src/patches/suse-2.6.27.31/patches.suse/netfilter-ip_conntrack_slp.patch

   1 From: Jiri Bohac <jbohac@suse.cz>
   2 Subject: connection tracking helper for SLP
   3 References: fate#301134
   4
   5 A simple connection tracking helper for SLP. Marks replies to a
   6 SLP broadcast query as ESTABLISHED to allow them to pass through the
   7 firewall.
   8
   9 Signed-off-by: Jiri Bohac <jbohac@suse.cz>
  10
  11 ---
  12  net/netfilter/Kconfig            |   15 ++++
  13  net/netfilter/Makefile           |    1
  14  net/netfilter/nf_conntrack_slp.c |  127 +++++++++++++++++++++++++++++++++++++++
  15  3 files changed, 143 insertions(+)
  16
  17 --- a/net/netfilter/Kconfig
  18 +++ b/net/netfilter/Kconfig
  19 @@ -278,6 +278,21 @@ config NF_CONNTRACK_TFTP
  20
  21           To compile it as a module, choose M here.  If unsure, say N.
  22
  23 +config NF_CONNTRACK_SLP
  24 +       tristate "SLP protocol support"
  25 +       depends on NF_CONNTRACK
  26 +       depends on NETFILTER_ADVANCED
  27 +       help
  28 +         SLP queries are sometimes sent as broadcast messages from an
  29 +         unprivileged port and responded to with unicast messages to the
  30 +         same port. This make them hard to firewall properly because connection
  31 +         tracking doesn't deal with broadcasts. This helper tracks locally
  32 +         originating broadcast SLP queries and the corresponding
  33 +         responses. It relies on correct IP address configuration, specifically
  34 +         netmask and broadcast address.
  35 +
  36 +         To compile it as a module, choose M here.  If unsure, say N.
  37 +
  38  config NF_CT_NETLINK
  39         tristate 'Connection tracking netlink interface'
  40         depends on NF_CONNTRACK
  41 --- a/net/netfilter/Makefile
  42 +++ b/net/netfilter/Makefile
  43 @@ -33,6 +33,7 @@ obj-$(CONFIG_NF_CONNTRACK_PPTP) += nf_co
  44  obj-$(CONFIG_NF_CONNTRACK_SANE) += nf_conntrack_sane.o
  45  obj-$(CONFIG_NF_CONNTRACK_SIP) += nf_conntrack_sip.o
  46  obj-$(CONFIG_NF_CONNTRACK_TFTP) += nf_conntrack_tftp.o
  47 +obj-$(CONFIG_NF_CONNTRACK_SLP) += nf_conntrack_slp.o
  48
  49  # generic X tables
  50  obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
  51 --- /dev/null
  52 +++ b/net/netfilter/nf_conntrack_slp.c
  53 @@ -0,0 +1,127 @@
  54 +/*
  55 + *      NetBIOS name service broadcast connection tracking helper
  56 + *
  57 + *      (c) 2007 Jiri Bohac <jbohac@suse.cz>
  58 + *      (c) 2005 Patrick McHardy <kaber@trash.net>
  59 + *
  60 + *      This program is free software; you can redistribute it and/or
  61 + *      modify it under the terms of the GNU General Public License
  62 + *      as published by the Free Software Foundation; either version
  63 + *      2 of the License, or (at your option) any later version.
  64 + */
  65 +/*
  66 + *      This helper tracks locally originating NetBIOS name service
  67 + *      requests by issuing permanent expectations (valid until
  68 + *      timing out) matching all reply connections from the
  69 + *      destination network. The only NetBIOS specific thing is
  70 + *      actually the port number.
