netfilter/ip_conntrack_irc.c

   1 /* IRC extension for IP connection tracking, Version 1.21
   2  * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
   3  * based on RR's ip_conntrack_ftp.c
   4  *
   5  * ip_conntrack_irc.c,v 1.21 2002/02/05 14:49:26 laforge Exp
   6  *
   7  *      This program is free software; you can redistribute it and/or
   8  *      modify it under the terms of the GNU General Public License
   9  *      as published by the Free Software Foundation; either version
  10  *      2 of the License, or (at your option) any later version.
  11  **
  12  *      Module load syntax:
  13  *      insmod ip_conntrack_irc.o ports=port1,port2,...port<MAX_PORTS>
  14  *                          max_dcc_channels=n dcc_timeout=secs
  15  *
  16  *      please give the ports of all IRC servers You wish to connect to.
  17  *      If You don't specify ports, the default will be port 6667.
  18  *      With max_dcc_channels you can define the maximum number of not
  19  *      yet answered DCC channels per IRC session (default 8).
  20  *      With dcc_timeout you can specify how long the system waits for
  21  *      an expected DCC channel (default 300 seconds).
  22  *
  23  */
  24
  25 #include <linux/config.h>
  26 #include <linux/module.h>
  27 #include <linux/netfilter.h>
  28 #include <linux/ip.h>
  29 #include <net/checksum.h>
  30 #include <net/tcp.h>
  31
  32 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
  33 #include <linux/netfilter_ipv4/ip_conntrack_irc.h>
  34
  35 #define MAX_PORTS 8
  36 static int ports[MAX_PORTS];
  37 static int ports_c = 0;
  38 static int max_dcc_channels = 8;
  39 static unsigned int dcc_timeout = 300;
  40
  41 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
  42 MODULE_DESCRIPTION("IRC (DCC) connection tracking module");
  43 MODULE_LICENSE("GPL");
  44 #ifdef MODULE_PARM
  45 MODULE_PARM(ports, "1-" __MODULE_STRING(MAX_PORTS) "i");
  46 MODULE_PARM_DESC(ports, "port numbers of IRC servers");
  47 MODULE_PARM(max_dcc_channels, "i");
  48 MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per IRC session");
  49 MODULE_PARM(dcc_timeout, "i");
  50 MODULE_PARM_DESC(dcc_timeout, "timeout on for unestablished DCC channels");
  51 #endif
  52
  53 #define NUM_DCCPROTO    5
  54 struct dccproto dccprotos[NUM_DCCPROTO] = {
  55         {"SEND ", 5},
  56         {"CHAT ", 5},
  57         {"MOVE ", 5},
  58         {"TSEND ", 6},
  59         {"SCHAT ", 6}
  60 };
  61 #define MINMATCHLEN     5
  62
  63 struct module *ip_conntrack_irc = THIS_MODULE;
  64
  65 #if 0
  66 #define DEBUGP(format, args...) printk(KERN_DEBUG __FILE__ ":" __FUNCTION__ \
  67                                         ":" format, ## args)
  68 #else
  69 #define DEBUGP(format, args...)
  70 #endif
  71
  72 int parse_dcc(char *data, char *data_end, u_int32_t * ip, u_int16_t * port,
  73               char **ad_beg_p, char **ad_end_p)
  74 /* tries to get the ip_addr and port out of a dcc command
  75    return value: -1 on failure, 0 on success
  76         data            pointer to first byte of DCC command data
  77         data_end        pointer to last byte of dcc command data
  78         ip              returns parsed ip of dcc command
  79         port            returns parsed port of dcc command
  80         ad_beg_p        returns pointer to first byte of addr data
  81         ad_end_p        returns pointer to last byte of addr data */
  82 {
  83
  84         /* at least 12: "AAAAAAAA P\1\n" */
  85         while (*data++ != ' ')
  86                 if (data > data_end - 12)
  87                         return -1;
  88
  89         *ad_beg_p = data;
  90         *ip = simple_strtoul(data, &data, 10);
  91
  92         /* skip blanks between ip and port */
  93         while (*data == ' ') {
  94                 if (data >= data_end)
  95                         return -1;
  96                 data++;
  97         }
  98
  99         *port = simple_strtoul(data, &data, 10);
 100         *ad_end_p = data;
 101
 102         return 0;
 103 }
 104
 105
 106 /* FIXME: This should be in userspace.  Later. */
 107 static int help(const struct iphdr *iph, size_t len,
 108                 struct ip_conntrack *ct, enum ip_conntrack_info ctinfo)
 109 {
 110         /* tcplen not negative guarenteed by ip_conntrack_tcp.c */
 111         struct tcphdr *tcph = (void *) iph + iph->ihl * 4;
 112         const char *data = (const char *) tcph + tcph->doff * 4;
 113         const char *_data = data;
