1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Helper handling for netfilter. */ 3 4 /* (C) 1999-2001 Paul `Rusty' Russell 5 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 6 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org> 7 * (C) 2006-2012 Patrick McHardy <kaber@trash.net> 8 */ 9 10 #include <linux/types.h> 11 #include <linux/netfilter.h> 12 #include <linux/module.h> 13 #include <linux/skbuff.h> 14 #include <linux/vmalloc.h> 15 #include <linux/stddef.h> 16 #include <linux/random.h> 17 #include <linux/err.h> 18 #include <linux/kernel.h> 19 #include <linux/netdevice.h> 20 #include <linux/rculist.h> 21 #include <linux/rtnetlink.h> 22 23 #include <net/netfilter/nf_conntrack.h> 24 #include <net/netfilter/nf_conntrack_core.h> 25 #include <net/netfilter/nf_conntrack_ecache.h> 26 #include <net/netfilter/nf_conntrack_extend.h> 27 #include <net/netfilter/nf_conntrack_helper.h> 28 #include <net/netfilter/nf_conntrack_l4proto.h> 29 #include <net/netfilter/nf_log.h> 30 31 static DEFINE_MUTEX(nf_ct_helper_mutex); 32 struct hlist_head *nf_ct_helper_hash __read_mostly; 33 EXPORT_SYMBOL_GPL(nf_ct_helper_hash); 34 unsigned int nf_ct_helper_hsize __read_mostly; 35 EXPORT_SYMBOL_GPL(nf_ct_helper_hsize); 36 static unsigned int nf_ct_helper_count __read_mostly; 37 38 static DEFINE_MUTEX(nf_ct_nat_helpers_mutex); 39 static struct list_head nf_ct_nat_helpers __read_mostly; 40 41 /* Stupid hash, but collision free for the default registrations of the 42 * helpers currently in the kernel. */ 43 static unsigned int helper_hash(const struct nf_conntrack_tuple *tuple) 44 { 45 return (((tuple->src.l3num << 8) | tuple->dst.protonum) ^ 46 (__force __u16)tuple->src.u.all) % nf_ct_helper_hsize; 47 } 48 49 struct nf_conntrack_helper * 50 __nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum) 51 { 52 struct nf_conntrack_helper *h; 53 unsigned int i; 54 55 for (i = 0; i < nf_ct_helper_hsize; i++) { 56 hlist_for_each_entry_rcu(h, &nf_ct_helper_hash[i], hnode) { 57 if (strcmp(h->name, name)) 58 continue; 59 60 if (h->tuple.src.l3num != NFPROTO_UNSPEC && 61 h->tuple.src.l3num != l3num) 62 continue; 63 64 if (h->tuple.dst.protonum == protonum) 65 return h; 66 } 67 } 68 return NULL; 69 } 70 EXPORT_SYMBOL_GPL(__nf_conntrack_helper_find); 71 72 struct nf_conntrack_helper * 73 nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum) 74 { 75 struct nf_conntrack_helper *h; 76 77 rcu_read_lock(); 78 79 h = __nf_conntrack_helper_find(name, l3num, protonum); 80 #ifdef CONFIG_MODULES 81 if (h == NULL) { 82 rcu_read_unlock(); 83 if (request_module("nfct-helper-%s", name) == 0) { 84 rcu_read_lock(); 85 h = __nf_conntrack_helper_find(name, l3num, protonum); 86 } else { 87 return h; 88 } 89 } 90 #endif 91 if (h != NULL && !try_module_get(h->me)) 92 h = NULL; 93 if (h != NULL && !refcount_inc_not_zero(&h->refcnt)) { 94 module_put(h->me); 95 h = NULL; 96 } 97 98 rcu_read_unlock(); 99 100 return h; 101 } 102 EXPORT_SYMBOL_GPL(nf_conntrack_helper_try_module_get); 103 104 void nf_conntrack_helper_put(struct nf_conntrack_helper *helper) 105 { 106 refcount_dec(&helper->refcnt); 107 module_put(helper->me); 108 } 109 EXPORT_SYMBOL_GPL(nf_conntrack_helper_put); 110 111 static struct nf_conntrack_nat_helper * 112 nf_conntrack_nat_helper_find(const char *mod_name) 113 { 114 struct nf_conntrack_nat_helper *cur; 115 bool found = false; 116 117 list_for_each_entry_rcu(cur, &nf_ct_nat_helpers, list) { 118 if (!strcmp(cur->mod_name, mod_name)) { 119 found = true; 120 break; 121 } 122 } 123 return found ? cur : NULL; 124 } 125 126 int 127 nf_nat_helper_try_module_get(const char *name, u16 l3num, u8 protonum) 128 { 129 struct