1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Helper handling for netfilter. */ 3 4 /* (C) 1999-2001 Paul `Rusty' Russell 5 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 6 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org> 7 * (C) 2006-2012 Patrick McHardy <kaber@trash.net> 8 */ 9 10 #include <linux/types.h> 11 #include <linux/netfilter.h> 12 #include <linux/module.h> 13 #include <linux/skbuff.h> 14 #include <linux/vmalloc.h> 15 #include <linux/stddef.h> 16 #include <linux/random.h> 17 #include <linux/err.h> 18 #include <linux/kernel.h> 19 #include <linux/netdevice.h> 20 #include <linux/rculist.h> 21 #include <linux/rtnetlink.h> 22 23 #include <net/netfilter/nf_conntrack.h> 24 #include <net/netfilter/nf_conntrack_core.h> 25 #include <net/netfilter/nf_conntrack_ecache.h> 26 #include <net/netfilter/nf_conntrack_extend.h> 27 #include <net/netfilter/nf_conntrack_helper.h> 28 #include <net/netfilter/nf_conntrack_l4proto.h> 29 #include <net/netfilter/nf_conntrack_seqadj.h> 30 #include <net/netfilter/nf_log.h> 31 #include <net/ip.h> 32 33 static DEFINE_MUTEX(nf_ct_helper_mutex); 34 struct hlist_head *nf_ct_helper_hash __read_mostly; 35 EXPORT_SYMBOL_GPL(nf_ct_helper_hash); 36 unsigned int nf_ct_helper_hsize __read_mostly; 37 EXPORT_SYMBOL_GPL(nf_ct_helper_hsize); 38 static unsigned int nf_ct_helper_count __read_mostly; 39 40 static DEFINE_MUTEX(nf_ct_nat_helpers_mutex); 41 static struct list_head nf_ct_nat_helpers __read_mostly; 42 43 /* Stupid hash, but collision free for the default registrations of the 44 * helpers currently in the kernel. */ 45 static unsigned int helper_hash(const struct nf_conntrack_tuple *tuple) 46 { 47 return (((tuple->src.l3num << 8) | tuple->dst.protonum) ^ 48 (__force __u16)tuple->src.u.all) % nf_ct_helper_hsize; 49 } 50 51 struct nf_conntrack_helper * 52 __nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum) 53 { 54 struct nf_conntrack_helper *h; 55 unsigned int i; 56 57 for (i = 0; i < nf_ct_helper_hsize; i++) { 58 hlist_for_each_entry_rcu(h, &nf_ct_helper_hash[i], hnode) { 59 if (strcmp(h->name, name)) 60 continue; 61 62 if (h->tuple.src.l3num != NFPROTO_UNSPEC && 63 h->tuple.src.l3num != l3num) 64 continue; 65 66 if (h->tuple.dst.protonum == protonum) 67 return h; 68 } 69 } 70 return NULL; 71 } 72 EXPORT_SYMBOL_GPL(__nf_conntrack_helper_find); 73 74 struct nf_conntrack_helper * 75 nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum) 76 { 77 struct nf_conntrack_helper *h; 78 79 rcu_read_lock(); 80 81 h = __nf_conntrack_helper_find(name, l3num, protonum); 82 #ifdef CONFIG_MODULES 83 if (h == NULL) { 84 rcu_read_unlock(); 85 if (request_module("nfct-helper-%s", name) == 0) { 86 rcu_read_lock(); 87 h = __nf_conntrack_helper_find(name, l3num, protonum); 88 } else { 89 return h; 90 } 91 } 92 #endif 93 if (h != NULL && !try_module_get(h->me)) 94 h = NULL; 95 if (h != NULL && !refcount_inc_not_zero(&h->refcnt)) { 96 module_put(h->me); 97 h = NULL; 98 } 99 100 rcu_read_unlock(); 101 102 return h; 103 } 104 EXPORT_SYMBOL_GPL(nf_conntrack_helper_try_module_get); 105 106 void nf_conntrack_helper_put(struct nf_conntrack_helper *helper) 107 { 108 refcount_dec(&helper->refcnt); 109 module_put(helper->me); 110 } 111 EXPORT_SYMBOL_GPL(nf_conntrack_helper_put); 112 113 static struct nf_conntrack_nat_helper * 114 nf_conntrack_nat_helper_find(const char *mod_name) 115 { 116 struct nf_conntrack_nat_helper *cur; 117 bool found = false; 118 119 