[linux-2.6-block.git] / net / netfilter / nf_conntrack_proto_icmp.c

// SPDX-License-Identifier: GPL-2.0-only
/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
 * (C) 2006-2010 Patrick McHardy <kaber@trash.net>
 */

#include <linux/types.h>
#include <linux/timer.h>
#include <linux/netfilter.h>
#include <linux/in.h>
#include <linux/icmp.h>
#include <linux/seq_file.h>
#include <net/ip.h>
#include <net/checksum.h>
#include <linux/netfilter_ipv4.h>
#include <net/netfilter/nf_conntrack_tuple.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_timeout.h>
#include <net/netfilter/nf_conntrack_zones.h>
#include <net/netfilter/nf_log.h>

static const unsigned int nf_ct_icmp_timeout = 30*HZ;

bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
		       struct net *net, struct nf_conntrack_tuple *tuple)
{
	const struct icmphdr *hp;
	struct icmphdr _hdr;

	hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
	if (hp == NULL)
		return false;

	tuple->dst.u.icmp.type = hp->type;
	tuple->src.u.icmp.id = hp->un.echo.id;
	tuple->dst.u.icmp.code = hp->code;

	return true;
}

/* Add 1; spaces filled with 0. */
static const u_int8_t invmap[] = {
	[ICMP_ECHO] = ICMP_ECHOREPLY + 1,
	[ICMP_ECHOREPLY] = ICMP_ECHO + 1,
	[ICMP_TIMESTAMP] = ICMP_TIMESTAMPREPLY + 1,
	[ICMP_TIMESTAMPREPLY] = ICMP_TIMESTAMP + 1,
	[ICMP_INFO_REQUEST] = ICMP_INFO_REPLY + 1,
	[ICMP_INFO_REPLY] = ICMP_INFO_REQUEST + 1,
	[ICMP_ADDRESS] = ICMP_ADDRESSREPLY + 1,
	[ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1
};

bool nf_conntrack_invert_icmp_tuple(struct nf_conntrack_tuple *tuple,
				    const struct nf_conntrack_tuple *orig)
{
	if (orig->dst.u.icmp.type >= sizeof(invmap) ||
	    !invmap[orig->dst.u.icmp.type])
		return false;

	tuple->src.u.icmp.id = orig->src.u.icmp.id;
	tuple->dst.u.icmp.type = invmap[orig->dst.u.icmp.type] - 1;
	tuple->dst.u.icmp.code = orig->dst.u.icmp.code;
	return true;
}

/* Returns verdict for packet, or -1 for invalid. */
int nf_conntrack_icmp_packet(struct nf_conn *ct,
			     struct sk_buff *skb,
			     enum ip_conntrack_info ctinfo,
			     const struct nf_hook_state *state)
{
	/* Do not immediately delete the connection after the first
	   successful reply to avoid excessive conntrackd traffic
	   and also to handle correctly ICMP echo reply duplicates. */
	unsigned int *timeout = nf_ct_timeout_lookup(ct);
	static const u_int8_t valid_new[] = {
		[ICMP_ECHO] = 1,
		[ICMP_TIMESTAMP] = 1,
		[ICMP_INFO_REQUEST] = 1,
		[ICMP_ADDRESS] = 1
	};

	if (state->pf != NFPROTO_IPV4)
		return -NF_ACCEPT;

	if (ct->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new) ||
	    !valid_new[ct->tuplehash[0].tuple.dst.u.icmp.type]) {
		/* Can't create a new ICMP `conn' with this. */
		pr_debug("icmp: can't create new conn with type %u\n",
			 ct->tuplehash[0].tuple.dst.u.icmp.type);
		nf_ct_dump_tuple_ip(&ct->tuplehash[0].tuple);
		return -NF_ACCEPT;
	}

	if (!timeout)
		timeout = &nf_icmp_pernet(nf_ct_net(ct))->timeout;

	nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
	return NF_ACCEPT;
}

/* Check inner header is related to any of the existing connections */
int nf_conntrack_inet_error(struct nf_conn *tmpl, struct sk_buff *skb,
			    unsigned int dataoff,
			    const struct nf_hook_state *state,
			    u8 l4proto, union nf_inet_addr *outer_daddr)
{
	struct nf_conntrack_tuple innertuple, origtuple;
	const struct nf_conntrack_tuple_hash *h;
	const struct nf_conntrack_zone *zone;
	enum ip_conntrack_info ctinfo;
	struct nf_conntrack_zone tmp;
	union nf_inet_addr *ct_daddr;
	enum ip_conntrack_dir dir;
	struct nf_conn *ct;

