[linux-block.git] / net / ipv4 / netfilter / nf_conntrack_l3proto_ipv4.c


/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/types.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/icmp.h>
#include <linux/sysctl.h>
#include <net/route.h>
#include <net/ip.h>

#include <linux/netfilter_ipv4.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_l3proto.h>
#include <net/netfilter/nf_conntrack_zones.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
#include <net/netfilter/nf_nat_helper.h>
#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
#include <net/netfilter/nf_log.h>

int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
			      struct nf_conn *ct,
			      enum ip_conntrack_info ctinfo);
EXPORT_SYMBOL_GPL(nf_nat_seq_adjust_hook);

static bool ipv4_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
			      struct nf_conntrack_tuple *tuple)
{
	const __be32 *ap;
	__be32 _addrs[2];
	ap = skb_header_pointer(skb, nhoff + offsetof(struct iphdr, saddr),
				sizeof(u_int32_t) * 2, _addrs);
	if (ap == NULL)
		return false;

	tuple->src.u3.ip = ap[0];
	tuple->dst.u3.ip = ap[1];

	return true;
}

static bool ipv4_invert_tuple(struct nf_conntrack_tuple *tuple,
			      const struct nf_conntrack_tuple *orig)
{
	tuple->src.u3.ip = orig->dst.u3.ip;
	tuple->dst.u3.ip = orig->src.u3.ip;

	return true;
}

static int ipv4_print_tuple(struct seq_file *s,
			    const struct nf_conntrack_tuple *tuple)
{
	return seq_printf(s, "src=%pI4 dst=%pI4 ",
			  &tuple->src.u3.ip, &tuple->dst.u3.ip);
}

static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
			    unsigned int *dataoff, u_int8_t *protonum)
{
	const struct iphdr *iph;
	struct iphdr _iph;

	iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
	if (iph == NULL)
		return -NF_ACCEPT;

	/* Conntrack defragments packets, we might still see fragments
	 * inside ICMP packets though. */
	if (iph->frag_off & htons(IP_OFFSET))
		return -NF_ACCEPT;

	*dataoff = nhoff + (iph->ihl << 2);
	*protonum = iph->protocol;

	/* Check bogus IP headers */
	if (*dataoff > skb->len) {
		pr_debug("nf_conntrack_ipv4: bogus IPv4 packet: "
			 "nhoff %u, ihl %u, skblen %u\n",
			 nhoff, iph->ihl << 2, skb->len);
		return -NF_ACCEPT;
	}

	return NF_ACCEPT;
}

static unsigned int ipv4_confirm(unsigned int hooknum,
				 struct sk_buff *skb,
				 const struct net_device *in,
				 const struct net_device *out,
				 int (*okfn)(struct sk_buff *))
{
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	const struct nf_conn_help *help;
	const struct nf_conntrack_helper *helper;
	unsigned int ret;

	/* This is where we call the helper: as the packet goes out. */
	ct = nf_ct_get(skb, &ctinfo);
	if (!ct || ctinfo == IP_CT_RELATED_REPLY)
		goto out;

	help = nfct_help(ct);
	if (!help)
		goto out;

	/* rcu_read_lock()ed by nf_hook_slow */
	helper = rcu_dereference(help->helper);
	if (!helper)
		goto out;

	ret = helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),
			   ct, ctinfo);
	if (ret != NF_ACCEPT) {
		nf_log_packet(NFPROTO_IPV4, hooknum, skb, in, out, NULL,
			      "nf_ct_%s: dropping packet", helper->name);
		return ret;
	}

	/* adjust seqs for loopback traffic only in outgoing direction */
	if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
	    !nf_is_loopback_packet(skb)) {
		typeof(nf_nat_seq_adjust_hook) seq_adjust;

		seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
		if (!seq_adjust || !seq_adjust(skb, ct, ctinfo)) {
			NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
			return NF_DROP;
		}
	}
out:
	/* We've seen it coming out the other side: confirm it */
	return nf_conntrack_confirm(skb);
}

static unsigned int ipv4_conntrack_in(unsigned int hooknum,
				      struct sk_buff *skb,
				      const struct net_device *in,
				      const struct net_device *out,
				      int (*okfn)(struct sk_buff *))
{
	return nf_conntrack_in(dev_net(in), PF_INET, hooknum, skb);
}

static unsigned int ipv4_conntrack_local(unsigned int hooknum,
					 struct sk_buff *skb,
					 const struct net_device *in,
					 const struct net_device *out,
					 int (*okfn)(struct sk_buff *))
{
	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr) ||
	    ip_hdrlen(skb) < sizeof(struct iphdr))
		return NF_ACCEPT;
	return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb);
}

/* Connection tracking may drop packets, but never alters them, so
   make it the first hook. */
static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
	{
		.hook		= ipv4_conntrack_in,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_PRE_ROUTING,
		.priority	= NF_IP_PRI_CONNTRACK,
	},
	{
		.hook		= ipv4_conntrack_local,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_OUT,
		.priority	= NF_IP_PRI_CONNTRACK,
	},
	{
		.hook		= ipv4_confirm,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_POST_ROUTING,
		.priority	= NF_IP_PRI_CONNTRACK_CONFIRM,
	},
	{
		.hook		= ipv4_confirm,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_IN,
		.priority	= NF_IP_PRI_CONNTRACK_CONFIRM,
	},
};

