[linux-2.6-block.git] / net / netfilter / nf_conntrack_tftp.c

/* (C) 2001-2002 Magnus Boden <mb@ozaba.mine.nu>
 * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/in.h>
#include <linux/udp.h>
#include <linux/netfilter.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_tuple.h>
#include <net/netfilter/nf_conntrack_expect.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <linux/netfilter/nf_conntrack_tftp.h>

MODULE_AUTHOR("Magnus Boden <mb@ozaba.mine.nu>");
MODULE_DESCRIPTION("TFTP connection tracking helper");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ip_conntrack_tftp");
MODULE_ALIAS_NFCT_HELPER("tftp");

#define MAX_PORTS 8
static unsigned short ports[MAX_PORTS];
static unsigned int ports_c;
module_param_array(ports, ushort, &ports_c, 0400);
MODULE_PARM_DESC(ports, "Port numbers of TFTP servers");

unsigned int (*nf_nat_tftp_hook)(struct sk_buff *skb,
				 enum ip_conntrack_info ctinfo,
				 struct nf_conntrack_expect *exp) __read_mostly;
EXPORT_SYMBOL_GPL(nf_nat_tftp_hook);

static int tftp_help(struct sk_buff *skb,
		     unsigned int protoff,
		     struct nf_conn *ct,
		     enum ip_conntrack_info ctinfo)
{
	const struct tftphdr *tfh;
	struct tftphdr _tftph;
	struct nf_conntrack_expect *exp;
	struct nf_conntrack_tuple *tuple;
	unsigned int ret = NF_ACCEPT;
	typeof(nf_nat_tftp_hook) nf_nat_tftp;

	tfh = skb_header_pointer(skb, protoff + sizeof(struct udphdr),
				 sizeof(_tftph), &_tftph);
	if (tfh == NULL)
		return NF_ACCEPT;

	switch (ntohs(tfh->opcode)) {
	case TFTP_OPCODE_READ:
	case TFTP_OPCODE_WRITE:
		/* RRQ and WRQ works the same way */
		nf_ct_dump_tuple(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
		nf_ct_dump_tuple(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);

		exp = nf_ct_expect_alloc(ct);
		if (exp == NULL) {
			nf_ct_helper_log(skb, ct, "cannot alloc expectation");
			return NF_DROP;
		}
		tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
		nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
				  nf_ct_l3num(ct),
				  &tuple->src.u3, &tuple->dst.u3,
				  IPPROTO_UDP, NULL, &tuple->dst.u.udp.port);

		pr_debug("expect: ");
		nf_ct_dump_tuple(&exp->tuple);

		nf_nat_tftp = rcu_dereference(nf_nat_tftp_hook);
		if (nf_nat_tftp && ct->status & IPS_NAT_MASK)
			ret = nf_nat_tftp(skb, ctinfo, exp);
		else if (nf_ct_expect_related(exp) != 0) {
			nf_ct_helper_log(skb, ct, "cannot add expectation");
			ret = NF_DROP;
		}
		nf_ct_expect_put(exp);
		break;
	case TFTP_OPCODE_DATA:
	case TFTP_OPCODE_ACK:
		pr_debug("Data/ACK opcode\n");
		break;
	case TFTP_OPCODE_ERROR:
		pr_debug("Error opcode\n");
		break;
	default:
		pr_debug("Unknown opcode\n");
	}
	return ret;
}

static struct nf_conntrack_helper tftp[MAX_PORTS][2] __read_mostly;

static const struct nf_conntrack_expect_policy tftp_exp_policy = {
	.max_expected	= 1,
	.timeout	= 5 * 60,
};

static void nf_conntrack_tftp_fini(void)
{
	int i, j;

	for (i = 0; i < ports_c; i++) {
		for (j = 0; j < 2; j++)
			nf_conntrack_helper_unregister(&tftp[i][j]);
	}
}

static int __init nf_conntrack_tftp_init(void)
{
	int i, j, ret;

	if (ports_c == 0)
		ports[ports_c++] = TFTP_PORT;

	for (i = 0; i < ports_c; i++) {
		memset(&tftp[i], 0, sizeof(tftp[i]));

