[linux-2.6-block.git] / net / ipv4 / netfilter / ip_conntrack_ftp.c

/* FTP extension for IP connection tracking. */

/* (C) 1999-2001 Paul `Rusty' Russell  
 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/config.h>
#include <linux/module.h>
#include <linux/netfilter.h>
#include <linux/ip.h>
#include <linux/ctype.h>
#include <net/checksum.h>
#include <net/tcp.h>

#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
#include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
#include <linux/moduleparam.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
MODULE_DESCRIPTION("ftp connection tracking helper");

/* This is slow, but it's simple. --RR */
static char *ftp_buffer;
static DEFINE_SPINLOCK(ip_ftp_lock);

#define MAX_PORTS 8
static short ports[MAX_PORTS];
static int ports_c;
module_param_array(ports, short, &ports_c, 0400);

static int loose;
module_param(loose, int, 0600);

unsigned int (*ip_nat_ftp_hook)(struct sk_buff **pskb,
				enum ip_conntrack_info ctinfo,
				enum ip_ct_ftp_type type,
				unsigned int matchoff,
				unsigned int matchlen,
				struct ip_conntrack_expect *exp,
				u32 *seq);
EXPORT_SYMBOL_GPL(ip_nat_ftp_hook);

#if 0
#define DEBUGP printk
#else
#define DEBUGP(format, args...)
#endif

static int try_rfc959(const char *, size_t, u_int32_t [], char);
static int try_eprt(const char *, size_t, u_int32_t [], char);
static int try_epsv_response(const char *, size_t, u_int32_t [], char);

static struct ftp_search {
	enum ip_conntrack_dir dir;
	const char *pattern;
	size_t plen;
	char skip;
	char term;
	enum ip_ct_ftp_type ftptype;
	int (*getnum)(const char *, size_t, u_int32_t[], char);
} search[] = {
	{
		IP_CT_DIR_ORIGINAL,
		"PORT",	sizeof("PORT") - 1, ' ', '\r',
		IP_CT_FTP_PORT,
		try_rfc959,
	},
	{
		IP_CT_DIR_REPLY,
		"227 ",	sizeof("227 ") - 1, '(', ')',
		IP_CT_FTP_PASV,
		try_rfc959,
	},
	{
		IP_CT_DIR_ORIGINAL,
		"EPRT", sizeof("EPRT") - 1, ' ', '\r',
		IP_CT_FTP_EPRT,
		try_eprt,
	},
	{
		IP_CT_DIR_REPLY,
		"229 ", sizeof("229 ") - 1, '(', ')',
		IP_CT_FTP_EPSV,
		try_epsv_response,
	},
};

static int try_number(const char *data, size_t dlen, u_int32_t array[],
		      int array_size, char sep, char term)
{
	u_int32_t i, len;

	memset(array, 0, sizeof(array[0])*array_size);

	/* Keep data pointing at next char. */
	for (i = 0, len = 0; len < dlen && i < array_size; len++, data++) {
		if (*data >= '0' && *data <= '9') {
			array[i] = array[i]*10 + *data - '0';
		}
		else if (*data == sep)
			i++;
		else {
			/* Unexpected character; true if it's the
			   terminator and we're finished. */
			if (*data == term && i == array_size - 1)
				return len;

			DEBUGP("Char %u (got %u nums) `%u' unexpected\n",
			       len, i, *data);
			return 0;
		}
	}
	DEBUGP("Failed to fill %u numbers separated by %c\n", array_size, sep);

	return 0;
}

/* Returns 0, or length of numbers: 192,168,1,1,5,6 */
static int try_rfc959(const char *data, size_t dlen, u_int32_t array[6],
		       char term)
{
	return try_number(data, dlen, array, 6, ',', term);
}

/* Grab port: number up to delimiter */
static int get_port(const char *data, int start, size_t dlen, char delim,
		    u_int32_t array[2])
{
	u_int16_t port = 0;
	int i;

	for (i = start; i < dlen; i++) {
		/* Finished? */
		if (data[i] == delim) {
			if (port == 0)
				break;
			array[0] = port >> 8;
			array[1] = port;
			return i + 1;
		}
		else if (data[i] >= '0' && data[i] <= '9')
			port = port*10 + data[i] - '0';
		else /* Some other crap */
			break;
	}
	return 0;
}

/* Returns 0, or length of numbers: |1|132.235.1.2|6275| */
static int try_eprt(const char *data, size_t dlen, u_int32_t array[6],
		    char term)
{
	char delim;
	int length;

