1
2
3
4
5
6
7
8
9
10
11
12
13#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14
15#include <linux/module.h>
16#include <linux/moduleparam.h>
17#include <linux/netfilter.h>
18#include <linux/ip.h>
19#include <linux/slab.h>
20#include <linux/ipv6.h>
21#include <linux/ctype.h>
22#include <linux/inet.h>
23#include <net/checksum.h>
24#include <net/tcp.h>
25
26#include <net/netfilter/nf_conntrack.h>
27#include <net/netfilter/nf_conntrack_expect.h>
28#include <net/netfilter/nf_conntrack_ecache.h>
29#include <net/netfilter/nf_conntrack_helper.h>
30#include <linux/netfilter/nf_conntrack_ftp.h>
31
32MODULE_LICENSE("GPL");
33MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
34MODULE_DESCRIPTION("ftp connection tracking helper");
35MODULE_ALIAS("ip_conntrack_ftp");
36MODULE_ALIAS_NFCT_HELPER("ftp");
37
38
39static char *ftp_buffer;
40
41static DEFINE_SPINLOCK(nf_ftp_lock);
42
43#define MAX_PORTS 8
44static u_int16_t ports[MAX_PORTS];
45static unsigned int ports_c;
46module_param_array(ports, ushort, &ports_c, 0400);
47
48static bool loose;
49module_param(loose, bool, 0600);
50
51unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
52 enum ip_conntrack_info ctinfo,
53 enum nf_ct_ftp_type type,
54 unsigned int protoff,
55 unsigned int matchoff,
56 unsigned int matchlen,
57 struct nf_conntrack_expect *exp);
58EXPORT_SYMBOL_GPL(nf_nat_ftp_hook);
59
60static int try_rfc959(const char *, size_t, struct nf_conntrack_man *,
61 char, unsigned int *);
62static int try_rfc1123(const char *, size_t, struct nf_conntrack_man *,
63 char, unsigned int *);
64static int try_eprt(const char *, size_t, struct nf_conntrack_man *,
65 char, unsigned int *);
66static int try_epsv_response(const char *, size_t, struct nf_conntrack_man *,
67 char, unsigned int *);
68
69static struct ftp_search {
70 const char *pattern;
71 size_t plen;
72 char skip;
73 char term;
74 enum nf_ct_ftp_type ftptype;
75 int (*getnum)(const char *, size_t, struct nf_conntrack_man *, char, unsigned int *);
76} search[IP_CT_DIR_MAX][2] = {
77 [IP_CT_DIR_ORIGINAL] = {
78 {
79 .pattern = "PORT",
80 .plen = sizeof("PORT") - 1,
81 .skip = ' ',
82 .term = '\r',
83 .ftptype = NF_CT_FTP_PORT,
84 .getnum = try_rfc959,
85 },
86 {
87 .pattern = "EPRT",
88 .plen = sizeof("EPRT") - 1,
89 .skip = ' ',
90 .term = '\r',
91 .ftptype = NF_CT_FTP_EPRT,
92 .getnum = try_eprt,
93 },
94 },
95 [IP_CT_DIR_REPLY] = {
96 {
97 .pattern = "227 ",
98 .plen = sizeof("227 ") - 1,
99 .ftptype = NF_CT_FTP_PASV,
100 .getnum = try_rfc1123,
101 },
102 {
103 .pattern = "229 ",
104 .plen = sizeof("229 ") - 1,
105 .skip = '(',
106 .term = ')',
107 .ftptype = NF_CT_FTP_EPSV,
108 .getnum = try_epsv_response,
109 },
110 },
111};
112
113static int
114get_ipv6_addr(const char *src, size_t dlen, struct in6_addr *dst, u_int8_t term)
115{
116 const char *end;
117 int ret = in6_pton(src, min_t(size_t, dlen, 0xffff), (u8 *)dst, term, &end);
118 if (ret > 0)
119 return (int)(end - src);
120 return 0;
121}
122
123static int try_number(const char *data, size_t dlen, u_int32_t array[],
