nf_nat_snmp_basic.c 29 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332
  1. /*
  2. * nf_nat_snmp_basic.c
  3. *
  4. * Basic SNMP Application Layer Gateway
  5. *
  6. * This IP NAT module is intended for use with SNMP network
  7. * discovery and monitoring applications where target networks use
  8. * conflicting private address realms.
  9. *
  10. * Static NAT is used to remap the networks from the view of the network
  11. * management system at the IP layer, and this module remaps some application
  12. * layer addresses to match.
  13. *
  14. * The simplest form of ALG is performed, where only tagged IP addresses
  15. * are modified. The module does not need to be MIB aware and only scans
  16. * messages at the ASN.1/BER level.
  17. *
  18. * Currently, only SNMPv1 and SNMPv2 are supported.
  19. *
  20. * More information on ALG and associated issues can be found in
  21. * RFC 2962
  22. *
  23. * The ASB.1/BER parsing code is derived from the gxsnmp package by Gregory
  24. * McLean & Jochen Friedrich, stripped down for use in the kernel.
  25. *
  26. * Copyright (c) 2000 RP Internet (www.rpi.net.au).
  27. *
  28. * This program is free software; you can redistribute it and/or modify
  29. * it under the terms of the GNU General Public License as published by
  30. * the Free Software Foundation; either version 2 of the License, or
  31. * (at your option) any later version.
  32. * This program is distributed in the hope that it will be useful,
  33. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  34. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  35. * GNU General Public License for more details.
  36. * You should have received a copy of the GNU General Public License
  37. * along with this program; if not, write to the Free Software
  38. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  39. *
  40. * Author: James Morris <jmorris@intercode.com.au>
  41. *
  42. * Updates:
  43. * 2000-08-06: Convert to new helper API (Harald Welte).
  44. *
  45. */
  46. #include <linux/module.h>
  47. #include <linux/moduleparam.h>
  48. #include <linux/types.h>
  49. #include <linux/kernel.h>
  50. #include <linux/in.h>
  51. #include <linux/ip.h>
  52. #include <linux/udp.h>
  53. #include <net/checksum.h>
  54. #include <net/udp.h>
  55. #include <net/netfilter/nf_nat.h>
  56. #include <net/netfilter/nf_conntrack_helper.h>
  57. #include <net/netfilter/nf_nat_helper.h>
  58. MODULE_LICENSE("GPL");
  59. MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>");
  60. MODULE_DESCRIPTION("Basic SNMP Application Layer Gateway");
  61. MODULE_ALIAS("ip_nat_snmp_basic");
  62. #define SNMP_PORT 161
  63. #define SNMP_TRAP_PORT 162
  64. #define NOCT1(n) (*(u8 *)n)
  65. static int debug;
  66. static DEFINE_SPINLOCK(snmp_lock);
  67. /*
  68. * Application layer address mapping mimics the NAT mapping, but
  69. * only for the first octet in this case (a more flexible system
  70. * can be implemented if needed).
  71. */
  72. struct oct1_map
  73. {
  74. u_int8_t from;
  75. u_int8_t to;
  76. };
  77. /*****************************************************************************
  78. *
  79. * Basic ASN.1 decoding routines (gxsnmp author Dirk Wisse)
  80. *
  81. *****************************************************************************/
  82. /* Class */
  83. #define ASN1_UNI 0 /* Universal */
  84. #define ASN1_APL 1 /* Application */
  85. #define ASN1_CTX 2 /* Context */
  86. #define ASN1_PRV 3 /* Private */
  87. /* Tag */
  88. #define ASN1_EOC 0 /* End Of Contents */
  89. #define ASN1_BOL 1 /* Boolean */
  90. #define ASN1_INT 2 /* Integer */
  91. #define ASN1_BTS 3 /* Bit String */
  92. #define ASN1_OTS 4 /* Octet String */
  93. #define ASN1_NUL 5 /* Null */
  94. #define ASN1_OJI 6 /* Object Identifier */
  95. #define ASN1_OJD 7 /* Object Description */
  96. #define ASN1_EXT 8 /* External */
  97. #define ASN1_SEQ 16 /* Sequence */
  98. #define ASN1_SET 17 /* Set */
  99. #define ASN1_NUMSTR 18 /* Numerical String */
  100. #define ASN1_PRNSTR 19 /* Printable String */
  101. #define ASN1_TEXSTR 20 /* Teletext String */
  102. #define ASN1_VIDSTR 21 /* Video String */
  103. #define ASN1_IA5STR 22 /* IA5 String */
  104. #define ASN1_UNITIM 23 /* Universal Time */
  105. #define ASN1_GENTIM 24 /* General Time */
  106. #define ASN1_GRASTR 25 /* Graphical String */
  107. #define ASN1_VISSTR 26 /* Visible String */
  108. #define ASN1_GENSTR 27 /* General String */
  109. /* Primitive / Constructed methods*/
  110. #define ASN1_PRI 0 /* Primitive */
  111. #define ASN1_CON 1 /* Constructed */
  112. /*
  113. * Error codes.
  114. */
  115. #define ASN1_ERR_NOERROR 0
  116. #define ASN1_ERR_DEC_EMPTY 2
  117. #define ASN1_ERR_DEC_EOC_MISMATCH 3
  118. #define ASN1_ERR_DEC_LENGTH_MISMATCH 4
  119. #define ASN1_ERR_DEC_BADVALUE 5
  120. /*
  121. * ASN.1 context.
