1 /* IRC extension for TCP NAT alteration.
2 * (C) 2000-2001 by Harald Welte <laforge@gnumonks.org>
3 * based on a copy of RR's ip_nat_ftp.c
5 * ip_nat_irc.c,v 1.16 2001/12/06 07:42:10 laforge Exp
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version
10 * 2 of the License, or (at your option) any later version.
13 * insmod ip_nat_irc.o ports=port1,port2,...port<MAX_PORTS>
15 * please give the ports of all IRC servers You wish to connect to.
16 * If You don't specify ports, the default will be port 6667
19 #include <linux/module.h>
20 #include <linux/netfilter_ipv4.h>
22 #include <linux/tcp.h>
23 #include <linux/kernel.h>
25 #include <linux/netfilter_ipv4/ip_nat.h>
26 #include <linux/netfilter_ipv4/ip_nat_helper.h>
27 #include <linux/netfilter_ipv4/ip_nat_rule.h>
28 #include <linux/netfilter_ipv4/ip_conntrack_irc.h>
29 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
34 #define DEBUGP(format, args...)
38 static int ports[MAX_PORTS];
41 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
42 MODULE_DESCRIPTION("IRC (DCC) NAT helper");
43 MODULE_LICENSE("GPL");
44 MODULE_PARM(ports, "1-" __MODULE_STRING(MAX_PORTS) "i");
45 MODULE_PARM_DESC(ports, "port numbers of IRC servers");
47 /* protects irc part of conntracks */
48 DECLARE_LOCK_EXTERN(ip_irc_lock);
50 /* FIXME: Time out? --RR */
53 irc_nat_expected(struct sk_buff **pskb,
55 struct ip_conntrack *ct,
56 struct ip_nat_info *info)
58 struct ip_nat_multi_range mr;
59 u_int32_t newdstip, newsrcip, newip;
61 struct ip_conntrack *master = master_ct(ct);
66 IP_NF_ASSERT(!(info->initialized & (1 << HOOK2MANIP(hooknum))));
68 DEBUGP("nat_expected: We have a connection!\n");
70 newdstip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
71 newsrcip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
72 DEBUGP("nat_expected: DCC cmd. %u.%u.%u.%u->%u.%u.%u.%u\n",
73 NIPQUAD(newsrcip), NIPQUAD(newdstip));
75 if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC)
80 DEBUGP("nat_expected: IP to %u.%u.%u.%u\n", NIPQUAD(newip));
83 /* We don't want to manip the per-protocol, just the IPs. */
84 mr.range[0].flags = IP_NAT_RANGE_MAP_IPS;
85 mr.range[0].min_ip = mr.range[0].max_ip = newip;
87 return ip_nat_setup_info(ct, &mr, hooknum);
90 static int irc_data_fixup(const struct ip_ct_irc_expect *ct_irc_info,
91 struct ip_conntrack *ct,
92 struct sk_buff **pskb,
93 enum ip_conntrack_info ctinfo,
94 struct ip_conntrack_expect *expect)
97 struct ip_conntrack_tuple t;
98 struct iphdr *iph = (*pskb)->nh.iph;
99 struct tcphdr *tcph = (void *) iph + iph->ihl * 4;
102 /* "4294967296 65635 " */
105 MUST_BE_LOCKED(&ip_irc_lock);
107 DEBUGP("IRC_NAT: info (seq %u + %u) in %u\n",
108 expect->seq, ct_irc_info->len,
111 newip = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
113 /* Alter conntrack's expectations. */
115 /* We can read expect here without conntrack lock, since it's
116 only set in ip_conntrack_irc, with ip_irc_lock held
121 for (port = ct_irc_info->port; port != 0; port++) {
122 t.dst.u.tcp.port = htons(port);
123 if (ip_conntrack_change_expect(expect, &t) == 0) {
124 DEBUGP("using port %d", port);
132 /* strlen("\1DCC CHAT chat AAAAAAAA P\1\n")=27
133 * strlen("\1DCC SCHAT chat AAAAAAAA P\1\n")=28
134 * strlen("\1DCC SEND F AAAAAAAA P S\1\n")=26
135 * strlen("\1DCC MOVE F AAAAAAAA P S\1\n")=26