124 int array_size, char sep, char term)
125{
126 u_int32_t i, len;
127
128 memset(array, 0, sizeof(array[0])*array_size);
129
130
131 for (i = 0, len = 0; len < dlen && i < array_size; len++, data++) {
132 if (*data >= '0' && *data <= '9') {
133 array[i] = array[i]*10 + *data - '0';
134 }
135 else if (*data == sep)
136 i++;
137 else {
138
139
140
141 if ((*data == term || !term) && i == array_size - 1)
142 return len;
143
144 pr_debug("Char %u (got %u nums) `%u' unexpected\n",
145 len, i, *data);
146 return 0;
147 }
148 }
149 pr_debug("Failed to fill %u numbers separated by %c\n",
150 array_size, sep);
151 return 0;
152}
153
154
155static int try_rfc959(const char *data, size_t dlen,
156 struct nf_conntrack_man *cmd, char term,
157 unsigned int *offset)
158{
159 int length;
160 u_int32_t array[6];
161
162 length = try_number(data, dlen, array, 6, ',', term);
163 if (length == 0)
164 return 0;
165
166 cmd->u3.ip = htonl((array[0] << 24) | (array[1] << 16) |
167 (array[2] << 8) | array[3]);
168 cmd->u.tcp.port = htons((array[4] << 8) | array[5]);
169 return length;
170}
171
172
173
174
175
176
177
178
179
180
181
182static int try_rfc1123(const char *data, size_t dlen,
183 struct nf_conntrack_man *cmd, char term,
184 unsigned int *offset)
185{
186 int i;
187 for (i = 0; i < dlen; i++)
188 if (isdigit(data[i]))
189 break;
190
191 if (i == dlen)
192 return 0;
193
194 *offset += i;
195
196 return try_rfc959(data + i, dlen - i, cmd, 0, offset);
197}
198
199
200static int get_port(const char *data, int start, size_t dlen, char delim,
201 __be16 *port)
202{
203 u_int16_t tmp_port = 0;
204 int i;
205
206 for (i = start; i < dlen; i++) {
207
208 if (data[i] == delim) {
209 if (tmp_port == 0)
210 break;
211 *port = htons(tmp_port);
212 pr_debug("get_port: return %d\n", tmp_port);
213 return i + 1;
214 }
215 else if (data[i] >= '0' && data[i] <= '9')
216 tmp_port = tmp_port*10 + data[i] - '0';
217 else {
218 pr_debug("get_port: invalid char.\n");
219 break;
220 }
221 }
222 return 0;
223}
224
225
226static int try_eprt(const char *data, size_t dlen, struct nf_conntrack_man *cmd,
227 char term, unsigned int *offset)
228{
229 char delim;
230 int length;
231
232
233
234 if (dlen <= 3) {
235 pr_debug("EPRT: too short\n");
236 return 0;
237 }
238 delim = data[0];
239 if (isdigit(delim) || delim < 33 || delim > 126 || data[2] != delim) {
240 pr_debug("try_eprt: invalid delimitter.\n");
241 return 0;
242 }
243
244 if ((cmd->l3num == PF_INET && data[1] != '1') ||
245 (cmd->l3num == PF_INET6 && data[1] != '2')) {
246 pr_debug("EPRT: invalid protocol number.\n");
247 return 0;
248 }
249
250 pr_debug("EPRT: Got %c%c%c\n", delim, data[1], delim);
251
252 if (data[1] == '1') {
253 u_int32_t array[4];
254
255
256 length = try_number(data + 3, dlen - 3, array, 4, '.', delim);
257 if (length != 0)
258 cmd->u3.ip = htonl((array[0] << 24) | (array[1] << 16)
259 | (array[2] << 8) | array[3]);
260 } else {
261
262 length = get_ipv6_addr(data + 3, dlen - 3,
263 (struct in6_addr *)cmd->u3.ip6, delim);
264 }
