[linux-2.6-block.git] / net / netfilter / nf_conntrack_ftp.c

/* FTP extension for connection tracking. */

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/netfilter.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/ctype.h>
#include <linux/inet.h>
#include <net/checksum.h>
#include <net/tcp.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_expect.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <linux/netfilter/nf_conntrack_ftp.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
MODULE_DESCRIPTION("ftp connection tracking helper");
MODULE_ALIAS("ip_conntrack_ftp");

/* This is slow, but it's simple. --RR */
static char *ftp_buffer;

static DEFINE_SPINLOCK(nf_ftp_lock);

#define MAX_PORTS 8
static u_int16_t ports[MAX_PORTS];
static unsigned int ports_c;
module_param_array(ports, ushort, &ports_c, 0400);

static int loose;
module_param(loose, bool, 0600);

unsigned int (*nf_nat_ftp_hook)(struct sk_buff **pskb,
				enum ip_conntrack_info ctinfo,
				enum nf_ct_ftp_type type,
				unsigned int matchoff,
				unsigned int matchlen,
				struct nf_conntrack_expect *exp,
				u32 *seq);
EXPORT_SYMBOL_GPL(nf_nat_ftp_hook);

#if 0
#define DEBUGP printk
#else
#define DEBUGP(format, args...)
#endif

static int try_rfc959(const char *, size_t, struct nf_conntrack_man *, char);
static int try_eprt(const char *, size_t, struct nf_conntrack_man *, char);
static int try_epsv_response(const char *, size_t, struct nf_conntrack_man *,
			     char);

static struct ftp_search {
	const char *pattern;
	size_t plen;
	char skip;
	char term;
	enum nf_ct_ftp_type ftptype;
	int (*getnum)(const char *, size_t, struct nf_conntrack_man *, char);
} search[IP_CT_DIR_MAX][2] = {
	[IP_CT_DIR_ORIGINAL] = {
		{
			.pattern	= "PORT",
			.plen		= sizeof("PORT") - 1,
			.skip		= ' ',
			.term		= '\r',
			.ftptype	= NF_CT_FTP_PORT,
			.getnum		= try_rfc959,
		},
		{
			.pattern	= "EPRT",
			.plen		= sizeof("EPRT") - 1,
			.skip		= ' ',
			.term		= '\r',
			.ftptype	= NF_CT_FTP_EPRT,
			.getnum		= try_eprt,
		},
	},
	[IP_CT_DIR_REPLY] = {
		{
			.pattern	= "227 ",
			.plen		= sizeof("227 ") - 1,
			.skip		= '(',
			.term		= ')',
			.ftptype	= NF_CT_FTP_PASV,
			.getnum		= try_rfc959,
		},
		{
			.pattern	= "229 ",
			.plen		= sizeof("229 ") - 1,
			.skip		= '(',
			.term		= ')',
			.ftptype	= NF_CT_FTP_EPSV,
			.getnum		= try_epsv_response,
		},
	},
};

static int
get_ipv6_addr(const char *src, size_t dlen, struct in6_addr *dst, u_int8_t term)
{
	const char *end;
	int ret = in6_pton(src, min_t(size_t, dlen, 0xffff), (u8 *)dst, term, &end);
	if (ret > 0)
		return (int)(end - src);
	return 0;
}

static int try_number(const char *data, size_t dlen, u_int32_t array[],
		      int array_size, char sep, char term)
{
	u_int32_t i, len;

	memset(array, 0, sizeof(array[0])*array_size);

	/* Keep data pointing at next char. */
	for (i = 0, len = 0; len < dlen && i < array_size; len++, data++) {
		if (*data >= '0' && *data <= '9') {
			array[i] = array[i]*10 + *data - '0';
		}
		else if (*data == sep)
			i++;
		else {
			/* Unexpected character; true if it's the
			   terminator and we're finished. */
			if (*data == term && i == array_size - 1)
				return len;

			DEBUGP("Char %u (got %u nums) `%u' unexpected\n",
			       len, i, *data);
			return 0;
		}
	}
	DEBUGP("Failed to fill %u numbers separated by %c\n", array_size, sep);

	return 0;
}

/* Returns 0, or length of numbers: 192,168,1,1,5,6 */
static int try_rfc959(const char *data, size_t dlen,
		      struct nf_conntrack_man *cmd, char term)
{
	int length;
	u_int32_t array[6];

	length = try_number(data, dlen, array, 6, ',', term);
	if (length == 0)
		return 0;

	cmd->u3.ip =  htonl((array[0] << 24) | (array[1] << 16) |
				    (array[2] << 8) | array[3]);
	cmd->u.tcp.port = htons((array[4] << 8) | array[5]);
	return length;
}

/* Grab port: number up to delimiter */
static int get_port(const char *data, int start, size_t dlen, char delim,
		    __be16 *port)
{
	u_int16_t tmp_port = 0;
	int i;

	for (i = start; i < dlen; i++) {
		/* Finished? */
		if (data[i] == delim) {
			if (tmp_port == 0)
				break;
			*port = htons(tmp_port);
			DEBUGP("get_port: return %d\n", tmp_port);
			return i + 1;
		}
		else if (data[i] >= '0' && data[i] <= '9')
			tmp_port = tmp_port*10 + data[i] - '0';
		else { /* Some other crap */
			DEBUGP("get_port: invalid char.\n");
			break;
		}
	}
	return 0;
}

/* Returns 0, or length of numbers: |1|132.235.1.2|6275| or |2|3ffe::1|6275| */
static int try_eprt(const char *data, size_t dlen, struct nf_conntrack_man *cmd,
		    char term)
{
	char delim;
	int length;

	/* First character is delimiter, then "1" for IPv4 or "2" for IPv6,
	   then delimiter again. */
	if (dlen <= 3) {
		DEBUGP("EPRT: too short\n");
		return 0;
	}
	delim = data[0];
	if (isdigit(delim) || delim < 33 || delim > 126 || data[2] != delim) {
		DEBUGP("try_eprt: invalid delimitter.\n");
		return 0;
	}

	if ((cmd->l3num == PF_INET && data[1] != '1') ||
	    (cmd->l3num == PF_INET6 && data[1] != '2')) {
		DEBUGP("EPRT: invalid protocol number.\n");
		return 0;
	}

