net/netfilter/nf_conntrack_irc.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /* IRC extension for IP connection tracking, Version 1.21
0003  * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
0004  * based on RR's ip_conntrack_ftp.c
0005  * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
0006  */
0007
0008 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
0009
0010 #include <linux/module.h>
0011 #include <linux/moduleparam.h>
0012 #include <linux/skbuff.h>
0013 #include <linux/in.h>
0014 #include <linux/ip.h>
0015 #include <linux/tcp.h>
0016 #include <linux/netfilter.h>
0017 #include <linux/slab.h>
0018
0019 #include <net/netfilter/nf_conntrack.h>
0020 #include <net/netfilter/nf_conntrack_expect.h>
0021 #include <net/netfilter/nf_conntrack_helper.h>
0022 #include <linux/netfilter/nf_conntrack_irc.h>
0023
0024 #define MAX_PORTS 8
0025 static unsigned short ports[MAX_PORTS];
0026 static unsigned int ports_c;
0027 static unsigned int max_dcc_channels = 8;
0028 static unsigned int dcc_timeout __read_mostly = 300;
0029 /* This is slow, but it's simple. --RR */
0030 static char *irc_buffer;
0031 static DEFINE_SPINLOCK(irc_buffer_lock);
0032
0033 unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
0034                 enum ip_conntrack_info ctinfo,
0035                 unsigned int protoff,
0036                 unsigned int matchoff,
0037                 unsigned int matchlen,
0038                 struct nf_conntrack_expect *exp) __read_mostly;
0039 EXPORT_SYMBOL_GPL(nf_nat_irc_hook);
0040
0041 #define HELPER_NAME "irc"
0042 #define MAX_SEARCH_SIZE 4095
0043
0044 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
0045 MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
0046 MODULE_LICENSE("GPL");
0047 MODULE_ALIAS("ip_conntrack_irc");
0048 MODULE_ALIAS_NFCT_HELPER(HELPER_NAME);
0049
0050 module_param_array(ports, ushort, &ports_c, 0400);
0051 MODULE_PARM_DESC(ports, "port numbers of IRC servers");
0052 module_param(max_dcc_channels, uint, 0400);
0053 MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per "
0054                    "IRC session");
0055 module_param(dcc_timeout, uint, 0400);
0056 MODULE_PARM_DESC(dcc_timeout, "timeout on for unestablished DCC channels");
0057
0058 static const char *const dccprotos[] = {
0059     "SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT "
0060 };
0061
0062 #define MINMATCHLEN 5
0063
0064 /* tries to get the ip_addr and port out of a dcc command
0065  * return value: -1 on failure, 0 on success
0066  *  data        pointer to first byte of DCC command data
0067  *  data_end    pointer to last byte of dcc command data
0068  *  ip      returns parsed ip of dcc command
0069  *  port        returns parsed port of dcc command
0070  *  ad_beg_p    returns pointer to first byte of addr data
0071  *  ad_end_p    returns pointer to last byte of addr data
0072  */
0073 static int parse_dcc(char *data, const char *data_end, __be32 *ip,
0074              u_int16_t *port, char **ad_beg_p, char **ad_end_p)
0075 {
0076     char *tmp;
0077
0078     /* at least 12: "AAAAAAAA P\1\n" */
0079     while (*data++ != ' ')
0080         if (data > data_end - 12)
0081             return -1;
0082
0083     /* Make sure we have a newline character within the packet boundaries
0084      * because simple_strtoul parses until the first invalid character. */
0085     for (tmp = data; tmp <= data_end; tmp++)
0086         if (*tmp == '\n')
0087             break;
0088     if (tmp > data_end || *tmp != '\n')
0089         return -1;
0090
0091     *ad_beg_p = data;
0092     *ip = cpu_to_be32(simple_strtoul(data, &data, 10));
0093
0094     /* skip blanks between ip and port */
0095     while (*data == ' ') {
0096         if (data >= data_end)
0097             return -1;