  122. */
  123. struct asn1_ctx
  124. {
  125. int error; /* Error condition */
  126. unsigned char *pointer; /* Octet just to be decoded */
  127. unsigned char *begin; /* First octet */
  128. unsigned char *end; /* Octet after last octet */
  129. };
  130. /*
  131. * Octet string (not null terminated)
  132. */
  133. struct asn1_octstr
  134. {
  135. unsigned char *data;
  136. unsigned int len;
  137. };
  138. static void asn1_open(struct asn1_ctx *ctx,
  139. unsigned char *buf,
  140. unsigned int len)
  141. {
  142. ctx->begin = buf;
  143. ctx->end = buf + len;
  144. ctx->pointer = buf;
  145. ctx->error = ASN1_ERR_NOERROR;
  146. }
  147. static unsigned char asn1_octet_decode(struct asn1_ctx *ctx, unsigned char *ch)
  148. {
  149. if (ctx->pointer >= ctx->end) {
  150. ctx->error = ASN1_ERR_DEC_EMPTY;
  151. return 0;
  152. }
  153. *ch = *(ctx->pointer)++;
  154. return 1;
  155. }
  156. static unsigned char asn1_tag_decode(struct asn1_ctx *ctx, unsigned int *tag)
  157. {
  158. unsigned char ch;
  159. *tag = 0;
  160. do
  161. {
  162. if (!asn1_octet_decode(ctx, &ch))
  163. return 0;
  164. *tag <<= 7;
  165. *tag |= ch & 0x7F;
  166. } while ((ch & 0x80) == 0x80);
  167. return 1;
  168. }
  169. static unsigned char asn1_id_decode(struct asn1_ctx *ctx,
  170. unsigned int *cls,
  171. unsigned int *con,
  172. unsigned int *tag)
  173. {
  174. unsigned char ch;
  175. if (!asn1_octet_decode(ctx, &ch))
  176. return 0;
  177. *cls = (ch & 0xC0) >> 6;
  178. *con = (ch & 0x20) >> 5;
  179. *tag = (ch & 0x1F);
  180. if (*tag == 0x1F) {
  181. if (!asn1_tag_decode(ctx, tag))
  182. return 0;
  183. }
  184. return 1;
  185. }
  186. static unsigned char asn1_length_decode(struct asn1_ctx *ctx,
  187. unsigned int *def,
  188. unsigned int *len)
  189. {
  190. unsigned char ch, cnt;
  191. if (!asn1_octet_decode(ctx, &ch))
  192. return 0;
  193. if (ch == 0x80)
  194. *def = 0;
  195. else {
  196. *def = 1;
  197. if (ch < 0x80)
  198. *len = ch;
  199. else {
  200. cnt = (unsigned char) (ch & 0x7F);
  201. *len = 0;
  202. while (cnt > 0) {
  203. if (!asn1_octet_decode(ctx, &ch))
  204. return 0;
  205. *len <<= 8;
  206. *len |= ch;
  207. cnt--;
  208. }
  209. }
  210. }
  211. return 1;
  212. }
  213. static unsigned char asn1_header_decode(struct asn1_ctx *ctx,
  214. unsigned char **eoc,
  215. unsigned int *cls,
  216. unsigned int *con,
  217. unsigned int *tag)
  218. {
  219. unsigned int def, len;
  220. if (!asn1_id_decode(ctx, cls, con, tag))
  221. return 0;
  222. def = len = 0;
  223. if (!asn1_length_decode(ctx, &def, &len))
  224. return 0;
  225. if (def)
  226. *eoc = ctx->pointer + len;
  227. else
  228. *eoc = NULL;
  229. return 1;
  230. }
  231. static unsigned char asn1_eoc_decode(struct asn1_ctx *ctx, unsigned char *eoc)
  232. {
  233. unsigned char ch;
  234. if (eoc == 0) {
  235. if (!asn1_octet_decode(ctx, &ch))
  236. return 0;
  237. if (ch != 0x00) {
  238. ctx->error = ASN1_ERR_DEC_EOC_MISMATCH;
  239. return 0;
  240. }
  241. if (!asn1_octet_decode(ctx, &ch))
  242. return 0;
  243. if (ch != 0x00) {
  244. ctx->error = ASN1_ERR_DEC_EOC_MISMATCH;
  245. return 0;
  246. }
  247. return 1;
  248. } else {
  249. if (ctx->pointer != eoc) {
  250. ctx->error = ASN1_ERR_DEC_LENGTH_MISMATCH;
  251. return 0;
  252. }
  253. return 1;
  254. }
  255. }
  256. static unsigned char asn1_null_decode(struct asn1_ctx *ctx, unsigned char *eoc)
  257. {
  258. ctx->pointer = eoc;
  259. return 1;
  260. }
  261. static unsigned char asn1_long_decode(struct asn1_ctx *ctx,
  262. unsigned char *eoc,
  263. long *integer)
  264. {
  265. unsigned char ch;
  266. unsigned int len;
  267. if (!asn1_octet_decode(ctx, &ch))
  268. return 0;
  269. *integer = (signed char) ch;
  270. len = 1;
  271. while (ctx->pointer < eoc) {
  272. if (++len > sizeof (long)) {
  273. ctx->error = ASN1_ERR_DEC_BADVALUE;
  274. return 0;
  275. }
  276. if (!asn1_octet_decode(ctx, &ch))
  277. return 0;
  278. *integer <<= 8;
  279. *integer |= ch;
  280. }
  281. return 1;
  282. }
  283. static unsigned char asn1_uint_decode(struct asn1_ctx *ctx,
  284. unsigned char *eoc,
  285. unsigned int *integer)
  286. {
  287. unsigned char ch;
  288. unsigned int len;
  289. if (!asn1_octet_decode(ctx, &ch))
  290. return 0;
  291. *integer = ch;
  292. if (ch == 0) len = 0;
  293. else len = 1;
  294. while (ctx->pointer < eoc) {