	DEBUGP("EPRT: Got %c%c%c\n", delim, data[1], delim);

	if (data[1] == '1') {
		u_int32_t array[4];

		/* Now we have IP address. */
		length = try_number(data + 3, dlen - 3, array, 4, '.', delim);
		if (length != 0)
			cmd->u3.ip = htonl((array[0] << 24) | (array[1] << 16)
					   | (array[2] << 8) | array[3]);
	} else {
		/* Now we have IPv6 address. */
		length = get_ipv6_addr(data + 3, dlen - 3,
				       (struct in6_addr *)cmd->u3.ip6, delim);
	}

	if (length == 0)
		return 0;
	DEBUGP("EPRT: Got IP address!\n");
	/* Start offset includes initial "|1|", and trailing delimiter */
	return get_port(data, 3 + length + 1, dlen, delim, &cmd->u.tcp.port);
}

/* Returns 0, or length of numbers: |||6446| */
static int try_epsv_response(const char *data, size_t dlen,
			     struct nf_conntrack_man *cmd, char term)
{
	char delim;

	/* Three delimiters. */
	if (dlen <= 3) return 0;
	delim = data[0];
	if (isdigit(delim) || delim < 33 || delim > 126
	    || data[1] != delim || data[2] != delim)
		return 0;

	return get_port(data, 3, dlen, delim, &cmd->u.tcp.port);
}

/* Return 1 for match, 0 for accept, -1 for partial. */
static int find_pattern(const char *data, size_t dlen,
			const char *pattern, size_t plen,
			char skip, char term,
			unsigned int *numoff,
			unsigned int *numlen,
			struct nf_conntrack_man *cmd,
			int (*getnum)(const char *, size_t,
				      struct nf_conntrack_man *, char))
{
	size_t i;

	DEBUGP("find_pattern `%s': dlen = %u\n", pattern, dlen);
	if (dlen == 0)
		return 0;

	if (dlen <= plen) {
		/* Short packet: try for partial? */
		if (strnicmp(data, pattern, dlen) == 0)
			return -1;
		else return 0;
	}

	if (strnicmp(data, pattern, plen) != 0) {
#if 0
		size_t i;

		DEBUGP("ftp: string mismatch\n");
		for (i = 0; i < plen; i++) {
			DEBUGP("ftp:char %u `%c'(%u) vs `%c'(%u)\n",
				i, data[i], data[i],
				pattern[i], pattern[i]);
		}
#endif
		return 0;
	}

	DEBUGP("Pattern matches!\n");
	/* Now we've found the constant string, try to skip
	   to the 'skip' character */
	for (i = plen; data[i] != skip; i++)
		if (i == dlen - 1) return -1;

	/* Skip over the last character */
	i++;

	DEBUGP("Skipped up to `%c'!\n", skip);

	*numoff = i;
	*numlen = getnum(data + i, dlen - i, cmd, term);
	if (!*numlen)
		return -1;

	DEBUGP("Match succeeded!\n");
	return 1;
}

/* Look up to see if we're just after a \n. */
static int find_nl_seq(u32 seq, const struct nf_ct_ftp_master *info, int dir)
{
	unsigned int i;

	for (i = 0; i < info->seq_aft_nl_num[dir]; i++)
		if (info->seq_aft_nl[dir][i] == seq)
			return 1;
	return 0;
}

/* We don't update if it's older than what we have. */
static void update_nl_seq(u32 nl_seq, struct nf_ct_ftp_master *info, int dir,
			  struct sk_buff *skb)
{
	unsigned int i, oldest = NUM_SEQ_TO_REMEMBER;

	/* Look for oldest: if we find exact match, we're done. */
	for (i = 0; i < info->seq_aft_nl_num[dir]; i++) {
		if (info->seq_aft_nl[dir][i] == nl_seq)
			return;

		if (oldest == info->seq_aft_nl_num[dir] ||
		    before(info->seq_aft_nl[dir][i],
			   info->seq_aft_nl[dir][oldest]))
			oldest = i;
	}

	if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
		info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
		nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
	} else if (oldest != NUM_SEQ_TO_REMEMBER &&
		   after(nl_seq, info->seq_aft_nl[dir][oldest])) {
		info->seq_aft_nl[dir][oldest] = nl_seq;
		nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
	}
}

static int help(struct sk_buff **pskb,
		unsigned int protoff,
		struct nf_conn *ct,
		enum ip_conntrack_info ctinfo)
{
	unsigned int dataoff, datalen;
	struct tcphdr _tcph, *th;
	char *fb_ptr;
	int ret;
	u32 seq;
	int dir = CTINFO2DIR(ctinfo);
	unsigned int matchlen, matchoff;
	struct nf_ct_ftp_master *ct_ftp_info = &nfct_help(ct)->help.ct_ftp_info;
	struct nf_conntrack_expect *exp;
	struct nf_conntrack_man cmd = {};
	unsigned int i;
	int found = 0, ends_in_nl;
	typeof(nf_nat_ftp_hook) nf_nat_ftp;

	/* Until there's been traffic both ways, don't look in packets. */
	if (ctinfo != IP_CT_ESTABLISHED
	    && ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY) {
		DEBUGP("ftp: Conntrackinfo = %u\n", ctinfo);
		return NF_ACCEPT;
	}

	th = skb_header_pointer(*pskb, protoff, sizeof(_tcph), &_tcph);
	if (th == NULL)
		return NF_ACCEPT;

	dataoff = protoff + th->doff * 4;
	/* No data? */
	if (dataoff >= (*pskb)->len) {
		DEBUGP("ftp: dataoff(%u) >= skblen(%u)\n", dataoff,
			(*pskb)->len);
		return NF_ACCEPT;
	}
	datalen = (*pskb)->len - dataoff;

	spin_lock_bh(&nf_ftp_lock);
	fb_ptr = skb_header_pointer(*pskb, dataoff, datalen, ftp_buffer);
	BUG_ON(fb_ptr == NULL);

	ends_in_nl = (fb_ptr[datalen - 1] == '\n');
	seq = ntohl(th->seq) + datalen;