	WARN_ON(skb_nfct(skb));
	zone = nf_ct_zone_tmpl(tmpl, skb, &tmp);

	/* Are they talking about one of our connections? */
	if (!nf_ct_get_tuplepr(skb, dataoff,
			       state->pf, state->net, &origtuple))
		return -NF_ACCEPT;

	/* Ordinarily, we'd expect the inverted tupleproto, but it's
	   been preserved inside the ICMP. */
	if (!nf_ct_invert_tuple(&innertuple, &origtuple))
		return -NF_ACCEPT;

	h = nf_conntrack_find_get(state->net, zone, &innertuple);
	if (!h)
		return -NF_ACCEPT;

	/* Consider: A -> T (=This machine) -> B
	 *   Conntrack entry will look like this:
	 *      Original:  A->B
	 *      Reply:     B->T (SNAT case) OR A
	 *
	 * When this function runs, we got packet that looks like this:
	 * iphdr|icmphdr|inner_iphdr|l4header (tcp, udp, ..).
	 *
	 * Above nf_conntrack_find_get() makes lookup based on inner_hdr,
	 * so we should expect that destination of the found connection
	 * matches outer header destination address.
	 *
	 * In above example, we can consider these two cases:
	 *  1. Error coming in reply direction from B or M (middle box) to
	 *     T (SNAT case) or A.
	 *     Inner saddr will be B, dst will be T or A.
	 *     The found conntrack will be reply tuple (B->T/A).
	 *  2. Error coming in original direction from A or M to B.
	 *     Inner saddr will be A, inner daddr will be B.
	 *     The found conntrack will be original tuple (A->B).
	 *
	 * In both cases, conntrack[dir].dst == inner.dst.
	 *
	 * A bogus packet could look like this:
	 *   Inner: B->T
	 *   Outer: B->X (other machine reachable by T).
	 *
	 * In this case, lookup yields connection A->B and will
	 * set packet from B->X as *RELATED*, even though no connection
	 * from X was ever seen.
	 */
	ct = nf_ct_tuplehash_to_ctrack(h);
	dir = NF_CT_DIRECTION(h);
	ct_daddr = &ct->tuplehash[dir].tuple.dst.u3;
	if (!nf_inet_addr_cmp(outer_daddr, ct_daddr)) {
		if (state->pf == AF_INET) {
			nf_l4proto_log_invalid(skb, state->net, state->pf,
					       l4proto,
					       "outer daddr %pI4 != inner %pI4",
					       &outer_daddr->ip, &ct_daddr->ip);
		} else if (state->pf == AF_INET6) {
			nf_l4proto_log_invalid(skb, state->net, state->pf,
					       l4proto,
					       "outer daddr %pI6 != inner %pI6",
					       &outer_daddr->ip6, &ct_daddr->ip6);
		}
		nf_ct_put(ct);
		return -NF_ACCEPT;
	}

	ctinfo = IP_CT_RELATED;
	if (dir == IP_CT_DIR_REPLY)
		ctinfo += IP_CT_IS_REPLY;

	/* Update skb to refer to this connection */
	nf_ct_set(skb, ct, ctinfo);
	return NF_ACCEPT;
}

static void icmp_error_log(const struct sk_buff *skb,
			   const struct nf_hook_state *state,
			   const char *msg)
{
	nf_l4proto_log_invalid(skb, state->net, state->pf,
			       IPPROTO_ICMP, "%s", msg);
}

/* Small and modified version of icmp_rcv */
int nf_conntrack_icmpv4_error(struct nf_conn *tmpl,
			      struct sk_buff *skb, unsigned int dataoff,
			      const struct nf_hook_state *state)
{
	union nf_inet_addr outer_daddr;
	const struct icmphdr *icmph;
	struct icmphdr _ih;

	/* Not enough header? */
	icmph = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
	if (icmph == NULL) {
		icmp_error_log(skb, state, "short packet");
		return -NF_ACCEPT;
	}

