[linux-2.6-block.git] / net / netfilter / nf_conntrack_irc.c

/* IRC extension for IP connection tracking, Version 1.21
 * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
 * based on RR's ip_conntrack_ftp.c
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */

#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/skbuff.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/netfilter.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_expect.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <linux/netfilter/nf_conntrack_irc.h>

#define MAX_PORTS 8
static unsigned short ports[MAX_PORTS];
static unsigned int ports_c;
static unsigned int max_dcc_channels = 8;
static unsigned int dcc_timeout __read_mostly = 300;
/* This is slow, but it's simple. --RR */
static char *irc_buffer;
static DEFINE_SPINLOCK(irc_buffer_lock);

unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
				enum ip_conntrack_info ctinfo,
				unsigned int matchoff,
				unsigned int matchlen,
				struct nf_conntrack_expect *exp) __read_mostly;
EXPORT_SYMBOL_GPL(nf_nat_irc_hook);

MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ip_conntrack_irc");

module_param_array(ports, ushort, &ports_c, 0400);
MODULE_PARM_DESC(ports, "port numbers of IRC servers");
module_param(max_dcc_channels, uint, 0400);
MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per "
				   "IRC session");
module_param(dcc_timeout, uint, 0400);
MODULE_PARM_DESC(dcc_timeout, "timeout on for unestablished DCC channels");

static const char *const dccprotos[] = {
	"SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT "
};

#define MINMATCHLEN	5

/* tries to get the ip_addr and port out of a dcc command
 * return value: -1 on failure, 0 on success
 *	data		pointer to first byte of DCC command data
 *	data_end	pointer to last byte of dcc command data
 *	ip		returns parsed ip of dcc command
 *	port		returns parsed port of dcc command
 *	ad_beg_p	returns pointer to first byte of addr data
 *	ad_end_p	returns pointer to last byte of addr data
 */
static int parse_dcc(char *data, const char *data_end, u_int32_t *ip,
		     u_int16_t *port, char **ad_beg_p, char **ad_end_p)
{
	/* at least 12: "AAAAAAAA P\1\n" */
	while (*data++ != ' ')
		if (data > data_end - 12)
			return -1;

	*ad_beg_p = data;
	*ip = simple_strtoul(data, &data, 10);

	/* skip blanks between ip and port */
	while (*data == ' ') {
		if (data >= data_end)
			return -1;
		data++;
	}

	*port = simple_strtoul(data, &data, 10);
	*ad_end_p = data;

	return 0;
}

static int help(struct sk_buff *skb, unsigned int protoff,
		struct nf_conn *ct, enum ip_conntrack_info ctinfo)
{
	unsigned int dataoff;
	const struct iphdr *iph;
	const struct tcphdr *th;
	struct tcphdr _tcph;
	const char *data_limit;
	char *data, *ib_ptr;
	int dir = CTINFO2DIR(ctinfo);
	struct nf_conntrack_expect *exp;
	struct nf_conntrack_tuple *tuple;
	u_int32_t dcc_ip;
	u_int16_t dcc_port;
	__be16 port;
	int i, ret = NF_ACCEPT;
	char *addr_beg_p, *addr_end_p;
	typeof(nf_nat_irc_hook) nf_nat_irc;

	/* If packet is coming from IRC server */
	if (dir == IP_CT_DIR_REPLY)
		return NF_ACCEPT;

	/* Until there's been traffic both ways, don't look in packets. */
	if (ctinfo != IP_CT_ESTABLISHED &&
	    ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY)
		return NF_ACCEPT;

	/* Not a full tcp header? */
	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
	if (th == NULL)
		return NF_ACCEPT;

	/* No data? */
	dataoff = protoff + th->doff*4;
	if (dataoff >= skb->len)
		return NF_ACCEPT;

	spin_lock_bh(&irc_buffer_lock);
	ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff,
				    irc_buffer);
	BUG_ON(ib_ptr == NULL);

	data = ib_ptr;
	data_limit = ib_ptr + skb->len - dataoff;

