/net/ipv4/netfilter/nf_conntrack_proto_icmp.c

https://bitbucket.org/abioy/linux · C · 318 lines · 245 code · 42 blank · 31 comment · 29 complexity · 12d61989e4d8b4db2be5959cbfba4e8f MD5 · raw file

  1. /* (C) 1999-2001 Paul `Rusty' Russell
  2. * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  3. *
  4. * This program is free software; you can redistribute it and/or modify
  5. * it under the terms of the GNU General Public License version 2 as
  6. * published by the Free Software Foundation.
  7. */
  8. #include <linux/types.h>
  9. #include <linux/timer.h>
  10. #include <linux/netfilter.h>
  11. #include <linux/in.h>
  12. #include <linux/icmp.h>
  13. #include <linux/seq_file.h>
  14. #include <net/ip.h>
  15. #include <net/checksum.h>
  16. #include <linux/netfilter_ipv4.h>
  17. #include <net/netfilter/nf_conntrack_tuple.h>
  18. #include <net/netfilter/nf_conntrack_l4proto.h>
  19. #include <net/netfilter/nf_conntrack_core.h>
  20. #include <net/netfilter/nf_conntrack_zones.h>
  21. #include <net/netfilter/nf_log.h>
  22. static unsigned int nf_ct_icmp_timeout __read_mostly = 30*HZ;
  23. static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
  24. struct nf_conntrack_tuple *tuple)
  25. {
  26. const struct icmphdr *hp;
  27. struct icmphdr _hdr;
  28. hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
  29. if (hp == NULL)
  30. return false;
  31. tuple->dst.u.icmp.type = hp->type;
  32. tuple->src.u.icmp.id = hp->un.echo.id;
  33. tuple->dst.u.icmp.code = hp->code;
  34. return true;
  35. }
  36. /* Add 1; spaces filled with 0. */
  37. static const u_int8_t invmap[] = {
  38. [ICMP_ECHO] = ICMP_ECHOREPLY + 1,
  39. [ICMP_ECHOREPLY] = ICMP_ECHO + 1,
  40. [ICMP_TIMESTAMP] = ICMP_TIMESTAMPREPLY + 1,
  41. [ICMP_TIMESTAMPREPLY] = ICMP_TIMESTAMP + 1,
  42. [ICMP_INFO_REQUEST] = ICMP_INFO_REPLY + 1,
  43. [ICMP_INFO_REPLY] = ICMP_INFO_REQUEST + 1,
  44. [ICMP_ADDRESS] = ICMP_ADDRESSREPLY + 1,
  45. [ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1
  46. };
  47. static bool icmp_invert_tuple(struct nf_conntrack_tuple *tuple,
  48. const struct nf_conntrack_tuple *orig)
  49. {
  50. if (orig->dst.u.icmp.type >= sizeof(invmap) ||
  51. !invmap[orig->dst.u.icmp.type])
  52. return false;
  53. tuple->src.u.icmp.id = orig->src.u.icmp.id;
  54. tuple->dst.u.icmp.type = invmap[orig->dst.u.icmp.type] - 1;
  55. tuple->dst.u.icmp.code = orig->dst.u.icmp.code;
  56. return true;
  57. }
  58. /* Print out the per-protocol part of the tuple. */
  59. static int icmp_print_tuple(struct seq_file *s,
  60. const struct nf_conntrack_tuple *tuple)
  61. {
  62. return seq_printf(s, "type=%u code=%u id=%u ",
  63. tuple->dst.u.icmp.type,
  64. tuple->dst.u.icmp.code,
  65. ntohs(tuple->src.u.icmp.id));
  66. }
  67. /* Returns verdict for packet, or -1 for invalid. */
  68. static int icmp_packet(struct nf_conn *ct,
  69. const struct sk_buff *skb,
  70. unsigned int dataoff,
  71. enum ip_conntrack_info ctinfo,
  72. u_int8_t pf,
  73. unsigned int hooknum)
  74. {
  75. /* Do not immediately delete the connection after the first
  76. successful reply to avoid excessive conntrackd traffic
  77. and also to handle correctly ICMP echo reply duplicates. */
  78. nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_icmp_timeout);
  79. return NF_ACCEPT;
  80. }
  81. /* Called when a new connection for this protocol found. */
  82. static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,