#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
static int log_invalid_proto_min = 0;
static int log_invalid_proto_max = 255;

static ctl_table ip_ct_sysctl_table[] = {
	{
		.procname	= "ip_conntrack_max",
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
	{
		.procname	= "ip_conntrack_count",
		.maxlen		= sizeof(int),
		.mode		= 0444,
		.proc_handler	= proc_dointvec,
	},
	{
		.procname	= "ip_conntrack_buckets",
		.maxlen		= sizeof(unsigned int),
		.mode		= 0444,
		.proc_handler	= proc_dointvec,
	},
	{
		.procname	= "ip_conntrack_checksum",
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
	{
		.procname	= "ip_conntrack_log_invalid",
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_minmax,
		.extra1		= &log_invalid_proto_min,
		.extra2		= &log_invalid_proto_max,
	},
	{ }
};
#endif /* CONFIG_SYSCTL && CONFIG_NF_CONNTRACK_PROC_COMPAT */

/* Fast function for those who don't want to parse /proc (and I don't
   blame them). */
/* Reversing the socket's dst/src point of view gives us the reply
   mapping. */
static int
getorigdst(struct sock *sk, int optval, void __user *user, int *len)
{
	const struct inet_sock *inet = inet_sk(sk);
	const struct nf_conntrack_tuple_hash *h;
	struct nf_conntrack_tuple tuple;

	memset(&tuple, 0, sizeof(tuple));
	tuple.src.u3.ip = inet->inet_rcv_saddr;
	tuple.src.u.tcp.port = inet->inet_sport;
	tuple.dst.u3.ip = inet->inet_daddr;
	tuple.dst.u.tcp.port = inet->inet_dport;
	tuple.src.l3num = PF_INET;
	tuple.dst.protonum = sk->sk_protocol;

	/* We only do TCP and SCTP at the moment: is there a better way? */
	if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) {
		pr_debug("SO_ORIGINAL_DST: Not a TCP/SCTP socket\n");
		return -ENOPROTOOPT;
	}

	if ((unsigned int) *len < sizeof(struct sockaddr_in)) {
		pr_debug("SO_ORIGINAL_DST: len %d not %Zu\n",
			 *len, sizeof(struct sockaddr_in));
		return -EINVAL;
	}

	h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);
	if (h) {
		struct sockaddr_in sin;
		struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);

		sin.sin_family = AF_INET;
		sin.sin_port = ct->tuplehash[IP_CT_DIR_ORIGINAL]
			.tuple.dst.u.tcp.port;
		sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
			.tuple.dst.u3.ip;
		memset(sin.sin_zero, 0, sizeof(sin.sin_zero));

		pr_debug("SO_ORIGINAL_DST: %pI4 %u\n",
			 &sin.sin_addr.s_addr, ntohs(sin.sin_port));
		nf_ct_put(ct);
		if (copy_to_user(user, &sin, sizeof(sin)) != 0)
			return -EFAULT;
		else
			return 0;
	}
	pr_debug("SO_ORIGINAL_DST: Can't find %pI4/%u-%pI4/%u.\n",
		 &tuple.src.u3.ip, ntohs(tuple.src.u.tcp.port),
		 &tuple.dst.u3.ip, ntohs(tuple.dst.u.tcp.port));
	return -ENOENT;
}

#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)

#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_conntrack.h>

static int ipv4_tuple_to_nlattr(struct sk_buff *skb,
				const struct nf_conntrack_tuple *tuple)
{
	if (nla_put_be32(skb, CTA_IP_V4_SRC, tuple->src.u3.ip) ||
	    nla_put_be32(skb, CTA_IP_V4_DST, tuple->dst.u3.ip))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static const struct nla_policy ipv4_nla_policy[CTA_IP_MAX+1] = {
	[CTA_IP_V4_SRC]	= { .type = NLA_U32 },
	[CTA_IP_V4_DST]	= { .type = NLA_U32 },
};

static int ipv4_nlattr_to_tuple(struct nlattr *tb[],
				struct nf_conntrack_tuple *t)
{
	if (!tb[CTA_IP_V4_SRC] || !tb[CTA_IP_V4_DST])
		return -EINVAL;

	t->src.u3.ip = nla_get_be32(tb[CTA_IP_V4_SRC]);
	t->dst.u3.ip = nla_get_be32(tb[CTA_IP_V4_DST]);

	return 0;
}

static int ipv4_nlattr_tuple_size(void)
{
	return nla_policy_len(ipv4_nla_policy, CTA_IP_MAX + 1);
}
#endif

static struct nf_sockopt_ops so_getorigdst = {
	.pf		= PF_INET,
	.get_optmin	= SO_ORIGINAL_DST,
	.get_optmax	= SO_ORIGINAL_DST+1,
	.get		= &getorigdst,
	.owner		= THIS_MODULE,
};

