest;
09f263cd	43	return true;
59eecdfb PM	44	}
59eecdfb PM	45
09f263cd JE	46	static bool udplite_invert_tuple(struct nf_conntrack_tuple *tuple,
09f263cd JE	47	const struct nf_conntrack_tuple *orig)
59eecdfb PM	48	{
	49	tuple->src.u.udp.port = orig->dst.u.udp.port;
	50	tuple->dst.u.udp.port = orig->src.u.udp.port;
09f263cd	51	return true;
59eecdfb PM	52	}
	53
	54	/* Print out the per-protocol part of the tuple. */
	55	static int udplite_print_tuple(struct seq_file *s,
	56	const struct nf_conntrack_tuple *tuple)
	57	{
	58	return seq_printf(s, "sport=%hu dport=%hu ",
	59	ntohs(tuple->src.u.udp.port),
	60	ntohs(tuple->dst.u.udp.port));
	61	}
	62
59eecdfb	63	/* Returns verdict for packet, and may modify conntracktype */
c88130bc	64	static int udplite_packet(struct nf_conn *ct,
59eecdfb PM	65	const struct sk_buff *skb,
	66	unsigned int dataoff,
	67	enum ip_conntrack_info ctinfo,
76108cea	68	u_int8_t pf,
59eecdfb PM	69	unsigned int hooknum)
	70	{
	71	/* If we've seen traffic both ways, this is some kind of UDP
	72	stream. Extend timeout. */
c88130bc PM	73	if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
c88130bc PM	74	nf_ct_refresh_acct(ct, ctinfo, skb,
59eecdfb PM	75	nf_ct_udplite_timeout_stream);
59eecdfb PM	76	/* Also, more likely to be important, and not a probe */
c88130bc	77	if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
858b3133	78	nf_conntrack_event_cache(IPCT_ASSURED, ct);
59eecdfb	79	} else
c88130bc	80	nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udplite_timeout);
59eecdfb PM	81
	82	return NF_ACCEPT;
	83	}
	84
	85	/* Called when a new connection for this protocol found. */
09f263cd JE	86	static bool udplite_new(struct nf_conn ct, const struct sk_buff skb,
09f263cd JE	87	unsigned int dataoff)
59eecdfb	88	{
09f263cd	89	return true;
59eecdfb PM	90	}
59eecdfb PM	91
8fea97ec	92	static int udplite_error(struct net net, struct nf_conn tmpl,
74c51a14 AD	93	struct sk_buff *skb,
74c51a14 AD	94	unsigned int dataoff,
59eecdfb	95	enum ip_conntrack_info *ctinfo,
76108cea	96	u_int8_t pf,
59eecdfb PM	97	unsigned int hooknum)
	98	{
	99	unsigned int udplen = skb->len - dataoff;
da3f13c9 JE	100	const struct udphdr *hdr;
da3f13c9 JE	101	struct udphdr _hdr;
59eecdfb PM	102	unsigned int cscov;
	103
	104	/* Header is too small? */
	105	hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
	106	if (hdr == NULL) {
c2a2c7e0	107	if (LOG_INVALID(net, IPPROTO_UDPLITE))
59eecdfb PM	108	nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
	109	"nf_ct_udplite: short packet ");
	110	return -NF_ACCEPT;
	111	}
	112
	113	cscov = ntohs(hdr->len);
	114	if (cscov == 0)
	115	cscov = udplen;
	116	else if (cscov < sizeof(*hdr) \|\| cscov > udplen) {
c2a2c7e0	117	if (LOG_INVALID(net, IPPROTO_UDPLITE))
59eecdfb PM	118	nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
	119	"nf_ct_udplite: invalid checksum coverage ");
	120	return -NF_ACCEPT;
	121	}
	122
	123	/* UDPLITE mandates checksums */
	124	if (!hdr->check) {
c2a2c7e0	125	if (LOG_INVALID(net, IPPROTO_UDPLITE))
59eecdfb PM	126	nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
	127	"nf_ct_udplite: checksum missing ");
	128	return -NF_ACCEPT;
	129	}
	130
	131	/* Checksum invalid? Ignore. */
c04d0552	132	if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
d63a6507 PM	133	nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_UDP,
d63a6507 PM	134	pf)) {
c2a2c7e0	135	if (LOG_INVALID(net, IPPROTO_UDPLITE))
d63a6507 PM	136	nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
	137	"nf_ct_udplite: bad UDPLite checksum ");