	/* First character is delimiter, then "1" for IPv4, then
           delimiter again. */
	if (dlen <= 3) return 0;
	delim = data[0];
	if (isdigit(delim) || delim < 33 || delim > 126
	    || data[1] != '1' || data[2] != delim)
		return 0;

	DEBUGP("EPRT: Got |1|!\n");
	/* Now we have IP address. */
	length = try_number(data + 3, dlen - 3, array, 4, '.', delim);
	if (length == 0)
		return 0;

	DEBUGP("EPRT: Got IP address!\n");
	/* Start offset includes initial "|1|", and trailing delimiter */
	return get_port(data, 3 + length + 1, dlen, delim, array+4);
}

/* Returns 0, or length of numbers: |||6446| */
static int try_epsv_response(const char *data, size_t dlen, u_int32_t array[6],
			     char term)
{
	char delim;

	/* Three delimiters. */
	if (dlen <= 3) return 0;
	delim = data[0];
	if (isdigit(delim) || delim < 33 || delim > 126
	    || data[1] != delim || data[2] != delim)
		return 0;

	return get_port(data, 3, dlen, delim, array+4);
}

/* Return 1 for match, 0 for accept, -1 for partial. */
static int find_pattern(const char *data, size_t dlen,
			const char *pattern, size_t plen,
			char skip, char term,
			unsigned int *numoff,
			unsigned int *numlen,
			u_int32_t array[6],
			int (*getnum)(const char *, size_t, u_int32_t[], char))
{
	size_t i;

	DEBUGP("find_pattern `%s': dlen = %u\n", pattern, dlen);
	if (dlen == 0)
		return 0;

	if (dlen <= plen) {
		/* Short packet: try for partial? */
		if (strnicmp(data, pattern, dlen) == 0)
			return -1;
		else return 0;
	}

	if (strnicmp(data, pattern, plen) != 0) {
#if 0
		size_t i;

		DEBUGP("ftp: string mismatch\n");
		for (i = 0; i < plen; i++) {
			DEBUGP("ftp:char %u `%c'(%u) vs `%c'(%u)\n",
				i, data[i], data[i],
				pattern[i], pattern[i]);
		}
#endif
		return 0;
	}

	DEBUGP("Pattern matches!\n");
	/* Now we've found the constant string, try to skip
	   to the 'skip' character */
	for (i = plen; data[i] != skip; i++)
		if (i == dlen - 1) return -1;

	/* Skip over the last character */
	i++;

	DEBUGP("Skipped up to `%c'!\n", skip);

	*numoff = i;
	*numlen = getnum(data + i, dlen - i, array, term);
	if (!*numlen)
		return -1;

	DEBUGP("Match succeeded!\n");
	return 1;
}

/* Look up to see if we're just after a \n. */
static int find_nl_seq(u32 seq, const struct ip_ct_ftp_master *info, int dir)
{
	unsigned int i;

	for (i = 0; i < info->seq_aft_nl_num[dir]; i++)
		if (info->seq_aft_nl[dir][i] == seq)
			return 1;
	return 0;
}

/* We don't update if it's older than what we have. */
static void update_nl_seq(u32 nl_seq, struct ip_ct_ftp_master *info, int dir,
			  struct sk_buff *skb)
{
	unsigned int i, oldest = NUM_SEQ_TO_REMEMBER;

	/* Look for oldest: if we find exact match, we're done. */
	for (i = 0; i < info->seq_aft_nl_num[dir]; i++) {
		if (info->seq_aft_nl[dir][i] == nl_seq)
			return;

		if (oldest == info->seq_aft_nl_num[dir]
		    || before(info->seq_aft_nl[dir][i], oldest))
			oldest = i;
	}

	if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
		info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
		ip_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
	} else if (oldest != NUM_SEQ_TO_REMEMBER) {
		info->seq_aft_nl[dir][oldest] = nl_seq;
		ip_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
	}
}

static int help(struct sk_buff **pskb,
		struct ip_conntrack *ct,
		enum ip_conntrack_info ctinfo)
{
	unsigned int dataoff, datalen;
	struct tcphdr _tcph, *th;
	char *fb_ptr;
	int ret;
	u32 seq, array[6] = { 0 };
	int dir = CTINFO2DIR(ctinfo);
	unsigned int matchlen, matchoff;
	struct ip_ct_ftp_master *ct_ftp_info = &ct->help.ct_ftp_info;
	struct ip_conntrack_expect *exp;
	unsigned int i;
	int found = 0, ends_in_nl;