	/* See nf_conntrack_proto_tcp.c */
	if (state->net->ct.sysctl_checksum &&
	    state->hook == NF_INET_PRE_ROUTING &&
	    nf_ip_checksum(skb, state->hook, dataoff, IPPROTO_ICMP)) {
		icmp_error_log(skb, state, "bad hw icmp checksum");
		return -NF_ACCEPT;
	}

	/*
	 *	18 is the highest 'known' ICMP type. Anything else is a mystery
	 *
	 *	RFC 1122: 3.2.2  Unknown ICMP messages types MUST be silently
	 *		  discarded.
	 */
	if (icmph->type > NR_ICMP_TYPES) {
		icmp_error_log(skb, state, "invalid icmp type");
		return -NF_ACCEPT;
	}

	/* Need to track icmp error message? */
	if (icmph->type != ICMP_DEST_UNREACH &&
	    icmph->type != ICMP_SOURCE_QUENCH &&
	    icmph->type != ICMP_TIME_EXCEEDED &&
	    icmph->type != ICMP_PARAMETERPROB &&
	    icmph->type != ICMP_REDIRECT)
		return NF_ACCEPT;

	memset(&outer_daddr, 0, sizeof(outer_daddr));
	outer_daddr.ip = ip_hdr(skb)->daddr;

	dataoff += sizeof(*icmph);
	return nf_conntrack_inet_error(tmpl, skb, dataoff, state,
				       IPPROTO_ICMP, &outer_daddr);
}

#if IS_ENABLED(CONFIG_NF_CT_NETLINK)

#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_conntrack.h>

static int icmp_tuple_to_nlattr(struct sk_buff *skb,
				const struct nf_conntrack_tuple *t)
{
	if (nla_put_be16(skb, CTA_PROTO_ICMP_ID, t->src.u.icmp.id) ||
	    nla_put_u8(skb, CTA_PROTO_ICMP_TYPE, t->dst.u.icmp.type) ||
	    nla_put_u8(skb, CTA_PROTO_ICMP_CODE, t->dst.u.icmp.code))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static const struct nla_policy icmp_nla_policy[CTA_PROTO_MAX+1] = {
	[CTA_PROTO_ICMP_TYPE]	= { .type = NLA_U8 },
	[CTA_PROTO_ICMP_CODE]	= { .type = NLA_U8 },
	[CTA_PROTO_ICMP_ID]	= { .type = NLA_U16 },
};

static int icmp_nlattr_to_tuple(struct nlattr *tb[],
				struct nf_conntrack_tuple *tuple)
{
	if (!tb[CTA_PROTO_ICMP_TYPE] ||
	    !tb[CTA_PROTO_ICMP_CODE] ||
	    !tb[CTA_PROTO_ICMP_ID])
		return -EINVAL;

	tuple->dst.u.icmp.type = nla_get_u8(tb[CTA_PROTO_ICMP_TYPE]);
	tuple->dst.u.icmp.code = nla_get_u8(tb[CTA_PROTO_ICMP_CODE]);
	tuple->src.u.icmp.id = nla_get_be16(tb[CTA_PROTO_ICMP_ID]);

	if (tuple->dst.u.icmp.type >= sizeof(invmap) ||
	    !invmap[tuple->dst.u.icmp.type])
		return -EINVAL;

	return 0;
}

static unsigned int icmp_nlattr_tuple_size(void)
{
	static unsigned int size __read_mostly;

	if (!size)
		size = nla_policy_len(icmp_nla_policy, CTA_PROTO_MAX + 1);

	return size;
}
#endif

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT

#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h>

static int icmp_timeout_nlattr_to_obj(struct nlattr *tb[],
				      struct net *net, void *data)
{
	unsigned int *timeout = data;
	struct nf_icmp_net *in = nf_icmp_pernet(net);

	if (tb[CTA_TIMEOUT_ICMP_TIMEOUT]) {
		if (!timeout)
			timeout = &in->timeout;
		*timeout =
			ntohl(nla_get_be32(tb[CTA_TIMEOUT_ICMP_TIMEOUT])) * HZ;
	} else if (timeout) {
		/* Set default ICMP timeout. */
		*timeout = in->timeout;
	}
	return 0;
}

static int
icmp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
{
	const unsigned int *timeout = data;

	if (nla_put_be32(skb, CTA_TIMEOUT_ICMP_TIMEOUT, htonl(*timeout / HZ)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -ENOSPC;
}

