Re: [PATCH 3/3 nf-next] netfilter: add netlink support for osf module

[Fernando Fernandez Mancera <ffmancera@xxxxxxxxxx>]

nfnetlink_osf has been testing by adding the following rule in iptables:

iptables -I input -p tcp -j ACCEPT -m osf --genre Linux --log 0 --ttl 2

$ lsmod | grep -i osf
> xt_osf                 16384  4
> nfnetlink_osf          16384  1 xt_osf
> nf_osf                 16384  1 xt_osf
> nfnetlink              16384  1 xt_osf
> x_tables               40960  3 iptable_filter,xt_osf,ip_tables

Is it enough?

Thanks!

On 07/14/2018 04:51 PM, Fernando Fernandez Mancera wrote:
> Signed-off-by: Fernando Fernandez Mancera <ffmancera@xxxxxxxxxx>
> ---
>   include/linux/netfilter/nfnetlink_osf.h |  20 +++++
>   net/netfilter/Kconfig                   |  11 ++-
>   net/netfilter/Makefile                  |   1 +
>   net/netfilter/nfnetlink_osf.c           | 100 +++++++++++++++++++++++
>   net/netfilter/xt_osf.c                  | 103 ++----------------------
>   5 files changed, 139 insertions(+), 96 deletions(-)
>   create mode 100644 include/linux/netfilter/nfnetlink_osf.h
>   create mode 100644 net/netfilter/nfnetlink_osf.c
>
> diff --git a/include/linux/netfilter/nfnetlink_osf.h b/include/linux/netfilter/nfnetlink_osf.h
> new file mode 100644
> index 000000000000..80fbbbbcd21b
> --- /dev/null
> +++ b/include/linux/netfilter/nfnetlink_osf.h
> @@ -0,0 +1,20 @@
> +#ifndef _NFNETLINK_OSF_H
> +#define _NFNETLINK_OSF_H
> +
> +#include <linux/list.h>
> +
> +#include <linux/netfilter/nfnetlink.h>
> +
> +extern struct list_head nf_osf_fingers[2];
> +
> +int nf_osf_add_callback(struct net *net, struct sock *ctnl,
> +			struct sk_buff *skb, const struct nlmsghdr *nlh,
> +			const struct nlattr * const osf_attrs[],
> +			struct netlink_ext_ack *extack);
> +
> +int nf_osf_remove_callback(struct net *net, struct sock *ctnl,
> +			   struct sk_buff *skb, const struct nlmsghdr *nlh,
> +			   const struct nlattr * const osf_attrs[],
> +			   struct netlink_ext_ack *extack);
> +
> +#endif	/* _NFNETLINK_OSF_H */
> diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
> index 29c8591f87c2..1e156978535b 100644
> --- a/net/netfilter/Kconfig
> +++ b/net/netfilter/Kconfig
> @@ -46,6 +46,14 @@ config NETFILTER_NETLINK_LOG
>   	  and is also scheduled to replace the old syslog-based ipt_LOG
>   	  and ip6t_LOG modules.
>   
> +config NETFILTER_NETLINK_OSF
> +	tristate "Netfilter NFOSF over NFNETLINK interface"
> +	depends on NETFILTER_ADVANCED
> +	select NETFILTER_NETLINK
> +	help
> +	  If this option is enables, the kernel will include support
> +	  for passive OS fingerprint via NFNETLINK.
> +
>   config NF_CONNTRACK
>   	tristate "Netfilter connection tracking support"
>   	default m if NETFILTER_ADVANCED=n
> @@ -636,6 +644,7 @@ config NFT_SOCKET
>   config NFT_OSF
>   	tristate "Netfilter nf_tables passive OS fingerprinting support"
>   	select NF_OSF
> +	select NETFILTER_NETLINK_OSF
>   	help
>   	  This option allows matching packets from an specific OS.
>   
> @@ -1385,8 +1394,8 @@ config NETFILTER_XT_MATCH_NFACCT
>   
>   config NETFILTER_XT_MATCH_OSF
>   	tristate '"osf" Passive OS fingerprint match'
> -	depends on NETFILTER_ADVANCED && NETFILTER_NETLINK
>   	select NF_OSF
> +	select NETFILTER_NETLINK_OSF
>   	help
>   	  This option selects the Passive OS Fingerprinting match module
>   	  that allows to passively match the remote operating system by
> diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
> index 75ddcb0f748d..2fa826d5fdc5 100644
> --- a/net/netfilter/Makefile
> +++ b/net/netfilter/Makefile
> @@ -20,6 +20,7 @@ obj-$(CONFIG_NETFILTER_NETLINK) += nfnetlink.o
>   obj-$(CONFIG_NETFILTER_NETLINK_ACCT) += nfnetlink_acct.o