	138	return -NF_ACCEPT;
59eecdfb PM	139	}
	140
	141	return NF_ACCEPT;
	142	}
	143
	144	#ifdef CONFIG_SYSCTL
	145	static unsigned int udplite_sysctl_table_users;
	146	static struct ctl_table_header *udplite_sysctl_header;
	147	static struct ctl_table udplite_sysctl_table[] = {
	148	{
59eecdfb PM	149	.procname = "nf_conntrack_udplite_timeout",
	150	.data = &nf_ct_udplite_timeout,
	151	.maxlen = sizeof(unsigned int),
	152	.mode = 0644,
6d9f239a	153	.proc_handler = proc_dointvec_jiffies,
59eecdfb PM	154	},
59eecdfb PM	155	{
59eecdfb PM	156	.procname = "nf_conntrack_udplite_timeout_stream",
	157	.data = &nf_ct_udplite_timeout_stream,
	158	.maxlen = sizeof(unsigned int),
	159	.mode = 0644,
6d9f239a	160	.proc_handler = proc_dointvec_jiffies,
59eecdfb	161	},
f8572d8f	162	{ }
59eecdfb PM	163	};
	164	#endif /* CONFIG_SYSCTL */
	165
	166	static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 __read_mostly =
	167	{
	168	.l3proto = PF_INET,
	169	.l4proto = IPPROTO_UDPLITE,
	170	.name = "udplite",
	171	.pkt_to_tuple = udplite_pkt_to_tuple,
	172	.invert_tuple = udplite_invert_tuple,
	173	.print_tuple = udplite_print_tuple,
59eecdfb PM	174	.packet = udplite_packet,
	175	.new = udplite_new,
	176	.error = udplite_error,
	177	#if defined(CONFIG_NF_CT_NETLINK) \|\| defined(CONFIG_NF_CT_NETLINK_MODULE)
fdf70832	178	.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
a400c30e	179	.nlattr_tuple_size = nf_ct_port_nlattr_tuple_size,
fdf70832	180	.nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
f73e924c	181	.nla_policy = nf_ct_port_nla_policy,
59eecdfb PM	182	#endif
	183	#ifdef CONFIG_SYSCTL
	184	.ctl_table_users = &udplite_sysctl_table_users,
	185	.ctl_table_header = &udplite_sysctl_header,
	186	.ctl_table = udplite_sysctl_table,
	187	#endif
	188	};
	189
	190	static struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 __read_mostly =
	191	{
	192	.l3proto = PF_INET6,
	193	.l4proto = IPPROTO_UDPLITE,
	194	.name = "udplite",
	195	.pkt_to_tuple = udplite_pkt_to_tuple,
	196	.invert_tuple = udplite_invert_tuple,
	197	.print_tuple = udplite_print_tuple,
59eecdfb PM	198	.packet = udplite_packet,
	199	.new = udplite_new,
	200	.error = udplite_error,
	201	#if defined(CONFIG_NF_CT_NETLINK) \|\| defined(CONFIG_NF_CT_NETLINK_MODULE)
fdf70832	202	.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
5ff48294	203	.nlattr_tuple_size = nf_ct_port_nlattr_tuple_size,
fdf70832	204	.nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
f73e924c	205	.nla_policy = nf_ct_port_nla_policy,
59eecdfb PM	206	#endif
	207	#ifdef CONFIG_SYSCTL
	208	.ctl_table_users = &udplite_sysctl_table_users,
	209	.ctl_table_header = &udplite_sysctl_header,
	210	.ctl_table = udplite_sysctl_table,
	211	#endif
	212	};
	213
	214	static int __init nf_conntrack_proto_udplite_init(void)
	215	{
	216	int err;
	217
	218	err = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udplite4);
	219	if (err < 0)
	220	goto err1;
	221	err = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udplite6);
	222	if (err < 0)
	223	goto err2;
	224	return 0;
	225	err2:
	226	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udplite4);
	227	err1:
	228	return err;
	229	}
	230
	231	static void __exit nf_conntrack_proto_udplite_exit(void)
	232	{
	233	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udplite6);
	234	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udplite4);
	235	}
	236
	237	module_init(nf_conntrack_proto_udplite_init);
	238	module_exit(nf_conntrack_proto_udplite_exit);
	239
	240	MODULE_LICENSE("GPL");