1 // SPDX-License-Identifier: GPL-2.0-only
2 /* (C) 1999-2001 Paul `Rusty' Russell
3  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
4  */
5 
6 #include <linux/types.h>
7 #include <linux/export.h>
8 #include <linux/init.h>
9 #include <linux/udp.h>
10 #include <linux/tcp.h>
11 #include <linux/icmp.h>
12 #include <linux/icmpv6.h>
13 
14 #include <linux/dccp.h>
15 #include <linux/sctp.h>
16 #include <net/sctp/checksum.h>
17 
18 #include <linux/netfilter.h>
19 #include <net/netfilter/nf_nat.h>
20 
21 #include <linux/ipv6.h>
22 #include <linux/netfilter_ipv6.h>
23 #include <net/checksum.h>
24 #include <net/ip6_checksum.h>
25 #include <net/ip6_route.h>
26 #include <net/xfrm.h>
27 #include <net/ipv6.h>
28 
29 #include <net/netfilter/nf_conntrack_core.h>
30 #include <net/netfilter/nf_conntrack.h>
31 #include <linux/netfilter/nfnetlink_conntrack.h>
32 
33 static void nf_csum_update(struct sk_buff *skb,
34 			   unsigned int iphdroff, __sum16 *check,
35 			   const struct nf_conntrack_tuple *t,
36 			   enum nf_nat_manip_type maniptype);
37 
38 static void
__udp_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,struct udphdr * hdr,const struct nf_conntrack_tuple * tuple,enum nf_nat_manip_type maniptype,bool do_csum)39 __udp_manip_pkt(struct sk_buff *skb,
40 	        unsigned int iphdroff, struct udphdr *hdr,
41 	        const struct nf_conntrack_tuple *tuple,
42 	        enum nf_nat_manip_type maniptype, bool do_csum)
43 {
44 	__be16 *portptr, newport;
45 
46 	if (maniptype == NF_NAT_MANIP_SRC) {
47 		/* Get rid of src port */
48 		newport = tuple->src.u.udp.port;
49 		portptr = &hdr->source;
50 	} else {
51 		/* Get rid of dst port */
52 		newport = tuple->dst.u.udp.port;
53 		portptr = &hdr->dest;
54 	}
55 	if (do_csum) {
56 		nf_csum_update(skb, iphdroff, &hdr->check, tuple, maniptype);
57 		inet_proto_csum_replace2(&hdr->check, skb, *portptr, newport,
58 					 false);
59 		if (!hdr->check)
60 			hdr->check = CSUM_MANGLED_0;
61 	}
62 	*portptr = newport;
63 }
64 
udp_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,unsigned int hdroff,const struct nf_conntrack_tuple * tuple,enum nf_nat_manip_type maniptype)65 static bool udp_manip_pkt(struct sk_buff *skb,
66 			  unsigned int iphdroff, unsigned int hdroff,
67 			  const struct nf_conntrack_tuple *tuple,
68 			  enum nf_nat_manip_type maniptype)
69 {
70 	struct udphdr *hdr;
71 
72 	if (skb_ensure_writable(skb, hdroff + sizeof(*hdr)))
73 		return false;
74 
75 	hdr = (struct udphdr *)(skb->data + hdroff);
76 	__udp_manip_pkt(skb, iphdroff, hdr, tuple, maniptype, !!hdr->check);
77 
78 	return true;
79 }
80 
udplite_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,unsigned int hdroff,const struct nf_conntrack_tuple * tuple,enum nf_nat_manip_type maniptype)81 static bool udplite_manip_pkt(struct sk_buff *skb,
82 			      unsigned int iphdroff, unsigned int hdroff,
83 			      const struct nf_conntrack_tuple *tuple,
84 			      enum nf_nat_manip_type maniptype)
85 {
86 #ifdef CONFIG_NF_CT_PROTO_UDPLITE
87 	struct udphdr *hdr;
88 
89 	if (skb_ensure_writable(skb, hdroff + sizeof(*hdr)))
90 		return false;
91 
92 	hdr = (struct udphdr *)(skb->data + hdroff);
93 	__udp_manip_pkt(skb, iphdroff, hdr, tuple, maniptype, true);
94 #endif
95 	return true;
96 }
97 
98 static bool
sctp_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,unsigned int hdroff,const struct nf_conntrack_tuple * tuple,enum nf_nat_manip_type maniptype)99 sctp_manip_pkt(struct sk_buff *skb,
100 	       unsigned int iphdroff, unsigned int hdroff,
101 	       const struct nf_conntrack_tuple *tuple,
102 	       enum nf_nat_manip_type maniptype)
103 {
104 #ifdef CONFIG_NF_CT_PROTO_SCTP
105 	struct sctphdr *hdr;
106 	int hdrsize = 8;
107 
108 	/* This could be an inner header returned in imcp packet; in such
109 	 * cases we cannot update the checksum field since it is outside
110 	 * of the 8 bytes of transport layer headers we are guaranteed.