	/* Look up to see if we're just after a \n. */
	if (!find_nl_seq(ntohl(th->seq), ct_ftp_info, dir)) {
		/* Now if this ends in \n, update ftp info. */
		DEBUGP("nf_conntrack_ftp_help: wrong seq pos %s(%u) or %s(%u)\n",
		       ct_ftp_info->seq_aft_nl_num[dir] > 0 ? "" : "(UNSET)",
		       ct_ftp_info->seq_aft_nl[dir][0],
		       ct_ftp_info->seq_aft_nl_num[dir] > 1 ? "" : "(UNSET)",
		       ct_ftp_info->seq_aft_nl[dir][1]);
		ret = NF_ACCEPT;
		goto out_update_nl;
	}

	/* Initialize IP/IPv6 addr to expected address (it's not mentioned
	   in EPSV responses) */
	cmd.l3num = ct->tuplehash[dir].tuple.src.l3num;
	memcpy(cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
	       sizeof(cmd.u3.all));

	for (i = 0; i < ARRAY_SIZE(search[dir]); i++) {
		found = find_pattern(fb_ptr, datalen,
				     search[dir][i].pattern,
				     search[dir][i].plen,
				     search[dir][i].skip,
				     search[dir][i].term,
				     &matchoff, &matchlen,
				     &cmd,
				     search[dir][i].getnum);
		if (found) break;
	}
	if (found == -1) {
		/* We don't usually drop packets.  After all, this is
		   connection tracking, not packet filtering.
		   However, it is necessary for accurate tracking in
		   this case. */
		if (net_ratelimit())
			printk("conntrack_ftp: partial %s %u+%u\n",
			       search[dir][i].pattern,
			       ntohl(th->seq), datalen);
		ret = NF_DROP;
		goto out;
	} else if (found == 0) { /* No match */
		ret = NF_ACCEPT;
		goto out_update_nl;
	}

	DEBUGP("conntrack_ftp: match `%.*s' (%u bytes at %u)\n",
	       (int)matchlen, fb_ptr + matchoff,
	       matchlen, ntohl(th->seq) + matchoff);

	exp = nf_conntrack_expect_alloc(ct);
	if (exp == NULL) {
		ret = NF_DROP;
		goto out;
	}

	/* We refer to the reverse direction ("!dir") tuples here,
	 * because we're expecting something in the other direction.
	 * Doesn't matter unless NAT is happening.  */
	exp->tuple.dst.u3 = ct->tuplehash[!dir].tuple.dst.u3;

	/* Update the ftp info */
	if ((cmd.l3num == ct->tuplehash[dir].tuple.src.l3num) &&
	    memcmp(&cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
		     sizeof(cmd.u3.all))) {
		/* Enrico Scholz's passive FTP to partially RNAT'd ftp
		   server: it really wants us to connect to a
		   different IP address.  Simply don't record it for
		   NAT. */
		if (cmd.l3num == PF_INET) {
			DEBUGP("conntrack_ftp: NOT RECORDING: " NIPQUAD_FMT " != " NIPQUAD_FMT "\n",
			       NIPQUAD(cmd.u3.ip),
			       NIPQUAD(ct->tuplehash[dir].tuple.src.u3.ip));
		} else {
			DEBUGP("conntrack_ftp: NOT RECORDING: " NIP6_FMT " != " NIP6_FMT "\n",
			       NIP6(*((struct in6_addr *)cmd.u3.ip6)),
			       NIP6(*((struct in6_addr *)ct->tuplehash[dir]
							.tuple.src.u3.ip6)));
		}

		/* Thanks to Cristiano Lincoln Mattos
		   <lincoln@cesar.org.br> for reporting this potential
		   problem (DMZ machines opening holes to internal
		   networks, or the packet filter itself). */
		if (!loose) {
			ret = NF_ACCEPT;
			goto out_put_expect;
		}
		memcpy(&exp->tuple.dst.u3, &cmd.u3.all,
		       sizeof(exp->tuple.dst.u3));
	}

	exp->tuple.src.u3 = ct->tuplehash[!dir].tuple.src.u3;
	exp->tuple.src.l3num = cmd.l3num;
	exp->tuple.src.u.tcp.port = 0;
	exp->tuple.dst.u.tcp.port = cmd.u.tcp.port;
	exp->tuple.dst.protonum = IPPROTO_TCP;

	exp->mask = (struct nf_conntrack_tuple)
		    { .src = { .l3num = 0xFFFF,
			       .u = { .tcp = { 0 }},
			     },
		      .dst = { .protonum = 0xFF,
			       .u = { .tcp = { __constant_htons(0xFFFF) }},
			     },
		    };
	if (cmd.l3num == PF_INET) {
		exp->mask.src.u3.ip = htonl(0xFFFFFFFF);
		exp->mask.dst.u3.ip = htonl(0xFFFFFFFF);
	} else {
		memset(exp->mask.src.u3.ip6, 0xFF,
		       sizeof(exp->mask.src.u3.ip6));
		memset(exp->mask.dst.u3.ip6, 0xFF,
		       sizeof(exp->mask.src.u3.ip6));
	}

	exp->expectfn = NULL;
	exp->helper = NULL;
	exp->flags = 0;

	/* Now, NAT might want to mangle the packet, and register the
	 * (possibly changed) expectation itself. */
	nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
	if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
		ret = nf_nat_ftp(pskb, ctinfo, search[dir][i].ftptype,
				 matchoff, matchlen, exp, &seq);
	else {
		/* Can't expect this?  Best to drop packet now. */
		if (nf_conntrack_expect_related(exp) != 0)
			ret = NF_DROP;
		else
			ret = NF_ACCEPT;
	}

out_put_expect:
	nf_conntrack_expect_put(exp);

out_update_nl:
	/* Now if this ends in \n, update ftp info.  Seq may have been
	 * adjusted by NAT code. */
	if (ends_in_nl)
		update_nl_seq(seq, ct_ftp_info, dir, *pskb);
 out:
	spin_unlock_bh(&nf_ftp_lock);
	return ret;
}

static struct nf_conntrack_helper ftp[MAX_PORTS][2];
static char ftp_names[MAX_PORTS][2][sizeof("ftp-65535")];

