1 #include <linux/types.h>
2 #include <linux/init.h>
3 #include <linux/netfilter.h>
4 #include <linux/ip.h>
5 #include <linux/tcp.h>
6 #include <linux/if.h>
7 #include <linux/netfilter_ipv4/ip_nat.h>
8 #include <linux/netfilter_ipv4/ip_nat_rule.h>
9 #include <linux/netfilter_ipv4/ip_nat_protocol.h>
10 
11 static int
tcp_in_range(const struct ip_conntrack_tuple * tuple,enum ip_nat_manip_type maniptype,const union ip_conntrack_manip_proto * min,const union ip_conntrack_manip_proto * max)12 tcp_in_range(const struct ip_conntrack_tuple *tuple,
13 	     enum ip_nat_manip_type maniptype,
14 	     const union ip_conntrack_manip_proto *min,
15 	     const union ip_conntrack_manip_proto *max)
16 {
17 	u_int16_t port;
18 
19 	if (maniptype == IP_NAT_MANIP_SRC)
20 		port = tuple->src.u.tcp.port;
21 	else
22 		port = tuple->dst.u.tcp.port;
23 
24 	return ntohs(port) >= ntohs(min->tcp.port)
25 		&& ntohs(port) <= ntohs(max->tcp.port);
26 }
27 
28 static int
tcp_unique_tuple(struct ip_conntrack_tuple * tuple,const struct ip_nat_range * range,enum ip_nat_manip_type maniptype,const struct ip_conntrack * conntrack)29 tcp_unique_tuple(struct ip_conntrack_tuple *tuple,
30 		 const struct ip_nat_range *range,
31 		 enum ip_nat_manip_type maniptype,
32 		 const struct ip_conntrack *conntrack)
33 {
34 	static u_int16_t port = 0;
35 	u_int16_t *portptr;
36 	unsigned int range_size, min, i;
37 
38 	if (maniptype == IP_NAT_MANIP_SRC)
39 		portptr = &tuple->src.u.tcp.port;
40 	else
41 		portptr = &tuple->dst.u.tcp.port;
42 
43 	/* If no range specified... */
44 	if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) {
45 		/* If it's dst rewrite, can't change port */
46 		if (maniptype == IP_NAT_MANIP_DST)
47 			return 0;
48 
49 		/* Map privileged onto privileged. */
50 		if (ntohs(*portptr) < 1024) {
51 			/* Loose convention: >> 512 is credential passing */
52 			if (ntohs(*portptr)<512) {
53 				min = 1;
54 				range_size = 511 - min + 1;
55 			} else {
56 				min = 600;
57 				range_size = 1023 - min + 1;
58 			}
59 		} else {
60 			min = 1024;
61 			range_size = 65535 - 1024 + 1;
62 		}
63 	} else {
64 		min = ntohs(range->min.tcp.port);
65 		range_size = ntohs(range->max.tcp.port) - min + 1;
66 	}
67 
68 	for (i = 0; i < range_size; i++, port++) {
69 		*portptr = htons(min + port % range_size);
70 		if (!ip_nat_used_tuple(tuple, conntrack)) {
71 			return 1;
72 		}
73 	}
74 	return 0;
75 }
76 
77 static void
tcp_manip_pkt(struct iphdr * iph,size_t len,const struct ip_conntrack_manip * manip,enum ip_nat_manip_type maniptype)78 tcp_manip_pkt(struct iphdr *iph, size_t len,
79 	      const struct ip_conntrack_manip *manip,
80 	      enum ip_nat_manip_type maniptype)
81 {
82 	struct tcphdr *hdr = (struct tcphdr *)((u_int32_t *)iph + iph->ihl);
83 	u_int32_t oldip;
84 	u_int16_t *portptr;
85 
86 	if (maniptype == IP_NAT_MANIP_SRC) {
87 		/* Get rid of src ip and src pt */
88 		oldip = iph->saddr;
89 		portptr = &hdr->source;
90 	} else {
91 		/* Get rid of dst ip and dst pt */
92 		oldip = iph->daddr;
93 		portptr = &hdr->dest;
94 	}
95 
96 	/* this could be a inner header returned in icmp packet; in such
97 	   cases we cannot update the checksum field since it is outside of
98 	   the 8 bytes of transport layer headers we are guaranteed */
99 	if(((void *)&hdr->check + sizeof(hdr->check) - (void *)iph) <= len) {
100 		hdr->check = ip_nat_cheat_check(~oldip, manip->ip,
101 					ip_nat_cheat_check(*portptr ^ 0xFFFF,
102 							   manip->u.tcp.port,
103 							   hdr->check));
104 	}
105 
106 	*portptr = manip->u.tcp.port;
107 }
108 
109 static unsigned int
tcp_print(char * buffer,const struct ip_conntrack_tuple * match,const struct ip_conntrack_tuple * mask)110 tcp_print(char *buffer,
111 	  const struct ip_conntrack_tuple *match,
112 	  const struct ip_conntrack_tuple *mask)
113 {
114 	unsigned int len = 0;
115 
116 	if (mask->src.u.tcp.port)
117 		len += sprintf(buffer + len, "srcpt=%u ",
118 			       ntohs(match->src.u.tcp.port));
119 
120 
121 	if (mask->dst.u.tcp.port)
122 		len += sprintf(buffer + len, "dstpt=%u ",
123 			       ntohs(match->dst.u.tcp.port));
124 
125 	return len;
126 }
127 
128 static unsigned int
tcp_print_range(char * buffer,const struct ip_nat_range * range)129 tcp_print_range(char *buffer, const struct ip_nat_range *range)
130 {
131 	if (range->min.tcp.port != 0 || range->max.tcp.port != 0xFFFF) {
132 		if (range->min.tcp.port == range->max.tcp.port)
133 			return sprintf(buffer, "port %u ",
134 				       ntohs(range->min.tcp.port));
135 		else
136 			return sprintf(buffer, "ports %u-%u ",
137 				       ntohs(range->min.tcp.port),
138 				       ntohs(range->max.tcp.port));
139 	}
140 	else return 0;
141 }
142 
143 struct ip_nat_protocol ip_nat_protocol_tcp
144 = { { NULL, NULL }, "TCP", IPPROTO_TCP,
145     tcp_manip_pkt,
146     tcp_in_range,
147     tcp_unique_tuple,
148     tcp_print,
149     tcp_print_range
150 };
151