static int ipv4_init_net(struct net *net)
{
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
	struct nf_ip_net *in = &net->ct.nf_ct_proto;
	in->ctl_table = kmemdup(ip_ct_sysctl_table,
				sizeof(ip_ct_sysctl_table),
				GFP_KERNEL);
	if (!in->ctl_table)
		return -ENOMEM;

	in->ctl_table[0].data = &nf_conntrack_max;
	in->ctl_table[1].data = &net->ct.count;
	in->ctl_table[2].data = &net->ct.htable_size;
	in->ctl_table[3].data = &net->ct.sysctl_checksum;
	in->ctl_table[4].data = &net->ct.sysctl_log_invalid;
#endif
	return 0;
}

struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
	.l3proto	 = PF_INET,
	.name		 = "ipv4",
	.pkt_to_tuple	 = ipv4_pkt_to_tuple,
	.invert_tuple	 = ipv4_invert_tuple,
	.print_tuple	 = ipv4_print_tuple,
	.get_l4proto	 = ipv4_get_l4proto,
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
	.tuple_to_nlattr = ipv4_tuple_to_nlattr,
	.nlattr_tuple_size = ipv4_nlattr_tuple_size,
	.nlattr_to_tuple = ipv4_nlattr_to_tuple,
	.nla_policy	 = ipv4_nla_policy,
#endif
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
	.ctl_table_path  = "net/ipv4/netfilter",
#endif
	.init_net	 = ipv4_init_net,
	.me		 = THIS_MODULE,
};

module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,
		  &nf_conntrack_htable_size, 0600);

MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET));
MODULE_ALIAS("ip_conntrack");
MODULE_LICENSE("GPL");

static int ipv4_net_init(struct net *net)
{
	int ret = 0;

	ret = nf_conntrack_l4proto_register(net,
					    &nf_conntrack_l4proto_tcp4);
	if (ret < 0) {
		pr_err("nf_conntrack_l4proto_tcp4 :protocol register failed\n");
		goto out_tcp;
	}
	ret = nf_conntrack_l4proto_register(net,
					    &nf_conntrack_l4proto_udp4);
	if (ret < 0) {
		pr_err("nf_conntrack_l4proto_udp4 :protocol register failed\n");
		goto out_udp;
	}
	ret = nf_conntrack_l4proto_register(net,
					    &nf_conntrack_l4proto_icmp);
	if (ret < 0) {
		pr_err("nf_conntrack_l4proto_icmp4 :protocol register failed\n");
		goto out_icmp;
	}
	ret = nf_conntrack_l3proto_register(net,
					    &nf_conntrack_l3proto_ipv4);
	if (ret < 0) {
		pr_err("nf_conntrack_l3proto_ipv4 :protocol register failed\n");
		goto out_ipv4;
	}
	return 0;
out_ipv4:
	nf_conntrack_l4proto_unregister(net,
					&nf_conntrack_l4proto_icmp);
out_icmp:
	nf_conntrack_l4proto_unregister(net,
					&nf_conntrack_l4proto_udp4);
out_udp:
	nf_conntrack_l4proto_unregister(net,
					&nf_conntrack_l4proto_tcp4);
out_tcp:
	return ret;
}

static void ipv4_net_exit(struct net *net)
{
	nf_conntrack_l3proto_unregister(net,
					&nf_conntrack_l3proto_ipv4);
	nf_conntrack_l4proto_unregister(net,
					&nf_conntrack_l4proto_icmp);
	nf_conntrack_l4proto_unregister(net,
					&nf_conntrack_l4proto_udp4);
	nf_conntrack_l4proto_unregister(net,
					&nf_conntrack_l4proto_tcp4);
}

static struct pernet_operations ipv4_net_ops = {
	.init = ipv4_net_init,
	.exit = ipv4_net_exit,
};

static int __init nf_conntrack_l3proto_ipv4_init(void)
{
	int ret = 0;

	need_conntrack();
	nf_defrag_ipv4_enable();

	ret = nf_register_sockopt(&so_getorigdst);
	if (ret < 0) {
		printk(KERN_ERR "Unable to register netfilter socket option\n");
		return ret;
	}

	ret = register_pernet_subsys(&ipv4_net_ops);
	if (ret < 0) {
		pr_err("nf_conntrack_ipv4: can't register pernet ops\n");
		goto cleanup_sockopt;
	}

	ret = nf_register_hooks(ipv4_conntrack_ops,
				ARRAY_SIZE(ipv4_conntrack_ops));
	if (ret < 0) {
		pr_err("nf_conntrack_ipv4: can't register hooks.\n");
		goto cleanup_pernet;
	}
#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
	ret = nf_conntrack_ipv4_compat_init();
	if (ret < 0)
		goto cleanup_hooks;
#endif
	return ret;
#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
 cleanup_hooks:
	nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
#endif
 cleanup_pernet:
	unregister_pernet_subsys(&ipv4_net_ops);
 cleanup_sockopt:
	nf_unregister_sockopt(&so_getorigdst);
	return ret;
}

static void __exit nf_conntrack_l3proto_ipv4_fini(void)
{
	synchronize_net();
#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
	nf_conntrack_ipv4_compat_fini();
#endif
	nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
	unregister_pernet_subsys(&ipv4_net_ops);
	nf_unregister_sockopt(&so_getorigdst);
}

