1 // SPDX-License-Identifier: GPL-2.0-only
2 /* (C) 1999-2001 Paul `Rusty' Russell
3 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
4 * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
5 */
6
7 #include <linux/types.h>
8 #include <linux/timer.h>
9 #include <linux/module.h>
10 #include <linux/udp.h>
11 #include <linux/seq_file.h>
12 #include <linux/skbuff.h>
13 #include <linux/ipv6.h>
14 #include <net/ip6_checksum.h>
15 #include <net/checksum.h>
16
17 #include <linux/netfilter.h>
18 #include <linux/netfilter_ipv4.h>
19 #include <linux/netfilter_ipv6.h>
20 #include <net/netfilter/nf_conntrack_l4proto.h>
21 #include <net/netfilter/nf_conntrack_ecache.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_log.h>
24 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
25 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
26
27 static const unsigned int udp_timeouts[UDP_CT_MAX] = {
28 [UDP_CT_UNREPLIED] = 30*HZ,
29 [UDP_CT_REPLIED] = 120*HZ,
30 };
31
udp_get_timeouts(struct net * net)32 static unsigned int *udp_get_timeouts(struct net *net)
33 {
34 return nf_udp_pernet(net)->timeouts;
35 }
36
udp_error_log(const struct sk_buff * skb,const struct nf_hook_state * state,const char * msg)37 static void udp_error_log(const struct sk_buff *skb,
38 const struct nf_hook_state *state,
39 const char *msg)
40 {
41 nf_l4proto_log_invalid(skb, state, IPPROTO_UDP, "%s", msg);
42 }
43
udp_validate_len(struct sk_buff * skb,const struct udphdr * hdr,unsigned int dataoff)44 static bool udp_validate_len(struct sk_buff *skb,
45 const struct udphdr *hdr,
46 unsigned int dataoff)
47 {
48 unsigned int udplen = udp_get_len(skb, hdr, dataoff);
49 unsigned int skblen = skb->len - dataoff;
50
51 if (udplen > skblen || udplen < sizeof(*hdr))
52 return false;
53 return true;
54 }
55
udp_error(struct sk_buff * skb,unsigned int dataoff,const struct nf_hook_state * state)56 static bool udp_error(struct sk_buff *skb,
57 unsigned int dataoff,
58 const struct nf_hook_state *state)
59 {
60 const struct udphdr *hdr;
61 struct udphdr _hdr;
62
63 /* Header is too small? */
64 hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
65 if (!hdr) {
66 udp_error_log(skb, state, "short packet");
67 return true;
68 }
69
70 /* Truncated/malformed packets */
71 if (!udp_validate_len(skb, hdr, dataoff)) {
72 udp_error_log(skb, state, "truncated/malformed packet");
73 return true;
74 }
75
76 /* Packet with no checksum */
77 if (!hdr->check)
78 return false;
79
80 /* Checksum invalid? Ignore.
81 * We skip checking packets on the outgoing path
82 * because the checksum is assumed to be correct.
83 * FIXME: Source route IP option packets --RR */
84 if (state->hook == NF_INET_PRE_ROUTING &&
85 state->net->ct.sysctl_checksum &&
86 nf_checksum(skb, state->hook, dataoff, IPPROTO_UDP, state->pf)) {
87 udp_error_log(skb, state, "bad checksum");
88 return true;
89 }
90
91 return false;
92 }
93
94 /* Returns verdict for packet, and may modify conntracktype */
nf_conntrack_udp_packet(struct nf_conn * ct,struct sk_buff * skb,unsigned int dataoff,enum ip_conntrack_info ctinfo,const struct nf_hook_state * state)95 int nf_conntrack_udp_packet(struct nf_conn *ct,
96 struct sk_buff *skb,
97 unsigned int dataoff,
98 enum ip_conntrack_info ctinfo,
99 const struct nf_hook_state *state)
100 {
101 unsigned int *timeouts;
102 unsigned long status;
103
104 if (udp_error(skb, dataoff, state))
105 return -NF_ACCEPT;
106
107 timeouts = nf_ct_timeout_lookup(ct);
108 if (!timeouts)
109 timeouts = udp_get_timeouts(nf_ct_net(ct));
110
111 status = READ_ONCE(ct->status);
112 if ((status & IPS_CONFIRMED) == 0)
113 ct->proto.udp.stream_ts = 2 * HZ + jiffies;
114
115 /* If we've seen traffic both ways, this is some kind of UDP
116 * stream. Set Assured.
