1 /* IRC extension for IP connection tracking, Version 1.21
2 * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
3 * based on RR's ip_conntrack_ftp.c
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License
7 * as published by the Free Software Foundation; either version
8 * 2 of the License, or (at your option) any later version.
11 #include <linux/module.h>
12 #include <linux/moduleparam.h>
13 #include <linux/skbuff.h>
16 #include <linux/tcp.h>
17 #include <linux/netfilter.h>
18 #include <linux/slab.h>
20 #include <net/netfilter/nf_conntrack.h>
21 #include <net/netfilter/nf_conntrack_expect.h>
22 #include <net/netfilter/nf_conntrack_helper.h>
23 #include <linux/netfilter/nf_conntrack_irc.h>
26 static unsigned short ports[MAX_PORTS];
27 static unsigned int ports_c;
28 static unsigned int max_dcc_channels = 8;
29 static unsigned int dcc_timeout __read_mostly = 300;
30 /* This is slow, but it's simple. --RR */
31 static char *irc_buffer;
32 static DEFINE_SPINLOCK(irc_buffer_lock);
34 unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
35 enum ip_conntrack_info ctinfo,
36 unsigned int matchoff,
37 unsigned int matchlen,
38 struct nf_conntrack_expect *exp) __read_mostly;
39 EXPORT_SYMBOL_GPL(nf_nat_irc_hook);
41 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
42 MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
43 MODULE_LICENSE("GPL");
44 MODULE_ALIAS("ip_conntrack_irc");
45 MODULE_ALIAS_NFCT_HELPER("irc");
47 module_param_array(ports, ushort, &ports_c, 0400);
48 MODULE_PARM_DESC(ports, "port numbers of IRC servers");
49 module_param(max_dcc_channels, uint, 0400);
50 MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per "
52 module_param(dcc_timeout, uint, 0400);
53 MODULE_PARM_DESC(dcc_timeout, "timeout on for unestablished DCC channels");
55 static const char *const dccprotos[] = {
56 "SEND ", "CHAT ", "MOVE ", "TSEND ", "SCHAT "
61 /* tries to get the ip_addr and port out of a dcc command
62 * return value: -1 on failure, 0 on success
63 * data pointer to first byte of DCC command data
64 * data_end pointer to last byte of dcc command data
65 * ip returns parsed ip of dcc command
66 * port returns parsed port of dcc command
67 * ad_beg_p returns pointer to first byte of addr data
68 * ad_end_p returns pointer to last byte of addr data
70 static int parse_dcc(char *data, const char *data_end, __be32 *ip,
71 u_int16_t *port, char **ad_beg_p, char **ad_end_p)
75 /* at least 12: "AAAAAAAA P\1\n" */
76 while (*data++ != ' ')
77 if (data > data_end - 12)
80 /* Make sure we have a newline character within the packet boundaries
81 * because simple_strtoul parses until the first invalid character. */
82 for (tmp = data; tmp <= data_end; tmp++)
85 if (tmp > data_end || *tmp != '\n')
89 *ip = cpu_to_be32(simple_strtoul(data, &data, 10));
91 /* skip blanks between ip and port */
92 while (*data == ' ') {
98 *port = simple_strtoul(data, &data, 10);
104 static int help(struct sk_buff *skb, unsigned int protoff,
105 struct nf_conn *ct, enum ip_conntrack_info ctinfo)
107 unsigned int dataoff;
108 const struct iphdr *iph;
109 const struct tcphdr *th;
111 const char *data_limit;
113 int dir = CTINFO2DIR(ctinfo);
114 struct nf_conntrack_expect *exp;
115 struct nf_conntrack_tuple *tuple;
119 int i, ret = NF_ACCEPT;
120 char *addr_beg_p, *addr_end_p;
121 typeof(nf_nat_irc_hook) nf_nat_irc;
123 /* If packet is coming from IRC server */
124 if (dir == IP_CT_DIR_REPLY)