  295. if (++len > sizeof (unsigned int)) {
  296. ctx->error = ASN1_ERR_DEC_BADVALUE;
  297. return 0;
  298. }
  299. if (!asn1_octet_decode(ctx, &ch))
  300. return 0;
  301. *integer <<= 8;
  302. *integer |= ch;
  303. }
  304. return 1;
  305. }
  306. static unsigned char asn1_ulong_decode(struct asn1_ctx *ctx,
  307. unsigned char *eoc,
  308. unsigned long *integer)
  309. {
  310. unsigned char ch;
  311. unsigned int len;
  312. if (!asn1_octet_decode(ctx, &ch))
  313. return 0;
  314. *integer = ch;
  315. if (ch == 0) len = 0;
  316. else len = 1;
  317. while (ctx->pointer < eoc) {
  318. if (++len > sizeof (unsigned long)) {
  319. ctx->error = ASN1_ERR_DEC_BADVALUE;
  320. return 0;
  321. }
  322. if (!asn1_octet_decode(ctx, &ch))
  323. return 0;
  324. *integer <<= 8;
  325. *integer |= ch;
  326. }
  327. return 1;
  328. }
  329. static unsigned char asn1_octets_decode(struct asn1_ctx *ctx,
  330. unsigned char *eoc,
  331. unsigned char **octets,
  332. unsigned int *len)
  333. {
  334. unsigned char *ptr;
  335. *len = 0;
  336. *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
  337. if (*octets == NULL) {
  338. if (net_ratelimit())
  339. printk("OOM in bsalg (%d)\n", __LINE__);
  340. return 0;
  341. }
  342. ptr = *octets;
  343. while (ctx->pointer < eoc) {
  344. if (!asn1_octet_decode(ctx, (unsigned char *)ptr++)) {
  345. kfree(*octets);
  346. *octets = NULL;
  347. return 0;
  348. }
  349. (*len)++;
  350. }
  351. return 1;
  352. }
  353. static unsigned char asn1_subid_decode(struct asn1_ctx *ctx,
  354. unsigned long *subid)
  355. {
  356. unsigned char ch;
  357. *subid = 0;
  358. do {
  359. if (!asn1_octet_decode(ctx, &ch))
  360. return 0;
  361. *subid <<= 7;
  362. *subid |= ch & 0x7F;
  363. } while ((ch & 0x80) == 0x80);
  364. return 1;
  365. }
  366. static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
  367. unsigned char *eoc,
  368. unsigned long **oid,
  369. unsigned int *len)
  370. {
  371. unsigned long subid;
  372. unsigned int size;
  373. unsigned long *optr;
  374. size = eoc - ctx->pointer + 1;
  375. *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
  376. if (*oid == NULL) {
  377. if (net_ratelimit())
  378. printk("OOM in bsalg (%d)\n", __LINE__);
  379. return 0;
  380. }
  381. optr = *oid;
  382. if (!asn1_subid_decode(ctx, &subid)) {
  383. kfree(*oid);
  384. *oid = NULL;
  385. return 0;
  386. }
  387. if (subid < 40) {
  388. optr [0] = 0;
  389. optr [1] = subid;
  390. } else if (subid < 80) {
  391. optr [0] = 1;
  392. optr [1] = subid - 40;
  393. } else {
  394. optr [0] = 2;
  395. optr [1] = subid - 80;
  396. }
  397. *len = 2;
  398. optr += 2;
  399. while (ctx->pointer < eoc) {
  400. if (++(*len) > size) {
  401. ctx->error = ASN1_ERR_DEC_BADVALUE;
  402. kfree(*oid);
  403. *oid = NULL;
  404. return 0;
  405. }
  406. if (!asn1_subid_decode(ctx, optr++)) {
  407. kfree(*oid);
  408. *oid = NULL;
  409. return 0;
  410. }
  411. }
  412. return 1;
  413. }
  414. /*****************************************************************************
  415. *
  416. * SNMP decoding routines (gxsnmp author Dirk Wisse)
  417. *
  418. *****************************************************************************/
  419. /* SNMP Versions */
  420. #define SNMP_V1 0
  421. #define SNMP_V2C 1
  422. #define SNMP_V2 2
  423. #define SNMP_V3 3
  424. /* Default Sizes */
  425. #define SNMP_SIZE_COMM 256
  426. #define SNMP_SIZE_OBJECTID 128
  427. #define SNMP_SIZE_BUFCHR 256
  428. #define SNMP_SIZE_BUFINT 128
  429. #define SNMP_SIZE_SMALLOBJECTID 16
  430. /* Requests */
  431. #define SNMP_PDU_GET 0
  432. #define SNMP_PDU_NEXT 1
  433. #define SNMP_PDU_RESPONSE 2
  434. #define SNMP_PDU_SET 3
  435. #define SNMP_PDU_TRAP1 4
  436. #define SNMP_PDU_BULK 5
  437. #define SNMP_PDU_INFORM 6
  438. #define SNMP_PDU_TRAP2 7
  439. /* Errors */
  440. #define SNMP_NOERROR 0
  441. #define SNMP_TOOBIG 1
  442. #define SNMP_NOSUCHNAME 2
  443. #define SNMP_BADVALUE 3
  444. #define SNMP_READONLY 4
  445. #define SNMP_GENERROR 5
  446. #define SNMP_NOACCESS 6
  447. #define SNMP_WRONGTYPE 7
  448. #define SNMP_WRONGLENGTH 8
  449. #define SNMP_WRONGENCODING 9
  450. #define SNMP_WRONGVALUE 10
  451. #define SNMP_NOCREATION 11
  452. #define SNMP_INCONSISTENTVALUE 12
  453. #define SNMP_RESOURCEUNAVAILABLE 13
  454. #define SNMP_COMMITFAILED 14
  455. #define SNMP_UNDOFAILED 15