111 	 */
112 	if (skb->len >= hdroff + sizeof(*hdr))
113 		hdrsize = sizeof(*hdr);
114 
115 	if (skb_ensure_writable(skb, hdroff + hdrsize))
116 		return false;
117 
118 	hdr = (struct sctphdr *)(skb->data + hdroff);
119 
120 	if (maniptype == NF_NAT_MANIP_SRC) {
121 		/* Get rid of src port */
122 		hdr->source = tuple->src.u.sctp.port;
123 	} else {
124 		/* Get rid of dst port */
125 		hdr->dest = tuple->dst.u.sctp.port;
126 	}
127 
128 	if (hdrsize < sizeof(*hdr))
129 		return true;
130 
131 	if (skb->ip_summed != CHECKSUM_PARTIAL) {
132 		hdr->checksum = sctp_compute_cksum(skb, hdroff);
133 		skb->ip_summed = CHECKSUM_NONE;
134 	}
135 
136 #endif
137 	return true;
138 }
139 
140 static bool
tcp_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,unsigned int hdroff,const struct nf_conntrack_tuple * tuple,enum nf_nat_manip_type maniptype)141 tcp_manip_pkt(struct sk_buff *skb,
142 	      unsigned int iphdroff, unsigned int hdroff,
143 	      const struct nf_conntrack_tuple *tuple,
144 	      enum nf_nat_manip_type maniptype)
145 {
146 	struct tcphdr *hdr;
147 	__be16 *portptr, newport, oldport;
148 	int hdrsize = 8; /* TCP connection tracking guarantees this much */
149 
150 	/* this could be a inner header returned in icmp packet; in such
151 	   cases we cannot update the checksum field since it is outside of
152 	   the 8 bytes of transport layer headers we are guaranteed */
153 	if (skb->len >= hdroff + sizeof(struct tcphdr))
154 		hdrsize = sizeof(struct tcphdr);
155 
156 	if (skb_ensure_writable(skb, hdroff + hdrsize))
157 		return false;
158 
159 	hdr = (struct tcphdr *)(skb->data + hdroff);
160 
161 	if (maniptype == NF_NAT_MANIP_SRC) {
162 		/* Get rid of src port */
163 		newport = tuple->src.u.tcp.port;
164 		portptr = &hdr->source;
165 	} else {
166 		/* Get rid of dst port */
167 		newport = tuple->dst.u.tcp.port;
168 		portptr = &hdr->dest;
169 	}
170 
171 	oldport = *portptr;
172 	*portptr = newport;
173 
174 	if (hdrsize < sizeof(*hdr))
175 		return true;
176 
177 	nf_csum_update(skb, iphdroff, &hdr->check, tuple, maniptype);
178 	inet_proto_csum_replace2(&hdr->check, skb, oldport, newport, false);
179 	return true;
180 }
181 
182 static bool
dccp_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,unsigned int hdroff,const struct nf_conntrack_tuple * tuple,enum nf_nat_manip_type maniptype)183 dccp_manip_pkt(struct sk_buff *skb,
184 	       unsigned int iphdroff, unsigned int hdroff,
185 	       const struct nf_conntrack_tuple *tuple,
186 	       enum nf_nat_manip_type maniptype)
187 {
188 #ifdef CONFIG_NF_CT_PROTO_DCCP
189 	struct dccp_hdr *hdr;
190 	__be16 *portptr, oldport, newport;
191 	int hdrsize = 8; /* DCCP connection tracking guarantees this much */
192 