nf_conntrack_helper *h; 130 struct nf_conntrack_nat_helper *nat; 131 char mod_name[NF_CT_HELPER_NAME_LEN]; 132 int ret = 0; 133 134 rcu_read_lock(); 135 h = __nf_conntrack_helper_find(name, l3num, protonum); 136 if (!h) { 137 rcu_read_unlock(); 138 return -ENOENT; 139 } 140 141 nat = nf_conntrack_nat_helper_find(h->nat_mod_name); 142 if (!nat) { 143 snprintf(mod_name, sizeof(mod_name), "%s", h->nat_mod_name); 144 rcu_read_unlock(); 145 request_module("%s", mod_name); 146 147 rcu_read_lock(); 148 nat = nf_conntrack_nat_helper_find(mod_name); 149 if (!nat) { 150 rcu_read_unlock(); 151 return -ENOENT; 152 } 153 } 154 155 if (!try_module_get(nat->module)) 156 ret = -ENOENT; 157 158 rcu_read_unlock(); 159 return ret; 160 } 161 EXPORT_SYMBOL_GPL(nf_nat_helper_try_module_get); 162 163 void nf_nat_helper_put(struct nf_conntrack_helper *helper) 164 { 165 struct nf_conntrack_nat_helper *nat; 166 167 nat = nf_conntrack_nat_helper_find(helper->nat_mod_name); 168 if (WARN_ON_ONCE(!nat)) 169 return; 170 171 module_put(nat->module); 172 } 173 EXPORT_SYMBOL_GPL(nf_nat_helper_put); 174 175 struct nf_conn_help * 176 nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp) 177 { 178 struct nf_conn_help *help; 179 180 help = nf_ct_ext_add(ct, NF_CT_EXT_HELPER, gfp); 181 if (help) 182 INIT_HLIST_HEAD(&help->expectations); 183 else 184 pr_debug("failed to add helper extension area"); 185 return help; 186 } 187 EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add); 188 189 int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl, 190 gfp_t flags) 191 { 192 struct nf_conntrack_helper *helper = NULL; 193 struct nf_conn_help *help; 194 195 /* We already got a helper explicitly attached. The function 196 * nf_conntrack_alter_reply - in case NAT is in use - asks for looking 197 * the helper up again. Since now the user is in full control of 198 * making consistent helper configurations, skip this automatic 199 * re-lookup, otherwise we'll lose the helper. 200 */ 201 if (test_bit(IPS_HELPER_BIT, &ct->status)) 202 return 0; 203 204 if (WARN_ON_ONCE(!tmpl)) 205 return 0; 206 207 help = nfct_help(tmpl); 208 if (help != NULL) { 209 helper = rcu_dereference(help->helper); 210 set_bit(IPS_HELPER_BIT, &ct->status); 211 } 212 213 help = nfct_help(ct); 214 215 if (helper == NULL) { 216 if (help) 217 RCU_INIT_POINTER(help->helper, NULL); 218 return 0; 219 } 220 221 if (help == NULL) { 222 help = nf_ct_helper_ext_add(ct, flags); 223 if (help == NULL) 224 return -ENOMEM; 225 } else { 226 /* We only allow helper re-assignment of the same sort since 227 * we cannot reallocate the helper extension area. 228 */ 229 struct nf_conntrack_helper *tmp = rcu_dereference(help->helper); 230 231 if (tmp && tmp->help != helper->help) { 232 RCU_INIT_POINTER(help->helper, NULL); 233 return 0; 234 } 235 } 236 237 rcu_assign_pointer(help->helper, helper); 238 239 return 0; 240 } 241 EXPORT_SYMBOL_GPL(__nf_ct_try_assign_helper); 242 243 /* appropriate ct lock protecting must be taken by caller */ 244 static int unhelp(struct nf_conn *ct, void *me) 245 { 246 struct nf_conn_help *help = nfct_help(ct); 247 248 if (help && rcu_dereference_raw(help->helper) == me) { 249 nf_conntrack_event(IPCT_HELPER, ct); 250 RCU_INIT_POINTER(help->helper, NULL); 251 } 252 253 /* We are not intended to delete this conntrack. */ 254 return 0; 255 } 256 257 void nf_ct_helper_destroy(struct nf_conn *ct) 258 { 259 struct nf_conn_help *help = nfct_help(ct); 260 struct nf_conntrack_helper *helper; 261 262 if (help) { 263 rcu_read_lock(); 264 helper = rcu_dereference(help->helper); 265 if (helper && helper->destroy) 266 helper->destroy(ct); 267 rcu_read_unlock(); 268 } 