nf_conntrack_amanda.c 6.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238
  1. /* Amanda extension for IP connection tracking
  2. *
  3. * (C) 2002 by Brian J. Murrell <netfilter@interlinx.bc.ca>
  4. * based on HW's ip_conntrack_irc.c as well as other modules
  5. *
  6. * This program is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU General Public License
  8. * as published by the Free Software Foundation; either version
  9. * 2 of the License, or (at your option) any later version.
  10. */
  11. #include <linux/kernel.h>
  12. #include <linux/module.h>
  13. #include <linux/moduleparam.h>
  14. #include <linux/textsearch.h>
  15. #include <linux/skbuff.h>
  16. #include <linux/in.h>
  17. #include <linux/udp.h>
  18. #include <linux/netfilter.h>
  19. #include <net/netfilter/nf_conntrack.h>
  20. #include <net/netfilter/nf_conntrack_expect.h>
  21. #include <net/netfilter/nf_conntrack_ecache.h>
  22. #include <net/netfilter/nf_conntrack_helper.h>
  23. #include <linux/netfilter/nf_conntrack_amanda.h>
  24. static unsigned int master_timeout __read_mostly = 300;
  25. static char *ts_algo = "kmp";
  26. MODULE_AUTHOR("Brian J. Murrell <netfilter@interlinx.bc.ca>");
  27. MODULE_DESCRIPTION("Amanda connection tracking module");
  28. MODULE_LICENSE("GPL");
  29. MODULE_ALIAS("ip_conntrack_amanda");
  30. module_param(master_timeout, uint, 0600);
  31. MODULE_PARM_DESC(master_timeout, "timeout for the master connection");
  32. module_param(ts_algo, charp, 0400);
  33. MODULE_PARM_DESC(ts_algo, "textsearch algorithm to use (default kmp)");
  34. unsigned int (*nf_nat_amanda_hook)(struct sk_buff **pskb,
  35. enum ip_conntrack_info ctinfo,
  36. unsigned int matchoff,
  37. unsigned int matchlen,
  38. struct nf_conntrack_expect *exp)
  39. __read_mostly;
  40. EXPORT_SYMBOL_GPL(nf_nat_amanda_hook);
  41. enum amanda_strings {
  42. SEARCH_CONNECT,
  43. SEARCH_NEWLINE,
  44. SEARCH_DATA,
  45. SEARCH_MESG,
  46. SEARCH_INDEX,
  47. };
  48. static struct {
  49. char *string;
  50. size_t len;
  51. struct ts_config *ts;
  52. } search[] __read_mostly = {
  53. [SEARCH_CONNECT] = {
  54. .string = "CONNECT ",
  55. .len = 8,
  56. },
  57. [SEARCH_NEWLINE] = {
  58. .string = "\n",
  59. .len = 1,
  60. },
  61. [SEARCH_DATA] = {
  62. .string = "DATA ",
  63. .len = 5,
  64. },
  65. [SEARCH_MESG] = {
  66. .string = "MESG ",
  67. .len = 5,
  68. },
  69. [SEARCH_INDEX] = {
  70. .string = "INDEX ",
  71. .len = 6,
  72. },
  73. };
  74. static int amanda_help(struct sk_buff **pskb,
  75. unsigned int protoff,
  76. struct nf_conn *ct,
  77. enum ip_conntrack_info ctinfo)
  78. {
  79. struct ts_state ts;
  80. struct nf_conntrack_expect *exp;
  81. struct nf_conntrack_tuple *tuple;
  82. unsigned int dataoff, start, stop, off, i;
  83. char pbuf[sizeof("65535")], *tmp;
  84. u_int16_t len;
  85. __be16 port;
  86. int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
  87. int ret = NF_ACCEPT;
  88. typeof(nf_nat_amanda_hook) nf_nat_amanda;
  89. /* Only look at packets from the Amanda server */
  90. if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)
  91. return NF_ACCEPT;
  92. /* increase the UDP timeout of the master connection as replies from
  93. * Amanda clients to the server can be quite delayed */
  94. nf_ct_refresh(ct, *pskb, master_timeout * HZ);
  95. /* No data? */
  96. dataoff = protoff + sizeof(struct udphdr);
  97. if (dataoff >= (*pskb)->len) {
  98. if (net_ratelimit())
  99. printk("amanda_help: skblen = %u\n", (*pskb)->len);
  100. return NF_ACCEPT;
  101. }
  102. memset(&ts, 0, sizeof(ts));
