123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231 |
- // SPDX-License-Identifier: GPL-2.0-or-later
- /*
- * nf_nat_snmp_basic.c
- *
- * Basic SNMP Application Layer Gateway
- *
- * This IP NAT module is intended for use with SNMP network
- * discovery and monitoring applications where target networks use
- * conflicting private address realms.
- *
- * Static NAT is used to remap the networks from the view of the network
- * management system at the IP layer, and this module remaps some application
- * layer addresses to match.
- *
- * The simplest form of ALG is performed, where only tagged IP addresses
- * are modified. The module does not need to be MIB aware and only scans
- * messages at the ASN.1/BER level.
- *
- * Currently, only SNMPv1 and SNMPv2 are supported.
- *
- * More information on ALG and associated issues can be found in
- * RFC 2962
- *
- * The ASB.1/BER parsing code is derived from the gxsnmp package by Gregory
- * McLean & Jochen Friedrich, stripped down for use in the kernel.
- *
- * Copyright (c) 2000 RP Internet (www.rpi.net.au).
- *
- * Author: James Morris <jmorris@intercode.com.au>
- *
- * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
- */
- #include <linux/module.h>
- #include <linux/moduleparam.h>
- #include <linux/types.h>
- #include <linux/kernel.h>
- #include <linux/in.h>
- #include <linux/ip.h>
- #include <linux/udp.h>
- #include <net/checksum.h>
- #include <net/udp.h>
- #include <net/netfilter/nf_nat.h>
- #include <net/netfilter/nf_conntrack_expect.h>
- #include <net/netfilter/nf_conntrack_helper.h>
- #include <linux/netfilter/nf_conntrack_snmp.h>
- #include "nf_nat_snmp_basic.asn1.h"
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>");
- MODULE_DESCRIPTION("Basic SNMP Application Layer Gateway");
- MODULE_ALIAS("ip_nat_snmp_basic");
- MODULE_ALIAS_NFCT_HELPER("snmp_trap");
- #define SNMP_PORT 161
- #define SNMP_TRAP_PORT 162
- static DEFINE_SPINLOCK(snmp_lock);
- struct snmp_ctx {
- unsigned char *begin;
- __sum16 *check;
- __be32 from;
- __be32 to;
- };
- static void fast_csum(struct snmp_ctx *ctx, unsigned char offset)
- {
- unsigned char s[12] = {0,};
- int size;
- if (offset & 1) {
- memcpy(&s[1], &ctx->from, 4);
- memcpy(&s[7], &ctx->to, 4);
- s[0] = ~0;
- s[1] = ~s[1];
- s[2] = ~s[2];
- s[3] = ~s[3];
- s[4] = ~s[4];
- s[5] = ~0;
- size = 12;
- } else {
- memcpy(&s[0], &ctx->from, 4);
- memcpy(&s[4], &ctx->to, 4);
- s[0] = ~s[0];
- s[1] = ~s[1];
- s[2] = ~s[2];
- s[3] = ~s[3];
- size = 8;
- }
- *ctx->check = csum_fold(csum_partial(s, size,
- ~csum_unfold(*ctx->check)));
- }
- int snmp_version(void *context, size_t hdrlen, unsigned char tag,
- const void *data, size_t datalen)
- {
- if (datalen != 1)
- return -EINVAL;
- if (*(unsigned char *)data > 1)
- return -ENOTSUPP;
- return 1;
- }
- int snmp_helper(void *context, size_t hdrlen, unsigned char tag,
- const void *data, size_t datalen)
- {
- struct snmp_ctx *ctx = (struct snmp_ctx *)context;
- __be32 *pdata;
- if (datalen != 4)
- return -EINVAL;
- pdata = (__be32 *)data;
- if (*pdata == ctx->from) {
- pr_debug("%s: %pI4 to %pI4\n", __func__,
- (void *)&ctx->from, (void *)&ctx->to);
- if (*ctx->check)