269 } 270 271 static LIST_HEAD(nf_ct_helper_expectfn_list); 272 273 void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n) 274 { 275 spin_lock_bh(&nf_conntrack_expect_lock); 276 list_add_rcu(&n->head, &nf_ct_helper_expectfn_list); 277 spin_unlock_bh(&nf_conntrack_expect_lock); 278 } 279 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_register); 280 281 void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n) 282 { 283 spin_lock_bh(&nf_conntrack_expect_lock); 284 list_del_rcu(&n->head); 285 spin_unlock_bh(&nf_conntrack_expect_lock); 286 } 287 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_unregister); 288 289 /* Caller should hold the rcu lock */ 290 struct nf_ct_helper_expectfn * 291 nf_ct_helper_expectfn_find_by_name(const char *name) 292 { 293 struct nf_ct_helper_expectfn *cur; 294 bool found = false; 295 296 list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) { 297 if (!strcmp(cur->name, name)) { 298 found = true; 299 break; 300 } 301 } 302 return found ? cur : NULL; 303 } 304 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_name); 305 306 /* Caller should hold the rcu lock */ 307 struct nf_ct_helper_expectfn * 308 nf_ct_helper_expectfn_find_by_symbol(const void *symbol) 309 { 310 struct nf_ct_helper_expectfn *cur; 311 bool found = false; 312 313 list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) { 314 if (cur->expectfn == symbol) { 315 found = true; 316 break; 317 } 318 } 319 return found ? cur : NULL; 320 } 321 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_symbol); 322 323 __printf(3, 4) 324 void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct, 325 const char *fmt, ...) 326 { 327 const struct nf_conn_help *help; 328 const struct nf_conntrack_helper *helper; 329 struct va_format vaf; 330 va_list args; 331 332 va_start(args, fmt); 333 334 vaf.fmt = fmt; 335 vaf.va = &args; 336 337 /* Called from the helper function, this call never fails */ 338 help = nfct_help(ct); 339 340 /* rcu_read_lock()ed by nf_hook_thresh */ 341 helper = rcu_dereference(help->helper); 342 343 nf_log_packet(nf_ct_net(ct), nf_ct_l3num(ct), 0, skb, NULL, NULL, NULL, 344 "nf_ct_%s: dropping packet: %pV ", helper->name, &vaf); 345 346 va_end(args); 347 } 348 EXPORT_SYMBOL_GPL(nf_ct_helper_log); 349 350 int nf_conntrack_helper_register(struct nf_conntrack_helper *me) 351 { 352 struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) }; 353 unsigned int h = helper_hash(&me->tuple); 354 struct nf_conntrack_helper *cur; 355 int ret = 0, i; 356 357 BUG_ON(me->expect_policy == NULL); 358 BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES); 359 BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1); 360 361 if (me->expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) 362 return -EINVAL; 363 364 mutex_lock(&nf_ct_helper_mutex); 365 for (i = 0; i < nf_ct_helper_hsize; i++) { 366 hlist_for_each_entry(cur, &nf_ct_helper_hash[i], hnode) { 367 if (!strcmp(cur->name, me->name) && 368 (cur->tuple.src.l3num == NFPROTO_UNSPEC || 369 cur->tuple.src.l3num == me->tuple.src.l3num) && 370 cur->tuple.dst.protonum == me->tuple.dst.protonum) { 371 ret = -EEXIST; 372 goto out; 373 } 374 } 375 } 376 377 /* avoid unpredictable behaviour for auto_assign_helper */ 378 if (!