/* don't make this __exit, since it's called from __init ! */
static void nf_conntrack_ftp_fini(void)
{
	int i, j;
	for (i = 0; i < ports_c; i++) {
		for (j = 0; j < 2; j++) {
			if (ftp[i][j].me == NULL)
				continue;

			DEBUGP("nf_ct_ftp: unregistering helper for pf: %d "
			       "port: %d\n",
				ftp[i][j].tuple.src.l3num, ports[i]);
			nf_conntrack_helper_unregister(&ftp[i][j]);
		}
	}

	kfree(ftp_buffer);
}

static int __init nf_conntrack_ftp_init(void)
{
	int i, j = -1, ret = 0;
	char *tmpname;

	ftp_buffer = kmalloc(65536, GFP_KERNEL);
	if (!ftp_buffer)
		return -ENOMEM;

	if (ports_c == 0)
		ports[ports_c++] = FTP_PORT;

	/* FIXME should be configurable whether IPv4 and IPv6 FTP connections
		 are tracked or not - YK */
	for (i = 0; i < ports_c; i++) {
		ftp[i][0].tuple.src.l3num = PF_INET;
		ftp[i][1].tuple.src.l3num = PF_INET6;
		for (j = 0; j < 2; j++) {
			ftp[i][j].tuple.src.u.tcp.port = htons(ports[i]);
			ftp[i][j].tuple.dst.protonum = IPPROTO_TCP;
			ftp[i][j].mask.src.l3num = 0xFFFF;
			ftp[i][j].mask.src.u.tcp.port = htons(0xFFFF);
			ftp[i][j].mask.dst.protonum = 0xFF;
			ftp[i][j].max_expected = 1;
			ftp[i][j].timeout = 5 * 60;	/* 5 Minutes */
			ftp[i][j].me = THIS_MODULE;
			ftp[i][j].help = help;
			tmpname = &ftp_names[i][j][0];
			if (ports[i] == FTP_PORT)
				sprintf(tmpname, "ftp");
			else
				sprintf(tmpname, "ftp-%d", ports[i]);
			ftp[i][j].name = tmpname;

			DEBUGP("nf_ct_ftp: registering helper for pf: %d "
			       "port: %d\n",
				ftp[i][j].tuple.src.l3num, ports[i]);
			ret = nf_conntrack_helper_register(&ftp[i][j]);
			if (ret) {
				printk("nf_ct_ftp: failed to register helper "
				       " for pf: %d port: %d\n",
					ftp[i][j].tuple.src.l3num, ports[i]);
				nf_conntrack_ftp_fini();
				return ret;
			}
		}
	}