0098         data++;
0099     }
0100
0101     *port = simple_strtoul(data, &data, 10);
0102     *ad_end_p = data;
0103
0104     return 0;
0105 }
0106
0107 static int help(struct sk_buff *skb, unsigned int protoff,
0108         struct nf_conn *ct, enum ip_conntrack_info ctinfo)
0109 {
0110     unsigned int dataoff;
0111     const struct iphdr *iph;
0112     const struct tcphdr *th;
0113     struct tcphdr _tcph;
0114     const char *data_limit;
0115     char *data, *ib_ptr;
0116     int dir = CTINFO2DIR(ctinfo);
0117     struct nf_conntrack_expect *exp;
0118     struct nf_conntrack_tuple *tuple;
0119     __be32 dcc_ip;
0120     u_int16_t dcc_port;
0121     __be16 port;
0122     int i, ret = NF_ACCEPT;
0123     char *addr_beg_p, *addr_end_p;
0124     typeof(nf_nat_irc_hook) nf_nat_irc;
0125     unsigned int datalen;
0126
0127     /* If packet is coming from IRC server */
0128     if (dir == IP_CT_DIR_REPLY)
0129         return NF_ACCEPT;
0130
0131     /* Until there's been traffic both ways, don't look in packets. */
0132     if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY)
0133         return NF_ACCEPT;
0134
0135     /* Not a full tcp header? */
0136     th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
0137     if (th == NULL)
0138         return NF_ACCEPT;
0139
0140     /* No data? */
0141     dataoff = protoff + th->doff*4;
0142     if (dataoff >= skb->len)
0143         return NF_ACCEPT;
0144
0145     datalen = skb->len - dataoff;
0146     if (datalen > MAX_SEARCH_SIZE)
0147         datalen = MAX_SEARCH_SIZE;
0148
0149     spin_lock_bh(&irc_buffer_lock);
0150     ib_ptr = skb_header_pointer(skb, dataoff, datalen,
0151                     irc_buffer);
0152     if (!ib_ptr) {
0153         spin_unlock_bh(&irc_buffer_lock);
0154         return NF_ACCEPT;
0155     }
0156
0157     data = ib_ptr;
0158     data_limit = ib_ptr + datalen;
0159
0160     /* Skip any whitespace */
0161     while (data < data_limit - 10) {
0162         if (*data == ' ' || *data == '\r' || *data == '\n')
0163             data++;
0164         else
0165             break;
0166     }
0167
0168     /* strlen("PRIVMSG x ")=10 */
0169     if (data < data_limit - 10) {
0170         if (strncasecmp("PRIVMSG ", data, 8))
0171             goto out;
0172         data += 8;
0173     }
0174
0175     /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26
0176      * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26
0177      */
0178     while (data < data_limit - (21 + MINMATCHLEN)) {
0179         /* Find first " :", the start of message */
0180         if (memcmp(data, " :", 2)) {
0181             data++;
0182             continue;
0183         }
0184         data += 2;
0185
0186         /* then check that place only for the DCC command */
0187         if (memcmp(data, "\1DCC ", 5))
0188             goto out;
0189         data += 5;
0190         /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */
0191
0192         iph = ip_hdr(skb);
0193         pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
0194              &iph->saddr, ntohs(th->source),
0195              &iph->daddr, ntohs(th->dest));
0196
0197         for (i = 0; i < ARRAY_SIZE(dccprotos); i++) {
0198             if (memcmp(data, dccprotos[i], strlen(dccprotos[i]))) {
0199                 /* no match */
0200                 continue;
0201             }
0202             data += strlen(dccprotos[i]);
0203             pr_debug("DCC %s detected\n", dccprotos[i]);
0204
0205             /* we have at least
0206              * (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid
0207              * data left (== 14/13 bytes) */
0208             if (parse_dcc(data, data_limit, &dcc_ip,
0209                        &dcc_port, &addr_beg_p, &addr_end_p)) {