  456. #define SNMP_AUTHORIZATIONERROR 16
  457. #define SNMP_NOTWRITABLE 17
  458. #define SNMP_INCONSISTENTNAME 18
  459. /* General SNMP V1 Traps */
  460. #define SNMP_TRAP_COLDSTART 0
  461. #define SNMP_TRAP_WARMSTART 1
  462. #define SNMP_TRAP_LINKDOWN 2
  463. #define SNMP_TRAP_LINKUP 3
  464. #define SNMP_TRAP_AUTFAILURE 4
  465. #define SNMP_TRAP_EQPNEIGHBORLOSS 5
  466. #define SNMP_TRAP_ENTSPECIFIC 6
  467. /* SNMPv1 Types */
  468. #define SNMP_NULL 0
  469. #define SNMP_INTEGER 1 /* l */
  470. #define SNMP_OCTETSTR 2 /* c */
  471. #define SNMP_DISPLAYSTR 2 /* c */
  472. #define SNMP_OBJECTID 3 /* ul */
  473. #define SNMP_IPADDR 4 /* uc */
  474. #define SNMP_COUNTER 5 /* ul */
  475. #define SNMP_GAUGE 6 /* ul */
  476. #define SNMP_TIMETICKS 7 /* ul */
  477. #define SNMP_OPAQUE 8 /* c */
  478. /* Additional SNMPv2 Types */
  479. #define SNMP_UINTEGER 5 /* ul */
  480. #define SNMP_BITSTR 9 /* uc */
  481. #define SNMP_NSAP 10 /* uc */
  482. #define SNMP_COUNTER64 11 /* ul */
  483. #define SNMP_NOSUCHOBJECT 12
  484. #define SNMP_NOSUCHINSTANCE 13
  485. #define SNMP_ENDOFMIBVIEW 14
  486. union snmp_syntax
  487. {
  488. unsigned char uc[0]; /* 8 bit unsigned */
  489. char c[0]; /* 8 bit signed */
  490. unsigned long ul[0]; /* 32 bit unsigned */
  491. long l[0]; /* 32 bit signed */
  492. };
  493. struct snmp_object
  494. {
  495. unsigned long *id;
  496. unsigned int id_len;
  497. unsigned short type;
  498. unsigned int syntax_len;
  499. union snmp_syntax syntax;
  500. };
  501. struct snmp_request
  502. {
  503. unsigned long id;
  504. unsigned int error_status;
  505. unsigned int error_index;
  506. };
  507. struct snmp_v1_trap
  508. {
  509. unsigned long *id;
  510. unsigned int id_len;
  511. unsigned long ip_address; /* pointer */
  512. unsigned int general;
  513. unsigned int specific;
  514. unsigned long time;
  515. };
  516. /* SNMP types */
  517. #define SNMP_IPA 0
  518. #define SNMP_CNT 1
  519. #define SNMP_GGE 2
  520. #define SNMP_TIT 3
  521. #define SNMP_OPQ 4
  522. #define SNMP_C64 6
  523. /* SNMP errors */
  524. #define SERR_NSO 0
  525. #define SERR_NSI 1
  526. #define SERR_EOM 2
  527. static inline void mangle_address(unsigned char *begin,
  528. unsigned char *addr,
  529. const struct oct1_map *map,
  530. __sum16 *check);
  531. struct snmp_cnv
  532. {
  533. unsigned int class;
  534. unsigned int tag;
  535. int syntax;
  536. };
  537. static struct snmp_cnv snmp_conv [] =
  538. {
  539. {ASN1_UNI, ASN1_NUL, SNMP_NULL},
  540. {ASN1_UNI, ASN1_INT, SNMP_INTEGER},
  541. {ASN1_UNI, ASN1_OTS, SNMP_OCTETSTR},
  542. {ASN1_UNI, ASN1_OTS, SNMP_DISPLAYSTR},
  543. {ASN1_UNI, ASN1_OJI, SNMP_OBJECTID},
  544. {ASN1_APL, SNMP_IPA, SNMP_IPADDR},
  545. {ASN1_APL, SNMP_CNT, SNMP_COUNTER}, /* Counter32 */
  546. {ASN1_APL, SNMP_GGE, SNMP_GAUGE}, /* Gauge32 == Unsigned32 */
  547. {ASN1_APL, SNMP_TIT, SNMP_TIMETICKS},
  548. {ASN1_APL, SNMP_OPQ, SNMP_OPAQUE},
  549. /* SNMPv2 data types and errors */
  550. {ASN1_UNI, ASN1_BTS, SNMP_BITSTR},
  551. {ASN1_APL, SNMP_C64, SNMP_COUNTER64},
  552. {ASN1_CTX, SERR_NSO, SNMP_NOSUCHOBJECT},
  553. {ASN1_CTX, SERR_NSI, SNMP_NOSUCHINSTANCE},
  554. {ASN1_CTX, SERR_EOM, SNMP_ENDOFMIBVIEW},
  555. {0, 0, -1}
  556. };
  557. static unsigned char snmp_tag_cls2syntax(unsigned int tag,
  558. unsigned int cls,
  559. unsigned short *syntax)
  560. {
  561. struct snmp_cnv *cnv;
  562. cnv = snmp_conv;
  563. while (cnv->syntax != -1) {
  564. if (cnv->tag == tag && cnv->class == cls) {
  565. *syntax = cnv->syntax;
  566. return 1;
  567. }
  568. cnv++;
  569. }
  570. return 0;
  571. }
  572. static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
  573. struct snmp_object **obj)
  574. {
  575. unsigned int cls, con, tag, len, idlen;
  576. unsigned short type;
  577. unsigned char *eoc, *end, *p;
  578. unsigned long *lp, *id;
  579. unsigned long ul;
  580. long l;
  581. *obj = NULL;
  582. id = NULL;
  583. if (!asn1_header_decode(ctx, &eoc, &cls, &con, &tag))
  584. return 0;
  585. if (cls != ASN1_UNI || con != ASN1_CON || tag != ASN1_SEQ)
  586. return 0;
  587. if (!asn1_header_decode(ctx, &end, &cls, &con, &tag))
  588. return 0;
  589. if (cls != ASN1_UNI || con != ASN1_PRI || tag != ASN1_OJI)
  590. return 0;
  591. if (!asn1_oid_decode(ctx, end, &id, &idlen))
  592. return 0;
  593. if (!asn1_header_decode(ctx, &end, &cls, &con, &tag)) {