193 	if (skb->len >= hdroff + sizeof(struct dccp_hdr))
194 		hdrsize = sizeof(struct dccp_hdr);
195 
196 	if (skb_ensure_writable(skb, hdroff + hdrsize))
197 		return false;
198 
199 	hdr = (struct dccp_hdr *)(skb->data + hdroff);
200 
201 	if (maniptype == NF_NAT_MANIP_SRC) {
202 		newport = tuple->src.u.dccp.port;
203 		portptr = &hdr->dccph_sport;
204 	} else {
205 		newport = tuple->dst.u.dccp.port;
206 		portptr = &hdr->dccph_dport;
207 	}
208 
209 	oldport = *portptr;
210 	*portptr = newport;
211 
212 	if (hdrsize < sizeof(*hdr))
213 		return true;
214 
215 	nf_csum_update(skb, iphdroff, &hdr->dccph_checksum, tuple, maniptype);
216 	inet_proto_csum_replace2(&hdr->dccph_checksum, skb, oldport, newport,
217 				 false);
218 #endif
219 	return true;
220 }
221 
222 static bool
icmp_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,unsigned int hdroff,const struct nf_conntrack_tuple * tuple,enum nf_nat_manip_type maniptype)223 icmp_manip_pkt(struct sk_buff *skb,
224 	       unsigned int iphdroff, unsigned int hdroff,
225 	       const struct nf_conntrack_tuple *tuple,
226 	       enum nf_nat_manip_type maniptype)
227 {
228 	struct icmphdr *hdr;
229 
230 	if (skb_ensure_writable(skb, hdroff + sizeof(*hdr)))
231 		return false;
232 
233 	hdr = (struct icmphdr *)(skb->data + hdroff);
234 	switch (hdr->type) {
235 	case ICMP_ECHO:
236 	case ICMP_ECHOREPLY:
237 	case ICMP_TIMESTAMP:
238 	case ICMP_TIMESTAMPREPLY:
239 	case ICMP_INFO_REQUEST:
240 	case ICMP_INFO_REPLY:
241 	case ICMP_ADDRESS:
242 	case ICMP_ADDRESSREPLY:
243 		break;
244 	default:
245 		return true;
246 	}
247 	inet_proto_csum_replace2(&hdr->checksum, skb,
248 				 hdr->un.echo.id, tuple->src.u.icmp.id, false);
249 	hdr->un.echo.id = tuple->src.u.icmp.id;
250 	return true;
251 }
252 
253 static bool
icmpv6_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,unsigned int hdroff,const struct nf_conntrack_tuple * tuple,enum nf_nat_manip_type maniptype)254 icmpv6_manip_pkt(struct sk_buff *skb,
255 		 unsigned int iphdroff, unsigned int hdroff,
256 		 const struct nf_conntrack_tuple *tuple,
257 		 enum nf_nat_manip_type maniptype)
258 {
259 	struct icmp6hdr *hdr;
260 
261 	if (skb_ensure_writable(skb, hdroff + sizeof(*hdr)))
262 		return false;
263 
264 	hdr = (struct icmp6hdr *)(skb->data + hdroff);
265 	nf_csum_update(skb, iphdroff, &hdr->icmp6_cksum, tuple, maniptype);
266 	if (hdr->icmp6_type == ICMPV6_ECHO_REQUEST ||
267 	    hdr->icmp6_type == ICMPV6_ECHO_REPLY) {
268 		inet_proto_csum_replace2(&hdr->icmp6_cksum, skb,
269 					 hdr->icmp6_identifier,
270 					 tuple->src.u.icmp.id, false);
271 		hdr->icmp6_identifier = tuple->src.u.icmp.id;
272 	}
273 	return true;
274 }
275 
276 /* manipulate a GRE packet according to maniptype */
277 static bool