	/* Until there's been traffic both ways, don't look in packets. */
	if (ctinfo != IP_CT_ESTABLISHED
	    && ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY) {
		DEBUGP("ftp: Conntrackinfo = %u\n", ctinfo);
		return NF_ACCEPT;
	}

	th = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl*4,
				sizeof(_tcph), &_tcph);
	if (th == NULL)
		return NF_ACCEPT;

	dataoff = (*pskb)->nh.iph->ihl*4 + th->doff*4;
	/* No data? */
	if (dataoff >= (*pskb)->len) {
		DEBUGP("ftp: pskblen = %u\n", (*pskb)->len);
		return NF_ACCEPT;
	}
	datalen = (*pskb)->len - dataoff;

	spin_lock_bh(&ip_ftp_lock);
	fb_ptr = skb_header_pointer(*pskb, dataoff,
				    (*pskb)->len - dataoff, ftp_buffer);
	BUG_ON(fb_ptr == NULL);

	ends_in_nl = (fb_ptr[datalen - 1] == '\n');
	seq = ntohl(th->seq) + datalen;

	/* Look up to see if we're just after a \n. */
	if (!find_nl_seq(ntohl(th->seq), ct_ftp_info, dir)) {
		/* Now if this ends in \n, update ftp info. */
		DEBUGP("ip_conntrack_ftp_help: wrong seq pos %s(%u) or %s(%u)\n",
		       ct_ftp_info->seq_aft_nl[0][dir] 
		       old_seq_aft_nl_set ? "":"(UNSET) ", old_seq_aft_nl);
		ret = NF_ACCEPT;
		goto out_update_nl;
	}

	/* Initialize IP array to expected address (it's not mentioned
           in EPSV responses) */
	array[0] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 24) & 0xFF;
	array[1] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 16) & 0xFF;
	array[2] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 8) & 0xFF;
	array[3] = ntohl(ct->tuplehash[dir].tuple.src.ip) & 0xFF;

	for (i = 0; i < ARRAY_SIZE(search); i++) {
		if (search[i].dir != dir) continue;

		found = find_pattern(fb_ptr, (*pskb)->len - dataoff,
				     search[i].pattern,
				     search[i].plen,
				     search[i].skip,
				     search[i].term,
				     &matchoff, &matchlen,
				     array,
				     search[i].getnum);
		if (found) break;
	}
	if (found == -1) {
		/* We don't usually drop packets.  After all, this is
		   connection tracking, not packet filtering.
		   However, it is necessary for accurate tracking in
		   this case. */
		if (net_ratelimit())
			printk("conntrack_ftp: partial %s %u+%u\n",
			       search[i].pattern,
			       ntohl(th->seq), datalen);
		ret = NF_DROP;
		goto out;
	} else if (found == 0) { /* No match */
		ret = NF_ACCEPT;
		goto out_update_nl;
	}

	DEBUGP("conntrack_ftp: match `%s' (%u bytes at %u)\n",
	       fb_ptr + matchoff, matchlen, ntohl(th->seq) + matchoff);
			 
	/* Allocate expectation which will be inserted */
	exp = ip_conntrack_expect_alloc(ct);
	if (exp == NULL) {
		ret = NF_DROP;
		goto out;
	}

	/* We refer to the reverse direction ("!dir") tuples here,
	 * because we're expecting something in the other direction.
	 * Doesn't matter unless NAT is happening.  */
	exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;

	if (htonl((array[0] << 24) | (array[1] << 16) | (array[2] << 8) | array[3])
	    != ct->tuplehash[dir].tuple.src.ip) {
		/* Enrico Scholz's passive FTP to partially RNAT'd ftp
		   server: it really wants us to connect to a
		   different IP address.  Simply don't record it for
		   NAT. */
		DEBUGP("conntrack_ftp: NOT RECORDING: %u,%u,%u,%u != %u.%u.%u.%u\n",
		       array[0], array[1], array[2], array[3],
		       NIPQUAD(ct->tuplehash[dir].tuple.src.ip));

		/* Thanks to Cristiano Lincoln Mattos
		   <lincoln@cesar.org.br> for reporting this potential
		   problem (DMZ machines opening holes to internal
		   networks, or the packet filter itself). */
		if (!loose) {
			ret = NF_ACCEPT;
			goto out_put_expect;
		}
		exp->tuple.dst.ip = htonl((array[0] << 24) | (array[1] << 16)
					 | (array[2] << 8) | array[3]);
	}

	exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
	exp->tuple.dst.u.tcp.port = htons(array[4] << 8 | array[5]);
	exp->tuple.src.u.tcp.port = 0; /* Don't care. */
	exp->tuple.dst.protonum = IPPROTO_TCP;
	exp->mask = ((struct ip_conntrack_tuple)
		{ { 0xFFFFFFFF, { 0 } },
		  { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});

	exp->expectfn = NULL;
	exp->flags = 0;