0210                 pr_debug("unable to parse dcc command\n");
0211                 continue;
0212             }
0213
0214             pr_debug("DCC bound ip/port: %pI4:%u\n",
0215                  &dcc_ip, dcc_port);
0216
0217             /* dcc_ip can be the internal OR external (NAT'ed) IP */
0218             tuple = &ct->tuplehash[dir].tuple;
0219             if ((tuple->src.u3.ip != dcc_ip &&
0220                  ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) ||
0221                 dcc_port == 0) {
0222                 net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
0223                              &tuple->src.u3.ip,
0224                              &dcc_ip, dcc_port);
0225                 continue;
0226             }
0227
0228             exp = nf_ct_expect_alloc(ct);
0229             if (exp == NULL) {
0230                 nf_ct_helper_log(skb, ct,
0231                          "cannot alloc expectation");
0232                 ret = NF_DROP;
0233                 goto out;
0234             }
0235             tuple = &ct->tuplehash[!dir].tuple;
0236             port = htons(dcc_port);
0237             nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
0238                       tuple->src.l3num,
0239                       NULL, &tuple->dst.u3,
0240                       IPPROTO_TCP, NULL, &port);
0241
0242             nf_nat_irc = rcu_dereference(nf_nat_irc_hook);
0243             if (nf_nat_irc && ct->status & IPS_NAT_MASK)
0244                 ret = nf_nat_irc(skb, ctinfo, protoff,
0245                          addr_beg_p - ib_ptr,
0246                          addr_end_p - addr_beg_p,
0247                          exp);
0248             else if (nf_ct_expect_related(exp, 0) != 0) {
0249                 nf_ct_helper_log(skb, ct,
0250                          "cannot add expectation");
0251                 ret = NF_DROP;
0252             }
0253             nf_ct_expect_put(exp);
0254             goto out;
0255         }
0256     }
0257  out:
0258     spin_unlock_bh(&irc_buffer_lock);
0259     return ret;
0260 }
0261
0262 static struct nf_conntrack_helper irc[MAX_PORTS] __read_mostly;
0263 static struct nf_conntrack_expect_policy irc_exp_policy;
0264
0265 static int __init nf_conntrack_irc_init(void)
0266 {
0267     int i, ret;
0268
0269     if (max_dcc_channels < 1) {
0270         pr_err("max_dcc_channels must not be zero\n");
0271         return -EINVAL;
0272     }
0273
0274     if (max_dcc_channels > NF_CT_EXPECT_MAX_CNT) {
0275         pr_err("max_dcc_channels must not be more than %u\n",
0276                NF_CT_EXPECT_MAX_CNT);
0277         return -EINVAL;
0278     }
0279
0280     irc_exp_policy.max_expected = max_dcc_channels;
0281     irc_exp_policy.timeout = dcc_timeout;
0282
0283     irc_buffer = kmalloc(MAX_SEARCH_SIZE + 1, GFP_KERNEL);
0284     if (!irc_buffer)
0285         return -ENOMEM;
0286
0287     /* If no port given, default to standard irc port */
0288     if (ports_c == 0)
0289         ports[ports_c++] = IRC_PORT;
0290
0291     for (i = 0; i < ports_c; i++) {
0292         nf_ct_helper_init(&irc[i], AF_INET, IPPROTO_TCP, HELPER_NAME,
0293                   IRC_PORT, ports[i], i, &irc_exp_policy,
0294                   0, help, NULL, THIS_MODULE);
0295     }
0296
0297     ret = nf_conntrack_helpers_register(&irc[0], ports_c);
0298     if (ret) {
0299         pr_err("failed to register helpers\n");
0300         kfree(irc_buffer);
0301         return ret;
0302     }
0303
0304     return 0;
0305 }
0306
0307 static void __exit nf_conntrack_irc_fini(void)
0308 {
0309     nf_conntrack_helpers_unregister(irc, ports_c);
0310     kfree(irc_buffer);
0311 }
0312
0313 module_init(nf_conntrack_irc_init);
0314 module_exit(nf_conntrack_irc_fini);