>   obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += nfnetlink_queue.o
>   obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
> +obj-$(CONFIG_NETFILTER_NETLINK_OSF) += nfnetlink_osf.o
>   
>   # connection tracking
>   obj-$(CONFIG_NF_CONNTRACK) += nf_conntrack.o
> diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
> new file mode 100644
> index 000000000000..df9d49c54655
> --- /dev/null
> +++ b/net/netfilter/nfnetlink_osf.c
> @@ -0,0 +1,100 @@
> +#include <linux/netfilter/nfnetlink_osf.h>
> +#include <linux/netfilter/nf_osf.h>
> +
> +/*
> + * Indexed by dont-fragment bit.
> + * It is the only constant value in the fingerprint.
> + */
> +struct list_head nf_osf_fingers[2];
> +EXPORT_SYMBOL_GPL(nf_osf_fingers);
> +
> +static const struct nla_policy nf_osf_policy[OSF_ATTR_MAX + 1] = {
> +	[OSF_ATTR_FINGER]	= { .len = sizeof(struct nf_osf_user_finger) },
> +};
> +
> +int nf_osf_add_callback(struct net *net, struct sock *ctnl,
> +			struct sk_buff *skb, const struct nlmsghdr *nlh,
> +			const struct nlattr * const osf_attrs[],
> +			struct netlink_ext_ack *extack)
> +{
> +	struct nf_osf_user_finger *f;
> +	struct nf_osf_finger *kf = NULL, *sf;
> +	int err = 0;
> +
> +	if (!capable(CAP_NET_ADMIN))
> +		return -EPERM;
> +
> +	if (!osf_attrs[OSF_ATTR_FINGER])
> +		return -EINVAL;
> +
> +	if (!(nlh->nlmsg_flags & NLM_F_CREATE))
> +		return -EINVAL;
> +
> +	f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
> +
> +	kf = kmalloc(sizeof(struct nf_osf_finger), GFP_KERNEL);
> +	if (!kf)
> +		return -ENOMEM;
> +
> +	memcpy(&kf->finger, f, sizeof(struct nf_osf_user_finger));
> +
> +	list_for_each_entry(sf, &nf_osf_fingers[!!f->df], finger_entry) {
> +		if (memcmp(&sf->finger, f, sizeof(struct nf_osf_user_finger)))
> +			continue;
> +
> +		kfree(kf);
> +		kf = NULL;
> +
> +		if (nlh->nlmsg_flags & NLM_F_EXCL)
> +			err = -EEXIST;
> +		break;
> +	}
> +
> +	/*
> +	 * We are protected by nfnl mutex.
> +	 */
> +	if (kf)
> +		list_add_tail_rcu(&kf->finger_entry, &nf_osf_fingers[!!f->df]);
> +
> +	return err;
> +}
> +EXPORT_SYMBOL_GPL(nf_osf_add_callback);
> +
> +int nf_osf_remove_callback(struct net *net, struct sock *ctnl,
> +			   struct sk_buff *skb,
> +			   const struct nlmsghdr *nlh,
> +			   const struct nlattr * const osf_attrs[],
> +			   struct netlink_ext_ack *extack)
> +{
> +	struct nf_osf_user_finger *f;
> +	struct nf_osf_finger *sf;
> +	int err = -ENOENT;
> +
> +	if (!capable(CAP_NET_ADMIN))
> +		return -EPERM;
> +
> +	if (!osf_attrs[OSF_ATTR_FINGER])
> +		return -EINVAL;
> +
> +	f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
> +
> +	list_for_each_entry(sf, &nf_osf_fingers[!!f->df], finger_entry) {
> +		if (memcmp(&sf->finger, f, sizeof(struct nf_osf_user_finger)))
> +			continue;
> +
> +		/*
> +		 * We are protected by nfnl mutex.
> +		 */
> +		list_del_rcu(&sf->finger_entry);
> +		kfree_rcu(sf, rcu_head);
> +
> +		err = 0;
> +		break;
> +	}
> +
> +	return err;
> +}
> +EXPORT_SYMBOL_GPL(nf_osf_remove_callback);
> +
> +MODULE_LICENSE("GPL");
> +MODULE_AUTHOR("Fernando Fernandez <ffmancera@xxxxxxxxxx>");
> diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
> index 9cfef73b4107..f6b3234d0ac1 100644
> --- a/net/netfilter/xt_osf.c
> +++ b/net/netfilter/xt_osf.c
> @@ -33,110 +33,23 @@
>   #include <net/tcp.h>
>   
>   #include <linux/netfilter/nfnetlink.h>
> +#include <linux/netfilter/nfnetlink_osf.h>
>   #include <linux/netfilter/x_tables.h>
>   #include <net/netfilter/nf_log.h>
>   #include <linux/netfilter/xt_osf.h>
>   
> -/*
> - * Indexed by dont-fragment bit.
> - * It is the only constant value in the fingerprint.
> - */
> -static struct list_head xt_osf_fingers[2];
> -
>   static const struct nla_policy xt_osf_policy[OSF_ATTR_MAX + 1] = {