  594. kfree(id);
  595. return 0;
  596. }
  597. if (con != ASN1_PRI) {
  598. kfree(id);
  599. return 0;
  600. }
  601. type = 0;
  602. if (!snmp_tag_cls2syntax(tag, cls, &type)) {
  603. kfree(id);
  604. return 0;
  605. }
  606. l = 0;
  607. switch (type) {
  608. case SNMP_INTEGER:
  609. len = sizeof(long);
  610. if (!asn1_long_decode(ctx, end, &l)) {
  611. kfree(id);
  612. return 0;
  613. }
  614. *obj = kmalloc(sizeof(struct snmp_object) + len,
  615. GFP_ATOMIC);
  616. if (*obj == NULL) {
  617. kfree(id);
  618. if (net_ratelimit())
  619. printk("OOM in bsalg (%d)\n", __LINE__);
  620. return 0;
  621. }
  622. (*obj)->syntax.l[0] = l;
  623. break;
  624. case SNMP_OCTETSTR:
  625. case SNMP_OPAQUE:
  626. if (!asn1_octets_decode(ctx, end, &p, &len)) {
  627. kfree(id);
  628. return 0;
  629. }
  630. *obj = kmalloc(sizeof(struct snmp_object) + len,
  631. GFP_ATOMIC);
  632. if (*obj == NULL) {
  633. kfree(id);
  634. if (net_ratelimit())
  635. printk("OOM in bsalg (%d)\n", __LINE__);
  636. return 0;
  637. }
  638. memcpy((*obj)->syntax.c, p, len);
  639. kfree(p);
  640. break;
  641. case SNMP_NULL:
  642. case SNMP_NOSUCHOBJECT:
  643. case SNMP_NOSUCHINSTANCE:
  644. case SNMP_ENDOFMIBVIEW:
  645. len = 0;
  646. *obj = kmalloc(sizeof(struct snmp_object), GFP_ATOMIC);
  647. if (*obj == NULL) {
  648. kfree(id);
  649. if (net_ratelimit())
  650. printk("OOM in bsalg (%d)\n", __LINE__);
  651. return 0;
  652. }
  653. if (!asn1_null_decode(ctx, end)) {
  654. kfree(id);
  655. kfree(*obj);
  656. *obj = NULL;
  657. return 0;
  658. }
  659. break;
  660. case SNMP_OBJECTID:
  661. if (!asn1_oid_decode(ctx, end, (unsigned long **)&lp, &len)) {
  662. kfree(id);
  663. return 0;
  664. }
  665. len *= sizeof(unsigned long);
  666. *obj = kmalloc(sizeof(struct snmp_object) + len, GFP_ATOMIC);
  667. if (*obj == NULL) {
  668. kfree(lp);
  669. kfree(id);
  670. if (net_ratelimit())
  671. printk("OOM in bsalg (%d)\n", __LINE__);
  672. return 0;
  673. }
  674. memcpy((*obj)->syntax.ul, lp, len);
  675. kfree(lp);
  676. break;
  677. case SNMP_IPADDR:
  678. if (!asn1_octets_decode(ctx, end, &p, &len)) {
  679. kfree(id);
  680. return 0;
  681. }
  682. if (len != 4) {
  683. kfree(p);
  684. kfree(id);
  685. return 0;
  686. }
  687. *obj = kmalloc(sizeof(struct snmp_object) + len, GFP_ATOMIC);
  688. if (*obj == NULL) {
  689. kfree(p);
  690. kfree(id);
  691. if (net_ratelimit())
  692. printk("OOM in bsalg (%d)\n", __LINE__);
  693. return 0;
  694. }
  695. memcpy((*obj)->syntax.uc, p, len);
  696. kfree(p);
  697. break;
  698. case SNMP_COUNTER:
  699. case SNMP_GAUGE:
  700. case SNMP_TIMETICKS:
  701. len = sizeof(unsigned long);
  702. if (!asn1_ulong_decode(ctx, end, &ul)) {
  703. kfree(id);
  704. return 0;
  705. }
  706. *obj = kmalloc(sizeof(struct snmp_object) + len, GFP_ATOMIC);
  707. if (*obj == NULL) {
  708. kfree(id);
  709. if (net_ratelimit())
  710. printk("OOM in bsalg (%d)\n", __LINE__);
  711. return 0;
  712. }
  713. (*obj)->syntax.ul[0] = ul;
  714. break;
  715. default:
  716. kfree(id);
  717. return 0;
  718. }
  719. (*obj)->syntax_len = len;
  720. (*obj)->type = type;
  721. (*obj)->id = id;
  722. (*obj)->id_len = idlen;
  723. if (!asn1_eoc_decode(ctx, eoc)) {
  724. kfree(id);
  725. kfree(*obj);
  726. *obj = NULL;
  727. return 0;
  728. }
  729. return 1;
  730. }
  731. static unsigned char snmp_request_decode(struct asn1_ctx *ctx,
  732. struct snmp_request *request)
  733. {
  734. unsigned int cls, con, tag;
  735. unsigned char *end;
  736. if (!asn1_header_decode(ctx, &end, &cls, &con, &tag))
  737. return 0;
  738. if (cls != ASN1_UNI || con != ASN1_PRI || tag != ASN1_INT)
  739. return 0;
  740. if (!asn1_ulong_decode(ctx, end, &request->id))
  741. return 0;
  742. if (!asn1_header_decode(ctx, &end, &cls, &con, &tag))
  743. return 0;
  744. if (cls != ASN1_UNI || con != ASN1_PRI || tag != ASN1_INT)
  745. return 0;
  746. if (!asn1_uint_decode(ctx, end, &request->error_status))
  747. return 0;
  748. if (!asn1_header_decode(ctx, &end, &cls, &con, &tag))
  749. return 0;
  750. if (cls != ASN1_UNI || con != ASN1_PRI || tag != ASN1_INT)
  751. return 0;
  752. if (!asn1_uint_decode(ctx, end, &request->error_index))
  753. return 0;
  754. return 1;
  755. }
  756. /*
  757. * Fast checksum update for possibly oddly-aligned UDP byte, from the
  758. * code example in the draft.
