net/netfilter/nfnetlink_osf.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
0003 #include <linux/module.h>
0004 #include <linux/kernel.h>
0005
0006 #include <linux/capability.h>
0007 #include <linux/if.h>
0008 #include <linux/inetdevice.h>
0009 #include <linux/ip.h>
0010 #include <linux/list.h>
0011 #include <linux/rculist.h>
0012 #include <linux/skbuff.h>
0013 #include <linux/slab.h>
0014 #include <linux/tcp.h>
0015
0016 #include <net/ip.h>
0017 #include <net/tcp.h>
0018
0019 #include <linux/netfilter/nfnetlink.h>
0020 #include <linux/netfilter/x_tables.h>
0021 #include <net/netfilter/nf_log.h>
0022 #include <linux/netfilter/nfnetlink_osf.h>
0023
0024 /*
0025  * Indexed by dont-fragment bit.
0026  * It is the only constant value in the fingerprint.
0027  */
0028 struct list_head nf_osf_fingers[2];
0029 EXPORT_SYMBOL_GPL(nf_osf_fingers);
0030
0031 static inline int nf_osf_ttl(const struct sk_buff *skb,
0032                  int ttl_check, unsigned char f_ttl)
0033 {
0034     struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
0035     const struct iphdr *ip = ip_hdr(skb);
0036     const struct in_ifaddr *ifa;
0037     int ret = 0;
0038
0039     if (ttl_check == NF_OSF_TTL_TRUE)
0040         return ip->ttl == f_ttl;
0041     if (ttl_check == NF_OSF_TTL_NOCHECK)
0042         return 1;
0043     else if (ip->ttl <= f_ttl)
0044         return 1;
0045
0046     in_dev_for_each_ifa_rcu(ifa, in_dev) {
0047         if (inet_ifa_match(ip->saddr, ifa)) {
0048             ret = (ip->ttl == f_ttl);
0049             break;
0050         }
0051     }
0052
0053     return ret;
0054 }
0055
0056 struct nf_osf_hdr_ctx {
0057     bool            df;
0058     u16         window;
0059     u16         totlen;
0060     const unsigned char *optp;
0061     unsigned int        optsize;
0062 };
0063
0064 static bool nf_osf_match_one(const struct sk_buff *skb,
0065                  const struct nf_osf_user_finger *f,
0066                  int ttl_check,
0067                  struct nf_osf_hdr_ctx *ctx)
0068 {
0069     const __u8 *optpinit = ctx->optp;
0070     unsigned int check_WSS = 0;
0071     int fmatch = FMATCH_WRONG;
0072     int foptsize, optnum;
0073     u16 mss = 0;
0074
0075     if (ctx->totlen != f->ss || !nf_osf_ttl(skb, ttl_check, f->ttl))
0076         return false;
0077
0078     /*
0079      * Should not happen if userspace parser was written correctly.
0080      */
0081     if (f->wss.wc >= OSF_WSS_MAX)
0082         return false;
0083
0084     /* Check options */
0085
0086     foptsize = 0;
0087     for (optnum = 0; optnum < f->opt_num; ++optnum)
0088         foptsize += f->opt[optnum].length;
0089
0090     if (foptsize > MAX_IPOPTLEN ||
0091         ctx->optsize > MAX_IPOPTLEN ||
0092         ctx->optsize != foptsize)
0093         return false;
0094
0095     check_WSS = f->wss.wc;
0096
0097     for (optnum = 0; optnum < f->opt_num; ++optnum) {
0098         if (f->opt[optnum].kind == *ctx->optp) {
0099             __u32 len = f->opt[optnum].length;
0100             const __u8 *optend = ctx->optp + len;
0101
0102             fmatch = FMATCH_OK;
0103
0104             switch (*ctx->optp) {
0105             case OSFOPT_MSS:
0106                 mss = ctx->optp[3];
0107                 mss <<= 8;
0108                 mss |= ctx->optp[2];
0109
0110                 mss = ntohs((__force __be16)mss);
0111                 break;
0112             case OSFOPT_TS:
0113                 break;
0114             }
0115
0116             ctx->optp = optend;
0117         } else
0118             fmatch = FMATCH_OPT_WRONG;
0119
0120         if (fmatch != FMATCH_OK)
0121             break;
0122     }
0123
0124     if (fmatch != FMATCH_OPT_WRONG) {
0125         fmatch = FMATCH_WRONG;
0126
0127         switch (check_WSS) {
0128         case OSF_WSS_PLAIN:
0129             if (f->wss.val == 0 || ctx->window == f->wss.val)
0130                 fmatch = FMATCH_OK;
0131             break;
0132         case OSF_WSS_MSS:
0133             /*
0134              * Some smart modems decrease mangle MSS to
0135              * SMART_MSS_2, so we check standard, decreased
0136              * and the one provided in the fingerprint MSS
0137              * values.