 114         char *data_limit;
 115         u_int32_t tcplen = len - iph->ihl * 4;
 116         u_int32_t datalen = tcplen - tcph->doff * 4;
 117         int dir = CTINFO2DIR(ctinfo);
 118         struct ip_conntrack_expect expect, *exp = &expect;
 119         struct ip_ct_irc_expect *exp_irc_info = &exp->help.exp_irc_info;
 120
 121         u_int32_t dcc_ip;
 122         u_int16_t dcc_port;
 123         int i;
 124         char *addr_beg_p, *addr_end_p;
 125
 126         DEBUGP("entered\n");
 127
 128         /* If packet is coming from IRC server */
 129         if (dir == IP_CT_DIR_REPLY)
 130                 return NF_ACCEPT;
 131
 132         /* Until there's been traffic both ways, don't look in packets. */
 133         if (ctinfo != IP_CT_ESTABLISHED
 134             && ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
 135                 DEBUGP("Conntrackinfo = %u\n", ctinfo);
 136                 return NF_ACCEPT;
 137         }
 138
 139         /* Not whole TCP header? */
 140         if (tcplen < sizeof(struct tcphdr) || tcplen < tcph->doff * 4) {
 141                 DEBUGP("tcplen = %u\n", (unsigned) tcplen);
 142                 return NF_ACCEPT;
 143         }
 144
 145         /* Checksum invalid?  Ignore. */
 146         /* FIXME: Source route IP option packets --RR */
 147         if (tcp_v4_check(tcph, tcplen, iph->saddr, iph->daddr,
 148                          csum_partial((char *) tcph, tcplen, 0))) {
 149                 DEBUGP("bad csum: %p %u %u.%u.%u.%u %u.%u.%u.%u\n",
 150                      tcph, tcplen, NIPQUAD(iph->saddr),
 151                      NIPQUAD(iph->daddr));
 152                 return NF_ACCEPT;
 153         }
 154
 155         data_limit = (char *) data + datalen;
 156
 157         /* strlen("\1DCC SEND t AAAAAAAA P\1\n")=24
 158          *         5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
 159         while (data < (data_limit - (19 + MINMATCHLEN))) {
 160                 if (memcmp(data, "\1DCC ", 5)) {
 161                         data++;
 162                         continue;
 163                 }
 164
 165                 data += 5;
 166                 /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
 167
 168                 DEBUGP("DCC found in master %u.%u.%u.%u:%u %u.%u.%u.%u:%u...\n",
 169                         NIPQUAD(iph->saddr), ntohs(tcph->source),
 170                         NIPQUAD(iph->daddr), ntohs(tcph->dest));
 171
 172                 for (i = 0; i < NUM_DCCPROTO; i++) {
 173                         if (memcmp(data, dccprotos[i].match,
 174                                    dccprotos[i].matchlen)) {
 175                                 /* no match */
 176                                 continue;
 177                         }
 178
 179                         DEBUGP("DCC %s detected\n", dccprotos[i].match);
 180                         data += dccprotos[i].matchlen;
 181                         /* we have at least
 182                          * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
 183                          * data left (== 14/13 bytes) */
 184                         if (parse_dcc((char *) data, data_limit, &dcc_ip,
 185                                        &dcc_port, &addr_beg_p, &addr_end_p)) {
 186                                 /* unable to parse */
 187                                 DEBUGP("unable to parse dcc command\n");
 188                                 continue;
 189                         }
 190                         DEBUGP("DCC bound ip/port: %u.%u.%u.%u:%u\n",
 191                                 HIPQUAD(dcc_ip), dcc_port);
 192
 193                         /* dcc_ip can be the internal OR external (NAT'ed) IP
 194                          * Tiago Sousa <mirage@kaotik.org> */
 195                         if (ct->tuplehash[dir].tuple.src.ip != htonl(dcc_ip)
 196                             && ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip != htonl(dcc_ip)) {
 197                                 if (net_ratelimit())
 198                                         printk(KERN_WARNING
 199                                                 "Forged DCC command from "
 200                                                 "%u.%u.%u.%u: %u.%u.%u.%u:%u\n",
 201                                 NIPQUAD(ct->tuplehash[dir].tuple.src.ip),
 202                                                 HIPQUAD(dcc_ip), dcc_port);
 203
 204                                 continue;
 205                         }
