1 /* Everything about the rules for NAT. */
2 #include <linux/types.h>
3 #include <linux/ip.h>
4 #include <linux/netfilter.h>
5 #include <linux/netfilter_ipv4.h>
6 #include <linux/module.h>
7 #include <linux/kmod.h>
8 #include <linux/skbuff.h>
9 #include <linux/proc_fs.h>
10 #include <net/checksum.h>
11 #include <linux/bitops.h>
12 #include <linux/version.h>
13
14 #define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_nat_lock)
15 #define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_nat_lock)
16
17 #include <linux/netfilter_ipv4/ip_tables.h>
18 #include <linux/netfilter_ipv4/ip_nat.h>
19 #include <linux/netfilter_ipv4/ip_nat_core.h>
20 #include <linux/netfilter_ipv4/ip_nat_rule.h>
21 #include <linux/netfilter_ipv4/listhelp.h>
22
23 #if 0
24 #define DEBUGP printk
25 #else
26 #define DEBUGP(format, args...)
27 #endif
28
29 #define NAT_VALID_HOOKS ((1<<NF_IP_PRE_ROUTING) | (1<<NF_IP_POST_ROUTING) | (1<<NF_IP_LOCAL_OUT))
30
31 /* Standard entry. */
32 struct ipt_standard
33 {
34 struct ipt_entry entry;
35 struct ipt_standard_target target;
36 };
37
38 struct ipt_error_target
39 {
40 struct ipt_entry_target target;
41 char errorname[IPT_FUNCTION_MAXNAMELEN];
42 };
43
44 struct ipt_error
45 {
46 struct ipt_entry entry;
47 struct ipt_error_target target;
48 };
49
50 static struct
51 {
52 struct ipt_replace repl;
53 struct ipt_standard entries[3];
54 struct ipt_error term;
55 } nat_initial_table __initdata
56 = { { "nat", NAT_VALID_HOOKS, 4,
57 sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
58 { [NF_IP_PRE_ROUTING] 0,
59 [NF_IP_POST_ROUTING] sizeof(struct ipt_standard),
60 [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) * 2 },
61 { [NF_IP_PRE_ROUTING] 0,
62 [NF_IP_POST_ROUTING] sizeof(struct ipt_standard),
63 [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) * 2 },
64 0, NULL, { } },
65 {
66 /* PRE_ROUTING */
67 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
68 0,
69 sizeof(struct ipt_entry),
70 sizeof(struct ipt_standard),
71 0, { 0, 0 }, { } },
72 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
73 -NF_ACCEPT - 1 } },
74 /* POST_ROUTING */
75 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
76 0,
77 sizeof(struct ipt_entry),
78 sizeof(struct ipt_standard),
79 0, { 0, 0 }, { } },
80 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
81 -NF_ACCEPT - 1 } },
82 /* LOCAL_OUT */
83 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
84 0,
85 sizeof(struct ipt_entry),
86 sizeof(struct ipt_standard),
87 0, { 0, 0 }, { } },
88 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } },
89 -NF_ACCEPT - 1 } }
90 },
91 /* ERROR */
92 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 },
93 0,
94 sizeof(struct ipt_entry),
95 sizeof(struct ipt_error),
96 0, { 0, 0 }, { } },
97 { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } },
98 { } },
99 "ERROR"
100 }
101 }
102 };
103
104 static struct ipt_table nat_table
105 = { { NULL, NULL }, "nat", &nat_initial_table.repl,
106 NAT_VALID_HOOKS, RW_LOCK_UNLOCKED, NULL, THIS_MODULE };
107
108 /* Source NAT */
ipt_snat_target(struct sk_buff ** pskb,unsigned int hooknum,const struct net_device * in,const struct net_device * out,const void * targinfo,void * userinfo)109 static unsigned int ipt_snat_target(struct sk_buff **pskb,
110 unsigned int hooknum,
111 const struct net_device *in,
112 const struct net_device *out,
113 const void *targinfo,
114 void *userinfo)
115 {
116 struct ip_conntrack *ct;
117 enum ip_conntrack_info ctinfo;
118
119 IP_NF_ASSERT(hooknum == NF_IP_POST_ROUTING);