	return 0;
}

module_init(nf_conntrack_ftp_init);
module_exit(nf_conntrack_ftp_fini);
Commit	Line	Data
9fb9cbb1 YK	1	/* FTP extension for connection tracking. */
	2
	3	/* (C) 1999-2001 Paul `Rusty' Russell
	4	* (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
	5	* (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
9fb9cbb1 YK	10	*/
9fb9cbb1 YK	11
9fb9cbb1 YK	12	#include <linux/module.h>
	13	#include <linux/moduleparam.h>
	14	#include <linux/netfilter.h>
	15	#include <linux/ip.h>
	16	#include <linux/ipv6.h>
	17	#include <linux/ctype.h>
6a28ec8c	18	#include <linux/inet.h>
9fb9cbb1 YK	19	#include <net/checksum.h>
	20	#include <net/tcp.h>
	21
	22	#include <net/netfilter/nf_conntrack.h>
77ab9cff	23	#include <net/netfilter/nf_conntrack_expect.h>
f6180121	24	#include <net/netfilter/nf_conntrack_ecache.h>
9fb9cbb1 YK	25	#include <net/netfilter/nf_conntrack_helper.h>
	26	#include <linux/netfilter/nf_conntrack_ftp.h>
	27
	28	MODULE_LICENSE("GPL");
	29	MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
	30	MODULE_DESCRIPTION("ftp connection tracking helper");
d2483dde	31	MODULE_ALIAS("ip_conntrack_ftp");
9fb9cbb1 YK	32
	33	/* This is slow, but it's simple. --RR */
	34	static char *ftp_buffer;
	35
	36	static DEFINE_SPINLOCK(nf_ftp_lock);
	37
	38	#define MAX_PORTS 8
	39	static u_int16_t ports[MAX_PORTS];
	40	static unsigned int ports_c;
	41	module_param_array(ports, ushort, &ports_c, 0400);
	42
	43	static int loose;
e7be6994	44	module_param(loose, bool, 0600);
9fb9cbb1 YK	45
	46	unsigned int (nf_nat_ftp_hook)(struct sk_buff *pskb,
	47	enum ip_conntrack_info ctinfo,
55a73324	48	enum nf_ct_ftp_type type,
9fb9cbb1 YK	49	unsigned int matchoff,
	50	unsigned int matchlen,
	51	struct nf_conntrack_expect *exp,
	52	u32 *seq);
	53	EXPORT_SYMBOL_GPL(nf_nat_ftp_hook);
	54
	55	#if 0
	56	#define DEBUGP printk
	57	#else
	58	#define DEBUGP(format, args...)
	59	#endif
	60
	61	static int try_rfc959(const char , size_t, struct nf_conntrack_man , char);
	62	static int try_eprt(const char , size_t, struct nf_conntrack_man , char);
	63	static int try_epsv_response(const char , size_t, struct nf_conntrack_man ,
	64	char);
	65
	66	static struct ftp_search {
9fb9cbb1 YK	67	const char *pattern;
	68	size_t plen;
	69	char skip;
	70	char term;
55a73324	71	enum nf_ct_ftp_type ftptype;
9fb9cbb1	72	int (getnum)(const char , size_t, struct nf_conntrack_man *, char);
7d8c5018 PM	73	} search[IP_CT_DIR_MAX][2] = {
	74	[IP_CT_DIR_ORIGINAL] = {
	75	{
	76	.pattern = "PORT",
	77	.plen = sizeof("PORT") - 1,
	78	.skip = ' ',
	79	.term = '\r',
55a73324	80	.ftptype = NF_CT_FTP_PORT,
7d8c5018 PM	81	.getnum = try_rfc959,
	82	},
	83	{
	84	.pattern = "EPRT",
	85	.plen = sizeof("EPRT") - 1,
	86	.skip = ' ',
	87	.term = '\r',
55a73324	88	.ftptype = NF_CT_FTP_EPRT,
7d8c5018 PM	89	.getnum = try_eprt,
7d8c5018 PM	90	},
9fb9cbb1	91	},
7d8c5018 PM	92	[IP_CT_DIR_REPLY] = {
	93	{
	94	.pattern = "227 ",
	95	.plen = sizeof("227 ") - 1,
	96	.skip = '(',
	97	.term = ')',
55a73324	98	.ftptype = NF_CT_FTP_PASV,
7d8c5018 PM	99	.getnum = try_rfc959,
	100	},
	101	{
	102	.pattern = "229 ",
	103	.plen = sizeof("229 ") - 1,
	104	.skip = '(',
	105	.term = ')',
55a73324	106	.ftptype = NF_CT_FTP_EPSV,
7d8c5018 PM	107	.getnum = try_epsv_response,
7d8c5018 PM	108	},
9fb9cbb1 YK	109	},
	110	};
	111
9fb9cbb1 YK	112	static int
	113	get_ipv6_addr(const char src, size_t dlen, struct in6_addr dst, u_int8_t term)
	114	{
6a28ec8c DM	115	const char *end;
6a28ec8c DM	116	int ret = in6_pton(src, min_t(size_t, dlen, 0xffff), (u8 *)dst, term, &end);
1884f78c YH	117	if (ret > 0)
	118	return (int)(end - src);
	119	return 0;
9fb9cbb1 YK	120	}
	121
	122	static int try_number(const char *data, size_t dlen, u_int32_t array[],
601e68e1	123	int array_size, char sep, char term)
9fb9cbb1 YK	124	{
	125	u_int32_t i, len;
	126
	127	memset(array, 0, sizeof(array[0])*array_size);
	128
	129	/* Keep data pointing at next char. */
	130	for (i = 0, len = 0; len < dlen && i < array_size; len++, data++) {
	131	if (data >= '0' && data <= '9') {
	132	array[i] = array[i]10 + data - '0';
	133	}
	134	else if (*data == sep)
	135	i++;
	136	else {
	137	/* Unexpected character; true if it's the
	138	terminator and we're finished. */
	139	if (*data == term && i == array_size - 1)
	140	return len;
	141
	142	DEBUGP("Char %u (got %u nums) `%u' unexpected\n",
	143	len, i, *data);
	144	return 0;
	145	}
	146	}
	147	DEBUGP("Failed to fill %u numbers separated by %c\n", array_size, sep);
	148
	149	return 0;
	150	}
	151
	152	/* Returns 0, or length of numbers: 192,168,1,1,5,6 */
	153	static int try_rfc959(const char *data, size_t dlen,
	154	struct nf_conntrack_man *cmd, char term)
	155	{
	156	int length;
	157	u_int32_t array[6];
	158
	159	length = try_number(data, dlen, array, 6, ',', term);
	160	if (length == 0)
	161	return 0;
	162