gre_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,unsigned int hdroff,const struct nf_conntrack_tuple * tuple,enum nf_nat_manip_type maniptype)278 gre_manip_pkt(struct sk_buff *skb,
279 	      unsigned int iphdroff, unsigned int hdroff,
280 	      const struct nf_conntrack_tuple *tuple,
281 	      enum nf_nat_manip_type maniptype)
282 {
283 #if IS_ENABLED(CONFIG_NF_CT_PROTO_GRE)
284 	const struct gre_base_hdr *greh;
285 	struct pptp_gre_header *pgreh;
286 
287 	/* pgreh includes two optional 32bit fields which are not required
288 	 * to be there.  That's where the magic '8' comes from */
289 	if (skb_ensure_writable(skb, hdroff + sizeof(*pgreh) - 8))
290 		return false;
291 
292 	greh = (void *)skb->data + hdroff;
293 	pgreh = (struct pptp_gre_header *)greh;
294 
295 	/* we only have destination manip of a packet, since 'source key'
296 	 * is not present in the packet itself */
297 	if (maniptype != NF_NAT_MANIP_DST)
298 		return true;
299 
300 	switch (greh->flags & GRE_VERSION) {
301 	case GRE_VERSION_0:
302 		/* We do not currently NAT any GREv0 packets.
303 		 * Try to behave like "nf_nat_proto_unknown" */
304 		break;
305 	case GRE_VERSION_1:
306 		pr_debug("call_id -> 0x%04x\n", ntohs(tuple->dst.u.gre.key));
307 		pgreh->call_id = tuple->dst.u.gre.key;
308 		break;
309 	default:
310 		pr_debug("can't nat unknown GRE version\n");
311 		return false;
312 	}
313 #endif
314 	return true;
315 }
316 
l4proto_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,unsigned int hdroff,const struct nf_conntrack_tuple * tuple,enum nf_nat_manip_type maniptype)317 static bool l4proto_manip_pkt(struct sk_buff *skb,
318 			      unsigned int iphdroff, unsigned int hdroff,
319 			      const struct nf_conntrack_tuple *tuple,
320 			      enum nf_nat_manip_type maniptype)
321 {
322 	switch (tuple->dst.protonum) {
323 	case IPPROTO_TCP:
324 		return tcp_manip_pkt(skb, iphdroff, hdroff,
325 				     tuple, maniptype);
326 	case IPPROTO_UDP:
327 		return udp_manip_pkt(skb, iphdroff, hdroff,
328 				     tuple, maniptype);
329 	case IPPROTO_UDPLITE:
330 		return udplite_manip_pkt(skb, iphdroff, hdroff,
331 					 tuple, maniptype);
332 	case IPPROTO_SCTP:
333 		return sctp_manip_pkt(skb, iphdroff, hdroff,
334 				      tuple, maniptype);
335 	case IPPROTO_ICMP:
336 		return icmp_manip_pkt(skb, iphdroff, hdroff,
337 				      tuple, maniptype);
338 	case IPPROTO_ICMPV6:
339 		return icmpv6_manip_pkt(skb, iphdroff, hdroff,
340 					tuple, maniptype);
341 	case IPPROTO_DCCP:
342 		return dccp_manip_pkt(skb, iphdroff, hdroff,
343 				      tuple, maniptype);
344 	case IPPROTO_GRE:
345 		return gre_manip_pkt(skb, iphdroff, hdroff,
346 				     tuple, maniptype);
347 	}
348 
349 	/* If we don't know protocol -- no error, pass it unmodified. */