module_init(nf_conntrack_l3proto_ipv4_init);
module_exit(nf_conntrack_l3proto_ipv4_fini);

void need_ipv4_conntrack(void)
{
	return;
}
EXPORT_SYMBOL_GPL(need_ipv4_conntrack);
Commit	Line	Data
73e4022f	1
9fb9cbb1 YK	2	/* (C) 1999-2001 Paul `Rusty' Russell
	3	* (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
9fb9cbb1 YK	8	*/
9fb9cbb1 YK	9
9fb9cbb1 YK	10	#include <linux/types.h>
	11	#include <linux/ip.h>
	12	#include <linux/netfilter.h>
	13	#include <linux/module.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/icmp.h>
	16	#include <linux/sysctl.h>
0ae2cfe7	17	#include <net/route.h>
9fb9cbb1 YK	18	#include <net/ip.h>
	19
	20	#include <linux/netfilter_ipv4.h>
	21	#include <net/netfilter/nf_conntrack.h>
	22	#include <net/netfilter/nf_conntrack_helper.h>
605dcad6	23	#include <net/netfilter/nf_conntrack_l4proto.h>
9fb9cbb1	24	#include <net/netfilter/nf_conntrack_l3proto.h>
5d0aa2cc	25	#include <net/netfilter/nf_conntrack_zones.h>
9fb9cbb1 YK	26	#include <net/netfilter/nf_conntrack_core.h>
9fb9cbb1 YK	27	#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
dd13b010	28	#include <net/netfilter/nf_nat_helper.h>
73e4022f	29	#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
74f7a655	30	#include <net/netfilter/nf_log.h>
dd13b010 PM	31
	32	int (nf_nat_seq_adjust_hook)(struct sk_buff skb,
	33	struct nf_conn *ct,
	34	enum ip_conntrack_info ctinfo);
	35	EXPORT_SYMBOL_GPL(nf_nat_seq_adjust_hook);
9fb9cbb1	36
8ce8439a JE	37	static bool ipv4_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
8ce8439a JE	38	struct nf_conntrack_tuple *tuple)
9fb9cbb1	39	{
32948588 JE	40	const __be32 *ap;
32948588 JE	41	__be32 _addrs[2];
9fb9cbb1 YK	42	ap = skb_header_pointer(skb, nhoff + offsetof(struct iphdr, saddr),
	43	sizeof(u_int32_t) * 2, _addrs);
	44	if (ap == NULL)
8ce8439a	45	return false;
9fb9cbb1 YK	46
	47	tuple->src.u3.ip = ap[0];
	48	tuple->dst.u3.ip = ap[1];
	49
8ce8439a	50	return true;
9fb9cbb1 YK	51	}
9fb9cbb1 YK	52
8ce8439a JE	53	static bool ipv4_invert_tuple(struct nf_conntrack_tuple *tuple,
8ce8439a JE	54	const struct nf_conntrack_tuple *orig)
9fb9cbb1 YK	55	{
	56	tuple->src.u3.ip = orig->dst.u3.ip;
	57	tuple->dst.u3.ip = orig->src.u3.ip;
	58
8ce8439a	59	return true;
9fb9cbb1 YK	60	}
	61
	62	static int ipv4_print_tuple(struct seq_file *s,
	63	const struct nf_conntrack_tuple *tuple)
	64	{
cffee385 HH	65	return seq_printf(s, "src=%pI4 dst=%pI4 ",
cffee385 HH	66	&tuple->src.u3.ip, &tuple->dst.u3.ip);
9fb9cbb1 YK	67	}
9fb9cbb1 YK	68
ffc30690 YK	69	static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
ffc30690 YK	70	unsigned int dataoff, u_int8_t protonum)
9fb9cbb1	71	{
32948588 JE	72	const struct iphdr *iph;
32948588 JE	73	struct iphdr _iph;
ffc30690 YK	74
	75	iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
	76	if (iph == NULL)
8430eac2	77	return -NF_ACCEPT;
ffc30690	78
0fb96701 PM	79	/* Conntrack defragments packets, we might still see fragments
	80	* inside ICMP packets though. */
	81	if (iph->frag_off & htons(IP_OFFSET))
8430eac2	82	return -NF_ACCEPT;
9fb9cbb1	83
ffc30690 YK	84	*dataoff = nhoff + (iph->ihl << 2);
ffc30690 YK	85	*protonum = iph->protocol;
9fb9cbb1	86
07153c6e JK	87	/* Check bogus IP headers */
	88	if (*dataoff > skb->len) {
	89	pr_debug("nf_conntrack_ipv4: bogus IPv4 packet: "
	90	"nhoff %u, ihl %u, skblen %u\n",
	91	nhoff, iph->ihl << 2, skb->len);
	92	return -NF_ACCEPT;
	93	}
	94
9fb9cbb1 YK	95	return NF_ACCEPT;
	96	}
	97
9fb9cbb1	98	static unsigned int ipv4_confirm(unsigned int hooknum,
3db05fea	99	struct sk_buff *skb,
9fb9cbb1 YK	100	const struct net_device *in,
	101	const struct net_device *out,
	102	int (okfn)(struct sk_buff ))