list_for_each_entry_rcu(cur, &nf_ct_nat_helpers, list) { 120 if (!strcmp(cur->mod_name, mod_name)) { 121 found = true; 122 break; 123 } 124 } 125 return found ? cur : NULL; 126 } 127 128 int 129 nf_nat_helper_try_module_get(const char *name, u16 l3num, u8 protonum) 130 { 131 struct nf_conntrack_helper *h; 132 struct nf_conntrack_nat_helper *nat; 133 char mod_name[NF_CT_HELPER_NAME_LEN]; 134 int ret = 0; 135 136 rcu_read_lock(); 137 h = __nf_conntrack_helper_find(name, l3num, protonum); 138 if (!h) { 139 rcu_read_unlock(); 140 return -ENOENT; 141 } 142 143 nat = nf_conntrack_nat_helper_find(h->nat_mod_name); 144 if (!nat) { 145 snprintf(mod_name, sizeof(mod_name), "%s", h->nat_mod_name); 146 rcu_read_unlock(); 147 request_module("%s", mod_name); 148 149 rcu_read_lock(); 150 nat = nf_conntrack_nat_helper_find(mod_name); 151 if (!nat) { 152 rcu_read_unlock(); 153 return -ENOENT; 154 } 155 } 156 157 if (!try_module_get(nat->module)) 158 ret = -ENOENT; 159 160 rcu_read_unlock(); 161 return ret; 162 } 163 EXPORT_SYMBOL_GPL(nf_nat_helper_try_module_get); 164 165 void nf_nat_helper_put(struct nf_conntrack_helper *helper) 166 { 167 struct nf_conntrack_nat_helper *nat; 168 169 nat = nf_conntrack_nat_helper_find(helper->nat_mod_name); 170 if (WARN_ON_ONCE(!nat)) 171 return; 172 173 module_put(nat->module); 174 } 175 EXPORT_SYMBOL_GPL(nf_nat_helper_put); 176 177 struct nf_conn_help * 178 nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp) 179 { 180 struct nf_conn_help *help; 181 182 help = nf_ct_ext_add(ct, NF_CT_EXT_HELPER, gfp); 183 if (help) 184 INIT_HLIST_HEAD(&help->expectations); 185 else 186 pr_debug("failed to add helper extension area"); 187 return help; 188 } 189 EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add); 190 191 int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl, 192 gfp_t flags) 193 { 194 struct nf_conntrack_helper *helper = NULL; 195 struct nf_conn_help *help; 196 197 /* We already got a helper explicitly attached. The function 198 * nf_conntrack_alter_reply - in case NAT is in use - asks for looking 199 * the helper up again. Since now the user is in full control of 200 * making consistent helper configurations, skip this automatic 201 * re-lookup, otherwise we'll lose the helper. 202 */ 203 if (test_bit(IPS_HELPER_BIT, &ct->status)) 204 return 0; 205 206 if (WARN_ON_ONCE(!tmpl)) 207 return 0; 208 209 help = nfct_help(tmpl); 210 if (help != NULL) { 211 helper = rcu_dereference(help->helper); 212 set_bit(IPS_HELPER_BIT, &ct->status); 213 } 214 215 help = nfct_help(ct); 216 217 if (helper == NULL) { 218 if (help) 219 RCU_INIT_POINTER(help->helper, NULL); 220 return 0; 221 } 222 223 if (help == NULL) { 224 help = nf_ct_helper_ext_add(ct, flags); 225 if (help == NULL) 226 return -ENOMEM; 227 } else { 228 /* We only allow helper re-assignment of the same sort since 229 * we cannot reallocate the helper extension area. 230 */ 231 struct nf_conntrack_helper *tmp = rcu_dereference(help->helper); 232 233 if (tmp && tmp->help != helper->help) { 234 RCU_INIT_POINTER(help->helper, NULL); 235 return 0; 236 } 237 } 238 239 rcu_assign_pointer(help->helper, helper); 240 241 return 0; 242 } 243 EXPORT_SYMBOL_GPL(__nf_ct_try_assign_helper); 244 245 /* 'skb' should already be pulled to nh_ofs. */ 246 int nf_ct_helper(struct sk_buff *skb, struct nf_conn *ct, 247 enum ip_conntrack_info ctinfo, u16 proto) 248 { 249 const struct nf_conntrack_helper *helper; 250 const struct nf_conn_help *help; 251 unsigned