265
266 if (length == 0)
267 return 0;
268 pr_debug("EPRT: Got IP address!\n");
269
270 return get_port(data, 3 + length + 1, dlen, delim, &cmd->u.tcp.port);
271}
272
273
274static int try_epsv_response(const char *data, size_t dlen,
275 struct nf_conntrack_man *cmd, char term,
276 unsigned int *offset)
277{
278 char delim;
279
280
281 if (dlen <= 3) return 0;
282 delim = data[0];
283 if (isdigit(delim) || delim < 33 || delim > 126 ||
284 data[1] != delim || data[2] != delim)
285 return 0;
286
287 return get_port(data, 3, dlen, delim, &cmd->u.tcp.port);
288}
289
290
291static int find_pattern(const char *data, size_t dlen,
292 const char *pattern, size_t plen,
293 char skip, char term,
294 unsigned int *numoff,
295 unsigned int *numlen,
296 struct nf_conntrack_man *cmd,
297 int (*getnum)(const char *, size_t,
298 struct nf_conntrack_man *, char,
299 unsigned int *))
300{
301 size_t i = plen;
302
303 pr_debug("find_pattern `%s': dlen = %Zu\n", pattern, dlen);
304 if (dlen == 0)
305 return 0;
306
307 if (dlen <= plen) {
308
309 if (strncasecmp(data, pattern, dlen) == 0)
310 return -1;
311 else return 0;
312 }
313
314 if (strncasecmp(data, pattern, plen) != 0) {
315#if 0
316 size_t i;
317
318 pr_debug("ftp: string mismatch\n");
319 for (i = 0; i < plen; i++) {
320 pr_debug("ftp:char %u `%c'(%u) vs `%c'(%u)\n",
321 i, data[i], data[i],
322 pattern[i], pattern[i]);
323 }
324#endif
325 return 0;
326 }
327
328 pr_debug("Pattern matches!\n");
329
330
331 if (skip) {
332 for (i = plen; data[i] != skip; i++)
333 if (i == dlen - 1) return -1;
334
335
336 i++;
337 }
338
339 pr_debug("Skipped up to `%c'!\n", skip);
340
341 *numoff = i;
342 *numlen = getnum(data + i, dlen - i, cmd, term, numoff);
343 if (!*numlen)
344 return -1;
345
346 pr_debug("Match succeeded!\n");
347 return 1;
348}
349
350
351static int find_nl_seq(u32 seq, const struct nf_ct_ftp_master *info, int dir)
352{
353 unsigned int i;
354
355 for (i = 0; i < info->seq_aft_nl_num[dir]; i++)
356 if (info->seq_aft_nl[dir][i] == seq)
357 return 1;
358 return 0;
359}
360
361
362static void update_nl_seq(struct nf_conn *ct, u32 nl_seq,
363 struct nf_ct_ftp_master *info, int dir,
364 struct sk_buff *skb)
365{
366 unsigned int i, oldest;
367
368
369 for (i = 0; i < info->seq_aft_nl_num[dir]; i++) {
370 if (info->seq_aft_nl[dir][i] == nl_seq)
371 return;
372 }
373
374 if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
375 info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
376 } else {
377 if (before(info->seq_aft_nl[dir][0], info->seq_aft_nl[dir][1]))
378 oldest = 0;
379 else
380 oldest = 1;
381
382 if (after(nl_seq, info->seq_aft_nl[dir][oldest]))
383 info->seq_aft_nl[dir][oldest] = nl_seq;
384 }
385}
386
387static int help(struct sk_buff *skb,
388 unsigned int protoff,
389 struct nf_conn *ct,
390 enum ip_conntrack_info ctinfo)
391{
392 unsigned int dataoff, datalen;
393 const struct tcphdr *th;
394 struct tcphdr _tcph;
395 const char *fb_ptr;
396 int ret;
397 u32 seq;
398 int dir = CTINFO2DIR(ctinfo);