  759. */
  760. static void fast_csum(__sum16 *csum,
  761. const unsigned char *optr,
  762. const unsigned char *nptr,
  763. int offset)
  764. {
  765. unsigned char s[4];
  766. if (offset & 1) {
  767. s[0] = s[2] = 0;
  768. s[1] = ~*optr;
  769. s[3] = *nptr;
  770. } else {
  771. s[1] = s[3] = 0;
  772. s[0] = ~*optr;
  773. s[2] = *nptr;
  774. }
  775. *csum = csum_fold(csum_partial(s, 4, ~csum_unfold(*csum)));
  776. }
  777. /*
  778. * Mangle IP address.
  779. * - begin points to the start of the snmp messgae
  780. * - addr points to the start of the address
  781. */
  782. static inline void mangle_address(unsigned char *begin,
  783. unsigned char *addr,
  784. const struct oct1_map *map,
  785. __sum16 *check)
  786. {
  787. if (map->from == NOCT1(addr)) {
  788. u_int32_t old;
  789. if (debug)
  790. memcpy(&old, (unsigned char *)addr, sizeof(old));
  791. *addr = map->to;
  792. /* Update UDP checksum if being used */
  793. if (*check) {
  794. fast_csum(check,
  795. &map->from, &map->to, addr - begin);
  796. }
  797. if (debug)
  798. printk(KERN_DEBUG "bsalg: mapped %u.%u.%u.%u to "
  799. "%u.%u.%u.%u\n", NIPQUAD(old), NIPQUAD(*addr));
  800. }
  801. }
  802. static unsigned char snmp_trap_decode(struct asn1_ctx *ctx,
  803. struct snmp_v1_trap *trap,
  804. const struct oct1_map *map,
  805. __sum16 *check)
  806. {
  807. unsigned int cls, con, tag, len;
  808. unsigned char *end;
  809. if (!asn1_header_decode(ctx, &end, &cls, &con, &tag))
  810. return 0;
  811. if (cls != ASN1_UNI || con != ASN1_PRI || tag != ASN1_OJI)
  812. return 0;
  813. if (!asn1_oid_decode(ctx, end, &trap->id, &trap->id_len))
  814. return 0;
  815. if (!asn1_header_decode(ctx, &end, &cls, &con, &tag))
  816. goto err_id_free;
  817. if (!((cls == ASN1_APL && con == ASN1_PRI && tag == SNMP_IPA) ||
  818. (cls == ASN1_UNI && con == ASN1_PRI && tag == ASN1_OTS)))
  819. goto err_id_free;
  820. if (!asn1_octets_decode(ctx, end, (unsigned char **)&trap->ip_address, &len))
  821. goto err_id_free;
  822. /* IPv4 only */
  823. if (len != 4)
  824. goto err_addr_free;
  825. mangle_address(ctx->begin, ctx->pointer - 4, map, check);
  826. if (!asn1_header_decode(ctx, &end, &cls, &con, &tag))
  827. goto err_addr_free;
  828. if (cls != ASN1_UNI || con != ASN1_PRI || tag != ASN1_INT)
  829. goto err_addr_free;
  830. if (!asn1_uint_decode(ctx, end, &trap->general))
  831. goto err_addr_free;
  832. if (!asn1_header_decode(ctx, &end, &cls, &con, &tag))
  833. goto err_addr_free;
  834. if (cls != ASN1_UNI || con != ASN1_PRI || tag != ASN1_INT)
  835. goto err_addr_free;
  836. if (!asn1_uint_decode(ctx, end, &trap->specific))
  837. goto err_addr_free;
  838. if (!asn1_header_decode(ctx, &end, &cls, &con, &tag))
  839. goto err_addr_free;
  840. if (!((cls == ASN1_APL && con == ASN1_PRI && tag == SNMP_TIT) ||
  841. (cls == ASN1_UNI && con == ASN1_PRI && tag == ASN1_INT)))
  842. goto err_addr_free;
  843. if (!asn1_ulong_decode(ctx, end, &trap->time))
  844. goto err_addr_free;
  845. return 1;
  846. err_addr_free:
  847. kfree((unsigned long *)trap->ip_address);
  848. err_id_free:
  849. kfree(trap->id);
  850. return 0;
  851. }
  852. /*****************************************************************************
  853. *
  854. * Misc. routines
  855. *
  856. *****************************************************************************/
  857. static void hex_dump(unsigned char *buf, size_t len)
  858. {
  859. size_t i;
  860. for (i = 0; i < len; i++) {
  861. if (i && !(i % 16))
  862. printk("\n");
  863. printk("%02x ", *(buf + i));
  864. }
  865. printk("\n");
  866. }
  867. /*
  868. * Parse and mangle SNMP message according to mapping.
  869. * (And this is the fucking 'basic' method).
  870. */
  871. static int snmp_parse_mangle(unsigned char *msg,
  872. u_int16_t len,
  873. const struct oct1_map *map,
  874. __sum16 *check)
  875. {
  876. unsigned char *eoc, *end;
  877. unsigned int cls, con, tag, vers, pdutype;
  878. struct asn1_ctx ctx;
  879. struct asn1_octstr comm;
  880. struct snmp_object **obj;
  881. if (debug > 1)
  882. hex_dump(msg, len);
  883. asn1_open(&ctx, msg, len);
  884. /*
  885. * Start of SNMP message.
