net/ipv4/netfilter/nf_socket_ipv4.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (C) 2007-2008 BalaBit IT Ltd.
   4  * Author: Krisztian Kovacs
   5  */
   6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   7 #include <linux/module.h>
   8 #include <linux/skbuff.h>
   9 #include <net/tcp.h>
  10 #include <net/udp.h>
  11 #include <net/icmp.h>
  12 #include <net/sock.h>
  13 #include <net/inet_sock.h>
  14 #include <net/netfilter/nf_socket.h>
  15 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
  16 #include <net/netfilter/nf_conntrack.h>
  17 #endif
  18
  19 static int
  20 extract_icmp4_fields(const struct sk_buff *skb, u8 *protocol,
  21                      __be32 *raddr, __be32 *laddr,
  22                      __be16 *rport, __be16 *lport)
  23 {
  24         unsigned int outside_hdrlen = ip_hdrlen(skb);
  25         struct iphdr *inside_iph, _inside_iph;
  26         struct icmphdr *icmph, _icmph;
  27         __be16 *ports, _ports[2];
  28
  29         icmph = skb_header_pointer(skb, outside_hdrlen,
  30                                    sizeof(_icmph), &_icmph);
  31         if (icmph == NULL)
  32                 return 1;
  33
  34         switch (icmph->type) {
  35         case ICMP_DEST_UNREACH:
  36         case ICMP_SOURCE_QUENCH:
  37         case ICMP_REDIRECT:
  38         case ICMP_TIME_EXCEEDED:
  39         case ICMP_PARAMETERPROB:
  40                 break;
  41         default:
  42                 return 1;
  43         }
  44
  45         inside_iph = skb_header_pointer(skb, outside_hdrlen +
  46                                         sizeof(struct icmphdr),
  47                                         sizeof(_inside_iph), &_inside_iph);
  48         if (inside_iph == NULL)
  49                 return 1;
  50
  51         if (inside_iph->protocol != IPPROTO_TCP &&
  52             inside_iph->protocol != IPPROTO_UDP)
  53                 return 1;
  54
  55         ports = skb_header_pointer(skb, outside_hdrlen +
  56                                    sizeof(struct icmphdr) +
  57                                    (inside_iph->ihl << 2),
  58                                    sizeof(_ports), &_ports);
  59         if (ports == NULL)
  60                 return 1;
  61
  62         /* the inside IP packet is the one quoted from our side, thus
  63          * its saddr is the local address */
  64         *protocol = inside_iph->protocol;
  65         *laddr = inside_iph->saddr;
  66         *lport = ports[0];
  67         *raddr = inside_iph->daddr;
  68         *rport = ports[1];
  69
  70         return 0;
  71 }
  72
  73 static struct sock *
  74 nf_socket_get_sock_v4(struct net *net, struct sk_buff *skb, const int doff,
  75                       const u8 protocol,
  76                       const __be32 saddr, const __be32 daddr,
  77                       const __be16 sport, const __be16 dport,
  78                       const struct net_device *in)
  79 {
  80         switch (protocol) {
  81         case IPPROTO_TCP:
  82                 return inet_lookup(net, &tcp_hashinfo, skb, doff,
  83                                    saddr, sport, daddr, dport,
  84                                    in->ifindex);
  85         case IPPROTO_UDP:
  86                 return udp4_lib_lookup(net, saddr, sport, daddr, dport,
  87                                        in->ifindex);
  88         }
  89         return NULL;
  90 }
  91
  92 struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb,
  93                                   const struct net_device *indev)
  94 {
  95         __be32 uninitialized_var(daddr), uninitialized_var(saddr);
  96         __be16 uninitialized_var(dport), uninitialized_var(sport);
  97         const struct iphdr *iph = ip_hdr(skb);
  98         struct sk_buff *data_skb = NULL;
  99         u8 uninitialized_var(protocol);
 100 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 101         enum ip_conntrack_info ctinfo;
 102         struct nf_conn const *ct;
 103 #endif
 104         int doff = 0;
 105
 106         if (iph->protocol == IPPROTO_UDP || iph->protocol == IPPROTO_TCP) {
 107                 struct tcphdr _hdr;
 108                 struct udphdr *hp;
 109
 110                 hp = skb_header_pointer(skb, ip_hdrlen(skb),
 111                                         iph->protocol == IPPROTO_UDP ?
 112                                         sizeof(*hp) : sizeof(_hdr), &_hdr);
 113                 if (hp == NULL)
 114                         return NULL;
 115
 116                 protocol = iph->protocol;
 117                 saddr = iph->saddr;
 118                 sport = hp->source;
 119                 daddr = iph->daddr;
 120                 dport = hp->dest;
 121                 data_skb = (struct sk_buff *)skb;
 122                 doff = iph->protocol == IPPROTO_TCP ?
 123                         ip_hdrlen(skb) + __tcp_hdrlen((struct tcphdr *)hp) :
 124                         ip_hdrlen(skb) + sizeof(*hp);
 125
 126         } else if (iph->protocol == IPPROTO_ICMP) {
 127                 if (extract_icmp4_fields(skb, &protocol, &saddr, &daddr,
 128                                          &sport, &dport))
 129                         return NULL;
 130         } else {
 131                 return NULL;
 132         }
 133
 134 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 135         /* Do the lookup with the original socket address in
 136          * case this is a reply packet of an established
 137          * SNAT-ted connection.
 138          */
 139         ct = nf_ct_get(skb, &ctinfo);
 140         if (ct &&
 141             ((iph->protocol != IPPROTO_ICMP &&
 142               ctinfo == IP_CT_ESTABLISHED_REPLY) ||
 143              (iph->protocol == IPPROTO_ICMP &&
 144               ctinfo == IP_CT_RELATED_REPLY)) &&
 145             (ct->status & IPS_SRC_NAT_DONE)) {
 146
 147                 daddr = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip;
 148                 dport = (iph->protocol == IPPROTO_TCP) ?
 149                         ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port :
 150                         ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
 151         }
 152 #endif
 153
 154         return nf_socket_get_sock_v4(net, data_skb, doff, protocol, saddr,
 155                                      daddr, sport, dport, indev);
 156 }
 157 EXPORT_SYMBOL_GPL(nf_sk_lookup_slow_v4);
 158
 159 MODULE_LICENSE("GPL");
 160 MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
 161 MODULE_DESCRIPTION("Netfilter IPv4 socket lookup infrastructure");