9fb9cbb1 YK	103	{
	104	struct nf_conn *ct;
	105	enum ip_conntrack_info ctinfo;
32948588 JE	106	const struct nf_conn_help *help;
32948588 JE	107	const struct nf_conntrack_helper *helper;
dd13b010	108	unsigned int ret;
9fb9cbb1 YK	109
9fb9cbb1 YK	110	/* This is where we call the helper: as the packet goes out. */
3db05fea	111	ct = nf_ct_get(skb, &ctinfo);
fb048833	112	if (!ct \|\| ctinfo == IP_CT_RELATED_REPLY)
dd13b010	113	goto out;
dc808fe2 HW	114
dc808fe2 HW	115	help = nfct_help(ct);
3c158f7f	116	if (!help)
dd13b010 PM	117	goto out;
dd13b010 PM	118
3c158f7f PM	119	/* rcu_read_lock()ed by nf_hook_slow */
	120	helper = rcu_dereference(help->helper);
	121	if (!helper)
dd13b010 PM	122	goto out;
	123
	124	ret = helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),
	125	ct, ctinfo);
74f7a655 PM	126	if (ret != NF_ACCEPT) {
	127	nf_log_packet(NFPROTO_IPV4, hooknum, skb, in, out, NULL,
	128	"nf_ct_%s: dropping packet", helper->name);
dd13b010	129	return ret;
74f7a655	130	}
dd13b010	131
42c1edd3 JA	132	/* adjust seqs for loopback traffic only in outgoing direction */
	133	if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
	134	!nf_is_loopback_packet(skb)) {
dd13b010 PM	135	typeof(nf_nat_seq_adjust_hook) seq_adjust;
	136
	137	seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
1db7a748 PNA	138	if (!seq_adjust \|\| !seq_adjust(skb, ct, ctinfo)) {
1db7a748 PNA	139	NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
dd13b010	140	return NF_DROP;
1db7a748	141	}
dd13b010 PM	142	}
	143	out:
	144	/* We've seen it coming out the other side: confirm it */
	145	return nf_conntrack_confirm(skb);
9fb9cbb1 YK	146	}
9fb9cbb1 YK	147
9fb9cbb1	148	static unsigned int ipv4_conntrack_in(unsigned int hooknum,
3db05fea	149	struct sk_buff *skb,
9fb9cbb1 YK	150	const struct net_device *in,
	151	const struct net_device *out,
	152	int (okfn)(struct sk_buff ))
	153	{
a702a65f	154	return nf_conntrack_in(dev_net(in), PF_INET, hooknum, skb);
9fb9cbb1 YK	155	}
	156
	157	static unsigned int ipv4_conntrack_local(unsigned int hooknum,
3db05fea	158	struct sk_buff *skb,
e905a9ed YH	159	const struct net_device *in,
	160	const struct net_device *out,
	161	int (okfn)(struct sk_buff ))
9fb9cbb1 YK	162	{
9fb9cbb1 YK	163	/* root is playing with raw sockets. */
3db05fea	164	if (skb->len < sizeof(struct iphdr) \|\|
88843104	165	ip_hdrlen(skb) < sizeof(struct iphdr))
9fb9cbb1	166	return NF_ACCEPT;
a702a65f	167	return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb);
9fb9cbb1 YK	168	}
	169
	170	/* Connection tracking may drop packets, but never alters them, so
	171	make it the first hook. */
1999414a	172	static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
964ddaa1 PM	173	{
	174	.hook = ipv4_conntrack_in,
	175	.owner = THIS_MODULE,
57750a22	176	.pf = NFPROTO_IPV4,
6e23ae2a	177	.hooknum = NF_INET_PRE_ROUTING,
964ddaa1 PM	178	.priority = NF_IP_PRI_CONNTRACK,
964ddaa1 PM	179	},
964ddaa1 PM	180	{
	181	.hook = ipv4_conntrack_local,
	182	.owner = THIS_MODULE,
57750a22	183	.pf = NFPROTO_IPV4,
6e23ae2a	184	.hooknum = NF_INET_LOCAL_OUT,
964ddaa1 PM	185	.priority = NF_IP_PRI_CONNTRACK,
964ddaa1 PM	186	},
964ddaa1 PM	187	{
	188	.hook = ipv4_confirm,
	189	.owner = THIS_MODULE,
57750a22	190	.pf = NFPROTO_IPV4,
6e23ae2a	191	.hooknum = NF_INET_POST_ROUTING,
964ddaa1 PM	192	.priority = NF_IP_PRI_CONNTRACK_CONFIRM,
	193	},
	194	{
	195	.hook = ipv4_confirm,
	196	.owner = THIS_MODULE,
57750a22	197	.pf = NFPROTO_IPV4,
6e23ae2a	198	.hooknum = NF_INET_LOCAL_IN,
964ddaa1 PM	199	.priority = NF_IP_PRI_CONNTRACK_CONFIRM,
964ddaa1 PM	200	},
9fb9cbb1 YK	201	};
9fb9cbb1 YK	202