0138              */
0139 #define SMART_MSS_1 1460
0140 #define SMART_MSS_2 1448
0141             if (ctx->window == f->wss.val * mss ||
0142                 ctx->window == f->wss.val * SMART_MSS_1 ||
0143                 ctx->window == f->wss.val * SMART_MSS_2)
0144                 fmatch = FMATCH_OK;
0145             break;
0146         case OSF_WSS_MTU:
0147             if (ctx->window == f->wss.val * (mss + 40) ||
0148                 ctx->window == f->wss.val * (SMART_MSS_1 + 40) ||
0149                 ctx->window == f->wss.val * (SMART_MSS_2 + 40))
0150                 fmatch = FMATCH_OK;
0151             break;
0152         case OSF_WSS_MODULO:
0153             if ((ctx->window % f->wss.val) == 0)
0154                 fmatch = FMATCH_OK;
0155             break;
0156         }
0157     }
0158
0159     if (fmatch != FMATCH_OK)
0160         ctx->optp = optpinit;
0161
0162     return fmatch == FMATCH_OK;
0163 }
0164
0165 static const struct tcphdr *nf_osf_hdr_ctx_init(struct nf_osf_hdr_ctx *ctx,
0166                         const struct sk_buff *skb,
0167                         const struct iphdr *ip,
0168                         unsigned char *opts,
0169                         struct tcphdr *_tcph)
0170 {
0171     const struct tcphdr *tcp;
0172
0173     tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), _tcph);
0174     if (!tcp)
0175         return NULL;
0176
0177     if (!tcp->syn)
0178         return NULL;
0179
0180     ctx->totlen = ntohs(ip->tot_len);
0181     ctx->df = ntohs(ip->frag_off) & IP_DF;
0182     ctx->window = ntohs(tcp->window);
0183
0184     if (tcp->doff * 4 > sizeof(struct tcphdr)) {
0185         ctx->optsize = tcp->doff * 4 - sizeof(struct tcphdr);
0186
0187         ctx->optp = skb_header_pointer(skb, ip_hdrlen(skb) +
0188                 sizeof(struct tcphdr), ctx->optsize, opts);
0189         if (!ctx->optp)
0190             return NULL;
0191     }
0192
0193     return tcp;
0194 }
0195
0196 bool
0197 nf_osf_match(const struct sk_buff *skb, u_int8_t family,
0198          int hooknum, struct net_device *in, struct net_device *out,
0199          const struct nf_osf_info *info, struct net *net,
0200          const struct list_head *nf_osf_fingers)
0201 {
0202     const struct iphdr *ip = ip_hdr(skb);
0203     const struct nf_osf_user_finger *f;
0204     unsigned char opts[MAX_IPOPTLEN];
0205     const struct nf_osf_finger *kf;
0206     int fcount = 0, ttl_check;
0207     int fmatch = FMATCH_WRONG;
0208     struct nf_osf_hdr_ctx ctx;
0209     const struct tcphdr *tcp;
0210     struct tcphdr _tcph;
0211
0212     memset(&ctx, 0, sizeof(ctx));
0213
0214     tcp = nf_osf_hdr_ctx_init(&ctx, skb, ip, opts, &_tcph);
0215     if (!tcp)
0216         return false;
0217
0218     ttl_check = (info->flags & NF_OSF_TTL) ? info->ttl : 0;
0219
0220     list_for_each_entry_rcu(kf, &nf_osf_fingers[ctx.df], finger_entry) {
0221
0222         f = &kf->finger;
0223
0224         if (!(info->flags & NF_OSF_LOG) && strcmp(info->genre, f->genre))
0225             continue;
0226
0227         if (!nf_osf_match_one(skb, f, ttl_check, &ctx))
0228             continue;
0229
0230         fmatch = FMATCH_OK;
0231
0232         fcount++;
0233
0234         if (info->flags & NF_OSF_LOG)
0235             nf_log_packet(net, family, hooknum, skb,
0236                       in, out, NULL,