	/* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
	 * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
	while (data < data_limit - (19 + MINMATCHLEN)) {
		if (memcmp(data, "\1DCC ", 5)) {
			data++;
			continue;
		}
		data += 5;
		/* we have at least (19+MINMATCHLEN)-5 bytes valid data left */

		iph = ip_hdr(skb);
		pr_debug("DCC found in master %u.%u.%u.%u:%u %u.%u.%u.%u:%u\n",
			 NIPQUAD(iph->saddr), ntohs(th->source),
			 NIPQUAD(iph->daddr), ntohs(th->dest));

		for (i = 0; i < ARRAY_SIZE(dccprotos); i++) {
			if (memcmp(data, dccprotos[i], strlen(dccprotos[i]))) {
				/* no match */
				continue;
			}
			data += strlen(dccprotos[i]);
			pr_debug("DCC %s detected\n", dccprotos[i]);

			/* we have at least
			 * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
			 * data left (== 14/13 bytes) */
			if (parse_dcc(data, data_limit, &dcc_ip,
				       &dcc_port, &addr_beg_p, &addr_end_p)) {
				pr_debug("unable to parse dcc command\n");
				continue;
			}
			pr_debug("DCC bound ip/port: %u.%u.%u.%u:%u\n",
				 HIPQUAD(dcc_ip), dcc_port);

			/* dcc_ip can be the internal OR external (NAT'ed) IP */
			tuple = &ct->tuplehash[dir].tuple;
			if (tuple->src.u3.ip != htonl(dcc_ip) &&
			    tuple->dst.u3.ip != htonl(dcc_ip)) {
				if (net_ratelimit())
					printk(KERN_WARNING
						"Forged DCC command from "
						"%u.%u.%u.%u: %u.%u.%u.%u:%u\n",
						NIPQUAD(tuple->src.u3.ip),
						HIPQUAD(dcc_ip), dcc_port);
				continue;
			}

			exp = nf_ct_expect_alloc(ct);
			if (exp == NULL) {
				ret = NF_DROP;
				goto out;
			}
			tuple = &ct->tuplehash[!dir].tuple;
			port = htons(dcc_port);
			nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
					  tuple->src.l3num,
					  NULL, &tuple->dst.u3,
					  IPPROTO_TCP, NULL, &port);

			nf_nat_irc = rcu_dereference(nf_nat_irc_hook);
			if (nf_nat_irc && ct->status & IPS_NAT_MASK)
				ret = nf_nat_irc(skb, ctinfo,
						 addr_beg_p - ib_ptr,
						 addr_end_p - addr_beg_p,
						 exp);
			else if (nf_ct_expect_related(exp) != 0)
				ret = NF_DROP;
			nf_ct_expect_put(exp);
			goto out;
		}
	}
 out:
	spin_unlock_bh(&irc_buffer_lock);
	return ret;
}

static struct nf_conntrack_helper irc[MAX_PORTS] __read_mostly;
static char irc_names[MAX_PORTS][sizeof("irc-65535")] __read_mostly;
static struct nf_conntrack_expect_policy irc_exp_policy;

static void nf_conntrack_irc_fini(void);

static int __init nf_conntrack_irc_init(void)
{
	int i, ret;
	char *tmpname;

	if (max_dcc_channels < 1) {
		printk("nf_ct_irc: max_dcc_channels must not be zero\n");
		return -EINVAL;
	}

	irc_exp_policy.max_expected = max_dcc_channels;
	irc_exp_policy.timeout = dcc_timeout;

	irc_buffer = kmalloc(65536, GFP_KERNEL);
	if (!irc_buffer)
		return -ENOMEM;

	/* If no port given, default to standard irc port */
	if (ports_c == 0)
		ports[ports_c++] = IRC_PORT;

	for (i = 0; i < ports_c; i++) {
		irc[i].tuple.src.l3num = AF_INET;
		irc[i].tuple.src.u.tcp.port = htons(ports[i]);
		irc[i].tuple.dst.protonum = IPPROTO_TCP;
		irc[i].expect_policy = &irc_exp_policy;
		irc[i].me = THIS_MODULE;
		irc[i].help = help;

		tmpname = &irc_names[i][0];
		if (ports[i] == IRC_PORT)
			sprintf(tmpname, "irc");
		else
			sprintf(tmpname, "irc-%u", i);
		irc[i].name = tmpname;

		ret = nf_conntrack_helper_register(&irc[i]);
		if (ret) {
			printk("nf_ct_irc: failed to register helper "
			       "for pf: %u port: %u\n",
			       irc[i].tuple.src.l3num, ports[i]);
			nf_conntrack_irc_fini();
			return ret;
		}
	}
	return 0;
}