		tftp[i][0].tuple.src.l3num = AF_INET;
		tftp[i][1].tuple.src.l3num = AF_INET6;
		for (j = 0; j < 2; j++) {
			tftp[i][j].tuple.dst.protonum = IPPROTO_UDP;
			tftp[i][j].tuple.src.u.udp.port = htons(ports[i]);
			tftp[i][j].expect_policy = &tftp_exp_policy;
			tftp[i][j].me = THIS_MODULE;
			tftp[i][j].help = tftp_help;

			if (ports[i] == TFTP_PORT)
				sprintf(tftp[i][j].name, "tftp");
			else
				sprintf(tftp[i][j].name, "tftp-%u", i);

			ret = nf_conntrack_helper_register(&tftp[i][j]);
			if (ret) {
				pr_err("failed to register helper for pf: %u port: %u\n",
				       tftp[i][j].tuple.src.l3num, ports[i]);
				ports_c = i;
				nf_conntrack_tftp_fini();
				return ret;
			}
		}
	}
	return 0;
}

module_init(nf_conntrack_tftp_init);
module_exit(nf_conntrack_tftp_fini);
Commit	Line	Data
a536df35	1	/* (C) 2001-2002 Magnus Boden <mb@ozaba.mine.nu>
f229f6ce	2	* (C) 2006-2012 Patrick McHardy <kaber@trash.net>
a536df35 PM	3	* This program is free software; you can redistribute it and/or modify
	4	* it under the terms of the GNU General Public License version 2 as
	5	* published by the Free Software Foundation.
	6	*/
	7
ad6d9503 PNA	8	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
ad6d9503 PNA	9
a536df35 PM	10	#include <linux/module.h>
	11	#include <linux/moduleparam.h>
	12	#include <linux/in.h>
	13	#include <linux/udp.h>
1863f096	14	#include <linux/netfilter.h>
a536df35 PM	15
	16	#include <net/netfilter/nf_conntrack.h>
	17	#include <net/netfilter/nf_conntrack_tuple.h>
	18	#include <net/netfilter/nf_conntrack_expect.h>
	19	#include <net/netfilter/nf_conntrack_ecache.h>
	20	#include <net/netfilter/nf_conntrack_helper.h>
	21	#include <linux/netfilter/nf_conntrack_tftp.h>
	22
	23	MODULE_AUTHOR("Magnus Boden <mb@ozaba.mine.nu>");
	24	MODULE_DESCRIPTION("TFTP connection tracking helper");
	25	MODULE_LICENSE("GPL");
	26	MODULE_ALIAS("ip_conntrack_tftp");
4dc06f96	27	MODULE_ALIAS_NFCT_HELPER("tftp");
a536df35 PM	28
	29	#define MAX_PORTS 8
	30	static unsigned short ports[MAX_PORTS];
2f0d2f10	31	static unsigned int ports_c;
a536df35 PM	32	module_param_array(ports, ushort, &ports_c, 0400);
	33	MODULE_PARM_DESC(ports, "Port numbers of TFTP servers");
	34
3db05fea	35	unsigned int (nf_nat_tftp_hook)(struct sk_buff skb,
a536df35 PM	36	enum ip_conntrack_info ctinfo,
	37	struct nf_conntrack_expect *exp) __read_mostly;
	38	EXPORT_SYMBOL_GPL(nf_nat_tftp_hook);
	39
3db05fea	40	static int tftp_help(struct sk_buff *skb,
a536df35 PM	41	unsigned int protoff,
	42	struct nf_conn *ct,
	43	enum ip_conntrack_info ctinfo)
	44	{
de24b4eb JE	45	const struct tftphdr *tfh;
de24b4eb JE	46	struct tftphdr _tftph;
a536df35 PM	47	struct nf_conntrack_expect *exp;
	48	struct nf_conntrack_tuple *tuple;
	49	unsigned int ret = NF_ACCEPT;
a536df35 PM	50	typeof(nf_nat_tftp_hook) nf_nat_tftp;
a536df35 PM	51
3db05fea	52	tfh = skb_header_pointer(skb, protoff + sizeof(struct udphdr),
a536df35 PM	53	sizeof(_tftph), &_tftph);
	54	if (tfh == NULL)
	55	return NF_ACCEPT;
	56
	57	switch (ntohs(tfh->opcode)) {
	58	case TFTP_OPCODE_READ:
	59	case TFTP_OPCODE_WRITE:
	60	/* RRQ and WRQ works the same way */