static const struct nla_policy
icmp_timeout_nla_policy[CTA_TIMEOUT_ICMP_MAX+1] = {
	[CTA_TIMEOUT_ICMP_TIMEOUT]	= { .type = NLA_U32 },
};
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */

void nf_conntrack_icmp_init_net(struct net *net)
{
	struct nf_icmp_net *in = nf_icmp_pernet(net);

	in->timeout = nf_ct_icmp_timeout;
}

const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp =
{
	.l4proto		= IPPROTO_ICMP,
#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
	.tuple_to_nlattr	= icmp_tuple_to_nlattr,
	.nlattr_tuple_size	= icmp_nlattr_tuple_size,
	.nlattr_to_tuple	= icmp_nlattr_to_tuple,
	.nla_policy		= icmp_nla_policy,
#endif
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	.ctnl_timeout		= {
		.nlattr_to_obj	= icmp_timeout_nlattr_to_obj,
		.obj_to_nlattr	= icmp_timeout_obj_to_nlattr,
		.nlattr_max	= CTA_TIMEOUT_ICMP_MAX,
		.obj_size	= sizeof(unsigned int),
		.nla_policy	= icmp_timeout_nla_policy,
	},
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
};
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
9fb9cbb1 YK	2	/* (C) 1999-2001 Paul `Rusty' Russell
9fb9cbb1 YK	3	* (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
f229f6ce	4	* (C) 2006-2010 Patrick McHardy <kaber@trash.net>
9fb9cbb1 YK	5	*/
	6
	7	#include <linux/types.h>
9fb9cbb1 YK	8	#include <linux/timer.h>
	9	#include <linux/netfilter.h>
	10	#include <linux/in.h>
	11	#include <linux/icmp.h>
	12	#include <linux/seq_file.h>
	13	#include <net/ip.h>
	14	#include <net/checksum.h>
	15	#include <linux/netfilter_ipv4.h>
	16	#include <net/netfilter/nf_conntrack_tuple.h>
605dcad6	17	#include <net/netfilter/nf_conntrack_l4proto.h>
9fb9cbb1	18	#include <net/netfilter/nf_conntrack_core.h>
c779e849	19	#include <net/netfilter/nf_conntrack_timeout.h>
5d0aa2cc	20	#include <net/netfilter/nf_conntrack_zones.h>
f01ffbd6	21	#include <net/netfilter/nf_log.h>
9fb9cbb1	22
2c9e8637	23	static const unsigned int nf_ct_icmp_timeout = 30*HZ;
9fb9cbb1	24
e2e48b47 FW	25	bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
e2e48b47 FW	26	struct net net, struct nf_conntrack_tuple tuple)
9fb9cbb1	27	{
7cc3864d JE	28	const struct icmphdr *hp;
7cc3864d JE	29	struct icmphdr _hdr;
9fb9cbb1 YK	30
	31	hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
	32	if (hp == NULL)
09f263cd	33	return false;
9fb9cbb1 YK	34
	35	tuple->dst.u.icmp.type = hp->type;
	36	tuple->src.u.icmp.id = hp->un.echo.id;
	37	tuple->dst.u.icmp.code = hp->code;
	38
09f263cd	39	return true;
9fb9cbb1 YK	40	}
9fb9cbb1 YK	41
c1d10adb PNA	42	/* Add 1; spaces filled with 0. */
	43	static const u_int8_t invmap[] = {
	44	[ICMP_ECHO] = ICMP_ECHOREPLY + 1,
	45	[ICMP_ECHOREPLY] = ICMP_ECHO + 1,
	46	[ICMP_TIMESTAMP] = ICMP_TIMESTAMPREPLY + 1,
	47	[ICMP_TIMESTAMPREPLY] = ICMP_TIMESTAMP + 1,
	48	[ICMP_INFO_REQUEST] = ICMP_INFO_REPLY + 1,
	49	[ICMP_INFO_REPLY] = ICMP_INFO_REQUEST + 1,
	50	[ICMP_ADDRESS] = ICMP_ADDRESSREPLY + 1,
	51	[ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1
	52	};
	53
197c4300 FW	54	bool nf_conntrack_invert_icmp_tuple(struct nf_conntrack_tuple *tuple,