  886. */
  887. if (!asn1_header_decode(&ctx, &eoc, &cls, &con, &tag))
  888. return 0;
  889. if (cls != ASN1_UNI || con != ASN1_CON || tag != ASN1_SEQ)
  890. return 0;
  891. /*
  892. * Version 1 or 2 handled.
  893. */
  894. if (!asn1_header_decode(&ctx, &end, &cls, &con, &tag))
  895. return 0;
  896. if (cls != ASN1_UNI || con != ASN1_PRI || tag != ASN1_INT)
  897. return 0;
  898. if (!asn1_uint_decode (&ctx, end, &vers))
  899. return 0;
  900. if (debug > 1)
  901. printk(KERN_DEBUG "bsalg: snmp version: %u\n", vers + 1);
  902. if (vers > 1)
  903. return 1;
  904. /*
  905. * Community.
  906. */
  907. if (!asn1_header_decode (&ctx, &end, &cls, &con, &tag))
  908. return 0;
  909. if (cls != ASN1_UNI || con != ASN1_PRI || tag != ASN1_OTS)
  910. return 0;
  911. if (!asn1_octets_decode(&ctx, end, &comm.data, &comm.len))
  912. return 0;
  913. if (debug > 1) {
  914. unsigned int i;
  915. printk(KERN_DEBUG "bsalg: community: ");
  916. for (i = 0; i < comm.len; i++)
  917. printk("%c", comm.data[i]);
  918. printk("\n");
  919. }
  920. kfree(comm.data);
  921. /*
  922. * PDU type
  923. */
  924. if (!asn1_header_decode(&ctx, &eoc, &cls, &con, &pdutype))
  925. return 0;
  926. if (cls != ASN1_CTX || con != ASN1_CON)
  927. return 0;
  928. if (debug > 1) {
  929. unsigned char *pdus[] = {
  930. [SNMP_PDU_GET] = "get",
  931. [SNMP_PDU_NEXT] = "get-next",
  932. [SNMP_PDU_RESPONSE] = "response",
  933. [SNMP_PDU_SET] = "set",
  934. [SNMP_PDU_TRAP1] = "trapv1",
  935. [SNMP_PDU_BULK] = "bulk",
  936. [SNMP_PDU_INFORM] = "inform",
  937. [SNMP_PDU_TRAP2] = "trapv2"
  938. };
  939. if (pdutype > SNMP_PDU_TRAP2)
  940. printk(KERN_DEBUG "bsalg: bad pdu type %u\n", pdutype);
  941. else
  942. printk(KERN_DEBUG "bsalg: pdu: %s\n", pdus[pdutype]);
  943. }
  944. if (pdutype != SNMP_PDU_RESPONSE &&
  945. pdutype != SNMP_PDU_TRAP1 && pdutype != SNMP_PDU_TRAP2)
  946. return 1;
  947. /*
  948. * Request header or v1 trap
  949. */
  950. if (pdutype == SNMP_PDU_TRAP1) {
  951. struct snmp_v1_trap trap;
  952. unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check);
  953. if (ret) {
  954. kfree(trap.id);
  955. kfree((unsigned long *)trap.ip_address);
  956. } else
  957. return ret;
  958. } else {
  959. struct snmp_request req;
  960. if (!snmp_request_decode(&ctx, &req))
  961. return 0;
  962. if (debug > 1)
  963. printk(KERN_DEBUG "bsalg: request: id=0x%lx error_status=%u "
  964. "error_index=%u\n", req.id, req.error_status,
  965. req.error_index);
  966. }
  967. /*
  968. * Loop through objects, look for IP addresses to mangle.
  969. */
  970. if (!asn1_header_decode(&ctx, &eoc, &cls, &con, &tag))
  971. return 0;
  972. if (cls != ASN1_UNI || con != ASN1_CON || tag != ASN1_SEQ)
  973. return 0;
  974. obj = kmalloc(sizeof(struct snmp_object), GFP_ATOMIC);
  975. if (obj == NULL) {
  976. if (net_ratelimit())
  977. printk(KERN_WARNING "OOM in bsalg(%d)\n", __LINE__);
  978. return 0;
  979. }
  980. while (!asn1_eoc_decode(&ctx, eoc)) {
  981. unsigned int i;
  982. if (!snmp_object_decode(&ctx, obj)) {
  983. if (*obj) {
  984. kfree((*obj)->id);
  985. kfree(*obj);
  986. }
  987. kfree(obj);
  988. return 0;
  989. }
  990. if (debug > 1) {
  991. printk(KERN_DEBUG "bsalg: object: ");
  992. for (i = 0; i < (*obj)->id_len; i++) {
  993. if (i > 0)
  994. printk(".");
  995. printk("%lu", (*obj)->id[i]);
  996. }
  997. printk(": type=%u\n", (*obj)->type);
  998. }
  999. if ((*obj)->type == SNMP_IPADDR)
  1000. mangle_address(ctx.begin, ctx.pointer - 4 , map, check);
  1001. kfree((*obj)->id);
  1002. kfree(*obj);
  1003. }
  1004. kfree(obj);
  1005. if (!asn1_eoc_decode(&ctx, eoc))
  1006. return 0;
  1007. return 1;
  1008. }
  1009. /*****************************************************************************
  1010. *
  1011. * NAT routines.
  1012. *
  1013. *****************************************************************************/
  1014. /*
  1015. * SNMP translation routine.
  1016. */
  1017. static int snmp_translate(struct nf_conn *ct,
  1018. enum ip_conntrack_info ctinfo,
  1019. struct sk_buff **pskb)
  1020. {
  1021. struct iphdr *iph = (*pskb)->nh.iph;
  1022. struct udphdr *udph = (struct udphdr *)((__be32 *)iph + iph->ihl);
  1023. u_int16_t udplen = ntohs(udph->len);
  1024. u_int16_t paylen = udplen - sizeof(struct udphdr);
  1025. int dir = CTINFO2DIR(ctinfo);
  1026. struct oct1_map map;
  1027. /*
  1028. * Determine mappping for application layer addresses based
  1029. * on NAT manipulations for the packet.