/* This function is intentionally _NOT_ defined as __exit, because
 * it is needed by the init function */
static void nf_conntrack_irc_fini(void)
{
	int i;

	for (i = 0; i < ports_c; i++)
		nf_conntrack_helper_unregister(&irc[i]);
	kfree(irc_buffer);
}

module_init(nf_conntrack_irc_init);
module_exit(nf_conntrack_irc_fini);
Commit	Line	Data
869f37d8 PM	1	/* IRC extension for IP connection tracking, Version 1.21
	2	* (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
	3	* based on RR's ip_conntrack_ftp.c
	4	*
	5	* This program is free software; you can redistribute it and/or
	6	* modify it under the terms of the GNU General Public License
	7	* as published by the Free Software Foundation; either version
	8	* 2 of the License, or (at your option) any later version.
	9	*/
	10
	11	#include <linux/module.h>
	12	#include <linux/moduleparam.h>
	13	#include <linux/skbuff.h>
	14	#include <linux/in.h>
0d53778e	15	#include <linux/ip.h>
869f37d8 PM	16	#include <linux/tcp.h>
	17	#include <linux/netfilter.h>
	18
	19	#include <net/netfilter/nf_conntrack.h>
	20	#include <net/netfilter/nf_conntrack_expect.h>
	21	#include <net/netfilter/nf_conntrack_helper.h>
	22	#include <linux/netfilter/nf_conntrack_irc.h>
	23
	24	#define MAX_PORTS 8
	25	static unsigned short ports[MAX_PORTS];
2f0d2f10	26	static unsigned int ports_c;
869f37d8 PM	27	static unsigned int max_dcc_channels = 8;
	28	static unsigned int dcc_timeout __read_mostly = 300;
	29	/* This is slow, but it's simple. --RR */
	30	static char *irc_buffer;
	31	static DEFINE_SPINLOCK(irc_buffer_lock);
	32
3db05fea	33	unsigned int (nf_nat_irc_hook)(struct sk_buff skb,
869f37d8 PM	34	enum ip_conntrack_info ctinfo,
	35	unsigned int matchoff,
	36	unsigned int matchlen,
	37	struct nf_conntrack_expect *exp) __read_mostly;
	38	EXPORT_SYMBOL_GPL(nf_nat_irc_hook);
	39
	40	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
	41	MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
	42	MODULE_LICENSE("GPL");
	43	MODULE_ALIAS("ip_conntrack_irc");
	44
	45	module_param_array(ports, ushort, &ports_c, 0400);
	46	MODULE_PARM_DESC(ports, "port numbers of IRC servers");
	47	module_param(max_dcc_channels, uint, 0400);
	48	MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per "
	49	"IRC session");
	50	module_param(dcc_timeout, uint, 0400);
	51	MODULE_PARM_DESC(dcc_timeout, "timeout on for unestablished DCC channels");
	52
58c0fb0d	53	static const char *const dccprotos[] = {
869f37d8 PM	54	"SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT "
	55	};
	56
	57	#define MINMATCHLEN 5
	58
869f37d8 PM	59	/* tries to get the ip_addr and port out of a dcc command
	60	* return value: -1 on failure, 0 on success
	61	* data pointer to first byte of DCC command data
	62	* data_end pointer to last byte of dcc command data
	63	* ip returns parsed ip of dcc command
	64	* port returns parsed port of dcc command
	65	* ad_beg_p returns pointer to first byte of addr data
	66	* ad_end_p returns pointer to last byte of addr data
	67	*/
58c0fb0d	68	static int parse_dcc(char data, const char data_end, u_int32_t *ip,
869f37d8 PM	69	u_int16_t port, char ad_beg_p, char *ad_end_p)
	70	{
	71	/* at least 12: "AAAAAAAA P\1\n" */