117 */
118 if (status & IPS_SEEN_REPLY) {
119 unsigned long extra = timeouts[UDP_CT_UNREPLIED];
120 bool stream = false;
121
122 /* Still active after two seconds? Extend timeout. */
123 if (time_after(jiffies, ct->proto.udp.stream_ts)) {
124 extra = timeouts[UDP_CT_REPLIED];
125 stream = (status & IPS_ASSURED) == 0;
126 }
127
128 nf_ct_refresh_acct(ct, ctinfo, skb, extra);
129
130 /* never set ASSURED for IPS_NAT_CLASH, they time out soon */
131 if (unlikely((status & IPS_NAT_CLASH)))
132 return NF_ACCEPT;
133
134 /* Also, more likely to be important, and not a probe */
135 if (stream && !test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
136 nf_conntrack_event_cache(IPCT_ASSURED, ct);
137 } else {
138 nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[UDP_CT_UNREPLIED]);
139 }
140 return NF_ACCEPT;
141 }
142
143 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
144
145 #include <linux/netfilter/nfnetlink.h>
146 #include <linux/netfilter/nfnetlink_cttimeout.h>
147
udp_timeout_nlattr_to_obj(struct nlattr * tb[],struct net * net,void * data)148 static int udp_timeout_nlattr_to_obj(struct nlattr *tb[],
149 struct net *net, void *data)
150 {
151 unsigned int *timeouts = data;
152 struct nf_udp_net *un = nf_udp_pernet(net);
153
154 if (!timeouts)
155 timeouts = un->timeouts;
156
157 /* set default timeouts for UDP. */
158 timeouts[UDP_CT_UNREPLIED] = un->timeouts[UDP_CT_UNREPLIED];
159 timeouts[UDP_CT_REPLIED] = un->timeouts[UDP_CT_REPLIED];
160
161 if (tb[CTA_TIMEOUT_UDP_UNREPLIED]) {
162 timeouts[UDP_CT_UNREPLIED] =
163 ntohl(nla_get_be32(tb[CTA_TIMEOUT_UDP_UNREPLIED])) * HZ;
164 }
165 if (tb[CTA_TIMEOUT_UDP_REPLIED]) {
166 timeouts[UDP_CT_REPLIED] =
167 ntohl(nla_get_be32(tb[CTA_TIMEOUT_UDP_REPLIED])) * HZ;
168 }
169 return 0;
170 }
171
172 static int
udp_timeout_obj_to_nlattr(struct sk_buff * skb,const void * data)173 udp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
174 {
175 const unsigned int *timeouts = data;
176
177 if (nla_put_be32(skb, CTA_TIMEOUT_UDP_UNREPLIED,
178 htonl(timeouts[UDP_CT_UNREPLIED] / HZ)) ||
179 nla_put_be32(skb, CTA_TIMEOUT_UDP_REPLIED,
180 htonl(timeouts[UDP_CT_REPLIED] / HZ)))
181 goto nla_put_failure;
182 return 0;
183
184 nla_put_failure:
185 return -ENOSPC;
186 }
187
188 static const struct nla_policy
189 udp_timeout_nla_policy[CTA_TIMEOUT_UDP_MAX+1] = {
190 [CTA_TIMEOUT_UDP_UNREPLIED] = { .type = NLA_U32 },
191 [CTA_TIMEOUT_UDP_REPLIED] = { .type = NLA_U32 },
192 };
193 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
194
nf_conntrack_udp_init_net(struct net * net)195 void nf_conntrack_udp_init_net(struct net *net)
196 {
197 struct nf_udp_net *un = nf_udp_pernet(net);
198 int i;
199
200 for (i = 0; i < UDP_CT_MAX; i++)
201 un->timeouts[i] = udp_timeouts[i];
202
203 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
204 un->offload_timeout = 30 * HZ;
205 #endif
206 }
207
208 const struct nf_conntrack_l4proto nf_conntrack_l4proto_udp =
209 {
210 .l4proto = IPPROTO_UDP,
211 .allow_clash = true,
212 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
213 .tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
214 .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
215 .nlattr_tuple_size = nf_ct_port_nlattr_tuple_size,
216 .nla_policy = nf_ct_port_nla_policy,
217 #endif
218 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
219 .ctnl_timeout = {
220 .nlattr_to_obj = udp_timeout_nlattr_to_obj,
221 .obj_to_nlattr = udp_timeout_obj_to_nlattr,
222 .nlattr_max = CTA_TIMEOUT_UDP_MAX,
223 .obj_size = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
224 .nla_policy = udp_timeout_nla_policy,
225 },
226 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
227 };
228