  71 + */
  72 +#include <linux/kernel.h>
  73 +#include <linux/module.h>
  74 +#include <linux/init.h>
  75 +#include <linux/skbuff.h>
  76 +#include <linux/netdevice.h>
  77 +#include <linux/inetdevice.h>
  78 +#include <linux/if_addr.h>
  79 +#include <linux/in.h>
  80 +#include <linux/ip.h>
  81 +#include <linux/netfilter.h>
  82 +#include <net/route.h>
  83 +
  84 +#include <net/netfilter/nf_conntrack.h>
  85 +#include <net/netfilter/nf_conntrack_helper.h>
  86 +#include <net/netfilter/nf_conntrack_expect.h>
  87 +
  88 +#define SLP_PORT       427
  89 +
  90 +MODULE_AUTHOR("Jiri Bohac <jbohac@suse.cz>");
  91 +MODULE_DESCRIPTION("SLP broadcast connection tracking helper");
  92 +MODULE_LICENSE("GPL");
  93 +MODULE_ALIAS("ip_conntrack_slp");
  94 +
  95 +static unsigned int timeout __read_mostly = 3;
  96 +module_param(timeout, uint, 0400);
  97 +MODULE_PARM_DESC(timeout, "timeout for master connection/replies in seconds");
  98 +
  99 +static int help(struct sk_buff *skb, unsigned int protoff,
 100 +               struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 101 +{
 102 +       struct nf_conntrack_expect *exp;
 103 +       struct iphdr *iph = ip_hdr(skb);
 104 +       struct rtable *rt = skb->rtable;
 105 +       struct in_device *in_dev;
 106 +       __be32 mask = 0;
 107 +
 108 +       /* we're only interested in locally generated packets */
 109 +       if (skb->sk == NULL)
 110 +               goto out;
 111 +       if (rt == NULL || !(rt->rt_flags & RTCF_BROADCAST))
 112 +               goto out;
 113 +       if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
 114 +               goto out;
 115 +
 116 +       rcu_read_lock();
 117 +       in_dev = __in_dev_get_rcu(rt->u.dst.dev);
 118 +       if (in_dev != NULL) {
 119 +               for_primary_ifa(in_dev) {
 120 +                       if (ifa->ifa_broadcast == iph->daddr) {
 121 +                               mask = ifa->ifa_mask;
 122 +                               break;
 123 +                       }
 124 +               } endfor_ifa(in_dev);
 125 +       }
 126 +       rcu_read_unlock();
 127 +
 128 +       if (mask == 0)
 129 +               goto out;
 130 +
 131 +       exp = nf_ct_expect_alloc(ct);
 132 +       if (exp == NULL)
 133 +               goto out;
 134 +
 135 +       exp->tuple                = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
 136 +       exp->tuple.src.u.udp.port = htons(SLP_PORT);
 137 +
 138 +       exp->mask.src.u3.ip       = mask;
 139 +       exp->mask.src.u.udp.port  = htons(0xFFFF);
 140 +
 141 +       exp->expectfn             = NULL;
 142 +       exp->flags                = NF_CT_EXPECT_PERMANENT;
 143 +       exp->class                = NF_CT_EXPECT_CLASS_DEFAULT;
 144 +       exp->helper               = NULL;
 145 +
 146 +       nf_ct_expect_related(exp);
 147 +       nf_ct_expect_put(exp);
 148 +
 149 +       nf_ct_refresh(ct, skb, timeout * HZ);
 150 +out:
 151 +       return NF_ACCEPT;
 152 +}
 153 +
 154 +static struct nf_conntrack_expect_policy exp_policy = {
 155 +       .max_expected   = 1,
 156 +};
 157 +
 158 +static struct nf_conntrack_helper helper __read_mostly = {
 159 +       .name                   = "slp",
 160 +       .tuple.src.l3num        = AF_INET,
 161 +       .tuple.src.u.udp.port   = __constant_htons(SLP_PORT),
 162 +       .tuple.dst.protonum     = IPPROTO_UDP,
 163 +       .me                     = THIS_MODULE,
 164 +       .help                   = help,
 165 +       .expect_policy          = &exp_policy,
 166 +};
 167 +
 168 +static int __init nf_conntrack_slp_init(void)
 169 +{
 170 +       exp_policy.timeout = timeout;
 171 +       return nf_conntrack_helper_register(&helper);
 172 +}
 173 +
 174 +static void __exit nf_conntrack_slp_fini(void)
 175 +{
 176 +       nf_conntrack_helper_unregister(&helper);
 177 +}
 178 +
 179 +module_init(nf_conntrack_slp_init);
 180 +module_exit(nf_conntrack_slp_fini);