a999e683 PM	203	#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
	204	static int log_invalid_proto_min = 0;
	205	static int log_invalid_proto_max = 255;
	206
	207	static ctl_table ip_ct_sysctl_table[] = {
	208	{
a999e683	209	.procname = "ip_conntrack_max",
a999e683 PM	210	.maxlen = sizeof(int),
a999e683 PM	211	.mode = 0644,
6d9f239a	212	.proc_handler = proc_dointvec,
a999e683 PM	213	},
a999e683 PM	214	{
a999e683	215	.procname = "ip_conntrack_count",
a999e683 PM	216	.maxlen = sizeof(int),
a999e683 PM	217	.mode = 0444,
6d9f239a	218	.proc_handler = proc_dointvec,
a999e683 PM	219	},
a999e683 PM	220	{
a999e683	221	.procname = "ip_conntrack_buckets",
a999e683 PM	222	.maxlen = sizeof(unsigned int),
a999e683 PM	223	.mode = 0444,
6d9f239a	224	.proc_handler = proc_dointvec,
a999e683 PM	225	},
a999e683 PM	226	{
a999e683	227	.procname = "ip_conntrack_checksum",
a999e683 PM	228	.maxlen = sizeof(int),
a999e683 PM	229	.mode = 0644,
6d9f239a	230	.proc_handler = proc_dointvec,
a999e683 PM	231	},
a999e683 PM	232	{
a999e683	233	.procname = "ip_conntrack_log_invalid",
a999e683 PM	234	.maxlen = sizeof(unsigned int),
a999e683 PM	235	.mode = 0644,
6d9f239a	236	.proc_handler = proc_dointvec_minmax,
a999e683 PM	237	.extra1 = &log_invalid_proto_min,
	238	.extra2 = &log_invalid_proto_max,
	239	},
f8572d8f	240	{ }
a999e683 PM	241	};
	242	#endif /* CONFIG_SYSCTL && CONFIG_NF_CONNTRACK_PROC_COMPAT */
	243
9fb9cbb1 YK	244	/* Fast function for those who don't want to parse /proc (and I don't
	245	blame them). */
	246	/* Reversing the socket's dst/src point of view gives us the reply
	247	mapping. */
	248	static int
	249	getorigdst(struct sock sk, int optval, void __user user, int *len)
	250	{
32948588 JE	251	const struct inet_sock *inet = inet_sk(sk);
32948588 JE	252	const struct nf_conntrack_tuple_hash *h;
9fb9cbb1	253	struct nf_conntrack_tuple tuple;
e905a9ed	254
443a70d5	255	memset(&tuple, 0, sizeof(tuple));
c720c7e8 ED	256	tuple.src.u3.ip = inet->inet_rcv_saddr;
	257	tuple.src.u.tcp.port = inet->inet_sport;
	258	tuple.dst.u3.ip = inet->inet_daddr;
	259	tuple.dst.u.tcp.port = inet->inet_dport;
9fb9cbb1	260	tuple.src.l3num = PF_INET;
54981279	261	tuple.dst.protonum = sk->sk_protocol;
9fb9cbb1	262
54981279 RL	263	/* We only do TCP and SCTP at the moment: is there a better way? */
	264	if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) {
	265	pr_debug("SO_ORIGINAL_DST: Not a TCP/SCTP socket\n");
9fb9cbb1 YK	266	return -ENOPROTOOPT;
	267	}
	268
	269	if ((unsigned int) *len < sizeof(struct sockaddr_in)) {
0d53778e PM	270	pr_debug("SO_ORIGINAL_DST: len %d not %Zu\n",
0d53778e PM	271	*len, sizeof(struct sockaddr_in));
9fb9cbb1 YK	272	return -EINVAL;
	273	}
	274
5d0aa2cc	275	h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);
9fb9cbb1 YK	276	if (h) {
	277	struct sockaddr_in sin;
	278	struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
	279
	280	sin.sin_family = AF_INET;
	281	sin.sin_port = ct->tuplehash[IP_CT_DIR_ORIGINAL]
	282	.tuple.dst.u.tcp.port;
	283	sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
	284	.tuple.dst.u3.ip;
6c813c3f	285	memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
9fb9cbb1	286
cffee385 HH	287	pr_debug("SO_ORIGINAL_DST: %pI4 %u\n",
cffee385 HH	288	&sin.sin_addr.s_addr, ntohs(sin.sin_port));
9fb9cbb1 YK	289	nf_ct_put(ct);
	290	if (copy_to_user(user, &sin, sizeof(sin)) != 0)
	291	return -EFAULT;
	292	else
	293	return 0;
	294	}
cffee385 HH	295	pr_debug("SO_ORIGINAL_DST: Can't find %pI4/%u-%pI4/%u.\n",
	296	&tuple.src.u3.ip, ntohs(tuple.src.u.tcp.port),
	297	&tuple.dst.u3.ip, ntohs(tuple.dst.u.tcp.port));
9fb9cbb1 YK	298	return -ENOENT;
	299	}
	300