 206
 207                         memset(&expect, 0, sizeof(expect));
 208
 209                         /* save position of address in dcc string,
 210                          * neccessary for NAT */
 211                         DEBUGP("tcph->seq = %u\n", tcph->seq);
 212                         exp->seq = ntohl(tcph->seq) + (addr_beg_p - _data);
 213                         exp_irc_info->len = (addr_end_p - addr_beg_p);
 214                         exp_irc_info->port = dcc_port;
 215                         DEBUGP("wrote info seq=%u (ofs=%u), len=%d\n",
 216                                 exp->seq, (addr_end_p - _data), exp_irc_info->len);
 217
 218                         exp->tuple = ((struct ip_conntrack_tuple)
 219                                 { { 0, { 0 } },
 220                                   { ct->tuplehash[dir].tuple.src.ip, { .tcp = { htons(dcc_port) } },
 221                                     IPPROTO_TCP }});
 222                         exp->mask = ((struct ip_conntrack_tuple)
 223                                 { { 0, { 0 } },
 224                                   { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFFFF }});
 225
 226                         exp->expectfn = NULL;
 227
 228                         DEBUGP("expect_related %u.%u.%u.%u:%u-%u.%u.%u.%u:%u\n",
 229                                 NIPQUAD(exp->tuple.src.ip),
 230                                 ntohs(exp->tuple.src.u.tcp.port),
 231                                 NIPQUAD(exp->tuple.dst.ip),
 232                                 ntohs(exp->tuple.dst.u.tcp.port));
 233
 234                         ip_conntrack_expect_related(ct, &expect);
 235                         return NF_ACCEPT;
 236                 } /* for .. NUM_DCCPROTO */
 237         } /* while data < ... */
 238
 239         return NF_ACCEPT;
 240 }
 241
 242 static struct ip_conntrack_helper irc_helpers[MAX_PORTS];
 243 static char irc_names[MAX_PORTS][10];
 244
 245 static void fini(void);
 246
 247 static int __init init(void)
 248 {
 249         int i, ret;
 250         struct ip_conntrack_helper *hlpr;
 251         char *tmpname;
 252
 253         if (max_dcc_channels < 1) {
 254                 printk("ip_conntrack_irc: max_dcc_channels must be a positive integer\n");
 255                 return -EBUSY;
 256         }
 257         if (dcc_timeout < 0) {
 258                 printk("ip_conntrack_irc: dcc_timeout must be a positive integer\n");
 259                 return -EBUSY;
 260         }
 261
 262         /* If no port given, default to standard irc port */
 263         if (ports[0] == 0)
 264                 ports[0] = IRC_PORT;
 265
 266         for (i = 0; (i < MAX_PORTS) && ports[i]; i++) {
 267                 hlpr = &irc_helpers[i];
 268                 hlpr->tuple.src.u.tcp.port = htons(ports[i]);
 269                 hlpr->tuple.dst.protonum = IPPROTO_TCP;
 270                 hlpr->mask.src.u.tcp.port = 0xFFFF;
 271                 hlpr->mask.dst.protonum = 0xFFFF;
 272                 hlpr->max_expected = max_dcc_channels;
 273                 hlpr->timeout = dcc_timeout;
 274                 hlpr->flags = IP_CT_HELPER_F_REUSE_EXPECT;
 275                 hlpr->me = ip_conntrack_irc;
 276                 hlpr->help = help;
 277
 278                 tmpname = &irc_names[i][0];
 279                 if (ports[i] == IRC_PORT)
 280                         sprintf(tmpname, "irc");
 281                 else
 282                         sprintf(tmpname, "irc-%d", i);
 283                 hlpr->name = tmpname;
 284
 285                 DEBUGP("port #%d: %d\n", i, ports[i]);
 286
 287                 ret = ip_conntrack_helper_register(hlpr);
 288
 289                 if (ret) {
 290                         printk("ip_conntrack_irc: ERROR registering port %d\n",
 291                                 ports[i]);
 292                         fini();
 293                         return -EBUSY;
 294                 }
 295                 ports_c++;
 296         }
 297         return 0;
 298 }
 299
 300 /* This function is intentionally _NOT_ defined as __exit, because
 301  * it is needed by the init function */
 302 static void fini(void)
 303 {
 304         int i;
 305         for (i = 0; i < ports_c; i++) {
 306                 DEBUGP("unregistering port %d\n",
 307                        ports[i]);
 308                 ip_conntrack_helper_unregister(&irc_helpers[i]);
 309         }
 310 }
 311
 312 module_init(init);
 313 module_exit(fini);