	/* Now, NAT might want to mangle the packet, and register the
	 * (possibly changed) expectation itself. */
	if (ip_nat_ftp_hook)
		ret = ip_nat_ftp_hook(pskb, ctinfo, search[i].ftptype,
				      matchoff, matchlen, exp, &seq);
	else {
		/* Can't expect this?  Best to drop packet now. */
		if (ip_conntrack_expect_related(exp) != 0)
			ret = NF_DROP;
		else
			ret = NF_ACCEPT;
	}

out_put_expect:
	ip_conntrack_expect_put(exp);

out_update_nl:
	/* Now if this ends in \n, update ftp info.  Seq may have been
	 * adjusted by NAT code. */
	if (ends_in_nl)
		update_nl_seq(seq, ct_ftp_info,dir, *pskb);
 out:
	spin_unlock_bh(&ip_ftp_lock);
	return ret;
}

static struct ip_conntrack_helper ftp[MAX_PORTS];
static char ftp_names[MAX_PORTS][sizeof("ftp-65535")];

/* Not __exit: called from init() */
static void fini(void)
{
	int i;
	for (i = 0; i < ports_c; i++) {
		DEBUGP("ip_ct_ftp: unregistering helper for port %d\n",
				ports[i]);
		ip_conntrack_helper_unregister(&ftp[i]);
	}

	kfree(ftp_buffer);
}

static int __init init(void)
{
	int i, ret;
	char *tmpname;

	ftp_buffer = kmalloc(65536, GFP_KERNEL);
	if (!ftp_buffer)
		return -ENOMEM;

	if (ports_c == 0)
		ports[ports_c++] = FTP_PORT;

	for (i = 0; i < ports_c; i++) {
		ftp[i].tuple.src.u.tcp.port = htons(ports[i]);
		ftp[i].tuple.dst.protonum = IPPROTO_TCP;
		ftp[i].mask.src.u.tcp.port = 0xFFFF;
		ftp[i].mask.dst.protonum = 0xFF;
		ftp[i].max_expected = 1;
		ftp[i].timeout = 5 * 60; /* 5 minutes */
		ftp[i].me = THIS_MODULE;
		ftp[i].help = help;

		tmpname = &ftp_names[i][0];
		if (ports[i] == FTP_PORT)
			sprintf(tmpname, "ftp");
		else
			sprintf(tmpname, "ftp-%d", ports[i]);
		ftp[i].name = tmpname;

		DEBUGP("ip_ct_ftp: registering helper for port %d\n", 
				ports[i]);
		ret = ip_conntrack_helper_register(&ftp[i]);