  1030. */
  1031. if (dir == IP_CT_DIR_ORIGINAL) {
  1032. /* SNAT traps */
  1033. map.from = NOCT1(&ct->tuplehash[dir].tuple.src.u3.ip);
  1034. map.to = NOCT1(&ct->tuplehash[!dir].tuple.dst.u3.ip);
  1035. } else {
  1036. /* DNAT replies */
  1037. map.from = NOCT1(&ct->tuplehash[dir].tuple.src.u3.ip);
  1038. map.to = NOCT1(&ct->tuplehash[!dir].tuple.dst.u3.ip);
  1039. }
  1040. if (map.from == map.to)
  1041. return NF_ACCEPT;
  1042. if (!snmp_parse_mangle((unsigned char *)udph + sizeof(struct udphdr),
  1043. paylen, &map, &udph->check)) {
  1044. if (net_ratelimit())
  1045. printk(KERN_WARNING "bsalg: parser failed\n");
  1046. return NF_DROP;
  1047. }
  1048. return NF_ACCEPT;
  1049. }
  1050. /* We don't actually set up expectations, just adjust internal IP
  1051. * addresses if this is being NATted */
  1052. static int help(struct sk_buff **pskb, unsigned int protoff,
  1053. struct nf_conn *ct,
  1054. enum ip_conntrack_info ctinfo)
  1055. {
  1056. int dir = CTINFO2DIR(ctinfo);
  1057. unsigned int ret;
  1058. struct iphdr *iph = (*pskb)->nh.iph;
  1059. struct udphdr *udph = (struct udphdr *)((u_int32_t *)iph + iph->ihl);
  1060. /* SNMP replies and originating SNMP traps get mangled */
  1061. if (udph->source == htons(SNMP_PORT) && dir != IP_CT_DIR_REPLY)
  1062. return NF_ACCEPT;
  1063. if (udph->dest == htons(SNMP_TRAP_PORT) && dir != IP_CT_DIR_ORIGINAL)
  1064. return NF_ACCEPT;
  1065. /* No NAT? */
  1066. if (!(ct->status & IPS_NAT_MASK))
  1067. return NF_ACCEPT;
  1068. /*
  1069. * Make sure the packet length is ok. So far, we were only guaranteed
  1070. * to have a valid length IP header plus 8 bytes, which means we have
  1071. * enough room for a UDP header. Just verify the UDP length field so we
  1072. * can mess around with the payload.
  1073. */
  1074. if (ntohs(udph->len) != (*pskb)->len - (iph->ihl << 2)) {
  1075. if (net_ratelimit())
  1076. printk(KERN_WARNING "SNMP: dropping malformed packet "
  1077. "src=%u.%u.%u.%u dst=%u.%u.%u.%u\n",
  1078. NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
  1079. return NF_DROP;
  1080. }
  1081. if (!skb_make_writable(pskb, (*pskb)->len))
  1082. return NF_DROP;
  1083. spin_lock_bh(&snmp_lock);
  1084. ret = snmp_translate(ct, ctinfo, pskb);
  1085. spin_unlock_bh(&snmp_lock);
  1086. return ret;
  1087. }
  1088. static struct nf_conntrack_helper snmp_helper __read_mostly = {
  1089. .max_expected = 0,
  1090. .timeout = 180,
  1091. .me = THIS_MODULE,
  1092. .help = help,
  1093. .name = "snmp",
  1094. .tuple.src.l3num = AF_INET,
  1095. .tuple.src.u.udp.port = __constant_htons(SNMP_PORT),
  1096. .tuple.dst.protonum = IPPROTO_UDP,
  1097. .mask.src.l3num = 0xFFFF,
  1098. .mask.src.u.udp.port = __constant_htons(0xFFFF),
  1099. .mask.dst.protonum = 0xFF,
  1100. };
  1101. static struct nf_conntrack_helper snmp_trap_helper __read_mostly = {
  1102. .max_expected = 0,
  1103. .timeout = 180,
  1104. .me = THIS_MODULE,
  1105. .help = help,
  1106. .name = "snmp_trap",
  1107. .tuple.src.l3num = AF_INET,
  1108. .tuple.src.u.udp.port = __constant_htons(SNMP_TRAP_PORT),
  1109. .tuple.dst.protonum = IPPROTO_UDP,
  1110. .mask.src.l3num = 0xFFFF,
  1111. .mask.src.u.udp.port = __constant_htons(0xFFFF),
  1112. .mask.dst.protonum = 0xFF,
  1113. };
  1114. /*****************************************************************************
  1115. *
  1116. * Module stuff.
  1117. *
  1118. *****************************************************************************/
  1119. static int __init nf_nat_snmp_basic_init(void)
  1120. {
  1121. int ret = 0;
  1122. ret = nf_conntrack_helper_register(&snmp_helper);
  1123. if (ret < 0)
  1124. return ret;
  1125. ret = nf_conntrack_helper_register(&snmp_trap_helper);
  1126. if (ret < 0) {
  1127. nf_conntrack_helper_unregister(&snmp_helper);
  1128. return ret;
  1129. }
  1130. return ret;
  1131. }
  1132. static void __exit nf_nat_snmp_basic_fini(void)
  1133. {
  1134. nf_conntrack_helper_unregister(&snmp_helper);
  1135. nf_conntrack_helper_unregister(&snmp_trap_helper);
  1136. }
  1137. module_init(nf_nat_snmp_basic_init);
  1138. module_exit(nf_nat_snmp_basic_fini);
  1139. module_param(debug, int, 0600);