105 lines
2.5 KiB
C
105 lines
2.5 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/* Support ct functions for openvswitch and used by OVS and TC conntrack. */
|
|
|
|
#include <net/netfilter/nf_conntrack_helper.h>
|
|
#include <net/netfilter/nf_conntrack_seqadj.h>
|
|
#include <net/ip.h>
|
|
|
|
/* 'skb' should already be pulled to nh_ofs. */
|
|
int nf_ct_helper(struct sk_buff *skb, struct nf_conn *ct,
|
|
enum ip_conntrack_info ctinfo, u16 proto)
|
|
{
|
|
const struct nf_conntrack_helper *helper;
|
|
const struct nf_conn_help *help;
|
|
unsigned int protoff;
|
|
int err;
|
|
|
|
if (ctinfo == IP_CT_RELATED_REPLY)
|
|
return NF_ACCEPT;
|
|
|
|
help = nfct_help(ct);
|
|
if (!help)
|
|
return NF_ACCEPT;
|
|
|
|
helper = rcu_dereference(help->helper);
|
|
if (!helper)
|
|
return NF_ACCEPT;
|
|
|
|
if (helper->tuple.src.l3num != NFPROTO_UNSPEC &&
|
|
helper->tuple.src.l3num != proto)
|
|
return NF_ACCEPT;
|
|
|
|
switch (proto) {
|
|
case NFPROTO_IPV4:
|
|
protoff = ip_hdrlen(skb);
|
|
proto = ip_hdr(skb)->protocol;
|
|
break;
|
|
case NFPROTO_IPV6: {
|
|
u8 nexthdr = ipv6_hdr(skb)->nexthdr;
|
|
__be16 frag_off;
|
|
int ofs;
|
|
|
|
ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
|
|
&frag_off);
|
|
if (ofs < 0 || (frag_off & htons(~0x7)) != 0) {
|
|
pr_debug("proto header not found\n");
|
|
return NF_ACCEPT;
|
|
}
|
|
protoff = ofs;
|
|
proto = nexthdr;
|
|
break;
|
|
}
|
|
default:
|
|
WARN_ONCE(1, "helper invoked on non-IP family!");
|
|
return NF_DROP;
|
|
}
|
|
|
|
if (helper->tuple.dst.protonum != proto)
|
|
return NF_ACCEPT;
|
|
|
|
err = helper->help(skb, protoff, ct, ctinfo);
|
|
if (err != NF_ACCEPT)
|
|
return err;
|
|
|
|
/* Adjust seqs after helper. This is needed due to some helpers (e.g.,
|
|
* FTP with NAT) adusting the TCP payload size when mangling IP
|
|
* addresses and/or port numbers in the text-based control connection.
|
|
*/
|
|
if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
|
|
!nf_ct_seq_adjust(skb, ct, ctinfo, protoff))
|
|
return NF_DROP;
|
|
return NF_ACCEPT;
|
|
}
|
|
EXPORT_SYMBOL_GPL(nf_ct_helper);
|
|
|
|
int nf_ct_add_helper(struct nf_conn *ct, const char *name, u8 family,
|
|
u8 proto, bool nat, struct nf_conntrack_helper **hp)
|
|
{
|
|
struct nf_conntrack_helper *helper;
|
|
struct nf_conn_help *help;
|
|
int ret = 0;
|
|
|
|
helper = nf_conntrack_helper_try_module_get(name, family, proto);
|
|
if (!helper)
|
|
return -EINVAL;
|
|
|
|
help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
|
|
if (!help) {
|
|
nf_conntrack_helper_put(helper);
|
|
return -ENOMEM;
|
|
}
|
|
#if IS_ENABLED(CONFIG_NF_NAT)
|
|
if (nat) {
|
|
ret = nf_nat_helper_try_module_get(name, family, proto);
|
|
if (ret) {
|
|
nf_conntrack_helper_put(helper);
|
|
return ret;
|
|
}
|
|
}
|
|
#endif
|
|
rcu_assign_pointer(help->helper, helper);
|
|
*hp = helper;
|
|
return ret;
|
|
}
|
|
EXPORT_SYMBOL_GPL(nf_ct_add_helper);
|