int protoff; 252 int err; 253 254 if (ctinfo == IP_CT_RELATED_REPLY) 255 return NF_ACCEPT; 256 257 help = nfct_help(ct); 258 if (!help) 259 return NF_ACCEPT; 260 261 helper = rcu_dereference(help->helper); 262 if (!helper) 263 return NF_ACCEPT; 264 265 if (helper->tuple.src.l3num != NFPROTO_UNSPEC && 266 helper->tuple.src.l3num != proto) 267 return NF_ACCEPT; 268 269 switch (proto) { 270 case NFPROTO_IPV4: 271 protoff = ip_hdrlen(skb); 272 proto = ip_hdr(skb)->protocol; 273 break; 274 case NFPROTO_IPV6: { 275 u8 nexthdr = ipv6_hdr(skb)->nexthdr; 276 __be16 frag_off; 277 int ofs; 278 279 ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, 280 &frag_off); 281 if (ofs < 0 || (frag_off & htons(~0x7)) != 0) { 282 pr_debug("proto header not found\n"); 283 return NF_ACCEPT; 284 } 285 protoff = ofs; 286 proto = nexthdr; 287 break; 288 } 289 default: 290 WARN_ONCE(1, "helper invoked on non-IP family!"); 291 return NF_DROP; 292 } 293 294 if (helper->tuple.dst.protonum != proto) 295 return NF_ACCEPT; 296 297 err = helper->help(skb, protoff, ct, ctinfo); 298 if (err != NF_ACCEPT) 299 return err; 300 301 /* Adjust seqs after helper. This is needed due to some helpers (e.g., 302 * FTP with NAT) adusting the TCP payload size when mangling IP 303 * addresses and/or port numbers in the text-based control connection. 304 */ 305 if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) && 306 !nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) 307 return NF_DROP; 308 return NF_ACCEPT; 309 } 310 EXPORT_SYMBOL_GPL(nf_ct_helper); 311 312 int nf_ct_add_helper(struct nf_conn *ct, const char *name, u8 family, 313 u8 proto, bool nat, struct nf_conntrack_helper **hp) 314 { 315 struct nf_conntrack_helper *helper; 316 struct nf_conn_help *help; 317 int ret = 0; 318 319 helper = nf_conntrack_helper_try_module_get(name, family, proto); 320 if (!helper) 321 return -EINVAL; 322 323 help = nf_ct_helper_ext_add(ct, GFP_KERNEL); 324 if (!help) { 325 nf_conntrack_helper_put(helper); 326 return -ENOMEM; 327 } 328 #if IS_ENABLED(CONFIG_NF_NAT) 329 if (nat) { 330 ret = nf_nat_helper_try_module_get(name, family, proto); 331 if (ret) { 332 nf_conntrack_helper_put(helper); 333 return ret; 334 } 335 } 336 #endif 337 rcu_assign_pointer(help->helper, helper); 338 *hp = helper; 339 return ret; 340 } 341 EXPORT_SYMBOL_GPL(nf_ct_add_helper); 342 343 /* appropriate ct lock protecting must be taken by caller */ 344 static int unhelp(struct nf_conn *ct, void *me) 345 { 346 struct nf_conn_help *help = nfct_help(ct); 347 348 if (help && rcu_dereference_raw(help->helper) == me) { 349 nf_conntrack_event(IPCT_HELPER, ct); 350 RCU_INIT_POINTER(help->helper, NULL); 351 } 352 353 /* We are not intended to delete this conntrack. */ 354 return 0; 355 } 356 357 void nf_ct_helper_destroy(struct nf_conn *ct) 358 { 359 struct nf_conn_help *help = nfct_help(ct); 360 struct nf_conntrack_helper *helper; 361 362 if (help) { 363 rcu_read_lock(); 364 helper = rcu_dereference(help->helper); 365 if (helper && helper->destroy) 366 helper->destroy(ct); 367 rcu_read_unlock(); 368 } 369 } 370 371 static LIST_HEAD(nf_ct_helper_expectfn_list); 372 373 void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n) 374 { 375 spin_lock_bh(&nf_conntrack_expect_lock); 376 list_add_rcu(&n->head, &nf_ct_helper_expectfn_list); 377 spin_unlock_bh(&nf_conntrack_expect_lock); 378 } 379 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_register); 380 381 