1 From: Jiri Bohac <jbohac@suse.cz>
2 Subject: connection tracking helper for SLP
3 References: fate#301134
5 A simple connection tracking helper for SLP. Marks replies to a
6 SLP broadcast query as ESTABLISHED to allow them to pass through the
9 Signed-off-by: Jiri Bohac <jbohac@suse.cz>
12 net/netfilter/Kconfig | 15 ++++
13 net/netfilter/Makefile | 1
14 net/netfilter/nf_conntrack_slp.c | 127 +++++++++++++++++++++++++++++++++++++++
15 3 files changed, 143 insertions(+)
17 --- a/net/netfilter/Kconfig
18 +++ b/net/netfilter/Kconfig
19 @@ -278,6 +278,21 @@ config NF_CONNTRACK_TFTP
21 To compile it as a module, choose M here. If unsure, say N.
23 +config NF_CONNTRACK_SLP
24 + tristate "SLP protocol support"
25 + depends on NF_CONNTRACK
26 + depends on NETFILTER_ADVANCED
28 + SLP queries are sometimes sent as broadcast messages from an
29 + unprivileged port and responded to with unicast messages to the
30 + same port. This make them hard to firewall properly because connection
31 + tracking doesn't deal with broadcasts. This helper tracks locally
32 + originating broadcast SLP queries and the corresponding
33 + responses. It relies on correct IP address configuration, specifically
34 + netmask and broadcast address.
36 + To compile it as a module, choose M here. If unsure, say N.
39 tristate 'Connection tracking netlink interface'
40 depends on NF_CONNTRACK
41 --- a/net/netfilter/Makefile
42 +++ b/net/netfilter/Makefile
43 @@ -33,6 +33,7 @@ obj-$(CONFIG_NF_CONNTRACK_PPTP) += nf_co
44 obj-$(CONFIG_NF_CONNTRACK_SANE) += nf_conntrack_sane.o
45 obj-$(CONFIG_NF_CONNTRACK_SIP) += nf_conntrack_sip.o
46 obj-$(CONFIG_NF_CONNTRACK_TFTP) += nf_conntrack_tftp.o
47 +obj-$(CONFIG_NF_CONNTRACK_SLP) += nf_conntrack_slp.o
50 obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
52 +++ b/net/netfilter/nf_conntrack_slp.c
55 + * NetBIOS name service broadcast connection tracking helper
57 + * (c) 2007 Jiri Bohac <jbohac@suse.cz>
58 + * (c) 2005 Patrick McHardy <kaber@trash.net>
60 + * This program is free software; you can redistribute it and/or
61 + * modify it under the terms of the GNU General Public License
62 + * as published by the Free Software Foundation; either version
63 + * 2 of the License, or (at your option) any later version.
66 + * This helper tracks locally originating NetBIOS name service
67 + * requests by issuing permanent expectations (valid until
68 + * timing out) matching all reply connections from the
69 + * destination network. The only NetBIOS specific thing is
70 + * actually the port number.
72 +#include <linux/kernel.h>
73 +#include <linux/module.h>
74 +#include <linux/init.h>
75 +#include <linux/skbuff.h>
76 +#include <linux/netdevice.h>
77 +#include <linux/inetdevice.h>
78 +#include <linux/if_addr.h>
79 +#include <linux/in.h>
80 +#include <linux/ip.h>
81 +#include <linux/netfilter.h>
82 +#include <net/route.h>
84 +#include <net/netfilter/nf_conntrack.h>
85 +#include <net/netfilter/nf_conntrack_helper.h>
86 +#include <net/netfilter/nf_conntrack_expect.h>
90 +MODULE_AUTHOR("Jiri Bohac <jbohac@suse.cz>");
91 +MODULE_DESCRIPTION("SLP broadcast connection tracking helper");
92 +MODULE_LICENSE("GPL");
93 +MODULE_ALIAS("ip_conntrack_slp");
95 +static unsigned int timeout __read_mostly = 3;
96 +module_param(timeout, uint, 0400);
97 +MODULE_PARM_DESC(timeout, "timeout for master connection/replies in seconds");
99 +static int help(struct sk_buff *skb, unsigned int protoff,
100 + struct nf_conn *ct, enum ip_conntrack_info ctinfo)
102 + struct nf_conntrack_expect *exp;
103 + struct iphdr *iph = ip_hdr(skb);
104 + struct rtable *rt = skb->rtable;
105 + struct in_device *in_dev;
108 + /* we're only interested in locally generated packets */
109 + if (skb->sk == NULL)
111 + if (rt == NULL || !(rt->rt_flags & RTCF_BROADCAST))
113 + if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
117 + in_dev = __in_dev_get_rcu(rt->u.dst.dev);
118 + if (in_dev != NULL) {
119 + for_primary_ifa(in_dev) {
120 + if (ifa->ifa_broadcast == iph->daddr) {
121 + mask = ifa->ifa_mask;
124 + } endfor_ifa(in_dev);
131 + exp = nf_ct_expect_alloc(ct);
135 + exp->tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
136 + exp->tuple.src.u.udp.port = htons(SLP_PORT);
138 + exp->mask.src.u3.ip = mask;
139 + exp->mask.src.u.udp.port = htons(0xFFFF);
141 + exp->expectfn = NULL;
142 + exp->flags = NF_CT_EXPECT_PERMANENT;
143 + exp->class = NF_CT_EXPECT_CLASS_DEFAULT;
144 + exp->helper = NULL;
146 + nf_ct_expect_related(exp);
147 + nf_ct_expect_put(exp);
149 + nf_ct_refresh(ct, skb, timeout * HZ);
154 +static struct nf_conntrack_expect_policy exp_policy = {
158 +static struct nf_conntrack_helper helper __read_mostly = {
160 + .tuple.src.l3num = AF_INET,
161 + .tuple.src.u.udp.port = __constant_htons(SLP_PORT),
162 + .tuple.dst.protonum = IPPROTO_UDP,
165 + .expect_policy = &exp_policy,
168 +static int __init nf_conntrack_slp_init(void)
170 + exp_policy.timeout = timeout;
171 + return nf_conntrack_helper_register(&helper);
174 +static void __exit nf_conntrack_slp_fini(void)
176 + nf_conntrack_helper_unregister(&helper);
179 +module_init(nf_conntrack_slp_init);
180 +module_exit(nf_conntrack_slp_fini);