- fast_csum(ctx, (unsigned char *)data - ctx->begin);
- *pdata = ctx->to;
- }
- return 1;
- }
- static int snmp_translate(struct nf_conn *ct, int dir, struct sk_buff *skb)
- {
- struct iphdr *iph = ip_hdr(skb);
- struct udphdr *udph = (struct udphdr *)((__be32 *)iph + iph->ihl);
- u16 datalen = ntohs(udph->len) - sizeof(struct udphdr);
- char *data = (unsigned char *)udph + sizeof(struct udphdr);
- struct snmp_ctx ctx;
- int ret;
- if (dir == IP_CT_DIR_ORIGINAL) {
- ctx.from = ct->tuplehash[dir].tuple.src.u3.ip;
- ctx.to = ct->tuplehash[!dir].tuple.dst.u3.ip;
- } else {
- ctx.from = ct->tuplehash[!dir].tuple.src.u3.ip;
- ctx.to = ct->tuplehash[dir].tuple.dst.u3.ip;
- }
- if (ctx.from == ctx.to)
- return NF_ACCEPT;
- ctx.begin = (unsigned char *)udph + sizeof(struct udphdr);
- ctx.check = &udph->check;
- ret = asn1_ber_decoder(&nf_nat_snmp_basic_decoder, &ctx, data, datalen);
- if (ret < 0) {
- nf_ct_helper_log(skb, ct, "parser failed\n");
- return NF_DROP;
- }
- return NF_ACCEPT;
- }
- /* We don't actually set up expectations, just adjust internal IP
- * addresses if this is being NATted
- */
- static int help(struct sk_buff *skb, unsigned int protoff,
- struct nf_conn *ct,
- enum ip_conntrack_info ctinfo)
- {
- int dir = CTINFO2DIR(ctinfo);
- unsigned int ret;
- const struct iphdr *iph = ip_hdr(skb);
- const struct udphdr *udph = (struct udphdr *)((__be32 *)iph + iph->ihl);
- /* SNMP replies and originating SNMP traps get mangled */
- if (udph->source == htons(SNMP_PORT) && dir != IP_CT_DIR_REPLY)
- return NF_ACCEPT;
- if (udph->dest == htons(SNMP_TRAP_PORT) && dir != IP_CT_DIR_ORIGINAL)
- return NF_ACCEPT;
- /* No NAT? */
- if (!(ct->status & IPS_NAT_MASK))
- return NF_ACCEPT;
- /* Make sure the packet length is ok. So far, we were only guaranteed
- * to have a valid length IP header plus 8 bytes, which means we have
- * enough room for a UDP header. Just verify the UDP length field so we
- * can mess around with the payload.
- */
- if (ntohs(udph->len) != skb->len - (iph->ihl << 2)) {
- nf_ct_helper_log(skb, ct, "dropping malformed packet\n");
- return NF_DROP;
- }
- if (skb_ensure_writable(skb, skb->len)) {
- nf_ct_helper_log(skb, ct, "cannot mangle packet");
- return NF_DROP;
- }
- spin_lock_bh(&snmp_lock);
- ret = snmp_translate(ct, dir, skb);
- spin_unlock_bh(&snmp_lock);
- return ret;
- }
- static const struct nf_conntrack_expect_policy snmp_exp_policy = {
- .max_expected = 0,
- .timeout = 180,
- };
- static struct nf_conntrack_helper snmp_trap_helper __read_mostly = {
- .me = THIS_MODULE,
- .help = help,
- .expect_policy = &snmp_exp_policy,
- .name = "snmp_trap",
- .tuple.src.l3num = AF_INET,
- .tuple.src.u.udp.port = cpu_to_be16(SNMP_TRAP_PORT),
- .tuple.dst.protonum = IPPROTO_UDP,
- };
- static int __init nf_nat_snmp_basic_init(void)
- {
- BUG_ON(nf_nat_snmp_hook != NULL);
- RCU_INIT_POINTER(nf_nat_snmp_hook, help);
- return nf_conntrack_helper_register(&snmp_trap_helper);
- }
- static void __exit nf_nat_snmp_basic_fini(void)
- {
- RCU_INIT_POINTER(nf_nat_snmp_hook, NULL);
- synchronize_rcu();
- nf_conntrack_helper_unregister(&snmp_trap_helper);
- }
- module_init(nf_nat_snmp_basic_init);
- module_exit(nf_nat_snmp_basic_fini);
|