void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n) 382 { 383 spin_lock_bh(&nf_conntrack_expect_lock); 384 list_del_rcu(&n->head); 385 spin_unlock_bh(&nf_conntrack_expect_lock); 386 } 387 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_unregister); 388 389 /* Caller should hold the rcu lock */ 390 struct nf_ct_helper_expectfn * 391 nf_ct_helper_expectfn_find_by_name(const char *name) 392 { 393 struct nf_ct_helper_expectfn *cur; 394 bool found = false; 395 396 list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) { 397 if (!strcmp(cur->name, name)) { 398 found = true; 399 break; 400 } 401 } 402 return found ? cur : NULL; 403 } 404 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_name); 405 406 /* Caller should hold the rcu lock */ 407 struct nf_ct_helper_expectfn * 408 nf_ct_helper_expectfn_find_by_symbol(const void *symbol) 409 { 410 struct nf_ct_helper_expectfn *cur; 411 bool found = false; 412 413 list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) { 414 if (cur->expectfn == symbol) { 415 found = true; 416 break; 417 } 418 } 419 return found ? cur : NULL; 420 } 421 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_symbol); 422 423 __printf(3, 4) 424 void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct, 425 const char *fmt, ...) 426 { 427 const struct nf_conn_help *help; 428 const struct nf_conntrack_helper *helper; 429 struct va_format vaf; 430 va_list args; 431 432 va_start(args, fmt); 433 434 vaf.fmt = fmt; 435 vaf.va = &args; 436 437 /* Called from the helper function, this call never fails */ 438 help = nfct_help(ct); 439 440 /* rcu_read_lock()ed by nf_hook_thresh */ 441 helper = rcu_dereference(help->helper); 442 443 nf_log_packet(nf_ct_net(ct), nf_ct_l3num(ct), 0, skb, NULL, NULL, NULL, 444 "nf_ct_%s: dropping packet: %pV ", helper->name, &vaf); 445 446 va_end(args); 447 } 448 EXPORT_SYMBOL_GPL(nf_ct_helper_log); 449 450 int nf_conntrack_helper_register(struct nf_conntrack_helper *me) 451 { 452 struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) }; 453 unsigned int h = helper_hash(&me->tuple); 454 struct nf_conntrack_helper *cur; 455 int ret = 0, i; 456 457 BUG_ON(me->expect_policy == NULL); 458 BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES); 459 BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1); 460 461 if (me->expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) 462 return -EINVAL; 463 464 mutex_lock(&nf_ct_helper_mutex); 465 for (i = 0; i < nf_ct_helper_hsize; i++) { 466 hlist_for_each_entry(cur, &nf_ct_helper_hash[i], hnode) { 467 if (!strcmp(cur->name, me->name) && 468 (cur->tuple.src.l3num == NFPROTO_UNSPEC || 469 cur->tuple.src.l3num == me->tuple.src.l3num) && 470 cur->tuple.dst.protonum == me->tuple.dst.protonum) { 471 ret = -EEXIST; 472 goto out; 473 } 474 } 475 } 476 477 /* avoid unpredictable behaviour for auto_assign_helper */ 478 if (!(me->flags & NF_CT_HELPER_F_USERSPACE)) { 479 hlist_for_each_entry(cur, &nf_ct_helper_hash[h], hnode) { 480 if (nf_ct_tuple_src_mask_cmp(&cur->tuple, &me->tuple, 481 &mask)) { 482 ret = -EEXIST; 483 goto out; 484 } 485 } 486 } 487 refcount_set(&me->refcnt, 1); 488 hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]); 489 nf_ct_helper_count++; 490 out: 491 mutex_unlock(&nf_ct_helper_mutex); 492 return ret; 493 } 494 EXPORT_SYMBOL_GPL(nf_conntrack_helper_register); 495 496 static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data) 497 { 498 struct nf_conn_help *help = nfct_help(exp->master); 