197c4300 FW	55	const struct nf_conntrack_tuple *orig)
9fb9cbb1	56	{
3666ed1c JP	57	if (orig->dst.u.icmp.type >= sizeof(invmap) \|\|
3666ed1c JP	58	!invmap[orig->dst.u.icmp.type])
09f263cd	59	return false;
9fb9cbb1 YK	60
	61	tuple->src.u.icmp.id = orig->src.u.icmp.id;
	62	tuple->dst.u.icmp.type = invmap[orig->dst.u.icmp.type] - 1;
	63	tuple->dst.u.icmp.code = orig->dst.u.icmp.code;
09f263cd	64	return true;
9fb9cbb1 YK	65	}
9fb9cbb1 YK	66
9fb9cbb1	67	/* Returns verdict for packet, or -1 for invalid. */
a47c5404 FW	68	int nf_conntrack_icmp_packet(struct nf_conn *ct,
	69	struct sk_buff *skb,
	70	enum ip_conntrack_info ctinfo,
	71	const struct nf_hook_state *state)
9fb9cbb1	72	{
f87fb666 JK	73	/* Do not immediately delete the connection after the first
	74	successful reply to avoid excessive conntrackd traffic
	75	and also to handle correctly ICMP echo reply duplicates. */
c779e849	76	unsigned int *timeout = nf_ct_timeout_lookup(ct);
c1d10adb PNA	77	static const u_int8_t valid_new[] = {
	78	[ICMP_ECHO] = 1,
	79	[ICMP_TIMESTAMP] = 1,
	80	[ICMP_INFO_REQUEST] = 1,
	81	[ICMP_ADDRESS] = 1
	82	};
9fb9cbb1	83
dd2934a9 FW	84	if (state->pf != NFPROTO_IPV4)
	85	return -NF_ACCEPT;
	86
3666ed1c JP	87	if (ct->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new) \|\|
3666ed1c JP	88	!valid_new[ct->tuplehash[0].tuple.dst.u.icmp.type]) {
9fb9cbb1	89	/* Can't create a new ICMP `conn' with this. */
0d53778e	90	pr_debug("icmp: can't create new conn with type %u\n",
c88130bc	91	ct->tuplehash[0].tuple.dst.u.icmp.type);
3c9fba65	92	nf_ct_dump_tuple_ip(&ct->tuplehash[0].tuple);
9976fc6e	93	return -NF_ACCEPT;
9fb9cbb1	94	}
9976fc6e FW	95
9976fc6e FW	96	if (!timeout)
a95a7774	97	timeout = &nf_icmp_pernet(nf_ct_net(ct))->timeout;
9976fc6e FW	98
	99	nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
	100	return NF_ACCEPT;
9fb9cbb1 YK	101	}
9fb9cbb1 YK	102
1025ce75 FW	103	/* Check inner header is related to any of the existing connections */
	104	int nf_conntrack_inet_error(struct nf_conn tmpl, struct sk_buff skb,
	105	unsigned int dataoff,
	106	const struct nf_hook_state *state,
	107	u8 l4proto, union nf_inet_addr *outer_daddr)
9fb9cbb1 YK	108	{
9fb9cbb1 YK	109	struct nf_conntrack_tuple innertuple, origtuple;
7cc3864d	110	const struct nf_conntrack_tuple_hash *h;
308ac914	111	const struct nf_conntrack_zone *zone;
11df4b76	112	enum ip_conntrack_info ctinfo;
5e8018fc	113	struct nf_conntrack_zone tmp;
1025ce75 FW	114	union nf_inet_addr *ct_daddr;
	115	enum ip_conntrack_dir dir;
	116	struct nf_conn *ct;
9fb9cbb1	117
44d6e2f2	118	WARN_ON(skb_nfct(skb));
5e8018fc	119	zone = nf_ct_zone_tmpl(tmpl, skb, &tmp);
9fb9cbb1	120
e2a3123f	121	/* Are they talking about one of our connections? */
1025ce75 FW	122	if (!nf_ct_get_tuplepr(skb, dataoff,
1025ce75 FW	123	state->pf, state->net, &origtuple))
9fb9cbb1	124	return -NF_ACCEPT;
9fb9cbb1	125
e905a9ed YH	126	/* Ordinarily, we'd expect the inverted tupleproto, but it's
e905a9ed YH	127	been preserved inside the ICMP. */