e281db5c	301	#if defined(CONFIG_NF_CT_NETLINK) \|\| defined(CONFIG_NF_CT_NETLINK_MODULE)
c1d10adb PNA	302
	303	#include <linux/netfilter/nfnetlink.h>
	304	#include <linux/netfilter/nfnetlink_conntrack.h>
	305
fdf70832	306	static int ipv4_tuple_to_nlattr(struct sk_buff *skb,
c1d10adb PNA	307	const struct nf_conntrack_tuple *tuple)
c1d10adb PNA	308	{
d317e4f6 DM	309	if (nla_put_be32(skb, CTA_IP_V4_SRC, tuple->src.u3.ip) \|\|
	310	nla_put_be32(skb, CTA_IP_V4_DST, tuple->dst.u3.ip))
	311	goto nla_put_failure;
c1d10adb PNA	312	return 0;
c1d10adb PNA	313
df6fb868	314	nla_put_failure:
c1d10adb PNA	315	return -1;
	316	}
	317
f73e924c PM	318	static const struct nla_policy ipv4_nla_policy[CTA_IP_MAX+1] = {
	319	[CTA_IP_V4_SRC] = { .type = NLA_U32 },
	320	[CTA_IP_V4_DST] = { .type = NLA_U32 },
c1d10adb PNA	321	};
c1d10adb PNA	322
fdf70832	323	static int ipv4_nlattr_to_tuple(struct nlattr *tb[],
c1d10adb PNA	324	struct nf_conntrack_tuple *t)
c1d10adb PNA	325	{
df6fb868	326	if (!tb[CTA_IP_V4_SRC] \|\| !tb[CTA_IP_V4_DST])
c1d10adb PNA	327	return -EINVAL;
c1d10adb PNA	328
77236b6e PM	329	t->src.u3.ip = nla_get_be32(tb[CTA_IP_V4_SRC]);
77236b6e PM	330	t->dst.u3.ip = nla_get_be32(tb[CTA_IP_V4_DST]);
c1d10adb PNA	331
	332	return 0;
	333	}
a400c30e HE	334
	335	static int ipv4_nlattr_tuple_size(void)
	336	{
	337	return nla_policy_len(ipv4_nla_policy, CTA_IP_MAX + 1);
	338	}
c1d10adb PNA	339	#endif
c1d10adb PNA	340
9fb9cbb1 YK	341	static struct nf_sockopt_ops so_getorigdst = {
	342	.pf = PF_INET,
	343	.get_optmin = SO_ORIGINAL_DST,
	344	.get_optmax = SO_ORIGINAL_DST+1,
	345	.get = &getorigdst,
16fcec35	346	.owner = THIS_MODULE,
9fb9cbb1 YK	347	};
9fb9cbb1 YK	348
3ea04dd3 G	349	static int ipv4_init_net(struct net *net)
	350	{
	351	#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
	352	struct nf_ip_net *in = &net->ct.nf_ct_proto;
	353	in->ctl_table = kmemdup(ip_ct_sysctl_table,
	354	sizeof(ip_ct_sysctl_table),
	355	GFP_KERNEL);
	356	if (!in->ctl_table)
	357	return -ENOMEM;
	358
	359	in->ctl_table[0].data = &nf_conntrack_max;
	360	in->ctl_table[1].data = &net->ct.count;
	361	in->ctl_table[2].data = &net->ct.htable_size;
	362	in->ctl_table[3].data = &net->ct.sysctl_checksum;
	363	in->ctl_table[4].data = &net->ct.sysctl_log_invalid;
	364	#endif
	365	return 0;
	366	}
	367
61075af5	368	struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
9fb9cbb1 YK	369	.l3proto = PF_INET,
	370	.name = "ipv4",
	371	.pkt_to_tuple = ipv4_pkt_to_tuple,
	372	.invert_tuple = ipv4_invert_tuple,
	373	.print_tuple = ipv4_print_tuple,
ffc30690	374	.get_l4proto = ipv4_get_l4proto,
e281db5c	375	#if defined(CONFIG_NF_CT_NETLINK) \|\| defined(CONFIG_NF_CT_NETLINK_MODULE)
fdf70832	376	.tuple_to_nlattr = ipv4_tuple_to_nlattr,
a400c30e	377	.nlattr_tuple_size = ipv4_nlattr_tuple_size,
fdf70832	378	.nlattr_to_tuple = ipv4_nlattr_to_tuple,
f73e924c	379	.nla_policy = ipv4_nla_policy,
a999e683 PM	380	#endif
a999e683 PM	381	#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
f99e8f71	382	.ctl_table_path = "net/ipv4/netfilter",
c1d10adb	383	#endif
3ea04dd3	384	.init_net = ipv4_init_net,
9fb9cbb1 YK	385	.me = THIS_MODULE,
	386	};
	387
fae718dd PM	388	module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,
	389	&nf_conntrack_htable_size, 0600);
	390
32292a7f	391	MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET));
d2483dde	392	MODULE_ALIAS("ip_conntrack");
32292a7f PM	393	MODULE_LICENSE("GPL");
32292a7f PM	394
3ea04dd3 G	395	static int ipv4_net_init(struct net *net)
	396	{
	397	int ret = 0;
	398
	399	ret = nf_conntrack_l4proto_register(net,
	400	&nf_conntrack_l4proto_tcp4);
	401	if (ret < 0) {