120
121 ct = ip_conntrack_get(*pskb, &ctinfo);
122
123 /* Connection must be valid and new. */
124 IP_NF_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
125 || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
126 IP_NF_ASSERT(out);
127
128 return ip_nat_setup_info(ct, targinfo, hooknum);
129 }
130
ipt_dnat_target(struct sk_buff ** pskb,unsigned int hooknum,const struct net_device * in,const struct net_device * out,const void * targinfo,void * userinfo)131 static unsigned int ipt_dnat_target(struct sk_buff **pskb,
132 unsigned int hooknum,
133 const struct net_device *in,
134 const struct net_device *out,
135 const void *targinfo,
136 void *userinfo)
137 {
138 struct ip_conntrack *ct;
139 enum ip_conntrack_info ctinfo;
140
141 IP_NF_ASSERT(hooknum == NF_IP_PRE_ROUTING
142 || hooknum == NF_IP_LOCAL_OUT);
143
144 ct = ip_conntrack_get(*pskb, &ctinfo);
145
146 /* Connection must be valid and new. */
147 IP_NF_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
148
149 return ip_nat_setup_info(ct, targinfo, hooknum);
150 }
151
ipt_snat_checkentry(const char * tablename,const struct ipt_entry * e,void * targinfo,unsigned int targinfosize,unsigned int hook_mask)152 static int ipt_snat_checkentry(const char *tablename,
153 const struct ipt_entry *e,
154 void *targinfo,
155 unsigned int targinfosize,
156 unsigned int hook_mask)
157 {
158 struct ip_nat_multi_range *mr = targinfo;
159
160 /* Must be a valid range */
161 if (targinfosize < sizeof(struct ip_nat_multi_range)) {
162 DEBUGP("SNAT: Target size %u too small\n", targinfosize);
163 return 0;
164 }
165
166 if (targinfosize != IPT_ALIGN((sizeof(struct ip_nat_multi_range)
167 + (sizeof(struct ip_nat_range)
168 * (mr->rangesize - 1))))) {
169 DEBUGP("SNAT: Target size %u wrong for %u ranges\n",
170 targinfosize, mr->rangesize);
171 return 0;
172 }
173
174 /* Only allow these for NAT. */
175 if (strcmp(tablename, "nat") != 0) {
176 DEBUGP("SNAT: wrong table %s\n", tablename);
177 return 0;
178 }
179
180 if (hook_mask & ~(1 << NF_IP_POST_ROUTING)) {
181 DEBUGP("SNAT: hook mask 0x%x bad\n", hook_mask);
182 return 0;
183 }
184 return 1;
185 }
186
ipt_dnat_checkentry(const char * tablename,const struct ipt_entry * e,void * targinfo,unsigned int targinfosize,unsigned int hook_mask)187 static int ipt_dnat_checkentry(const char *tablename,
188 const struct ipt_entry *e,
189 void *targinfo,
190 unsigned int targinfosize,
191 unsigned int hook_mask)
192 {
193 struct ip_nat_multi_range *mr = targinfo;
194
195 /* Must be a valid range */
196 if (targinfosize < sizeof(struct ip_nat_multi_range)) {
197 DEBUGP("DNAT: Target size %u too small\n", targinfosize);
198 return 0;
199 }
200
201 if (targinfosize != IPT_ALIGN((sizeof(struct ip_nat_multi_range)
202 + (sizeof(struct ip_nat_range)
203 * (mr->rangesize - 1))))) {
204 DEBUGP("DNAT: Target size %u wrong for %u ranges\n",
205 targinfosize, mr->rangesize);
206 return 0;
207 }
208
209 /* Only allow these for NAT. */
210 if (strcmp(tablename, "nat") != 0) {
211 DEBUGP("DNAT: wrong table %s\n", tablename);
212 return 0;
213 }
214
215 if (hook_mask & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT))) {
216 DEBUGP("DNAT: hook mask 0x%x bad\n", hook_mask);
217 return 0;
218 }
219
220 return 1;
221 }
222
223 inline unsigned int
alloc_null_binding(struct ip_conntrack * conntrack,struct ip_nat_info * info,unsigned int hooknum)224 alloc_null_binding(struct ip_conntrack *conntrack,
225 struct ip_nat_info *info,
226 unsigned int hooknum)
