path: root/release/src/linux/linux/net/ipv4/netfilter/ip_conntrack_proto_gre.c

/*
 * ip_conntrack_proto_gre.c - Version 1.11
 *
 * Connection tracking protocol helper module for GRE.
 *
 * GRE is a generic encapsulation protocol, which is generally not very
 * suited for NAT, as it has no protocol-specific part as port numbers.
 *
 * It has an optional key field, which may help us distinguishing two 
 * connections between the same two hosts.
 *
 * GRE is defined in RFC 1701 and RFC 1702, as well as RFC 2784 
 *
 * PPTP is built on top of a modified version of GRE, and has a mandatory
 * field called "CallID", which serves us for the same purpose as the key
 * field in plain GRE.
 *
 * Documentation about PPTP can be found in RFC 2637
 *
 * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 *
 */

#include <linux/config.h>
#include <linux/module.h>
#include <linux/types.h>
#include <linux/timer.h>
#include <linux/netfilter.h>
#include <linux/ip.h>
#include <linux/in.h>
#include <linux/list.h>

#include <linux/netfilter_ipv4/lockhelp.h>

DECLARE_RWLOCK(ip_ct_gre_lock);
#define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_ct_gre_lock)
#define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_ct_gre_lock)

#include <linux/netfilter_ipv4/listhelp.h>
#include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
#include <linux/netfilter_ipv4/ip_conntrack_core.h>

#include <linux/netfilter_ipv4/ip_conntrack_proto_gre.h>
#include <linux/netfilter_ipv4/ip_conntrack_pptp.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
MODULE_DESCRIPTION("netfilter connection tracking protocol helper for GRE");

/* shamelessly stolen from ip_conntrack_proto_udp.c */
#define GRE_TIMEOUT		(30*HZ)
#define GRE_STREAM_TIMEOUT	(180*HZ)

#define DEBUGP(x, args...)
#define DUMP_TUPLE_GRE(x)
				
/* GRE KEYMAP HANDLING FUNCTIONS */
static LIST_HEAD(gre_keymap_list);

static inline int gre_key_cmpfn(const struct ip_ct_gre_keymap *km,
				const struct ip_conntrack_tuple *t)
{
	return ((km->tuple.src.ip == t->src.ip) &&
		(km->tuple.dst.ip == t->dst.ip) &&
	        (km->tuple.dst.protonum == t->dst.protonum) &&
	        (km->tuple.dst.u.all == t->dst.u.all));
}

/* look up the source key for a given tuple */
static u_int32_t gre_keymap_lookup(struct ip_conntrack_tuple *t)
{
	struct ip_ct_gre_keymap *km;
	u_int32_t key;

	READ_LOCK(&ip_ct_gre_lock);
	km = LIST_FIND(&gre_keymap_list, gre_key_cmpfn,
			struct ip_ct_gre_keymap *, t);
	if (!km) {
		READ_UNLOCK(&ip_ct_gre_lock);
		return 0;
	}

	key = km->tuple.src.u.gre.key;
	READ_UNLOCK(&ip_ct_gre_lock);

	return key;
}

/* add a single keymap entry, associate with specified expect */
int ip_ct_gre_keymap_add(struct ip_conntrack_expect *exp,
			 struct ip_conntrack_tuple *t, int reply)
{
	struct ip_ct_gre_keymap *km;

	km = kmalloc(sizeof(*km), GFP_ATOMIC);
	if (!km)
		return -1;

	/* initializing list head should be sufficient */
	memset(km, 0, sizeof(*km));

	memcpy(&km->tuple, t, sizeof(*t));
	km->master = exp;

	if (!reply)
		exp->proto.gre.keymap_orig = km;
	else
		exp->proto.gre.keymap_reply = km;

	DEBUGP("adding new entry %p: ", km);
	DUMP_TUPLE_GRE(&km->tuple);

	WRITE_LOCK(&ip_ct_gre_lock);
	list_append(&gre_keymap_list, km);
	WRITE_UNLOCK(&ip_ct_gre_lock);

	return 0;
}

/* change the tuple of a keymap entry (used by nat helper) */
void ip_ct_gre_keymap_change(struct ip_ct_gre_keymap *km,
			     struct ip_conntrack_tuple *t)
{
	DEBUGP("changing entry %p to: ", km);
	DUMP_TUPLE_GRE(t);

	WRITE_LOCK(&ip_ct_gre_lock);
	memcpy(&km->tuple, t, sizeof(km->tuple));
	WRITE_UNLOCK(&ip_ct_gre_lock);
}


/* PUBLIC CONNTRACK PROTO HELPER FUNCTIONS */

/* invert gre part of tuple */
static int gre_invert_tuple(struct ip_conntrack_tuple *tuple,
			    const struct ip_conntrack_tuple *orig)
{
	tuple->dst.u.gre.protocol = orig->dst.u.gre.protocol;
	tuple->dst.u.gre.version = orig->dst.u.gre.version;

	tuple->dst.u.gre.key = orig->src.u.gre.key;
	tuple->src.u.gre.key = orig->dst.u.gre.key;

	return 1;
}

/* gre hdr info to tuple */
static int gre_pkt_to_tuple(const void *datah, size_t datalen,
			    struct ip_conntrack_tuple *tuple)
{
	struct gre_hdr *grehdr = (struct gre_hdr *) datah;
	struct gre_hdr_pptp *pgrehdr = (struct gre_hdr_pptp *) datah;
	u_int32_t srckey;