1025ce75	128	if (!nf_ct_invert_tuple(&innertuple, &origtuple))
9fb9cbb1	129	return -NF_ACCEPT;
9fb9cbb1	130
93e66024	131	h = nf_conntrack_find_get(state->net, zone, &innertuple);
1025ce75 FW	132	if (!h)
	133	return -NF_ACCEPT;
	134
	135	/* Consider: A -> T (=This machine) -> B
	136	* Conntrack entry will look like this:
	137	* Original: A->B
	138	* Reply: B->T (SNAT case) OR A
	139	*
	140	* When this function runs, we got packet that looks like this:
	141	* iphdr\|icmphdr\|inner_iphdr\|l4header (tcp, udp, ..).
	142	*
	143	* Above nf_conntrack_find_get() makes lookup based on inner_hdr,
	144	* so we should expect that destination of the found connection
	145	* matches outer header destination address.
	146	*
	147	* In above example, we can consider these two cases:
	148	* 1. Error coming in reply direction from B or M (middle box) to
	149	* T (SNAT case) or A.
	150	* Inner saddr will be B, dst will be T or A.
	151	* The found conntrack will be reply tuple (B->T/A).
	152	* 2. Error coming in original direction from A or M to B.
	153	* Inner saddr will be A, inner daddr will be B.
	154	* The found conntrack will be original tuple (A->B).
	155	*
	156	* In both cases, conntrack[dir].dst == inner.dst.
	157	*
	158	* A bogus packet could look like this:
	159	* Inner: B->T
	160	* Outer: B->X (other machine reachable by T).
	161	*
	162	* In this case, lookup yields connection A->B and will
	163	* set packet from B->X as RELATED, even though no connection
	164	* from X was ever seen.
	165	*/
	166	ct = nf_ct_tuplehash_to_ctrack(h);
	167	dir = NF_CT_DIRECTION(h);
	168	ct_daddr = &ct->tuplehash[dir].tuple.dst.u3;
	169	if (!nf_inet_addr_cmp(outer_daddr, ct_daddr)) {
	170	if (state->pf == AF_INET) {
	171	nf_l4proto_log_invalid(skb, state->net, state->pf,
	172	l4proto,
	173	"outer daddr %pI4 != inner %pI4",
	174	&outer_daddr->ip, &ct_daddr->ip);
	175	} else if (state->pf == AF_INET6) {
	176	nf_l4proto_log_invalid(skb, state->net, state->pf,
	177	l4proto,
	178	"outer daddr %pI6 != inner %pI6",
	179	&outer_daddr->ip6, &ct_daddr->ip6);
	180	}
	181	nf_ct_put(ct);
130e7a83	182	return -NF_ACCEPT;
9fb9cbb1 YK	183	}
9fb9cbb1 YK	184
1025ce75 FW	185	ctinfo = IP_CT_RELATED;
1025ce75 FW	186	if (dir == IP_CT_DIR_REPLY)
11df4b76	187	ctinfo += IP_CT_IS_REPLY;
130e7a83	188
e905a9ed	189	/* Update skb to refer to this connection */
1025ce75	190	nf_ct_set(skb, ct, ctinfo);
88ed01d1	191	return NF_ACCEPT;
9fb9cbb1 YK	192	}
9fb9cbb1 YK	193
93e66024 FW	194	static void icmp_error_log(const struct sk_buff *skb,
	195	const struct nf_hook_state *state,
	196	const char *msg)
c4f3db15	197	{
93e66024 FW	198	nf_l4proto_log_invalid(skb, state->net, state->pf,
93e66024 FW	199	IPPROTO_ICMP, "%s", msg);
c4f3db15 FW	200	}
c4f3db15 FW	201
9fb9cbb1	202	/* Small and modified version of icmp_rcv */
6fe78fa4 FW	203	int nf_conntrack_icmpv4_error(struct nf_conn *tmpl,
	204	struct sk_buff *skb, unsigned int dataoff,
	205	const struct nf_hook_state *state)
9fb9cbb1	206	{
1025ce75	207	union nf_inet_addr outer_daddr;
7cc3864d JE	208	const struct icmphdr *icmph;