  83. unsigned int dataoff)
  84. {
  85. static const u_int8_t valid_new[] = {
  86. [ICMP_ECHO] = 1,
  87. [ICMP_TIMESTAMP] = 1,
  88. [ICMP_INFO_REQUEST] = 1,
  89. [ICMP_ADDRESS] = 1
  90. };
  91. if (ct->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new) ||
  92. !valid_new[ct->tuplehash[0].tuple.dst.u.icmp.type]) {
  93. /* Can't create a new ICMP `conn' with this. */
  94. pr_debug("icmp: can't create new conn with type %u\n",
  95. ct->tuplehash[0].tuple.dst.u.icmp.type);
  96. nf_ct_dump_tuple_ip(&ct->tuplehash[0].tuple);
  97. return false;
  98. }
  99. return true;
  100. }
  101. /* Returns conntrack if it dealt with ICMP, and filled in skb fields */
  102. static int
  103. icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
  104. enum ip_conntrack_info *ctinfo,
  105. unsigned int hooknum)
  106. {
  107. struct nf_conntrack_tuple innertuple, origtuple;
  108. const struct nf_conntrack_l4proto *innerproto;
  109. const struct nf_conntrack_tuple_hash *h;
  110. u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE;
  111. NF_CT_ASSERT(skb->nfct == NULL);
  112. /* Are they talking about one of our connections? */
  113. if (!nf_ct_get_tuplepr(skb,
  114. skb_network_offset(skb) + ip_hdrlen(skb)
  115. + sizeof(struct icmphdr),
  116. PF_INET, &origtuple)) {
  117. pr_debug("icmp_error_message: failed to get tuple\n");
  118. return -NF_ACCEPT;
  119. }
  120. /* rcu_read_lock()ed by nf_hook_slow */
  121. innerproto = __nf_ct_l4proto_find(PF_INET, origtuple.dst.protonum);
  122. /* Ordinarily, we'd expect the inverted tupleproto, but it's
  123. been preserved inside the ICMP. */
  124. if (!nf_ct_invert_tuple(&innertuple, &origtuple,
  125. &nf_conntrack_l3proto_ipv4, innerproto)) {
  126. pr_debug("icmp_error_message: no match\n");
  127. return -NF_ACCEPT;
  128. }
  129. *ctinfo = IP_CT_RELATED;
  130. h = nf_conntrack_find_get(net, zone, &innertuple);
  131. if (!h) {
  132. pr_debug("icmp_error_message: no match\n");
  133. return -NF_ACCEPT;
  134. }
  135. if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
  136. *ctinfo += IP_CT_IS_REPLY;
  137. /* Update skb to refer to this connection */
  138. skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
  139. skb->nfctinfo = *ctinfo;
  140. return -NF_ACCEPT;
  141. }
  142. /* Small and modified version of icmp_rcv */
  143. static int
  144. icmp_error(struct net *net, struct nf_conn *tmpl,
  145. struct sk_buff *skb, unsigned int dataoff,
  146. enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum)
  147. {
  148. const struct icmphdr *icmph;
  149. struct icmphdr _ih;
  150. /* Not enough header? */
  151. icmph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_ih), &_ih);
  152. if (icmph == NULL) {
  153. if (LOG_INVALID(net, IPPROTO_ICMP))
  154. nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
  155. "nf_ct_icmp: short packet ");
  156. return -NF_ACCEPT;
  157. }
  158. /* See ip_conntrack_proto_tcp.c */
  159. if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
  160. nf_ip_checksum(skb, hooknum, dataoff, 0)) {
  161. if (LOG_INVALID(net, IPPROTO_ICMP))
  162. nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
  163. "nf_ct_icmp: bad HW ICMP checksum ");
  164. return -NF_ACCEPT;
  165. }
  166. /*
  167. * 18 is the highest 'known' ICMP type. Anything else is a mystery
  168. *
  169. * RFC 1122: 3.2.2 Unknown ICMP messages types MUST be silently
  170. * discarded.