0237                       "%s [%s:%s] : %pI4:%d -> %pI4:%d hops=%d\n",
0238                       f->genre, f->version, f->subtype,
0239                       &ip->saddr, ntohs(tcp->source),
0240                       &ip->daddr, ntohs(tcp->dest),
0241                       f->ttl - ip->ttl);
0242
0243         if ((info->flags & NF_OSF_LOG) &&
0244             info->loglevel == NF_OSF_LOGLEVEL_FIRST)
0245             break;
0246     }
0247
0248     if (!fcount && (info->flags & NF_OSF_LOG))
0249         nf_log_packet(net, family, hooknum, skb, in, out, NULL,
0250                   "Remote OS is not known: %pI4:%u -> %pI4:%u\n",
0251                   &ip->saddr, ntohs(tcp->source),
0252                   &ip->daddr, ntohs(tcp->dest));
0253
0254     if (fcount)
0255         fmatch = FMATCH_OK;
0256
0257     return fmatch == FMATCH_OK;
0258 }
0259 EXPORT_SYMBOL_GPL(nf_osf_match);
0260
0261 bool nf_osf_find(const struct sk_buff *skb,
0262          const struct list_head *nf_osf_fingers,
0263          const int ttl_check, struct nf_osf_data *data)
0264 {
0265     const struct iphdr *ip = ip_hdr(skb);
0266     const struct nf_osf_user_finger *f;
0267     unsigned char opts[MAX_IPOPTLEN];
0268     const struct nf_osf_finger *kf;
0269     struct nf_osf_hdr_ctx ctx;
0270     const struct tcphdr *tcp;
0271     struct tcphdr _tcph;
0272     bool found = false;
0273
0274     memset(&ctx, 0, sizeof(ctx));
0275
0276     tcp = nf_osf_hdr_ctx_init(&ctx, skb, ip, opts, &_tcph);
0277     if (!tcp)
0278         return false;
0279
0280     list_for_each_entry_rcu(kf, &nf_osf_fingers[ctx.df], finger_entry) {
0281         f = &kf->finger;
0282         if (!nf_osf_match_one(skb, f, ttl_check, &ctx))
0283             continue;
0284
0285         data->genre = f->genre;
0286         data->version = f->version;
0287         found = true;
0288         break;
0289     }
0290
0291     return found;
0292 }
0293 EXPORT_SYMBOL_GPL(nf_osf_find);
0294
0295 static const struct nla_policy nfnl_osf_policy[OSF_ATTR_MAX + 1] = {
0296     [OSF_ATTR_FINGER]   = { .len = sizeof(struct nf_osf_user_finger) },
0297 };
0298
0299 static int nfnl_osf_add_callback(struct sk_buff *skb,
0300                  const struct nfnl_info *info,
0301                  const struct nlattr * const osf_attrs[])
0302 {
0303     struct nf_osf_user_finger *f;
0304     struct nf_osf_finger *kf = NULL, *sf;
0305     int err = 0;
0306
0307     if (!capable(CAP_NET_ADMIN))
0308         return -EPERM;
0309
0310     if (!osf_attrs[OSF_ATTR_FINGER])
0311         return -EINVAL;
0312
0313     if (!(info->nlh->nlmsg_flags & NLM_F_CREATE))
0314         return -EINVAL;
0315
0316     f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
0317
0318     kf = kmalloc(sizeof(struct nf_osf_finger), GFP_KERNEL);
0319     if (!kf)
0320         return -ENOMEM;
0321
0322     memcpy(&kf->finger, f, sizeof(struct nf_osf_user_finger));
0323
0324     list_for_each_entry(sf, &nf_osf_fingers[!!f->df], finger_entry) {
0325         if (memcmp(&sf->finger, f, sizeof(struct nf_osf_user_finger)))
0326             continue;
0327
0328         kfree(kf);
0329         kf = NULL;
0330
0331         if (info->nlh->nlmsg_flags & NLM_F_EXCL)
0332             err = -EEXIST;
0333         break;
0334     }
0335
0336     /*
0337      * We are protected by nfnl mutex.