127 /* Until there's been traffic both ways, don't look in packets. */
128 if (ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY)
131 /* Not a full tcp header? */
132 th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
137 dataoff = protoff + th->doff*4;
138 if (dataoff >= skb->len)
141 spin_lock_bh(&irc_buffer_lock);
142 ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff,
144 BUG_ON(ib_ptr == NULL);
147 data_limit = ib_ptr + skb->len - dataoff;
149 /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
150 * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
151 while (data < data_limit - (19 + MINMATCHLEN)) {
152 if (memcmp(data, "\1DCC ", 5)) {
157 /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
160 pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
161 &iph->saddr, ntohs(th->source),
162 &iph->daddr, ntohs(th->dest));
164 for (i = 0; i < ARRAY_SIZE(dccprotos); i++) {
165 if (memcmp(data, dccprotos[i], strlen(dccprotos[i]))) {
169 data += strlen(dccprotos[i]);
170 pr_debug("DCC %s detected\n", dccprotos[i]);
173 * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
174 * data left (== 14/13 bytes) */
175 if (parse_dcc(data, data_limit, &dcc_ip,
176 &dcc_port, &addr_beg_p, &addr_end_p)) {
177 pr_debug("unable to parse dcc command\n");
181 pr_debug("DCC bound ip/port: %pI4:%u\n",
184 /* dcc_ip can be the internal OR external (NAT'ed) IP */
185 tuple = &ct->tuplehash[dir].tuple;
186 if (tuple->src.u3.ip != dcc_ip &&
187 tuple->dst.u3.ip != dcc_ip) {
188 net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
194 exp = nf_ct_expect_alloc(ct);
199 tuple = &ct->tuplehash[!dir].tuple;
200 port = htons(dcc_port);
201 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
203 NULL, &tuple->dst.u3,
204 IPPROTO_TCP, NULL, &port);
206 nf_nat_irc = rcu_dereference(nf_nat_irc_hook);
207 if (nf_nat_irc && ct->status & IPS_NAT_MASK)
208 ret = nf_nat_irc(skb, ctinfo,
210 addr_end_p - addr_beg_p,
212 else if (nf_ct_expect_related(exp) != 0)
214 nf_ct_expect_put(exp);
219 spin_unlock_bh(&irc_buffer_lock);
223 static struct nf_conntrack_helper irc[MAX_PORTS] __read_mostly;
224 static struct nf_conntrack_expect_policy irc_exp_policy;
226 static void nf_conntrack_irc_fini(void);
228 static int __init nf_conntrack_irc_init(void)
232 if (max_dcc_channels < 1) {
233 printk(KERN_ERR "nf_ct_irc: max_dcc_channels must not be zero\n");
237 irc_exp_policy.max_expected = max_dcc_channels;
238 irc_exp_policy.timeout = dcc_timeout;
240 irc_buffer = kmalloc(65536, GFP_KERNEL);
244 /* If no port given, default to standard irc port */
246 ports[ports_c++] = IRC_PORT;
248 for (i = 0; i < ports_c; i++) {
249 irc[i].tuple.src.l3num = AF_INET;
250 irc[i].tuple.src.u.tcp.port = htons(ports[i]);
251 irc[i].tuple.dst.protonum = IPPROTO_TCP;
252 irc[i].expect_policy = &irc_exp_policy;
253 irc[i].me = THIS_MODULE;
256 if (ports[i] == IRC_PORT)
257 sprintf(irc[i].name, "irc");
259 sprintf(irc[i].name, "irc-%u", i);
261 ret = nf_conntrack_helper_register(&irc[i]);
263 printk(KERN_ERR "nf_ct_irc: failed to register helper "
264 "for pf: %u port: %u\n",
265 irc[i].tuple.src.l3num, ports[i]);
266 nf_conntrack_irc_fini();
273 /* This function is intentionally _NOT_ defined as __exit, because
274 * it is needed by the init function */
275 static void nf_conntrack_irc_fini(void)
279 for (i = 0; i < ports_c; i++)
280 nf_conntrack_helper_unregister(&irc[i]);
284 module_init(nf_conntrack_irc_init);
285 module_exit(nf_conntrack_irc_fini);