499 const struct nf_conntrack_helper *me = data; 500 const struct nf_conntrack_helper *this; 501 502 if (exp->helper == me) 503 return true; 504 505 this = rcu_dereference_protected(help->helper, 506 lockdep_is_held(&nf_conntrack_expect_lock)); 507 return this == me; 508 } 509 510 void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) 511 { 512 mutex_lock(&nf_ct_helper_mutex); 513 hlist_del_rcu(&me->hnode); 514 nf_ct_helper_count--; 515 mutex_unlock(&nf_ct_helper_mutex); 516 517 /* Make sure every nothing is still using the helper unless its a 518 * connection in the hash. 519 */ 520 synchronize_rcu(); 521 522 nf_ct_expect_iterate_destroy(expect_iter_me, NULL); 523 nf_ct_iterate_destroy(unhelp, me); 524 } 525 EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister); 526 527 void nf_ct_helper_init(struct nf_conntrack_helper *helper, 528 u16 l3num, u16 protonum, const char *name, 529 u16 default_port, u16 spec_port, u32 id, 530 const struct nf_conntrack_expect_policy *exp_pol, 531 u32 expect_class_max, 532 int (*help)(struct sk_buff *skb, unsigned int protoff, 533 struct nf_conn *ct, 534 enum ip_conntrack_info ctinfo), 535 int (*from_nlattr)(struct nlattr *attr, 536 struct nf_conn *ct), 537 struct module *module) 538 { 539 helper->tuple.src.l3num = l3num; 540 helper->tuple.dst.protonum = protonum; 541 helper->tuple.src.u.all = htons(spec_port); 542 helper->expect_policy = exp_pol; 543 helper->expect_class_max = expect_class_max; 544 helper->help = help; 545 helper->from_nlattr = from_nlattr; 546 helper->me = module; 547 snprintf(helper->nat_mod_name, sizeof(helper->nat_mod_name), 548 NF_NAT_HELPER_PREFIX "%s", name); 549 550 if (spec_port == default_port) 551 snprintf(helper->name, sizeof(helper->name), "%s", name); 552 else 553 snprintf(helper->name, sizeof(helper->name), "%s-%u", name, id); 554 } 555 EXPORT_SYMBOL_GPL(nf_ct_helper_init); 556 557 int nf_conntrack_helpers_register(struct nf_conntrack_helper *helper, 558 unsigned int n) 559 { 560 unsigned int i; 561 int err = 0; 562 563 for (i = 0; i < n; i++) { 564 err = nf_conntrack_helper_register(&helper[i]); 565 if (err < 0) 566 goto err; 567 } 568 569 return err; 570 err: 571 if (i > 0) 572 nf_conntrack_helpers_unregister(helper, i); 573 return err; 574 } 575 EXPORT_SYMBOL_GPL(nf_conntrack_helpers_register); 576 577 void nf_conntrack_helpers_unregister(struct nf_conntrack_helper *helper, 578 unsigned int n) 579 { 580 while (n-- > 0) 581 nf_conntrack_helper_unregister(&helper[n]); 582 } 583 EXPORT_SYMBOL_GPL(nf_conntrack_helpers_unregister); 584 585 void nf_nat_helper_register(struct nf_conntrack_nat_helper *nat) 586 { 587 mutex_lock(&nf_ct_nat_helpers_mutex); 588 list_add_rcu(&nat->list, &nf_ct_nat_helpers); 589 mutex_unlock(&nf_ct_nat_helpers_mutex); 590 } 591 EXPORT_SYMBOL_GPL(nf_nat_helper_register); 592 593 void nf_nat_helper_unregister(struct nf_conntrack_nat_helper *nat) 594 { 595 mutex_lock(&nf_ct_nat_helpers_mutex); 596 list_del_rcu(&nat->list); 597 mutex_unlock(&nf_ct_nat_helpers_mutex); 598 } 599 EXPORT_SYMBOL_GPL(nf_nat_helper_unregister); 600 601 int nf_conntrack_helper_init(void) 602 { 603 nf_ct_helper_hsize = 1; /* gets rounded up to use one page */ 604 nf_ct_helper_hash = 605 nf_ct_alloc_hashtable(&nf_ct_helper_hsize, 0); 606 if (!nf_ct_helper_hash) 607 return -ENOMEM; 608 609 INIT_LIST_HEAD(&nf_ct_nat_helpers); 610 return 0; 611 } 612 613 void nf_conntrack_helper_fini(void) 614 { 615 kvfree(nf_ct_helper_hash); 616 } 617