	163	cmd->u3.ip = htonl((array[0] << 24) \| (array[1] << 16) \|
	164	(array[2] << 8) \| array[3]);
	165	cmd->u.tcp.port = htons((array[4] << 8) \| array[5]);
	166	return length;
	167	}
	168
	169	/* Grab port: number up to delimiter */
	170	static int get_port(const char *data, int start, size_t dlen, char delim,
bff9a89b	171	__be16 *port)
9fb9cbb1 YK	172	{
	173	u_int16_t tmp_port = 0;
	174	int i;
	175
	176	for (i = start; i < dlen; i++) {
	177	/* Finished? */
	178	if (data[i] == delim) {
	179	if (tmp_port == 0)
	180	break;
	181	*port = htons(tmp_port);
	182	DEBUGP("get_port: return %d\n", tmp_port);
	183	return i + 1;
	184	}
	185	else if (data[i] >= '0' && data[i] <= '9')
	186	tmp_port = tmp_port*10 + data[i] - '0';
	187	else { /* Some other crap */
	188	DEBUGP("get_port: invalid char.\n");
	189	break;
	190	}
	191	}
	192	return 0;
	193	}
	194
	195	/* Returns 0, or length of numbers: \|1\|132.235.1.2\|6275\| or \|2\|3ffe::1\|6275\| */
	196	static int try_eprt(const char data, size_t dlen, struct nf_conntrack_man cmd,
	197	char term)
	198	{
	199	char delim;
	200	int length;
	201
	202	/* First character is delimiter, then "1" for IPv4 or "2" for IPv6,
	203	then delimiter again. */
	204	if (dlen <= 3) {
	205	DEBUGP("EPRT: too short\n");
	206	return 0;
	207	}
	208	delim = data[0];
	209	if (isdigit(delim) \|\| delim < 33 \|\| delim > 126 \|\| data[2] != delim) {
	210	DEBUGP("try_eprt: invalid delimitter.\n");
	211	return 0;
	212	}
	213
	214	if ((cmd->l3num == PF_INET && data[1] != '1') \|\|
	215	(cmd->l3num == PF_INET6 && data[1] != '2')) {
	216	DEBUGP("EPRT: invalid protocol number.\n");
	217	return 0;
	218	}
	219
	220	DEBUGP("EPRT: Got %c%c%c\n", delim, data[1], delim);
	221
	222	if (data[1] == '1') {
	223	u_int32_t array[4];
	224
	225	/* Now we have IP address. */
	226	length = try_number(data + 3, dlen - 3, array, 4, '.', delim);
	227	if (length != 0)
	228	cmd->u3.ip = htonl((array[0] << 24) \| (array[1] << 16)
	229	\| (array[2] << 8) \| array[3]);
	230	} else {
	231	/* Now we have IPv6 address. */
	232	length = get_ipv6_addr(data + 3, dlen - 3,
	233	(struct in6_addr *)cmd->u3.ip6, delim);
	234	}
	235
236	if (length == 0)
237	return 0;
238	DEBUGP("EPRT: Got IP address!\n");
239	/* Start offset includes initial "\|1\|", and trailing delimiter */
240	return get_port(data, 3 + length + 1, dlen, delim, &cmd->u.tcp.port);
241	}
242
243	/* Returns 0, or length of numbers: \|\|\|6446\| */
244	static int try_epsv_response(const char *data, size_t dlen,
245	struct nf_conntrack_man *cmd, char term)
246	{
247	char delim;
248
249	/* Three delimiters. */
250	if (dlen <= 3) return 0;
251	delim = data[0];
252	if (isdigit(delim) \|\| delim < 33 \|\| delim > 126
253	\|\| data[1] != delim \|\| data[2] != delim)
254	return 0;
255
256	return get_port(data, 3, dlen, delim, &cmd->u.tcp.port);
257	}
258
259	/* Return 1 for match, 0 for accept, -1 for partial. */
260	static int find_pattern(const char *data, size_t dlen,
261	const char *pattern, size_t plen,
262	char skip, char term,
263	unsigned int *numoff,
264	unsigned int *numlen,
265	struct nf_conntrack_man *cmd,
266	int (getnum)(const char , size_t,
267	struct nf_conntrack_man *, char))
268	{
269	size_t i;
270
271	DEBUGP("find_pattern `%s': dlen = %u\n", pattern, dlen);
272	if (dlen == 0)
273	return 0;
274
275	if (dlen <= plen) {
276	/* Short packet: try for partial? */
277	if (strnicmp(data, pattern, dlen) == 0)
278	return -1;
279	else return 0;
280	}
281
282	if (strnicmp(data, pattern, plen) != 0) {
283	#if 0
284	size_t i;
285
286	DEBUGP("ftp: string mismatch\n");
287	for (i = 0; i < plen; i++) {
288	DEBUGP("ftp:char %u `%c'(%u) vs `%c'(%u)\n",
289	i, data[i], data[i],
290	pattern[i], pattern[i]);
291	}
292	#endif
293	return 0;
294	}
295
296	DEBUGP("Pattern matches!\n");
297	/* Now we've found the constant string, try to skip
298	to the 'skip' character */
299	for (i = plen; data[i] != skip; i++)
300	if (i == dlen - 1) return -1;
301
302	/* Skip over the last character */
303	i++;
304
305	DEBUGP("Skipped up to `%c'!\n", skip);
306
307	*numoff = i;
308	*numlen = getnum(data + i, dlen - i, cmd, term);
309	if (!*numlen)
310	return -1;
311
312	DEBUGP("Match succeeded!\n");
313	return 1;
314	}
315
316	/* Look up to see if we're just after a \n. */
55a73324	317	static int find_nl_seq(u32 seq, const struct nf_ct_ftp_master *info, int dir)
9fb9cbb1 YK	318	{
	319	unsigned int i;
	320
	321	for (i = 0; i < info->seq_aft_nl_num[dir]; i++)
	322	if (info->seq_aft_nl[dir][i] == seq)
	323	return 1;
	324	return 0;
	325	}
	326
	327	/* We don't update if it's older than what we have. */
55a73324	328	static void update_nl_seq(u32 nl_seq, struct nf_ct_ftp_master *info, int dir,
9fb9cbb1 YK	329	struct sk_buff *skb)
	330	{
	331	unsigned int i, oldest = NUM_SEQ_TO_REMEMBER;
	332
	333	/* Look for oldest: if we find exact match, we're done. */