399 unsigned int uninitialized_var(matchlen), uninitialized_var(matchoff);
400 struct nf_ct_ftp_master *ct_ftp_info = nfct_help_data(ct);
401 struct nf_conntrack_expect *exp;
402 union nf_inet_addr *daddr;
403 struct nf_conntrack_man cmd = {};
404 unsigned int i;
405 int found = 0, ends_in_nl;
406 typeof(nf_nat_ftp_hook) nf_nat_ftp;
407
408
409 if (ctinfo != IP_CT_ESTABLISHED &&
410 ctinfo != IP_CT_ESTABLISHED_REPLY) {
411 pr_debug("ftp: Conntrackinfo = %u\n", ctinfo);
412 return NF_ACCEPT;
413 }
414
415 th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
416 if (th == NULL)
417 return NF_ACCEPT;
418
419 dataoff = protoff + th->doff * 4;
420
421 if (dataoff >= skb->len) {
422 pr_debug("ftp: dataoff(%u) >= skblen(%u)\n", dataoff,
423 skb->len);
424 return NF_ACCEPT;
425 }
426 datalen = skb->len - dataoff;
427
428 spin_lock_bh(&nf_ftp_lock);
429 fb_ptr = skb_header_pointer(skb, dataoff, datalen, ftp_buffer);
430 BUG_ON(fb_ptr == NULL);
431
432 ends_in_nl = (fb_ptr[datalen - 1] == '\n');
433 seq = ntohl(th->seq) + datalen;
434
435
436 if (!find_nl_seq(ntohl(th->seq), ct_ftp_info, dir)) {
437
438 if (unlikely(ct_ftp_info->flags[dir] & NF_CT_FTP_SEQ_PICKUP)) {
439 ct_ftp_info->flags[dir] ^= NF_CT_FTP_SEQ_PICKUP;
440 goto skip_nl_seq;
441 }
442
443
444 pr_debug("nf_conntrack_ftp: wrong seq pos %s(%u) or %s(%u)\n",
445 ct_ftp_info->seq_aft_nl_num[dir] > 0 ? "" : "(UNSET)",
446 ct_ftp_info->seq_aft_nl[dir][0],
447 ct_ftp_info->seq_aft_nl_num[dir] > 1 ? "" : "(UNSET)",
448 ct_ftp_info->seq_aft_nl[dir][1]);
449 ret = NF_ACCEPT;
450 goto out_update_nl;
451 }
452
453skip_nl_seq:
454
455
456 cmd.l3num = nf_ct_l3num(ct);
457 memcpy(cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
458 sizeof(cmd.u3.all));
459
460 for (i = 0; i < ARRAY_SIZE(search[dir]); i++) {
461 found = find_pattern(fb_ptr, datalen,
462 search[dir][i].pattern,
463 search[dir][i].plen,
464 search[dir][i].skip,
465 search[dir][i].term,
466 &matchoff, &matchlen,
467 &cmd,
468 search[dir][i].getnum);
469 if (found) break;
470 }
471 if (found == -1) {
472
473
474
475
476 nf_ct_helper_log(skb, ct, "partial matching of `%s'",
477 search[dir][i].pattern);
478 ret = NF_DROP;
479 goto out;
480 } else if (found == 0) {
481 ret = NF_ACCEPT;
482 goto out_update_nl;
483 }
484
485 pr_debug("conntrack_ftp: match `%.*s' (%u bytes at %u)\n",
486 matchlen, fb_ptr + matchoff,
487 matchlen, ntohl(th->seq) + matchoff);
488
489 exp = nf_ct_expect_alloc(ct);
490 if (exp == NULL) {
491 nf_ct_helper_log(skb, ct, "cannot alloc expectation");
492 ret = NF_DROP;
493 goto out;
494 }
495
496
497
498
499 daddr = &ct->tuplehash[!dir].tuple.dst.u3;
500
501
502 if ((cmd.l3num == nf_ct_l3num(ct)) &&
503 memcmp(&cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
504 sizeof(cmd.u3.all))) {
505
506
507
508
509 if (cmd.l3num == PF_INET) {
510 pr_debug("NOT RECORDING: %pI4 != %pI4\n",
511 &cmd.u3.ip,
512 &ct->tuplehash[dir].tuple.src.u3.ip);
513 } else {
514 pr_debug("NOT RECORDING: %pI6 != %pI6\n",
515 cmd.u3.ip6,
516 ct->tuplehash[dir].tuple.src.u3.ip6);
517 }
518
519
520