		if (ret) {
			fini();
			return ret;
		}
	}
	return 0;
}

module_init(init);
module_exit(fini);
Commit	Line	Data
1da177e4 LT	1	/* FTP extension for IP connection tracking. */
	2
	3	/* (C) 1999-2001 Paul `Rusty' Russell
	4	* (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/config.h>
	12	#include <linux/module.h>
	13	#include <linux/netfilter.h>
	14	#include <linux/ip.h>
	15	#include <linux/ctype.h>
	16	#include <net/checksum.h>
	17	#include <net/tcp.h>
	18
1da177e4 LT	19	#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
	20	#include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
	21	#include <linux/moduleparam.h>
	22
	23	MODULE_LICENSE("GPL");
	24	MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
	25	MODULE_DESCRIPTION("ftp connection tracking helper");
	26
	27	/* This is slow, but it's simple. --RR */
2669d63d	28	static char *ftp_buffer;
e45b1be8	29	static DEFINE_SPINLOCK(ip_ftp_lock);
1da177e4 LT	30
1da177e4 LT	31	#define MAX_PORTS 8
5cb30640	32	static short ports[MAX_PORTS];
1da177e4	33	static int ports_c;
5cb30640	34	module_param_array(ports, short, &ports_c, 0400);
1da177e4 LT	35
	36	static int loose;
	37	module_param(loose, int, 0600);
	38
	39	unsigned int (ip_nat_ftp_hook)(struct sk_buff *pskb,
	40	enum ip_conntrack_info ctinfo,
	41	enum ip_ct_ftp_type type,
	42	unsigned int matchoff,
	43	unsigned int matchlen,
	44	struct ip_conntrack_expect *exp,
	45	u32 *seq);
	46	EXPORT_SYMBOL_GPL(ip_nat_ftp_hook);
	47
	48	#if 0
	49	#define DEBUGP printk
	50	#else
	51	#define DEBUGP(format, args...)
	52	#endif
	53
	54	static int try_rfc959(const char *, size_t, u_int32_t [], char);
	55	static int try_eprt(const char *, size_t, u_int32_t [], char);
	56	static int try_epsv_response(const char *, size_t, u_int32_t [], char);
	57
	58	static struct ftp_search {
	59	enum ip_conntrack_dir dir;
	60	const char *pattern;
	61	size_t plen;
	62	char skip;
	63	char term;
	64	enum ip_ct_ftp_type ftptype;
	65	int (getnum)(const char , size_t, u_int32_t[], char);
	66	} search[] = {
	67	{
	68	IP_CT_DIR_ORIGINAL,
	69	"PORT", sizeof("PORT") - 1, ' ', '\r',
	70	IP_CT_FTP_PORT,
	71	try_rfc959,
	72	},
	73	{
	74	IP_CT_DIR_REPLY,
	75	"227 ", sizeof("227 ") - 1, '(', ')',
	76	IP_CT_FTP_PASV,
	77	try_rfc959,
	78	},
	79	{
	80	IP_CT_DIR_ORIGINAL,
	81	"EPRT", sizeof("EPRT") - 1, ' ', '\r',
	82	IP_CT_FTP_EPRT,
	83	try_eprt,
	84	},
	85	{
	86	IP_CT_DIR_REPLY,
	87	"229 ", sizeof("229 ") - 1, '(', ')',
	88	IP_CT_FTP_EPSV,
	89	try_epsv_response,
	90	},
	91	};
	92
	93	static int try_number(const char *data, size_t dlen, u_int32_t array[],
	94	int array_size, char sep, char term)
	95	{
	96	u_int32_t i, len;
	97
	98	memset(array, 0, sizeof(array[0])*array_size);
99
100	/* Keep data pointing at next char. */
101	for (i = 0, len = 0; len < dlen && i < array_size; len++, data++) {
102	if (data >= '0' && data <= '9') {
103	array[i] = array[i]10 + data - '0';
104	}
105	else if (*data == sep)
106	i++;
107	else {
108	/* Unexpected character; true if it's the
109	terminator and we're finished. */
110	if (*data == term && i == array_size - 1)
111	return len;
112
113	DEBUGP("Char %u (got %u nums) `%u' unexpected\n",
114	len, i, *data);
115	return 0;
116	}
117	}
118	DEBUGP("Failed to fill %u numbers separated by %c\n", array_size, sep);
119
120	return 0;
121	}
122
123	/* Returns 0, or length of numbers: 192,168,1,1,5,6 */
124	static int try_rfc959(const char *data, size_t dlen, u_int32_t array[6],
125	char term)
126	{
127	return try_number(data, dlen, array, 6, ',', term);
128	}
129
130	/* Grab port: number up to delimiter */
131	static int get_port(const char *data, int start, size_t dlen, char delim,
132	u_int32_t array[2])
133	{
134	u_int16_t port = 0;
135	int i;
136
137	for (i = start; i < dlen; i++) {
138	/* Finished? */
139	if (data[i] == delim) {