	72	while (*data++ != ' ')
	73	if (data > data_end - 12)
	74	return -1;
	75
	76	*ad_beg_p = data;
	77	*ip = simple_strtoul(data, &data, 10);
	78
	79	/* skip blanks between ip and port */
	80	while (*data == ' ') {
	81	if (data >= data_end)
	82	return -1;
	83	data++;
	84	}
	85
	86	*port = simple_strtoul(data, &data, 10);
	87	*ad_end_p = data;
	88
	89	return 0;
	90	}
	91
3db05fea	92	static int help(struct sk_buff *skb, unsigned int protoff,
869f37d8 PM	93	struct nf_conn *ct, enum ip_conntrack_info ctinfo)
	94	{
	95	unsigned int dataoff;
58c0fb0d JE	96	const struct iphdr *iph;
	97	const struct tcphdr *th;
	98	struct tcphdr _tcph;
	99	const char *data_limit;
	100	char data, ib_ptr;
869f37d8 PM	101	int dir = CTINFO2DIR(ctinfo);
	102	struct nf_conntrack_expect *exp;
	103	struct nf_conntrack_tuple *tuple;
	104	u_int32_t dcc_ip;
	105	u_int16_t dcc_port;
	106	__be16 port;
	107	int i, ret = NF_ACCEPT;
	108	char addr_beg_p, addr_end_p;
	109	typeof(nf_nat_irc_hook) nf_nat_irc;
	110
	111	/* If packet is coming from IRC server */
	112	if (dir == IP_CT_DIR_REPLY)
	113	return NF_ACCEPT;
	114
	115	/* Until there's been traffic both ways, don't look in packets. */
	116	if (ctinfo != IP_CT_ESTABLISHED &&
	117	ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY)
	118	return NF_ACCEPT;
	119
	120	/* Not a full tcp header? */
3db05fea	121	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
869f37d8 PM	122	if (th == NULL)
	123	return NF_ACCEPT;
	124
	125	/* No data? */
	126	dataoff = protoff + th->doff*4;
3db05fea	127	if (dataoff >= skb->len)
869f37d8 PM	128	return NF_ACCEPT;
	129
	130	spin_lock_bh(&irc_buffer_lock);
3db05fea	131	ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff,
869f37d8 PM	132	irc_buffer);
	133	BUG_ON(ib_ptr == NULL);
	134
	135	data = ib_ptr;
3db05fea	136	data_limit = ib_ptr + skb->len - dataoff;
869f37d8 PM	137
	138	/* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
	139	* 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
	140	while (data < data_limit - (19 + MINMATCHLEN)) {
	141	if (memcmp(data, "\1DCC ", 5)) {
	142	data++;
	143	continue;
	144	}
	145	data += 5;
	146	/* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
	147
3db05fea	148	iph = ip_hdr(skb);
0d53778e PM	149	pr_debug("DCC found in master %u.%u.%u.%u:%u %u.%u.%u.%u:%u\n",
	150	NIPQUAD(iph->saddr), ntohs(th->source),
	151	NIPQUAD(iph->daddr), ntohs(th->dest));
869f37d8 PM	152
	153	for (i = 0; i < ARRAY_SIZE(dccprotos); i++) {
	154	if (memcmp(data, dccprotos[i], strlen(dccprotos[i]))) {
	155	/* no match */
	156	continue;
	157	}
	158	data += strlen(dccprotos[i]);
0d53778e	159	pr_debug("DCC %s detected\n", dccprotos[i]);
869f37d8 PM	160
	161	/* we have at least
	162	* (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
	163	* data left (== 14/13 bytes) */
58c0fb0d	164	if (parse_dcc(data, data_limit, &dcc_ip,
869f37d8	165	&dcc_port, &addr_beg_p, &addr_end_p)) {
0d53778e	166	pr_debug("unable to parse dcc command\n");
869f37d8 PM	167	continue;
869f37d8 PM	168	}
0d53778e PM	169	pr_debug("DCC bound ip/port: %u.%u.%u.%u:%u\n",
0d53778e PM	170	HIPQUAD(dcc_ip), dcc_port);
869f37d8 PM	171
	172	/* dcc_ip can be the internal OR external (NAT'ed) IP */