521
522
523 if (!loose) {
524 ret = NF_ACCEPT;
525 goto out_put_expect;
526 }
527 daddr = &cmd.u3;
528 }
529
530 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, cmd.l3num,
531 &ct->tuplehash[!dir].tuple.src.u3, daddr,
532 IPPROTO_TCP, NULL, &cmd.u.tcp.port);
533
534
535
536 nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
537 if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
538 ret = nf_nat_ftp(skb, ctinfo, search[dir][i].ftptype,
539 protoff, matchoff, matchlen, exp);
540 else {
541
542 if (nf_ct_expect_related(exp) != 0) {
543 nf_ct_helper_log(skb, ct, "cannot add expectation");
544 ret = NF_DROP;
545 } else
546 ret = NF_ACCEPT;
547 }
548
549out_put_expect:
550 nf_ct_expect_put(exp);
551
552out_update_nl:
553
554
555 if (ends_in_nl)
556 update_nl_seq(ct, seq, ct_ftp_info, dir, skb);
557 out:
558 spin_unlock_bh(&nf_ftp_lock);
559 return ret;
560}
561
562static int nf_ct_ftp_from_nlattr(struct nlattr *attr, struct nf_conn *ct)
563{
564 struct nf_ct_ftp_master *ftp = nfct_help_data(ct);
565
566
567
568
569
570 ftp->flags[IP_CT_DIR_ORIGINAL] |= NF_CT_FTP_SEQ_PICKUP;
571 ftp->flags[IP_CT_DIR_REPLY] |= NF_CT_FTP_SEQ_PICKUP;
572 return 0;
573}
574
575static struct nf_conntrack_helper ftp[MAX_PORTS][2] __read_mostly;
576
577static const struct nf_conntrack_expect_policy ftp_exp_policy = {
578 .max_expected = 1,
579 .timeout = 5 * 60,
580};
581
582
583static void nf_conntrack_ftp_fini(void)
584{
585 int i, j;
586 for (i = 0; i < ports_c; i++) {
587 for (j = 0; j < 2; j++) {
588 if (ftp[i][j].me == NULL)
589 continue;
590
591 pr_debug("unregistering helper for pf: %d port: %d\n",
592 ftp[i][j].tuple.src.l3num, ports[i]);
593 nf_conntrack_helper_unregister(&ftp[i][j]);
594 }
595 }
596
597 kfree(ftp_buffer);
598}
599
600static int __init nf_conntrack_ftp_init(void)
601{
602 int i, j = -1, ret = 0;
603
604 ftp_buffer = kmalloc(65536, GFP_KERNEL);
605 if (!ftp_buffer)
606 return -ENOMEM;
607
608 if (ports_c == 0)
609 ports[ports_c++] = FTP_PORT;
610
611
612
613 for (i = 0; i < ports_c; i++) {
614 ftp[i][0].tuple.src.l3num = PF_INET;
615 ftp[i][1].tuple.src.l3num = PF_INET6;
616 for (j = 0; j < 2; j++) {
617 ftp[i][j].data_len = sizeof(struct nf_ct_ftp_master);
618 ftp[i][j].tuple.src.u.tcp.port = htons(ports[i]);
619 ftp[i][j].tuple.dst.protonum = IPPROTO_TCP;
620 ftp[i][j].expect_policy = &ftp_exp_policy;
621 ftp[i][j].me = THIS_MODULE;
622 ftp[i][j].help = help;
623 ftp[i][j].from_nlattr = nf_ct_ftp_from_nlattr;
624 if (ports[i] == FTP_PORT)
625 sprintf(ftp[i][j].name, "ftp");
626 else
627 sprintf(ftp[i][j].name, "ftp-%d", ports[i]);
628
629 pr_debug("registering helper for pf: %d port: %d\n",
630 ftp[i][j].tuple.src.l3num, ports[i]);
631 ret = nf_conntrack_helper_register(&ftp[i][j]);
632 if (ret) {
633 pr_err("failed to register helper for pf: %d port: %d\n",
634 ftp[i][j].tuple.src.l3num, ports[i]);
635 nf_conntrack_ftp_fini();
636 return ret;
637 }
638 }
639 }
640
641 return 0;
642}
643
644module_init(nf_conntrack_ftp_init);
645module_exit(nf_conntrack_ftp_fini);
646