140	if (port == 0)
141	break;
142	array[0] = port >> 8;
143	array[1] = port;
144	return i + 1;
145	}
146	else if (data[i] >= '0' && data[i] <= '9')
147	port = port*10 + data[i] - '0';
148	else /* Some other crap */
149	break;
150	}
151	return 0;
152	}
153
154	/* Returns 0, or length of numbers: \|1\|132.235.1.2\|6275\| */
155	static int try_eprt(const char *data, size_t dlen, u_int32_t array[6],
156	char term)
157	{
158	char delim;
159	int length;
160
161	/* First character is delimiter, then "1" for IPv4, then
162	delimiter again. */
163	if (dlen <= 3) return 0;
164	delim = data[0];
165	if (isdigit(delim) \|\| delim < 33 \|\| delim > 126
166	\|\| data[1] != '1' \|\| data[2] != delim)
167	return 0;
168
169	DEBUGP("EPRT: Got \|1\|!\n");
170	/* Now we have IP address. */
171	length = try_number(data + 3, dlen - 3, array, 4, '.', delim);
172	if (length == 0)
173	return 0;
174
175	DEBUGP("EPRT: Got IP address!\n");
176	/* Start offset includes initial "\|1\|", and trailing delimiter */
177	return get_port(data, 3 + length + 1, dlen, delim, array+4);
178	}
179
180	/* Returns 0, or length of numbers: \|\|\|6446\| */
181	static int try_epsv_response(const char *data, size_t dlen, u_int32_t array[6],
182	char term)
183	{
184	char delim;
185
186	/* Three delimiters. */
187	if (dlen <= 3) return 0;
188	delim = data[0];
189	if (isdigit(delim) \|\| delim < 33 \|\| delim > 126
190	\|\| data[1] != delim \|\| data[2] != delim)
191	return 0;
192
193	return get_port(data, 3, dlen, delim, array+4);
194	}
195
196	/* Return 1 for match, 0 for accept, -1 for partial. */
197	static int find_pattern(const char *data, size_t dlen,
198	const char *pattern, size_t plen,
199	char skip, char term,
200	unsigned int *numoff,
201	unsigned int *numlen,
202	u_int32_t array[6],
203	int (getnum)(const char , size_t, u_int32_t[], char))
204	{
205	size_t i;
206
207	DEBUGP("find_pattern `%s': dlen = %u\n", pattern, dlen);
208	if (dlen == 0)
209	return 0;
210
211	if (dlen <= plen) {
212	/* Short packet: try for partial? */
213	if (strnicmp(data, pattern, dlen) == 0)
214	return -1;
215	else return 0;
216	}
217
218	if (strnicmp(data, pattern, plen) != 0) {
219	#if 0
220	size_t i;
221
222	DEBUGP("ftp: string mismatch\n");
223	for (i = 0; i < plen; i++) {
224	DEBUGP("ftp:char %u `%c'(%u) vs `%c'(%u)\n",
225	i, data[i], data[i],
226	pattern[i], pattern[i]);
227	}
228	#endif
229	return 0;
230	}
231
232	DEBUGP("Pattern matches!\n");
233	/* Now we've found the constant string, try to skip
234	to the 'skip' character */
235	for (i = plen; data[i] != skip; i++)
236	if (i == dlen - 1) return -1;
237
238	/* Skip over the last character */
239	i++;
240
241	DEBUGP("Skipped up to `%c'!\n", skip);
242
243	*numoff = i;
244	*numlen = getnum(data + i, dlen - i, array, term);
245	if (!*numlen)
246	return -1;
247
248	DEBUGP("Match succeeded!\n");
249	return 1;
250	}
251
252	/* Look up to see if we're just after a \n. */
f649a3bf	253	static int find_nl_seq(u32 seq, const struct ip_ct_ftp_master *info, int dir)
1da177e4 LT	254	{
	255	unsigned int i;
	256
	257	for (i = 0; i < info->seq_aft_nl_num[dir]; i++)
	258	if (info->seq_aft_nl[dir][i] == seq)
	259	return 1;
	260	return 0;
	261	}
	262
	263	/* We don't update if it's older than what we have. */
ac3247ba HW	264	static void update_nl_seq(u32 nl_seq, struct ip_ct_ftp_master *info, int dir,
ac3247ba HW	265	struct sk_buff *skb)
1da177e4 LT	266	{
	267	unsigned int i, oldest = NUM_SEQ_TO_REMEMBER;
	268
	269	/* Look for oldest: if we find exact match, we're done. */
	270	for (i = 0; i < info->seq_aft_nl_num[dir]; i++) {
	271	if (info->seq_aft_nl[dir][i] == nl_seq)
	272	return;
	273
	274	if (oldest == info->seq_aft_nl_num[dir]
	275	\|\| before(info->seq_aft_nl[dir][i], oldest))
	276	oldest = i;
	277	}
	278
ac3247ba	279	if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