(me->flags & NF_CT_HELPER_F_USERSPACE)) { 379 hlist_for_each_entry(cur, &nf_ct_helper_hash[h], hnode) { 380 if (nf_ct_tuple_src_mask_cmp(&cur->tuple, &me->tuple, 381 &mask)) { 382 ret = -EEXIST; 383 goto out; 384 } 385 } 386 } 387 refcount_set(&me->refcnt, 1); 388 hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]); 389 nf_ct_helper_count++; 390 out: 391 mutex_unlock(&nf_ct_helper_mutex); 392 return ret; 393 } 394 EXPORT_SYMBOL_GPL(nf_conntrack_helper_register); 395 396 static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data) 397 { 398 struct nf_conn_help *help = nfct_help(exp->master); 399 const struct nf_conntrack_helper *me = data; 400 const struct nf_conntrack_helper *this; 401 402 if (exp->helper == me) 403 return true; 404 405 this = rcu_dereference_protected(help->helper, 406 lockdep_is_held(&nf_conntrack_expect_lock)); 407 return this == me; 408 } 409 410 void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) 411 { 412 mutex_lock(&nf_ct_helper_mutex); 413 hlist_del_rcu(&me->hnode); 414 nf_ct_helper_count--; 415 mutex_unlock(&nf_ct_helper_mutex); 416 417 /* Make sure every nothing is still using the helper unless its a 418 * connection in the hash. 419 */ 420 synchronize_rcu(); 421 422 nf_ct_expect_iterate_destroy(expect_iter_me, NULL); 423 nf_ct_iterate_destroy(unhelp, me); 424 } 425 EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister); 426 427 void nf_ct_helper_init(struct nf_conntrack_helper *helper, 428 u16 l3num, u16 protonum, const char *name, 429 u16 default_port, u16 spec_port, u32 id, 430 const struct nf_conntrack_expect_policy *exp_pol, 431 u32 expect_class_max, 432 int (*help)(struct sk_buff *skb, unsigned int protoff, 433 struct nf_conn *ct, 434 enum ip_conntrack_info ctinfo), 435 int (*from_nlattr)(struct nlattr *attr, 436 struct nf_conn *ct), 437 struct module *module) 438 { 439 helper->tuple.src.l3num = l3num; 440 helper->tuple.dst.protonum = protonum; 441 helper->tuple.src.u.all = htons(spec_port); 442 helper->expect_policy = exp_pol; 443 helper->expect_class_max = expect_class_max; 444 helper->help = help; 445 helper->from_nlattr = from_nlattr; 446 helper->me = module; 447 snprintf(helper->nat_mod_name, sizeof(helper->nat_mod_name), 448 NF_NAT_HELPER_PREFIX "%s", name); 449 450 if (spec_port == default_port) 451 snprintf(helper->name, sizeof(helper->name), "%s", name); 452 else 453 snprintf(helper->name, sizeof(helper->name), "%s-%u", name, id); 454 } 455 EXPORT_SYMBOL_GPL(nf_ct_helper_init); 456 457 int nf_conntrack_helpers_register(struct nf_conntrack_helper *helper, 458 unsigned int n) 459 { 460 unsigned int i; 461 int err = 0; 462 463 for (i = 0; i < n; i++) { 464 err = nf_conntrack_helper_register(&helper[i]); 465 if (err < 0) 466 goto err; 467 } 468 469 return err; 470 err: 471 if (i > 0) 472 nf_conntrack_helpers_unregister(helper, i); 473 return err; 474 } 475 EXPORT_SYMBOL_GPL(nf_conntrack_helpers_register); 476 477 void nf_conntrack_helpers_unregister(struct nf_conntrack_helper *helper, 478 unsigned int n) 479 { 480 while (n-- > 0) 481 nf_conntrack_helper_unregister(&helper[n]); 482 } 483 EXPORT_SYMBOL_GPL(nf_conntrack_helpers_unregister); 484 485 void nf_nat_helper_register(struct nf_conntrack_nat_helper *nat) 486 { 487 mutex_lock(&nf_ct_nat_helpers_mutex); 488 list_add_rcu(&nat->list, &nf_ct_nat_helpers); 489 mutex_unlock(&nf_ct_nat_helpers_mutex); 490 } 491 EXPORT_SYMBOL_GPL(nf_nat_helper_register); 492 493 void nf_nat_helper_unregister(struct nf_conntrack_nat_helper *nat) 494 { 495 mutex_lock(&nf_ct_nat_helpers_mutex); 496 list_del_rcu(&nat->list); 497 mutex_unlock(&nf_ct_nat_helpers_mutex); 498 } 499 EXPORT_SYMBOL_GPL(nf_nat_helper_unregister); 500 501 int nf_conntrack_helper_init(void) 502 { 503 nf_ct_helper_hsize = 1; /* gets rounded up to use one page */ 504 nf_ct_helper_hash = 505 nf_ct_alloc_hashtable(&nf_ct_helper_hsize, 0); 506 if (!nf_ct_helper_hash) 507 return -ENOMEM; 508 509 INIT_LIST_HEAD(&nf_ct_nat_helpers); 510 return 0; 511 } 512 513 void nf_conntrack_helper_fini(void) 514 { 515 kvfree(nf_ct_helper_hash); 516 } 517