	402	pr_err("nf_conntrack_l4proto_tcp4 :protocol register failed\n");
	403	goto out_tcp;
	404	}
	405	ret = nf_conntrack_l4proto_register(net,
	406	&nf_conntrack_l4proto_udp4);
	407	if (ret < 0) {
	408	pr_err("nf_conntrack_l4proto_udp4 :protocol register failed\n");
	409	goto out_udp;
	410	}
	411	ret = nf_conntrack_l4proto_register(net,
	412	&nf_conntrack_l4proto_icmp);
	413	if (ret < 0) {
	414	pr_err("nf_conntrack_l4proto_icmp4 :protocol register failed\n");
	415	goto out_icmp;
	416	}
	417	ret = nf_conntrack_l3proto_register(net,
	418	&nf_conntrack_l3proto_ipv4);
	419	if (ret < 0) {
	420	pr_err("nf_conntrack_l3proto_ipv4 :protocol register failed\n");
	421	goto out_ipv4;
	422	}
	423	return 0;
	424	out_ipv4:
	425	nf_conntrack_l4proto_unregister(net,
	426	&nf_conntrack_l4proto_icmp);
	427	out_icmp:
	428	nf_conntrack_l4proto_unregister(net,
	429	&nf_conntrack_l4proto_udp4);
	430	out_udp:
	431	nf_conntrack_l4proto_unregister(net,
	432	&nf_conntrack_l4proto_tcp4);
	433	out_tcp:
	434	return ret;
	435	}
	436
	437	static void ipv4_net_exit(struct net *net)
	438	{
	439	nf_conntrack_l3proto_unregister(net,
	440	&nf_conntrack_l3proto_ipv4);
	441	nf_conntrack_l4proto_unregister(net,
	442	&nf_conntrack_l4proto_icmp);
	443	nf_conntrack_l4proto_unregister(net,
	444	&nf_conntrack_l4proto_udp4);
	445	nf_conntrack_l4proto_unregister(net,
	446	&nf_conntrack_l4proto_tcp4);
	447	}
	448
	449	static struct pernet_operations ipv4_net_ops = {
	450	.init = ipv4_net_init,
	451	.exit = ipv4_net_exit,
	452	};
	453
32292a7f	454	static int __init nf_conntrack_l3proto_ipv4_init(void)
9fb9cbb1 YK	455	{
	456	int ret = 0;
	457
32292a7f	458	need_conntrack();
73e4022f	459	nf_defrag_ipv4_enable();
9fb9cbb1 YK	460
	461	ret = nf_register_sockopt(&so_getorigdst);
	462	if (ret < 0) {
	463	printk(KERN_ERR "Unable to register netfilter socket option\n");
32292a7f	464	return ret;
9fb9cbb1 YK	465	}
9fb9cbb1 YK	466
3ea04dd3	467	ret = register_pernet_subsys(&ipv4_net_ops);
9fb9cbb1	468	if (ret < 0) {
3ea04dd3	469	pr_err("nf_conntrack_ipv4: can't register pernet ops\n");
9fb9cbb1 YK	470	goto cleanup_sockopt;
	471	}
	472
964ddaa1 PM	473	ret = nf_register_hooks(ipv4_conntrack_ops,
964ddaa1 PM	474	ARRAY_SIZE(ipv4_conntrack_ops));
9fb9cbb1	475	if (ret < 0) {
654d0fbd	476	pr_err("nf_conntrack_ipv4: can't register hooks.\n");
3ea04dd3	477	goto cleanup_pernet;
9fb9cbb1	478	}
e4bd8bce PM	479	#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
	480	ret = nf_conntrack_ipv4_compat_init();
	481	if (ret < 0)
	482	goto cleanup_hooks;
	483	#endif
9fb9cbb1	484	return ret;
e4bd8bce PM	485	#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
e4bd8bce PM	486	cleanup_hooks:
e905a9ed	487	nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
e4bd8bce	488	#endif
3ea04dd3 G	489	cleanup_pernet:
3ea04dd3 G	490	unregister_pernet_subsys(&ipv4_net_ops);
9fb9cbb1 YK	491	cleanup_sockopt:
9fb9cbb1 YK	492	nf_unregister_sockopt(&so_getorigdst);
9fb9cbb1 YK	493	return ret;
	494	}
	495
65b4b4e8	496	static void __exit nf_conntrack_l3proto_ipv4_fini(void)
9fb9cbb1	497	{
32292a7f	498	synchronize_net();
e4bd8bce PM	499	#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
	500	nf_conntrack_ipv4_compat_fini();
	501	#endif
32292a7f	502	nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
3ea04dd3	503	unregister_pernet_subsys(&ipv4_net_ops);
32292a7f	504	nf_unregister_sockopt(&so_getorigdst);
9fb9cbb1 YK	505	}
9fb9cbb1 YK	506
65b4b4e8 AM	507	module_init(nf_conntrack_l3proto_ipv4_init);
65b4b4e8 AM	508	module_exit(nf_conntrack_l3proto_ipv4_fini);
591e6206 PM	509
	510	void need_ipv4_conntrack(void)
	511	{
	512	return;
	513	}
	514	EXPORT_SYMBOL_GPL(need_ipv4_conntrack);