136 * strlen("\1DCC TSEND F AAAAAAAA P S\1\n")=27
137 * AAAAAAAAA: bound addr (1.0.0.0==16777216, min 8 digits,
138 * 255.255.255.255==4294967296, 10 digits)
139 * P: bound port (min 1 d, max 5d (65635))
140 * F: filename (min 1 d )
142 * 0x01, \n: terminators
145 sprintf(buffer, "%u %u", ntohl(newip), port);
146 DEBUGP("ip_nat_irc: Inserting '%s' == %u.%u.%u.%u, port %u\n",
147 buffer, NIPQUAD(newip), port);
149 return ip_nat_mangle_tcp_packet(pskb, ct, ctinfo,
150 expect->seq - ntohl(tcph->seq),
151 ct_irc_info->len, buffer,
155 static unsigned int help(struct ip_conntrack *ct,
156 struct ip_conntrack_expect *exp,
157 struct ip_nat_info *info,
158 enum ip_conntrack_info ctinfo,
159 unsigned int hooknum,
160 struct sk_buff **pskb)
162 struct iphdr *iph = (*pskb)->nh.iph;
163 struct tcphdr *tcph = (void *) iph + iph->ihl * 4;
164 unsigned int datalen;
166 struct ip_ct_irc_expect *ct_irc_info;
169 DEBUGP("ip_nat_irc: no exp!!");
171 ct_irc_info = &exp->help.exp_irc_info;
173 /* Only mangle things once: original direction in POST_ROUTING
174 and reply direction on PRE_ROUTING. */
175 dir = CTINFO2DIR(ctinfo);
176 if (!((hooknum == NF_IP_POST_ROUTING && dir == IP_CT_DIR_ORIGINAL)
177 || (hooknum == NF_IP_PRE_ROUTING && dir == IP_CT_DIR_REPLY))) {
178 DEBUGP("nat_irc: Not touching dir %s at hook %s\n",
179 dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY",
180 hooknum == NF_IP_POST_ROUTING ? "POSTROUTING"
181 : hooknum == NF_IP_PRE_ROUTING ? "PREROUTING"
182 : hooknum == NF_IP_LOCAL_OUT ? "OUTPUT" : "???");
185 DEBUGP("got beyond not touching\n");
187 datalen = (*pskb)->len - iph->ihl * 4 - tcph->doff * 4;
188 LOCK_BH(&ip_irc_lock);
189 /* Check whether the whole IP/address pattern is carried in the payload */
190 if (between(exp->seq + ct_irc_info->len,
192 ntohl(tcph->seq) + datalen)) {
193 if (!irc_data_fixup(ct_irc_info, ct, pskb, ctinfo, exp)) {
194 UNLOCK_BH(&ip_irc_lock);
198 /* Half a match? This means a partial retransmisison.
199 It's a cracker being funky. */
200 if (net_ratelimit()) {
202 ("IRC_NAT: partial packet %u/%u in %u/%u\n",
203 exp->seq, ct_irc_info->len,
205 ntohl(tcph->seq) + datalen);
207 UNLOCK_BH(&ip_irc_lock);
210 UNLOCK_BH(&ip_irc_lock);
215 static struct ip_nat_helper ip_nat_irc_helpers[MAX_PORTS];
216 static char irc_names[MAX_PORTS][10];
218 /* This function is intentionally _NOT_ defined as __exit, because
219 * it is needed by init() */
220 static void fini(void)
224 for (i = 0; i < ports_c; i++) {
225 DEBUGP("ip_nat_irc: unregistering helper for port %d\n",
227 ip_nat_helper_unregister(&ip_nat_irc_helpers[i]);
231 static int __init init(void)
235 struct ip_nat_helper *hlpr;
242 for (i = 0; (i < MAX_PORTS) && ports[i] != 0; i++) {
243 hlpr = &ip_nat_irc_helpers[i];
244 hlpr->tuple.dst.protonum = IPPROTO_TCP;
245 hlpr->tuple.src.u.tcp.port = htons(ports[i]);
246 hlpr->mask.src.u.tcp.port = 0xFFFF;
247 hlpr->mask.dst.protonum = 0xFFFF;
250 hlpr->me = THIS_MODULE;
251 hlpr->expect = irc_nat_expected;
253 tmpname = &irc_names[i][0];
254 if (ports[i] == IRC_PORT)
255 sprintf(tmpname, "irc");
257 sprintf(tmpname, "irc-%d", i);
258 hlpr->name = tmpname;
261 ("ip_nat_irc: Trying to register helper for port %d: name %s\n",
262 ports[i], hlpr->name);
263 ret = ip_nat_helper_register(hlpr);
267 ("ip_nat_irc: error registering helper for port %d\n",
277 NEEDS_CONNTRACK(irc);