  103. start = skb_find_text(*pskb, dataoff, (*pskb)->len,
  104. search[SEARCH_CONNECT].ts, &ts);
  105. if (start == UINT_MAX)
  106. goto out;
  107. start += dataoff + search[SEARCH_CONNECT].len;
  108. memset(&ts, 0, sizeof(ts));
  109. stop = skb_find_text(*pskb, start, (*pskb)->len,
  110. search[SEARCH_NEWLINE].ts, &ts);
  111. if (stop == UINT_MAX)
  112. goto out;
  113. stop += start;
  114. for (i = SEARCH_DATA; i <= SEARCH_INDEX; i++) {
  115. memset(&ts, 0, sizeof(ts));
  116. off = skb_find_text(*pskb, start, stop, search[i].ts, &ts);
  117. if (off == UINT_MAX)
  118. continue;
  119. off += start + search[i].len;
  120. len = min_t(unsigned int, sizeof(pbuf) - 1, stop - off);
  121. if (skb_copy_bits(*pskb, off, pbuf, len))
  122. break;
  123. pbuf[len] = '\0';
  124. port = htons(simple_strtoul(pbuf, &tmp, 10));
  125. len = tmp - pbuf;
  126. if (port == 0 || len > 5)
  127. break;
  128. exp = nf_conntrack_expect_alloc(ct);
  129. if (exp == NULL) {
  130. ret = NF_DROP;
  131. goto out;
  132. }
  133. tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
  134. nf_conntrack_expect_init(exp, family,
  135. &tuple->src.u3, &tuple->dst.u3,
  136. IPPROTO_TCP, NULL, &port);
  137. nf_nat_amanda = rcu_dereference(nf_nat_amanda_hook);
  138. if (nf_nat_amanda && ct->status & IPS_NAT_MASK)
  139. ret = nf_nat_amanda(pskb, ctinfo, off - dataoff,
  140. len, exp);
  141. else if (nf_conntrack_expect_related(exp) != 0)
  142. ret = NF_DROP;
  143. nf_conntrack_expect_put(exp);
  144. }
  145. out:
  146. return ret;
  147. }
  148. static struct nf_conntrack_helper amanda_helper[2] __read_mostly = {
  149. {
  150. .name = "amanda",
  151. .max_expected = 3,
  152. .timeout = 180,
  153. .me = THIS_MODULE,
  154. .help = amanda_help,
  155. .tuple.src.l3num = AF_INET,
  156. .tuple.src.u.udp.port = __constant_htons(10080),
  157. .tuple.dst.protonum = IPPROTO_UDP,
  158. .mask.src.l3num = 0xFFFF,
  159. .mask.src.u.udp.port = __constant_htons(0xFFFF),
  160. .mask.dst.protonum = 0xFF,
  161. },
  162. {
  163. .name = "amanda",
  164. .max_expected = 3,
  165. .timeout = 180,
  166. .me = THIS_MODULE,
  167. .help = amanda_help,
  168. .tuple.src.l3num = AF_INET6,
  169. .tuple.src.u.udp.port = __constant_htons(10080),
  170. .tuple.dst.protonum = IPPROTO_UDP,
  171. .mask.src.l3num = 0xFFFF,
  172. .mask.src.u.udp.port = __constant_htons(0xFFFF),
  173. .mask.dst.protonum = 0xFF,
  174. },
  175. };
  176. static void __exit nf_conntrack_amanda_fini(void)
  177. {
  178. int i;
  179. nf_conntrack_helper_unregister(&amanda_helper[0]);
  180. nf_conntrack_helper_unregister(&amanda_helper[1]);
  181. for (i = 0; i < ARRAY_SIZE(search); i++)
  182. textsearch_destroy(search[i].ts);
  183. }
  184. static int __init nf_conntrack_amanda_init(void)
  185. {
  186. int ret, i;
  187. ret = -ENOMEM;
  188. for (i = 0; i < ARRAY_SIZE(search); i++) {
  189. search[i].ts = textsearch_prepare(ts_algo, search[i].string,
  190. search[i].len,
  191. GFP_KERNEL, TS_AUTOLOAD);
  192. if (search[i].ts == NULL)
  193. goto err1;
  194. }
  195. ret = nf_conntrack_helper_register(&amanda_helper[0]);
  196. if (ret < 0)
  197. goto err1;
  198. ret = nf_conntrack_helper_register(&amanda_helper[1]);
  199. if (ret < 0)
  200. goto err2;
  201. return 0;
  202. err2:
  203. nf_conntrack_helper_unregister(&amanda_helper[0]);
  204. err1:
  205. for (; i >= 0; i--) {
  206. if (search[i].ts)
  207. textsearch_destroy(search[i].ts);
  208. }
  209. return ret;
  210. }
  211. module_init(nf_conntrack_amanda_init);
  212. module_exit(nf_conntrack_amanda_fini);