0338      */
0339     if (kf)
0340         list_add_tail_rcu(&kf->finger_entry, &nf_osf_fingers[!!f->df]);
0341
0342     return err;
0343 }
0344
0345 static int nfnl_osf_remove_callback(struct sk_buff *skb,
0346                     const struct nfnl_info *info,
0347                     const struct nlattr * const osf_attrs[])
0348 {
0349     struct nf_osf_user_finger *f;
0350     struct nf_osf_finger *sf;
0351     int err = -ENOENT;
0352
0353     if (!capable(CAP_NET_ADMIN))
0354         return -EPERM;
0355
0356     if (!osf_attrs[OSF_ATTR_FINGER])
0357         return -EINVAL;
0358
0359     f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
0360
0361     list_for_each_entry(sf, &nf_osf_fingers[!!f->df], finger_entry) {
0362         if (memcmp(&sf->finger, f, sizeof(struct nf_osf_user_finger)))
0363             continue;
0364
0365         /*
0366          * We are protected by nfnl mutex.
0367          */
0368         list_del_rcu(&sf->finger_entry);
0369         kfree_rcu(sf, rcu_head);
0370
0371         err = 0;
0372         break;
0373     }
0374
0375     return err;
0376 }
0377
0378 static const struct nfnl_callback nfnl_osf_callbacks[OSF_MSG_MAX] = {
0379     [OSF_MSG_ADD]   = {
0380         .call       = nfnl_osf_add_callback,
0381         .type       = NFNL_CB_MUTEX,
0382         .attr_count = OSF_ATTR_MAX,
0383         .policy     = nfnl_osf_policy,
0384     },
0385     [OSF_MSG_REMOVE]    = {
0386         .call       = nfnl_osf_remove_callback,
0387         .type       = NFNL_CB_MUTEX,
0388         .attr_count = OSF_ATTR_MAX,
0389         .policy     = nfnl_osf_policy,
0390     },
0391 };
0392
0393 static const struct nfnetlink_subsystem nfnl_osf_subsys = {
0394     .name           = "osf",
0395     .subsys_id      = NFNL_SUBSYS_OSF,
0396     .cb_count       = OSF_MSG_MAX,
0397     .cb         = nfnl_osf_callbacks,
0398 };
0399
0400 static int __init nfnl_osf_init(void)
0401 {
0402     int err = -EINVAL;
0403     int i;
0404
0405     for (i = 0; i < ARRAY_SIZE(nf_osf_fingers); ++i)
0406         INIT_LIST_HEAD(&nf_osf_fingers[i]);
0407
0408     err = nfnetlink_subsys_register(&nfnl_osf_subsys);
0409     if (err < 0) {
0410         pr_err("Failed to register OSF nsfnetlink helper (%d)\n", err);
0411         goto err_out_exit;
0412     }
0413     return 0;
0414
0415 err_out_exit:
0416     return err;
0417 }
0418
0419 static void __exit nfnl_osf_fini(void)
0420 {
0421     struct nf_osf_finger *f;
0422     int i;
0423
0424     nfnetlink_subsys_unregister(&nfnl_osf_subsys);
0425
0426     rcu_read_lock();
0427     for (i = 0; i < ARRAY_SIZE(nf_osf_fingers); ++i) {
0428         list_for_each_entry_rcu(f, &nf_osf_fingers[i], finger_entry) {
0429             list_del_rcu(&f->finger_entry);
0430             kfree_rcu(f, rcu_head);
0431         }
0432     }
0433     rcu_read_unlock();
0434
0435     rcu_barrier();
0436 }
0437
0438 module_init(nfnl_osf_init);
0439 module_exit(nfnl_osf_fini);
0440
0441 MODULE_LICENSE("GPL");