1da177e4	280	info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
ac3247ba HW	281	ip_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
ac3247ba HW	282	} else if (oldest != NUM_SEQ_TO_REMEMBER) {
1da177e4	283	info->seq_aft_nl[dir][oldest] = nl_seq;
ac3247ba HW	284	ip_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
ac3247ba HW	285	}
1da177e4 LT	286	}
	287
	288	static int help(struct sk_buff **pskb,
	289	struct ip_conntrack *ct,
	290	enum ip_conntrack_info ctinfo)
	291	{
	292	unsigned int dataoff, datalen;
	293	struct tcphdr _tcph, *th;
	294	char *fb_ptr;
	295	int ret;
	296	u32 seq, array[6] = { 0 };
	297	int dir = CTINFO2DIR(ctinfo);
	298	unsigned int matchlen, matchoff;
	299	struct ip_ct_ftp_master *ct_ftp_info = &ct->help.ct_ftp_info;
	300	struct ip_conntrack_expect *exp;
	301	unsigned int i;
	302	int found = 0, ends_in_nl;
	303
	304	/* Until there's been traffic both ways, don't look in packets. */
	305	if (ctinfo != IP_CT_ESTABLISHED
	306	&& ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY) {
	307	DEBUGP("ftp: Conntrackinfo = %u\n", ctinfo);
	308	return NF_ACCEPT;
	309	}
	310
	311	th = skb_header_pointer(pskb, (pskb)->nh.iph->ihl*4,
	312	sizeof(_tcph), &_tcph);
	313	if (th == NULL)
	314	return NF_ACCEPT;
	315
	316	dataoff = (pskb)->nh.iph->ihl4 + th->doff*4;
	317	/* No data? */
	318	if (dataoff >= (*pskb)->len) {
	319	DEBUGP("ftp: pskblen = %u\n", (*pskb)->len);
	320	return NF_ACCEPT;
	321	}
	322	datalen = (*pskb)->len - dataoff;
	323
e45b1be8	324	spin_lock_bh(&ip_ftp_lock);
1da177e4 LT	325	fb_ptr = skb_header_pointer(*pskb, dataoff,
	326	(*pskb)->len - dataoff, ftp_buffer);
	327	BUG_ON(fb_ptr == NULL);
	328
	329	ends_in_nl = (fb_ptr[datalen - 1] == '\n');
	330	seq = ntohl(th->seq) + datalen;
	331
	332	/* Look up to see if we're just after a \n. */
	333	if (!find_nl_seq(ntohl(th->seq), ct_ftp_info, dir)) {
	334	/* Now if this ends in \n, update ftp info. */
	335	DEBUGP("ip_conntrack_ftp_help: wrong seq pos %s(%u) or %s(%u)\n",
	336	ct_ftp_info->seq_aft_nl[0][dir]
	337	old_seq_aft_nl_set ? "":"(UNSET) ", old_seq_aft_nl);
	338	ret = NF_ACCEPT;
	339	goto out_update_nl;
	340	}
	341
	342	/* Initialize IP array to expected address (it's not mentioned
	343	in EPSV responses) */
	344	array[0] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 24) & 0xFF;
	345	array[1] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 16) & 0xFF;
	346	array[2] = (ntohl(ct->tuplehash[dir].tuple.src.ip) >> 8) & 0xFF;
	347	array[3] = ntohl(ct->tuplehash[dir].tuple.src.ip) & 0xFF;
	348
	349	for (i = 0; i < ARRAY_SIZE(search); i++) {
	350	if (search[i].dir != dir) continue;
	351
	352	found = find_pattern(fb_ptr, (*pskb)->len - dataoff,
	353	search[i].pattern,
	354	search[i].plen,
	355	search[i].skip,
	356	search[i].term,
	357	&matchoff, &matchlen,
	358	array,
	359	search[i].getnum);
	360	if (found) break;
	361	}
	362	if (found == -1) {
	363	/* We don't usually drop packets. After all, this is
	364	connection tracking, not packet filtering.
	365	However, it is necessary for accurate tracking in
	366	this case. */
	367	if (net_ratelimit())
	368	printk("conntrack_ftp: partial %s %u+%u\n",
	369	search[i].pattern,
	370	ntohl(th->seq), datalen);
	371	ret = NF_DROP;
	372	goto out;
	373	} else if (found == 0) { /* No match */
	374	ret = NF_ACCEPT;
	375	goto out_update_nl;
	376	}
	377
	378	DEBUGP("conntrack_ftp: match `%s' (%u bytes at %u)\n",
	379	fb_ptr + matchoff, matchlen, ntohl(th->seq) + matchoff);
	380
	381	/* Allocate expectation which will be inserted */
4acdbdbe	382	exp = ip_conntrack_expect_alloc(ct);
1da177e4 LT	383	if (exp == NULL) {
	384	ret = NF_DROP;
	385	goto out;
	386	}
	387
	388	/* We refer to the reverse direction ("!dir") tuples here,
	389	* because we're expecting something in the other direction.