	334	for (i = 0; i < info->seq_aft_nl_num[dir]; i++) {
	335	if (info->seq_aft_nl[dir][i] == nl_seq)
	336	return;
	337
5fe26f53 PM	338	if (oldest == info->seq_aft_nl_num[dir] \|\|
	339	before(info->seq_aft_nl[dir][i],
	340	info->seq_aft_nl[dir][oldest]))
9fb9cbb1 YK	341	oldest = i;
	342	}
	343
	344	if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
	345	info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
	346	nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
5fe26f53 PM	347	} else if (oldest != NUM_SEQ_TO_REMEMBER &&
5fe26f53 PM	348	after(nl_seq, info->seq_aft_nl[dir][oldest])) {
9fb9cbb1 YK	349	info->seq_aft_nl[dir][oldest] = nl_seq;
	350	nf_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
	351	}
	352	}
	353
	354	static int help(struct sk_buff **pskb,
	355	unsigned int protoff,
	356	struct nf_conn *ct,
	357	enum ip_conntrack_info ctinfo)
	358	{
	359	unsigned int dataoff, datalen;
	360	struct tcphdr _tcph, *th;
	361	char *fb_ptr;
	362	int ret;
	363	u32 seq;
	364	int dir = CTINFO2DIR(ctinfo);
	365	unsigned int matchlen, matchoff;
55a73324	366	struct nf_ct_ftp_master *ct_ftp_info = &nfct_help(ct)->help.ct_ftp_info;
9fb9cbb1 YK	367	struct nf_conntrack_expect *exp;
9fb9cbb1 YK	368	struct nf_conntrack_man cmd = {};
9fb9cbb1 YK	369	unsigned int i;
9fb9cbb1 YK	370	int found = 0, ends_in_nl;
337fbc41	371	typeof(nf_nat_ftp_hook) nf_nat_ftp;
9fb9cbb1 YK	372
	373	/* Until there's been traffic both ways, don't look in packets. */
	374	if (ctinfo != IP_CT_ESTABLISHED
	375	&& ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY) {
	376	DEBUGP("ftp: Conntrackinfo = %u\n", ctinfo);
	377	return NF_ACCEPT;
	378	}
	379
	380	th = skb_header_pointer(*pskb, protoff, sizeof(_tcph), &_tcph);
	381	if (th == NULL)
	382	return NF_ACCEPT;
	383
	384	dataoff = protoff + th->doff * 4;
	385	/* No data? */
	386	if (dataoff >= (*pskb)->len) {
	387	DEBUGP("ftp: dataoff(%u) >= skblen(%u)\n", dataoff,
	388	(*pskb)->len);
	389	return NF_ACCEPT;
	390	}
	391	datalen = (*pskb)->len - dataoff;
	392
	393	spin_lock_bh(&nf_ftp_lock);
	394	fb_ptr = skb_header_pointer(*pskb, dataoff, datalen, ftp_buffer);
	395	BUG_ON(fb_ptr == NULL);
	396
	397	ends_in_nl = (fb_ptr[datalen - 1] == '\n');
	398	seq = ntohl(th->seq) + datalen;
	399
	400	/* Look up to see if we're just after a \n. */
	401	if (!find_nl_seq(ntohl(th->seq), ct_ftp_info, dir)) {
	402	/* Now if this ends in \n, update ftp info. */
	403	DEBUGP("nf_conntrack_ftp_help: wrong seq pos %s(%u) or %s(%u)\n",
	404	ct_ftp_info->seq_aft_nl_num[dir] > 0 ? "" : "(UNSET)",
	405	ct_ftp_info->seq_aft_nl[dir][0],
	406	ct_ftp_info->seq_aft_nl_num[dir] > 1 ? "" : "(UNSET)",
	407	ct_ftp_info->seq_aft_nl[dir][1]);
	408	ret = NF_ACCEPT;
	409	goto out_update_nl;
	410	}
	411
601e68e1 YH	412	/* Initialize IP/IPv6 addr to expected address (it's not mentioned
601e68e1 YH	413	in EPSV responses) */
9fb9cbb1 YK	414	cmd.l3num = ct->tuplehash[dir].tuple.src.l3num;
	415	memcpy(cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
	416	sizeof(cmd.u3.all));
	417
7d8c5018	418	for (i = 0; i < ARRAY_SIZE(search[dir]); i++) {
9fb9cbb1	419	found = find_pattern(fb_ptr, datalen,
7d8c5018 PM	420	search[dir][i].pattern,
	421	search[dir][i].plen,
	422	search[dir][i].skip,
	423	search[dir][i].term,
9fb9cbb1 YK	424	&matchoff, &matchlen,
9fb9cbb1 YK	425	&cmd,
7d8c5018	426	search[dir][i].getnum);
9fb9cbb1 YK	427	if (found) break;
	428	}
	429	if (found == -1) {
	430	/* We don't usually drop packets. After all, this is
	431	connection tracking, not packet filtering.
	432	However, it is necessary for accurate tracking in
	433	this case. */
	434	if (net_ratelimit())
	435	printk("conntrack_ftp: partial %s %u+%u\n",
7d8c5018	436	search[dir][i].pattern,
9fb9cbb1 YK	437	ntohl(th->seq), datalen);
	438	ret = NF_DROP;
	439	goto out;
	440	} else if (found == 0) { /* No match */
	441	ret = NF_ACCEPT;
	442	goto out_update_nl;
	443	}
	444
	445	DEBUGP("conntrack_ftp: match `%.*s' (%u bytes at %u)\n",
	446	(int)matchlen, fb_ptr + matchoff,
	447	matchlen, ntohl(th->seq) + matchoff);
	448
	449	exp = nf_conntrack_expect_alloc(ct);
	450	if (exp == NULL) {
	451	ret = NF_DROP;
	452	goto out;
	453	}
	454
	455	/* We refer to the reverse direction ("!dir") tuples here,
	456	* because we're expecting something in the other direction.
	457	* Doesn't matter unless NAT is happening. */
	458	exp->tuple.dst.u3 = ct->tuplehash[!dir].tuple.dst.u3;
	459
	460	/* Update the ftp info */
	461	if ((cmd.l3num == ct->tuplehash[dir].tuple.src.l3num) &&
	462	memcmp(&cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
	463	sizeof(cmd.u3.all))) {
	464	/* Enrico Scholz's passive FTP to partially RNAT'd ftp
601e68e1 YH	465	server: it really wants us to connect to a
	466	different IP address. Simply don't record it for
	467	NAT. */
9fb9cbb1	468	if (cmd.l3num == PF_INET) {