  171. */
  172. if (icmph->type > NR_ICMP_TYPES) {
  173. if (LOG_INVALID(net, IPPROTO_ICMP))
  174. nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
  175. "nf_ct_icmp: invalid ICMP type ");
  176. return -NF_ACCEPT;
  177. }
  178. /* Need to track icmp error message? */
  179. if (icmph->type != ICMP_DEST_UNREACH &&
  180. icmph->type != ICMP_SOURCE_QUENCH &&
  181. icmph->type != ICMP_TIME_EXCEEDED &&
  182. icmph->type != ICMP_PARAMETERPROB &&
  183. icmph->type != ICMP_REDIRECT)
  184. return NF_ACCEPT;
  185. return icmp_error_message(net, tmpl, skb, ctinfo, hooknum);
  186. }
  187. #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
  188. #include <linux/netfilter/nfnetlink.h>
  189. #include <linux/netfilter/nfnetlink_conntrack.h>
  190. static int icmp_tuple_to_nlattr(struct sk_buff *skb,
  191. const struct nf_conntrack_tuple *t)
  192. {
  193. NLA_PUT_BE16(skb, CTA_PROTO_ICMP_ID, t->src.u.icmp.id);
  194. NLA_PUT_U8(skb, CTA_PROTO_ICMP_TYPE, t->dst.u.icmp.type);
  195. NLA_PUT_U8(skb, CTA_PROTO_ICMP_CODE, t->dst.u.icmp.code);
  196. return 0;
  197. nla_put_failure:
  198. return -1;
  199. }
  200. static const struct nla_policy icmp_nla_policy[CTA_PROTO_MAX+1] = {
  201. [CTA_PROTO_ICMP_TYPE] = { .type = NLA_U8 },
  202. [CTA_PROTO_ICMP_CODE] = { .type = NLA_U8 },
  203. [CTA_PROTO_ICMP_ID] = { .type = NLA_U16 },
  204. };
  205. static int icmp_nlattr_to_tuple(struct nlattr *tb[],
  206. struct nf_conntrack_tuple *tuple)
  207. {
  208. if (!tb[CTA_PROTO_ICMP_TYPE] ||
  209. !tb[CTA_PROTO_ICMP_CODE] ||
  210. !tb[CTA_PROTO_ICMP_ID])
  211. return -EINVAL;
  212. tuple->dst.u.icmp.type = nla_get_u8(tb[CTA_PROTO_ICMP_TYPE]);
  213. tuple->dst.u.icmp.code = nla_get_u8(tb[CTA_PROTO_ICMP_CODE]);
  214. tuple->src.u.icmp.id = nla_get_be16(tb[CTA_PROTO_ICMP_ID]);
  215. if (tuple->dst.u.icmp.type >= sizeof(invmap) ||
  216. !invmap[tuple->dst.u.icmp.type])
  217. return -EINVAL;
  218. return 0;
  219. }
  220. static int icmp_nlattr_tuple_size(void)
  221. {
  222. return nla_policy_len(icmp_nla_policy, CTA_PROTO_MAX + 1);
  223. }
  224. #endif
  225. #ifdef CONFIG_SYSCTL
  226. static struct ctl_table_header *icmp_sysctl_header;
  227. static struct ctl_table icmp_sysctl_table[] = {
  228. {
  229. .procname = "nf_conntrack_icmp_timeout",
  230. .data = &nf_ct_icmp_timeout,
  231. .maxlen = sizeof(unsigned int),
  232. .mode = 0644,
  233. .proc_handler = proc_dointvec_jiffies,
  234. },
  235. { }
  236. };
  237. #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
  238. static struct ctl_table icmp_compat_sysctl_table[] = {
  239. {
  240. .procname = "ip_conntrack_icmp_timeout",
  241. .data = &nf_ct_icmp_timeout,
  242. .maxlen = sizeof(unsigned int),
  243. .mode = 0644,
  244. .proc_handler = proc_dointvec_jiffies,
  245. },
  246. { }
  247. };
  248. #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
  249. #endif /* CONFIG_SYSCTL */
  250. struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp __read_mostly =
  251. {
  252. .l3proto = PF_INET,
  253. .l4proto = IPPROTO_ICMP,
  254. .name = "icmp",
  255. .pkt_to_tuple = icmp_pkt_to_tuple,
  256. .invert_tuple = icmp_invert_tuple,
  257. .print_tuple = icmp_print_tuple,
  258. .packet = icmp_packet,
  259. .new = icmp_new,
  260. .error = icmp_error,
  261. .destroy = NULL,
  262. .me = NULL,
  263. #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
  264. .tuple_to_nlattr = icmp_tuple_to_nlattr,
  265. .nlattr_tuple_size = icmp_nlattr_tuple_size,
  266. .nlattr_to_tuple = icmp_nlattr_to_tuple,
  267. .nla_policy = icmp_nla_policy,
  268. #endif
  269. #ifdef CONFIG_SYSCTL
  270. .ctl_table_header = &icmp_sysctl_header,
  271. .ctl_table = icmp_sysctl_table,
  272. #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
  273. .ctl_compat_table = icmp_compat_sysctl_table,
  274. #endif
  275. #endif
  276. };