3c9fba65 JE	61	nf_ct_dump_tuple(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
3c9fba65 JE	62	nf_ct_dump_tuple(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
a536df35	63
6823645d	64	exp = nf_ct_expect_alloc(ct);
b20ab9cc PNA	65	if (exp == NULL) {
b20ab9cc PNA	66	nf_ct_helper_log(skb, ct, "cannot alloc expectation");
a536df35	67	return NF_DROP;
b20ab9cc	68	}
a536df35	69	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
5e8fbe2a PM	70	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
5e8fbe2a PM	71	nf_ct_l3num(ct),
6002f266	72	&tuple->src.u3, &tuple->dst.u3,
6823645d	73	IPPROTO_UDP, NULL, &tuple->dst.u.udp.port);
a536df35	74
0d53778e	75	pr_debug("expect: ");
3c9fba65	76	nf_ct_dump_tuple(&exp->tuple);
a536df35 PM	77
	78	nf_nat_tftp = rcu_dereference(nf_nat_tftp_hook);
	79	if (nf_nat_tftp && ct->status & IPS_NAT_MASK)
3db05fea	80	ret = nf_nat_tftp(skb, ctinfo, exp);
b20ab9cc PNA	81	else if (nf_ct_expect_related(exp) != 0) {
b20ab9cc PNA	82	nf_ct_helper_log(skb, ct, "cannot add expectation");
a536df35	83	ret = NF_DROP;
b20ab9cc	84	}
6823645d	85	nf_ct_expect_put(exp);
a536df35 PM	86	break;
	87	case TFTP_OPCODE_DATA:
	88	case TFTP_OPCODE_ACK:
0d53778e	89	pr_debug("Data/ACK opcode\n");
a536df35 PM	90	break;
a536df35 PM	91	case TFTP_OPCODE_ERROR:
0d53778e	92	pr_debug("Error opcode\n");
a536df35 PM	93	break;
a536df35 PM	94	default:
0d53778e	95	pr_debug("Unknown opcode\n");
a536df35 PM	96	}
	97	return ret;
	98	}
	99
	100	static struct nf_conntrack_helper tftp[MAX_PORTS][2] __read_mostly;
a536df35	101
6002f266 PM	102	static const struct nf_conntrack_expect_policy tftp_exp_policy = {
	103	.max_expected = 1,
	104	.timeout = 5 * 60,
	105	};
	106
a536df35 PM	107	static void nf_conntrack_tftp_fini(void)
	108	{
	109	int i, j;
	110
	111	for (i = 0; i < ports_c; i++) {
	112	for (j = 0; j < 2; j++)
	113	nf_conntrack_helper_unregister(&tftp[i][j]);
	114	}
	115	}
	116
	117	static int __init nf_conntrack_tftp_init(void)
	118	{
	119	int i, j, ret;
a536df35 PM	120
	121	if (ports_c == 0)
	122	ports[ports_c++] = TFTP_PORT;
	123
	124	for (i = 0; i < ports_c; i++) {
	125	memset(&tftp[i], 0, sizeof(tftp[i]));
	126
	127	tftp[i][0].tuple.src.l3num = AF_INET;
	128	tftp[i][1].tuple.src.l3num = AF_INET6;
	129	for (j = 0; j < 2; j++) {
	130	tftp[i][j].tuple.dst.protonum = IPPROTO_UDP;
	131	tftp[i][j].tuple.src.u.udp.port = htons(ports[i]);
6002f266	132	tftp[i][j].expect_policy = &tftp_exp_policy;
a536df35 PM	133	tftp[i][j].me = THIS_MODULE;
	134	tftp[i][j].help = tftp_help;
	135
a536df35	136	if (ports[i] == TFTP_PORT)
3a8fc53a	137	sprintf(tftp[i][j].name, "tftp");
a536df35	138	else
3a8fc53a	139	sprintf(tftp[i][j].name, "tftp-%u", i);
a536df35 PM	140
	141	ret = nf_conntrack_helper_register(&tftp[i][j]);
	142	if (ret) {
ad6d9503 PNA	143	pr_err("failed to register helper for pf: %u port: %u\n",
ad6d9503 PNA	144	tftp[i][j].tuple.src.l3num, ports[i]);
b7a8daa9	145	ports_c = i;
a536df35 PM	146	nf_conntrack_tftp_fini();
	147	return ret;
	148	}
	149	}
	150	}
	151	return 0;
	152	}
	153
	154	module_init(nf_conntrack_tftp_init);
	155	module_exit(nf_conntrack_tftp_fini);