227 {
228 /* Force range to this IP; let proto decide mapping for
229 per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
230 Use reply in case it's already been mangled (eg local packet).
231 */
232 u_int32_t ip
233 = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
234 ? conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip
235 : conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip);
236 struct ip_nat_multi_range mr
237 = { 1, { { IP_NAT_RANGE_MAP_IPS, ip, ip, { 0 }, { 0 } } } };
238
239 DEBUGP("Allocating NULL binding for %p (%u.%u.%u.%u)\n", conntrack,
240 NIPQUAD(ip));
241 return ip_nat_setup_info(conntrack, &mr, hooknum);
242 }
243
244 unsigned int
alloc_null_binding_confirmed(struct ip_conntrack * conntrack,struct ip_nat_info * info,unsigned int hooknum)245 alloc_null_binding_confirmed(struct ip_conntrack *conntrack,
246 struct ip_nat_info *info,
247 unsigned int hooknum)
248 {
249 u_int32_t ip
250 = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
251 ? conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip
252 : conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip);
253 u_int16_t all
254 = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
255 ? conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.all
256 : conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.src.u.all);
257 struct ip_nat_multi_range mr
258 = { 1, { { IP_NAT_RANGE_MAP_IPS, ip, ip, { all }, { all } } } };
259
260 DEBUGP("Allocating NULL binding for confirmed %p (%u.%u.%u.%u)\n",
261 conntrack, NIPQUAD(ip));
262 return ip_nat_setup_info(conntrack, &mr, hooknum);
263 }
264
ip_nat_rule_find(struct sk_buff ** pskb,unsigned int hooknum,const struct net_device * in,const struct net_device * out,struct ip_conntrack * ct,struct ip_nat_info * info)265 int ip_nat_rule_find(struct sk_buff **pskb,
266 unsigned int hooknum,
267 const struct net_device *in,
268 const struct net_device *out,
269 struct ip_conntrack *ct,
270 struct ip_nat_info *info)
271 {
272 int ret;
273
274 ret = ipt_do_table(pskb, hooknum, in, out, &nat_table, NULL);
275
276 if (ret == NF_ACCEPT) {
277 if (!(info->initialized & (1 << HOOK2MANIP(hooknum))))
278 /* NUL mapping */
279 ret = alloc_null_binding(ct, info, hooknum);
280 }
281 return ret;
282 }
283
284 static struct ipt_target ipt_snat_reg
285 = { { NULL, NULL }, "SNAT", ipt_snat_target, ipt_snat_checkentry, NULL };
286 static struct ipt_target ipt_dnat_reg
287 = { { NULL, NULL }, "DNAT", ipt_dnat_target, ipt_dnat_checkentry, NULL };
288
ip_nat_rule_init(void)289 int __init ip_nat_rule_init(void)
290 {
291 int ret;
292
293 ret = ipt_register_table(&nat_table);
294 if (ret != 0)
295 return ret;
296 ret = ipt_register_target(&ipt_snat_reg);
297 if (ret != 0)
298 goto unregister_table;
299
300 ret = ipt_register_target(&ipt_dnat_reg);
301 if (ret != 0)
302 goto unregister_snat;
303
304 return ret;
305
306 unregister_snat:
307 ipt_unregister_target(&ipt_snat_reg);
308 unregister_table:
309 ipt_unregister_table(&nat_table);
310
311 return ret;
312 }
313
ip_nat_rule_cleanup(void)314 void ip_nat_rule_cleanup(void)
315 {
316 ipt_unregister_target(&ipt_dnat_reg);
317 ipt_unregister_target(&ipt_snat_reg);
318 ipt_unregister_table(&nat_table);
319 }
320