1 #include <linux/types.h>
2 #include <linux/init.h>
3 #include <linux/netfilter.h>
4 #include <linux/ip.h>
5 #include <linux/tcp.h>
6 #include <linux/if.h>
7 #include <linux/netfilter_ipv4/ip_nat.h>
8 #include <linux/netfilter_ipv4/ip_nat_rule.h>
9 #include <linux/netfilter_ipv4/ip_nat_protocol.h>
10
11 static int
tcp_in_range(const struct ip_conntrack_tuple * tuple,enum ip_nat_manip_type maniptype,const union ip_conntrack_manip_proto * min,const union ip_conntrack_manip_proto * max)12 tcp_in_range(const struct ip_conntrack_tuple *tuple,
13 enum ip_nat_manip_type maniptype,
14 const union ip_conntrack_manip_proto *min,
15 const union ip_conntrack_manip_proto *max)
16 {
17 u_int16_t port;
18
19 if (maniptype == IP_NAT_MANIP_SRC)
20 port = tuple->src.u.tcp.port;
21 else
22 port = tuple->dst.u.tcp.port;
23
24 return ntohs(port) >= ntohs(min->tcp.port)
25 && ntohs(port) <= ntohs(max->tcp.port);
26 }
27
28 static int
tcp_unique_tuple(struct ip_conntrack_tuple * tuple,const struct ip_nat_range * range,enum ip_nat_manip_type maniptype,const struct ip_conntrack * conntrack)29 tcp_unique_tuple(struct ip_conntrack_tuple *tuple,
30 const struct ip_nat_range *range,
31 enum ip_nat_manip_type maniptype,
32 const struct ip_conntrack *conntrack)
33 {
34 static u_int16_t port = 0;
35 u_int16_t *portptr;
36 unsigned int range_size, min, i;
37
38 if (maniptype == IP_NAT_MANIP_SRC)
39 portptr = &tuple->src.u.tcp.port;
40 else
41 portptr = &tuple->dst.u.tcp.port;
42
43 /* If no range specified... */
44 if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) {
45 /* If it's dst rewrite, can't change port */
46 if (maniptype == IP_NAT_MANIP_DST)
47 return 0;
48
49 /* Map privileged onto privileged. */
50 if (ntohs(*portptr) < 1024) {
51 /* Loose convention: >> 512 is credential passing */
52 if (ntohs(*portptr)<512) {
53 min = 1;
54 range_size = 511 - min + 1;
55 } else {
56 min = 600;
57 range_size = 1023 - min + 1;
58 }
59 } else {
60 min = 1024;
61 range_size = 65535 - 1024 + 1;
62 }
63 } else {
64 min = ntohs(range->min.tcp.port);
65 range_size = ntohs(range->max.tcp.port) - min + 1;
66 }
67
68 for (i = 0; i < range_size; i++, port++) {
69 *portptr = htons(min + port % range_size);
70 if (!ip_nat_used_tuple(tuple, conntrack)) {
71 return 1;
72 }
73 }
74 return 0;
75 }
76
77 static void
tcp_manip_pkt(struct iphdr * iph,size_t len,const struct ip_conntrack_manip * manip,enum ip_nat_manip_type maniptype)78 tcp_manip_pkt(struct iphdr *iph, size_t len,
79 const struct ip_conntrack_manip *manip,
80 enum ip_nat_manip_type maniptype)
81 {
82 struct tcphdr *hdr = (struct tcphdr *)((u_int32_t *)iph + iph->ihl);
83 u_int32_t oldip;
84 u_int16_t *portptr;
85
86 if (maniptype == IP_NAT_MANIP_SRC) {
87 /* Get rid of src ip and src pt */
88 oldip = iph->saddr;
89 portptr = &hdr->source;
90 } else {
91 /* Get rid of dst ip and dst pt */
92 oldip = iph->daddr;
93 portptr = &hdr->dest;
94 }
95
96 /* this could be a inner header returned in icmp packet; in such
97 cases we cannot update the checksum field since it is outside of
98 the 8 bytes of transport layer headers we are guaranteed */
99 if(((void *)&hdr->check + sizeof(hdr->check) - (void *)iph) <= len) {
100 hdr->check = ip_nat_cheat_check(~oldip, manip->ip,
101 ip_nat_cheat_check(*portptr ^ 0xFFFF,
102 manip->u.tcp.port,
103 hdr->check));
104 }
105
106 *portptr = manip->u.tcp.port;
107 }
108
109 static unsigned int
tcp_print(char * buffer,const struct ip_conntrack_tuple * match,const struct ip_conntrack_tuple * mask)110 tcp_print(char *buffer,
111 const struct ip_conntrack_tuple *match,
112 const struct ip_conntrack_tuple *mask)
113 {
114 unsigned int len = 0;
115
116 if (mask->src.u.tcp.port)
117 len += sprintf(buffer + len, "srcpt=%u ",
118 ntohs(match->src.u.tcp.port));
119
120
121 if (mask->dst.u.tcp.port)
122 len += sprintf(buffer + len, "dstpt=%u ",
123 ntohs(match->dst.u.tcp.port));
124
125 return len;
126 }
127
128 static unsigned int
tcp_print_range(char * buffer,const struct ip_nat_range * range)129 tcp_print_range(char *buffer, const struct ip_nat_range *range)
130 {
131 if (range->min.tcp.port != 0 || range->max.tcp.port != 0xFFFF) {
132 if (range->min.tcp.port == range->max.tcp.port)
133 return sprintf(buffer, "port %u ",
134 ntohs(range->min.tcp.port));
135 else
136 return sprintf(buffer, "ports %u-%u ",
137 ntohs(range->min.tcp.port),
138 ntohs(range->max.tcp.port));
139 }
140 else return 0;
141 }
142
143 struct ip_nat_protocol ip_nat_protocol_tcp
144 = { { NULL, NULL }, "TCP", IPPROTO_TCP,
145 tcp_manip_pkt,
146 tcp_in_range,
147 tcp_unique_tuple,
148 tcp_print,
149 tcp_print_range
150 };
151