7cc3864d JE	209	struct icmphdr _ih;
9fb9cbb1 YK	210
9fb9cbb1 YK	211	/* Not enough header? */
1025ce75	212	icmph = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
9fb9cbb1	213	if (icmph == NULL) {
93e66024	214	icmp_error_log(skb, state, "short packet");
9fb9cbb1 YK	215	return -NF_ACCEPT;
	216	}
	217
05ba4c89	218	/* See nf_conntrack_proto_tcp.c */
93e66024 FW	219	if (state->net->ct.sysctl_checksum &&
93e66024 FW	220	state->hook == NF_INET_PRE_ROUTING &&
5d154984	221	nf_ip_checksum(skb, state->hook, dataoff, IPPROTO_ICMP)) {
93e66024	222	icmp_error_log(skb, state, "bad hw icmp checksum");
9fb9cbb1	223	return -NF_ACCEPT;
9fb9cbb1 YK	224	}
9fb9cbb1 YK	225
9fb9cbb1 YK	226	/*
	227	* 18 is the highest 'known' ICMP type. Anything else is a mystery
	228	*
	229	* RFC 1122: 3.2.2 Unknown ICMP messages types MUST be silently
	230	* discarded.
	231	*/
	232	if (icmph->type > NR_ICMP_TYPES) {
93e66024	233	icmp_error_log(skb, state, "invalid icmp type");
9fb9cbb1 YK	234	return -NF_ACCEPT;
	235	}
	236
	237	/* Need to track icmp error message? */
3666ed1c JP	238	if (icmph->type != ICMP_DEST_UNREACH &&
	239	icmph->type != ICMP_SOURCE_QUENCH &&
	240	icmph->type != ICMP_TIME_EXCEEDED &&
	241	icmph->type != ICMP_PARAMETERPROB &&
	242	icmph->type != ICMP_REDIRECT)
9fb9cbb1 YK	243	return NF_ACCEPT;
9fb9cbb1 YK	244
1025ce75 FW	245	memset(&outer_daddr, 0, sizeof(outer_daddr));
	246	outer_daddr.ip = ip_hdr(skb)->daddr;
	247
	248	dataoff += sizeof(*icmph);
	249	return nf_conntrack_inet_error(tmpl, skb, dataoff, state,
	250	IPPROTO_ICMP, &outer_daddr);
9fb9cbb1 YK	251	}
9fb9cbb1 YK	252
24de3d37	253	#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
c1d10adb PNA	254
	255	#include <linux/netfilter/nfnetlink.h>
	256	#include <linux/netfilter/nfnetlink_conntrack.h>
	257
fdf70832	258	static int icmp_tuple_to_nlattr(struct sk_buff *skb,
c1d10adb PNA	259	const struct nf_conntrack_tuple *t)
c1d10adb PNA	260	{
d317e4f6 DM	261	if (nla_put_be16(skb, CTA_PROTO_ICMP_ID, t->src.u.icmp.id) \|\|
	262	nla_put_u8(skb, CTA_PROTO_ICMP_TYPE, t->dst.u.icmp.type) \|\|
	263	nla_put_u8(skb, CTA_PROTO_ICMP_CODE, t->dst.u.icmp.code))
	264	goto nla_put_failure;
c1d10adb PNA	265	return 0;
c1d10adb PNA	266
df6fb868	267	nla_put_failure:
c1d10adb PNA	268	return -1;
	269	}
	270
f73e924c PM	271	static const struct nla_policy icmp_nla_policy[CTA_PROTO_MAX+1] = {
	272	[CTA_PROTO_ICMP_TYPE] = { .type = NLA_U8 },
	273	[CTA_PROTO_ICMP_CODE] = { .type = NLA_U8 },
	274	[CTA_PROTO_ICMP_ID] = { .type = NLA_U16 },
c1d10adb PNA	275	};
c1d10adb PNA	276
fdf70832	277	static int icmp_nlattr_to_tuple(struct nlattr *tb[],
c1d10adb PNA	278	struct nf_conntrack_tuple *tuple)
c1d10adb PNA	279	{
3666ed1c JP	280	if (!tb[CTA_PROTO_ICMP_TYPE] \|\|
	281	!tb[CTA_PROTO_ICMP_CODE] \|\|
	282	!tb[CTA_PROTO_ICMP_ID])
c1d10adb PNA	283	return -EINVAL;
c1d10adb PNA	284
77236b6e PM	285	tuple->dst.u.icmp.type = nla_get_u8(tb[CTA_PROTO_ICMP_TYPE]);
	286	tuple->dst.u.icmp.code = nla_get_u8(tb[CTA_PROTO_ICMP_CODE]);
	287	tuple->src.u.icmp.id = nla_get_be16(tb[CTA_PROTO_ICMP_ID]);