>   	[OSF_ATTR_FINGER]	= { .len = sizeof(struct xt_osf_user_finger) },
>   };
>   
> -static int xt_osf_add_callback(struct net *net, struct sock *ctnl,
> -			       struct sk_buff *skb, const struct nlmsghdr *nlh,
> -			       const struct nlattr * const osf_attrs[],
> -			       struct netlink_ext_ack *extack)
> -{
> -	struct xt_osf_user_finger *f;
> -	struct xt_osf_finger *kf = NULL, *sf;
> -	int err = 0;
> -
> -	if (!capable(CAP_NET_ADMIN))
> -		return -EPERM;
> -
> -	if (!osf_attrs[OSF_ATTR_FINGER])
> -		return -EINVAL;
> -
> -	if (!(nlh->nlmsg_flags & NLM_F_CREATE))
> -		return -EINVAL;
> -
> -	f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
> -
> -	kf = kmalloc(sizeof(struct xt_osf_finger), GFP_KERNEL);
> -	if (!kf)
> -		return -ENOMEM;
> -
> -	memcpy(&kf->finger, f, sizeof(struct xt_osf_user_finger));
> -
> -	list_for_each_entry(sf, &xt_osf_fingers[!!f->df], finger_entry) {
> -		if (memcmp(&sf->finger, f, sizeof(struct xt_osf_user_finger)))
> -			continue;
> -
> -		kfree(kf);
> -		kf = NULL;
> -
> -		if (nlh->nlmsg_flags & NLM_F_EXCL)
> -			err = -EEXIST;
> -		break;
> -	}
> -
> -	/*
> -	 * We are protected by nfnl mutex.
> -	 */
> -	if (kf)
> -		list_add_tail_rcu(&kf->finger_entry, &xt_osf_fingers[!!f->df]);
> -
> -	return err;
> -}
> -
> -static int xt_osf_remove_callback(struct net *net, struct sock *ctnl,
> -				  struct sk_buff *skb,
> -				  const struct nlmsghdr *nlh,
> -				  const struct nlattr * const osf_attrs[],
> -				  struct netlink_ext_ack *extack)
> -{
> -	struct xt_osf_user_finger *f;
> -	struct xt_osf_finger *sf;
> -	int err = -ENOENT;
> -
> -	if (!capable(CAP_NET_ADMIN))
> -		return -EPERM;
> -
> -	if (!osf_attrs[OSF_ATTR_FINGER])
> -		return -EINVAL;
> -
> -	f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
> -
> -	list_for_each_entry(sf, &xt_osf_fingers[!!f->df], finger_entry) {
> -		if (memcmp(&sf->finger, f, sizeof(struct xt_osf_user_finger)))
> -			continue;
> -
> -		/*
> -		 * We are protected by nfnl mutex.
> -		 */
> -		list_del_rcu(&sf->finger_entry);
> -		kfree_rcu(sf, rcu_head);
> -
> -		err = 0;
> -		break;
> -	}
> -
> -	return err;
> -}
> -
>   static const struct nfnl_callback xt_osf_nfnetlink_callbacks[OSF_MSG_MAX] = {
>   	[OSF_MSG_ADD]	= {
> -		.call		= xt_osf_add_callback,
> +		.call		= nf_osf_add_callback,
>   		.attr_count	= OSF_ATTR_MAX,
>   		.policy		= xt_osf_policy,
>   	},
>   	[OSF_MSG_REMOVE]	= {
> -		.call		= xt_osf_remove_callback,
> +		.call		= nf_osf_remove_callback,
>   		.attr_count	= OSF_ATTR_MAX,
>   		.policy		= xt_osf_policy,
>   	},
> @@ -159,7 +72,7 @@ xt_osf_match_packet(const struct sk_buff *skb, struct xt_action_param *p)
>   		return false;
>   
>   	return nf_osf_match(skb, xt_family(p), xt_hooknum(p), xt_in(p),
> -			    xt_out(p), info, net, xt_osf_fingers);
> +			    xt_out(p), info, net, nf_osf_fingers);
>   }
>   
>   static struct xt_match xt_osf_match = {
> @@ -180,8 +93,8 @@ static int __init xt_osf_init(void)
>   	int err = -EINVAL;
>   	int i;
>   
> -	for (i=0; i<ARRAY_SIZE(xt_osf_fingers); ++i)
> -		INIT_LIST_HEAD(&xt_osf_fingers[i]);
> +	for (i = 0; i < ARRAY_SIZE(nf_osf_fingers); ++i)
> +		INIT_LIST_HEAD(&nf_osf_fingers[i]);
>   
>   	err = nfnetlink_subsys_register(&xt_osf_nfnetlink);
>   	if (err < 0) {
> @@ -213,9 +126,9 @@ static void __exit xt_osf_fini(void)
>   	xt_unregister_match(&xt_osf_match);
>   
>   	rcu_read_lock();
> -	for (i=0; i<ARRAY_SIZE(xt_osf_fingers); ++i) {
> +	for (i = 0; i < ARRAY_SIZE(nf_osf_fingers); ++i) {
>   
> -		list_for_each_entry_rcu(f, &xt_osf_fingers[i], finger_entry) {
> +		list_for_each_entry_rcu(f, &nf_osf_fingers[i], finger_entry) {
>   			list_del_rcu(&f->finger_entry);
>   			kfree_rcu(f, rcu_head);
>   		}
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html