	/* core guarantees 8 protocol bytes, no need for size check */

	tuple->dst.u.gre.version = grehdr->version; 
	tuple->dst.u.gre.protocol = grehdr->protocol;

	switch (grehdr->version) {
		case GRE_VERSION_1701:
			if (!grehdr->key) {
				DEBUGP("Can't track GRE without key\n");
				return 0;
			}
			tuple->dst.u.gre.key = *(gre_key(grehdr));
			break;

		case GRE_VERSION_PPTP:
			if (ntohs(grehdr->protocol) != GRE_PROTOCOL_PPTP) {
				DEBUGP("GRE_VERSION_PPTP but unknown proto\n");
				return 0;
			}
			tuple->dst.u.gre.key = htonl(ntohs(pgrehdr->call_id));
			break;

		default:
			printk(KERN_WARNING "unknown GRE version %hu\n",
				tuple->dst.u.gre.version);
			return 0;
	}

	srckey = gre_keymap_lookup(tuple);

	tuple->src.u.gre.key = srckey;

	return 1;
}

/* print gre part of tuple */
static unsigned int gre_print_tuple(char *buffer,
				    const struct ip_conntrack_tuple *tuple)
{
	return sprintf(buffer, "version=%d protocol=0x%04x srckey=0x%x dstkey=0x%x ", 
			tuple->dst.u.gre.version,
			ntohs(tuple->dst.u.gre.protocol),
			ntohl(tuple->src.u.gre.key),
			ntohl(tuple->dst.u.gre.key));
}

/* print private data for conntrack */
static unsigned int gre_print_conntrack(char *buffer,
					const struct ip_conntrack *ct)
{
	return sprintf(buffer, "timeout=%u, stream_timeout=%u ",
		       (ct->proto.gre.timeout / HZ),
		       (ct->proto.gre.stream_timeout / HZ));
}

/* Returns verdict for packet, and may modify conntrack */
static int gre_packet(struct ip_conntrack *ct,
		      struct iphdr *iph, size_t len,
		      enum ip_conntrack_info conntrackinfo)
{
	/* If we've seen traffic both ways, this is a GRE connection.
	 * Extend timeout. */
	if (ct->status & IPS_SEEN_REPLY) {
		ip_ct_refresh(ct, ct->proto.gre.stream_timeout);
		/* Also, more likely to be important, and not a probe. */
		set_bit(IPS_ASSURED_BIT, &ct->status);
	} else
		ip_ct_refresh(ct, ct->proto.gre.timeout);
	
	return NF_ACCEPT;
}

/* Called when a new connection for this protocol found. */
static int gre_new(struct ip_conntrack *ct,
		   struct iphdr *iph, size_t len)
{ 
	DEBUGP(": ");
	DUMP_TUPLE_GRE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);

	/* initialize to sane value.  Ideally a conntrack helper
	 * (e.g. in case of pptp) is increasing them */
	ct->proto.gre.stream_timeout = GRE_STREAM_TIMEOUT;
	ct->proto.gre.timeout = GRE_TIMEOUT;

	return 1;
}

/* Called when a conntrack entry has already been removed from the hashes
 * and is about to be deleted from memory */
static void gre_destroy(struct ip_conntrack *ct)
{
	struct ip_conntrack_expect *master = ct->master;

	DEBUGP(" entering\n");

	if (!master) {
		DEBUGP("no master exp for ct %p\n", ct);
		return;
	}

	WRITE_LOCK(&ip_ct_gre_lock);
	if (master->proto.gre.keymap_orig) {
		DEBUGP("removing %p from list\n", master->proto.gre.keymap_orig);
		list_del(&master->proto.gre.keymap_orig->list);
		kfree(master->proto.gre.keymap_orig);
	}
	if (master->proto.gre.keymap_reply) {
		DEBUGP("removing %p from list\n", master->proto.gre.keymap_reply);
		list_del(&master->proto.gre.keymap_reply->list);
		kfree(master->proto.gre.keymap_reply);
	}
	WRITE_UNLOCK(&ip_ct_gre_lock);
}

/* protocol helper struct */
static struct ip_conntrack_protocol gre = { { NULL, NULL }, IPPROTO_GRE,
					    "gre", 
					    gre_pkt_to_tuple,
					    gre_invert_tuple,
					    gre_print_tuple,
					    gre_print_conntrack,
					    gre_packet,
					    gre_new,
					    gre_destroy,
					    NULL,
					    THIS_MODULE };

/* ip_conntrack_proto_gre initialization */
static int __init init(void)
{
	int retcode;

	if ((retcode = ip_conntrack_protocol_register(&gre))) {
                printk(KERN_ERR "Unable to register conntrack protocol "
			        "helper for gre: %d\n",	retcode);
		return -EIO;
	}

	return 0;
}

static void __exit fini(void)
{
	struct list_head *pos, *n;

	/* delete all keymap entries */
	WRITE_LOCK(&ip_ct_gre_lock);
	list_for_each_safe(pos, n, &gre_keymap_list) {
		DEBUGP("deleting keymap %p\n", pos);
		list_del(pos);
		kfree(pos);
	}
	WRITE_UNLOCK(&ip_ct_gre_lock);

	ip_conntrack_protocol_unregister(&gre); 
}

EXPORT_SYMBOL(ip_ct_gre_keymap_add);
EXPORT_SYMBOL(ip_ct_gre_keymap_change);

module_init(init);
module_exit(fini);