	390	* Doesn't matter unless NAT is happening. */
	391	exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
	392
	393	if (htonl((array[0] << 24) \| (array[1] << 16) \| (array[2] << 8) \| array[3])
	394	!= ct->tuplehash[dir].tuple.src.ip) {
	395	/* Enrico Scholz's passive FTP to partially RNAT'd ftp
	396	server: it really wants us to connect to a
	397	different IP address. Simply don't record it for
	398	NAT. */
	399	DEBUGP("conntrack_ftp: NOT RECORDING: %u,%u,%u,%u != %u.%u.%u.%u\n",
	400	array[0], array[1], array[2], array[3],
	401	NIPQUAD(ct->tuplehash[dir].tuple.src.ip));
	402
	403	/* Thanks to Cristiano Lincoln Mattos
	404	<lincoln@cesar.org.br> for reporting this potential
	405	problem (DMZ machines opening holes to internal
	406	networks, or the packet filter itself). */
	407	if (!loose) {
	408	ret = NF_ACCEPT;
4acdbdbe	409	goto out_put_expect;
1da177e4 LT	410	}
	411	exp->tuple.dst.ip = htonl((array[0] << 24) \| (array[1] << 16)
	412	\| (array[2] << 8) \| array[3]);
	413	}
	414
	415	exp->tuple.src.ip = ct->tuplehash[!dir].tuple.src.ip;
	416	exp->tuple.dst.u.tcp.port = htons(array[4] << 8 \| array[5]);
	417	exp->tuple.src.u.tcp.port = 0; /* Don't care. */
	418	exp->tuple.dst.protonum = IPPROTO_TCP;
	419	exp->mask = ((struct ip_conntrack_tuple)
	420	{ { 0xFFFFFFFF, { 0 } },
	421	{ 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});
	422
	423	exp->expectfn = NULL;
2248bcfc	424	exp->flags = 0;
1da177e4 LT	425
	426	/* Now, NAT might want to mangle the packet, and register the
	427	* (possibly changed) expectation itself. */
	428	if (ip_nat_ftp_hook)
	429	ret = ip_nat_ftp_hook(pskb, ctinfo, search[i].ftptype,
	430	matchoff, matchlen, exp, &seq);
	431	else {
	432	/* Can't expect this? Best to drop packet now. */
4acdbdbe	433	if (ip_conntrack_expect_related(exp) != 0)
1da177e4	434	ret = NF_DROP;
4acdbdbe	435	else
1da177e4 LT	436	ret = NF_ACCEPT;
	437	}
	438
4acdbdbe RR	439	out_put_expect:
	440	ip_conntrack_expect_put(exp);
	441
1da177e4 LT	442	out_update_nl:
	443	/* Now if this ends in \n, update ftp info. Seq may have been
	444	* adjusted by NAT code. */
	445	if (ends_in_nl)
ac3247ba	446	update_nl_seq(seq, ct_ftp_info,dir, *pskb);
1da177e4	447	out:
e45b1be8	448	spin_unlock_bh(&ip_ftp_lock);
1da177e4 LT	449	return ret;
	450	}
	451
	452	static struct ip_conntrack_helper ftp[MAX_PORTS];
5cb30640	453	static char ftp_names[MAX_PORTS][sizeof("ftp-65535")];
1da177e4 LT	454
	455	/* Not __exit: called from init() */
	456	static void fini(void)
	457	{
	458	int i;
	459	for (i = 0; i < ports_c; i++) {
	460	DEBUGP("ip_ct_ftp: unregistering helper for port %d\n",
	461	ports[i]);
	462	ip_conntrack_helper_unregister(&ftp[i]);
	463	}
2669d63d HW	464
2669d63d HW	465	kfree(ftp_buffer);
1da177e4 LT	466	}
	467
	468	static int __init init(void)
	469	{
	470	int i, ret;
	471	char *tmpname;
	472
2669d63d HW	473	ftp_buffer = kmalloc(65536, GFP_KERNEL);
	474	if (!ftp_buffer)
	475	return -ENOMEM;
	476
1da177e4 LT	477	if (ports_c == 0)
	478	ports[ports_c++] = FTP_PORT;
	479
	480	for (i = 0; i < ports_c; i++) {
	481	ftp[i].tuple.src.u.tcp.port = htons(ports[i]);
	482	ftp[i].tuple.dst.protonum = IPPROTO_TCP;
	483	ftp[i].mask.src.u.tcp.port = 0xFFFF;
	484	ftp[i].mask.dst.protonum = 0xFF;
	485	ftp[i].max_expected = 1;
	486	ftp[i].timeout = 5 * 60; /* 5 minutes */
	487	ftp[i].me = THIS_MODULE;
	488	ftp[i].help = help;
	489
	490	tmpname = &ftp_names[i][0];
	491	if (ports[i] == FTP_PORT)
	492	sprintf(tmpname, "ftp");
	493	else
	494	sprintf(tmpname, "ftp-%d", ports[i]);
	495	ftp[i].name = tmpname;
	496
	497	DEBUGP("ip_ct_ftp: registering helper for port %d\n",
	498	ports[i]);
	499	ret = ip_conntrack_helper_register(&ftp[i]);
	500
	501	if (ret) {
	502	fini();
	503	return ret;
	504	}
	505	}
	506	return 0;
	507	}
	508
	509	module_init(init);
	510	module_exit(fini);