601e68e1	469	DEBUGP("conntrack_ftp: NOT RECORDING: " NIPQUAD_FMT " != " NIPQUAD_FMT "\n",
9fb9cbb1 YK	470	NIPQUAD(cmd.u3.ip),
	471	NIPQUAD(ct->tuplehash[dir].tuple.src.u3.ip));
	472	} else {
46b86a2d	473	DEBUGP("conntrack_ftp: NOT RECORDING: " NIP6_FMT " != " NIP6_FMT "\n",
9fb9cbb1 YK	474	NIP6(((struct in6_addr )cmd.u3.ip6)),
	475	NIP6(((struct in6_addr )ct->tuplehash[dir]
	476	.tuple.src.u3.ip6)));
	477	}
	478
	479	/* Thanks to Cristiano Lincoln Mattos
	480	<lincoln@cesar.org.br> for reporting this potential
	481	problem (DMZ machines opening holes to internal
	482	networks, or the packet filter itself). */
	483	if (!loose) {
	484	ret = NF_ACCEPT;
	485	goto out_put_expect;
	486	}
	487	memcpy(&exp->tuple.dst.u3, &cmd.u3.all,
	488	sizeof(exp->tuple.dst.u3));
	489	}
	490
	491	exp->tuple.src.u3 = ct->tuplehash[!dir].tuple.src.u3;
	492	exp->tuple.src.l3num = cmd.l3num;
	493	exp->tuple.src.u.tcp.port = 0;
	494	exp->tuple.dst.u.tcp.port = cmd.u.tcp.port;
	495	exp->tuple.dst.protonum = IPPROTO_TCP;
	496
	497	exp->mask = (struct nf_conntrack_tuple)
	498	{ .src = { .l3num = 0xFFFF,
	499	.u = { .tcp = { 0 }},
	500	},
	501	.dst = { .protonum = 0xFF,
bff9a89b	502	.u = { .tcp = { __constant_htons(0xFFFF) }},
9fb9cbb1 YK	503	},
	504	};
	505	if (cmd.l3num == PF_INET) {
bff9a89b PM	506	exp->mask.src.u3.ip = htonl(0xFFFFFFFF);
bff9a89b PM	507	exp->mask.dst.u3.ip = htonl(0xFFFFFFFF);
9fb9cbb1 YK	508	} else {
	509	memset(exp->mask.src.u3.ip6, 0xFF,
	510	sizeof(exp->mask.src.u3.ip6));
	511	memset(exp->mask.dst.u3.ip6, 0xFF,
	512	sizeof(exp->mask.src.u3.ip6));
	513	}
	514
	515	exp->expectfn = NULL;
9457d851	516	exp->helper = NULL;
9fb9cbb1 YK	517	exp->flags = 0;
	518
	519	/* Now, NAT might want to mangle the packet, and register the
	520	* (possibly changed) expectation itself. */
337fbc41	521	nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
55a73324	522	if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
337fbc41 PM	523	ret = nf_nat_ftp(pskb, ctinfo, search[dir][i].ftptype,
337fbc41 PM	524	matchoff, matchlen, exp, &seq);
9fb9cbb1 YK	525	else {
	526	/* Can't expect this? Best to drop packet now. */
	527	if (nf_conntrack_expect_related(exp) != 0)
	528	ret = NF_DROP;
	529	else
	530	ret = NF_ACCEPT;
	531	}
	532
	533	out_put_expect:
	534	nf_conntrack_expect_put(exp);
	535
	536	out_update_nl:
	537	/* Now if this ends in \n, update ftp info. Seq may have been
	538	* adjusted by NAT code. */
	539	if (ends_in_nl)
	540	update_nl_seq(seq, ct_ftp_info, dir, *pskb);
	541	out:
	542	spin_unlock_bh(&nf_ftp_lock);
	543	return ret;
	544	}
	545
	546	static struct nf_conntrack_helper ftp[MAX_PORTS][2];
	547	static char ftp_names[MAX_PORTS][2][sizeof("ftp-65535")];
	548
	549	/* don't make this __exit, since it's called from __init ! */
65b4b4e8	550	static void nf_conntrack_ftp_fini(void)
9fb9cbb1 YK	551	{
	552	int i, j;
	553	for (i = 0; i < ports_c; i++) {
	554	for (j = 0; j < 2; j++) {
	555	if (ftp[i][j].me == NULL)
	556	continue;
	557
	558	DEBUGP("nf_ct_ftp: unregistering helper for pf: %d "
	559	"port: %d\n",
	560	ftp[i][j].tuple.src.l3num, ports[i]);
	561	nf_conntrack_helper_unregister(&ftp[i][j]);
	562	}
	563	}
	564
	565	kfree(ftp_buffer);
	566	}
	567
65b4b4e8	568	static int __init nf_conntrack_ftp_init(void)
9fb9cbb1 YK	569	{
	570	int i, j = -1, ret = 0;
	571	char *tmpname;
	572
	573	ftp_buffer = kmalloc(65536, GFP_KERNEL);
	574	if (!ftp_buffer)
	575	return -ENOMEM;
	576
	577	if (ports_c == 0)
	578	ports[ports_c++] = FTP_PORT;
	579
	580	/* FIXME should be configurable whether IPv4 and IPv6 FTP connections
	581	are tracked or not - YK */
	582	for (i = 0; i < ports_c; i++) {
9fb9cbb1 YK	583	ftp[i][0].tuple.src.l3num = PF_INET;
	584	ftp[i][1].tuple.src.l3num = PF_INET6;
	585	for (j = 0; j < 2; j++) {
	586	ftp[i][j].tuple.src.u.tcp.port = htons(ports[i]);
	587	ftp[i][j].tuple.dst.protonum = IPPROTO_TCP;
d7346853	588	ftp[i][j].mask.src.l3num = 0xFFFF;
bff9a89b	589	ftp[i][j].mask.src.u.tcp.port = htons(0xFFFF);
9fb9cbb1 YK	590	ftp[i][j].mask.dst.protonum = 0xFF;
	591	ftp[i][j].max_expected = 1;
	592	ftp[i][j].timeout = 5 * 60; /* 5 Minutes */
	593	ftp[i][j].me = THIS_MODULE;
	594	ftp[i][j].help = help;
	595	tmpname = &ftp_names[i][j][0];
	596	if (ports[i] == FTP_PORT)
	597	sprintf(tmpname, "ftp");
	598	else
	599	sprintf(tmpname, "ftp-%d", ports[i]);
	600	ftp[i][j].name = tmpname;
	601
	602	DEBUGP("nf_ct_ftp: registering helper for pf: %d "
	603	"port: %d\n",
	604	ftp[i][j].tuple.src.l3num, ports[i]);
	605	ret = nf_conntrack_helper_register(&ftp[i][j]);
	606	if (ret) {
	607	printk("nf_ct_ftp: failed to register helper "
	608	" for pf: %d port: %d\n",
	609	ftp[i][j].tuple.src.l3num, ports[i]);
65b4b4e8	610	nf_conntrack_ftp_fini();
9fb9cbb1 YK	611	return ret;
	612	}
	613	}
	614	}
	615
	616	return 0;
	617	}
	618
65b4b4e8 AM	619	module_init(nf_conntrack_ftp_init);
65b4b4e8 AM	620	module_exit(nf_conntrack_ftp_fini);