	173	tuple = &ct->tuplehash[dir].tuple;
	174	if (tuple->src.u3.ip != htonl(dcc_ip) &&
	175	tuple->dst.u3.ip != htonl(dcc_ip)) {
	176	if (net_ratelimit())
	177	printk(KERN_WARNING
	178	"Forged DCC command from "
	179	"%u.%u.%u.%u: %u.%u.%u.%u:%u\n",
	180	NIPQUAD(tuple->src.u3.ip),
	181	HIPQUAD(dcc_ip), dcc_port);
	182	continue;
	183	}
	184
6823645d	185	exp = nf_ct_expect_alloc(ct);
869f37d8 PM	186	if (exp == NULL) {
	187	ret = NF_DROP;
	188	goto out;
	189	}
	190	tuple = &ct->tuplehash[!dir].tuple;
	191	port = htons(dcc_port);
6002f266 PM	192	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
6002f266 PM	193	tuple->src.l3num,
6823645d PM	194	NULL, &tuple->dst.u3,
6823645d PM	195	IPPROTO_TCP, NULL, &port);
869f37d8 PM	196
	197	nf_nat_irc = rcu_dereference(nf_nat_irc_hook);
	198	if (nf_nat_irc && ct->status & IPS_NAT_MASK)
3db05fea	199	ret = nf_nat_irc(skb, ctinfo,
869f37d8 PM	200	addr_beg_p - ib_ptr,
	201	addr_end_p - addr_beg_p,
	202	exp);
6823645d	203	else if (nf_ct_expect_related(exp) != 0)
869f37d8	204	ret = NF_DROP;
6823645d	205	nf_ct_expect_put(exp);
869f37d8 PM	206	goto out;
	207	}
	208	}
	209	out:
	210	spin_unlock_bh(&irc_buffer_lock);
	211	return ret;
	212	}
	213
	214	static struct nf_conntrack_helper irc[MAX_PORTS] __read_mostly;
	215	static char irc_names[MAX_PORTS][sizeof("irc-65535")] __read_mostly;
6002f266	216	static struct nf_conntrack_expect_policy irc_exp_policy;
869f37d8 PM	217
	218	static void nf_conntrack_irc_fini(void);
	219
	220	static int __init nf_conntrack_irc_init(void)
	221	{
	222	int i, ret;
	223	char *tmpname;
	224
	225	if (max_dcc_channels < 1) {
	226	printk("nf_ct_irc: max_dcc_channels must not be zero\n");
	227	return -EINVAL;
	228	}
	229
6002f266 PM	230	irc_exp_policy.max_expected = max_dcc_channels;
	231	irc_exp_policy.timeout = dcc_timeout;
	232
869f37d8 PM	233	irc_buffer = kmalloc(65536, GFP_KERNEL);
	234	if (!irc_buffer)
	235	return -ENOMEM;
	236
	237	/* If no port given, default to standard irc port */
	238	if (ports_c == 0)
	239	ports[ports_c++] = IRC_PORT;
	240
	241	for (i = 0; i < ports_c; i++) {
	242	irc[i].tuple.src.l3num = AF_INET;
	243	irc[i].tuple.src.u.tcp.port = htons(ports[i]);
	244	irc[i].tuple.dst.protonum = IPPROTO_TCP;
6002f266	245	irc[i].expect_policy = &irc_exp_policy;
869f37d8 PM	246	irc[i].me = THIS_MODULE;
	247	irc[i].help = help;
	248
	249	tmpname = &irc_names[i][0];
	250	if (ports[i] == IRC_PORT)
	251	sprintf(tmpname, "irc");
	252	else
	253	sprintf(tmpname, "irc-%u", i);
	254	irc[i].name = tmpname;
	255
	256	ret = nf_conntrack_helper_register(&irc[i]);
	257	if (ret) {
	258	printk("nf_ct_irc: failed to register helper "
	259	"for pf: %u port: %u\n",
	260	irc[i].tuple.src.l3num, ports[i]);
	261	nf_conntrack_irc_fini();
	262	return ret;
	263	}
	264	}
	265	return 0;
	266	}
	267
	268	/* This function is intentionally _NOT_ defined as __exit, because
	269	* it is needed by the init function */
	270	static void nf_conntrack_irc_fini(void)
	271	{
	272	int i;
	273
	274	for (i = 0; i < ports_c; i++)
	275	nf_conntrack_helper_unregister(&irc[i]);
	276	kfree(irc_buffer);
	277	}
	278
	279	module_init(nf_conntrack_irc_init);
	280	module_exit(nf_conntrack_irc_fini);