c1d10adb	288
3666ed1c JP	289	if (tuple->dst.u.icmp.type >= sizeof(invmap) \|\|
3666ed1c JP	290	!invmap[tuple->dst.u.icmp.type])
c1d10adb PNA	291	return -EINVAL;
	292
	293	return 0;
	294	}
a400c30e	295
5caaed15	296	static unsigned int icmp_nlattr_tuple_size(void)
a400c30e	297	{
5caaed15 FW	298	static unsigned int size __read_mostly;
	299
	300	if (!size)
	301	size = nla_policy_len(icmp_nla_policy, CTA_PROTO_MAX + 1);
	302
	303	return size;
a400c30e	304	}
c1d10adb PNA	305	#endif
c1d10adb PNA	306
a874752a	307	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
50978462 PNA	308
	309	#include <linux/netfilter/nfnetlink.h>
	310	#include <linux/netfilter/nfnetlink_cttimeout.h>
	311
8264deb8 G	312	static int icmp_timeout_nlattr_to_obj(struct nlattr *tb[],
8264deb8 G	313	struct net net, void data)
50978462 PNA	314	{
50978462 PNA	315	unsigned int *timeout = data;
a95a7774	316	struct nf_icmp_net *in = nf_icmp_pernet(net);
50978462 PNA	317
50978462 PNA	318	if (tb[CTA_TIMEOUT_ICMP_TIMEOUT]) {
c779e849 FW	319	if (!timeout)
c779e849 FW	320	timeout = &in->timeout;
50978462 PNA	321	*timeout =
50978462 PNA	322	ntohl(nla_get_be32(tb[CTA_TIMEOUT_ICMP_TIMEOUT])) * HZ;
c779e849	323	} else if (timeout) {
50978462	324	/* Set default ICMP timeout. */
8264deb8	325	*timeout = in->timeout;
50978462 PNA	326	}
	327	return 0;
	328	}
	329
	330	static int
	331	icmp_timeout_obj_to_nlattr(struct sk_buff skb, const void data)
	332	{
	333	const unsigned int *timeout = data;
	334
d317e4f6 DM	335	if (nla_put_be32(skb, CTA_TIMEOUT_ICMP_TIMEOUT, htonl(*timeout / HZ)))
d317e4f6 DM	336	goto nla_put_failure;
50978462 PNA	337	return 0;
	338
	339	nla_put_failure:
	340	return -ENOSPC;
	341	}
	342
	343	static const struct nla_policy
	344	icmp_timeout_nla_policy[CTA_TIMEOUT_ICMP_MAX+1] = {
	345	[CTA_TIMEOUT_ICMP_TIMEOUT] = { .type = NLA_U32 },
	346	};
a874752a	347	#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
50978462	348
2a389de8	349	void nf_conntrack_icmp_init_net(struct net *net)
a9082b45	350	{
a95a7774	351	struct nf_icmp_net *in = nf_icmp_pernet(net);
a9082b45 G	352
a9082b45 G	353	in->timeout = nf_ct_icmp_timeout;
08911475 PNA	354	}
08911475 PNA	355
9dae47ab	356	const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp =
9fb9cbb1	357	{
605dcad6	358	.l4proto = IPPROTO_ICMP,
24de3d37	359	#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
fdf70832	360	.tuple_to_nlattr = icmp_tuple_to_nlattr,
a400c30e	361	.nlattr_tuple_size = icmp_nlattr_tuple_size,
fdf70832	362	.nlattr_to_tuple = icmp_nlattr_to_tuple,
f73e924c	363	.nla_policy = icmp_nla_policy,
c1d10adb	364	#endif
a874752a	365	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
50978462 PNA	366	.ctnl_timeout = {
	367	.nlattr_to_obj = icmp_timeout_nlattr_to_obj,
	368	.obj_to_nlattr = icmp_timeout_obj_to_nlattr,
	369	.nlattr_max = CTA_TIMEOUT_ICMP_MAX,
	370	.obj_size = sizeof(unsigned int),
	371	.nla_policy = icmp_timeout_nla_policy,
	372	},
a874752a	373	#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
9fb9cbb1	374	};