350 	return true;
351 }
352 
nf_nat_ipv4_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,const struct nf_conntrack_tuple * target,enum nf_nat_manip_type maniptype)353 static bool nf_nat_ipv4_manip_pkt(struct sk_buff *skb,
354 				  unsigned int iphdroff,
355 				  const struct nf_conntrack_tuple *target,
356 				  enum nf_nat_manip_type maniptype)
357 {
358 	struct iphdr *iph;
359 	unsigned int hdroff;
360 
361 	if (skb_ensure_writable(skb, iphdroff + sizeof(*iph)))
362 		return false;
363 
364 	iph = (void *)skb->data + iphdroff;
365 	hdroff = iphdroff + iph->ihl * 4;
366 
367 	if (!l4proto_manip_pkt(skb, iphdroff, hdroff, target, maniptype))
368 		return false;
369 	iph = (void *)skb->data + iphdroff;
370 
371 	if (maniptype == NF_NAT_MANIP_SRC) {
372 		csum_replace4(&iph->check, iph->saddr, target->src.u3.ip);
373 		iph->saddr = target->src.u3.ip;
374 	} else {
375 		csum_replace4(&iph->check, iph->daddr, target->dst.u3.ip);
376 		iph->daddr = target->dst.u3.ip;
377 	}
378 	return true;
379 }
380 
nf_nat_ipv6_manip_pkt(struct sk_buff * skb,unsigned int iphdroff,const struct nf_conntrack_tuple * target,enum nf_nat_manip_type maniptype)381 static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb,
382 				  unsigned int iphdroff,
383 				  const struct nf_conntrack_tuple *target,
384 				  enum nf_nat_manip_type maniptype)
385 {
386 #if IS_ENABLED(CONFIG_IPV6)
387 	struct ipv6hdr *ipv6h;
388 	__be16 frag_off;
389 	int hdroff;
390 	u8 nexthdr;
391 
392 	if (skb_ensure_writable(skb, iphdroff + sizeof(*ipv6h)))
393 		return false;
394 
395 	ipv6h = (void *)skb->data + iphdroff;
396 	nexthdr = ipv6h->nexthdr;
397 	hdroff = ipv6_skip_exthdr(skb, iphdroff + sizeof(*ipv6h),
398 				  &nexthdr, &frag_off);
399 	if (hdroff < 0)
400 		goto manip_addr;
401 
402 	if ((frag_off & htons(~0x7)) == 0 &&
403 	    !l4proto_manip_pkt(skb, iphdroff, hdroff, target, maniptype))
404 		return false;
405 
406 	/* must reload, offset might have changed */
407 	ipv6h = (void *)skb->data + iphdroff;
408 
409 manip_addr:
410 	if (maniptype == NF_NAT_MANIP_SRC)
411 		ipv6h->saddr = target->src.u3.in6;
412 	else
413 		ipv6h->daddr = target->dst.u3.in6;
414 
415 #endif
416 	return true;
417 }
418 
nf_nat_manip_pkt(struct sk_buff * skb,struct nf_conn * ct,enum nf_nat_manip_type mtype,enum ip_conntrack_dir dir)419 unsigned int nf_nat_manip_pkt(struct sk_buff *skb, struct nf_conn *ct,
420 			      enum nf_nat_manip_type mtype,
421 			      enum ip_conntrack_dir dir)
422 {
423 	struct nf_conntrack_tuple target;
424 
425 	/* We are aiming to look like inverse of other direction. */
426 	nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple);
427 
428 	switch (target.src.l3num) {
429 	case NFPROTO_IPV6:
430 		if (nf_nat_ipv6_manip_pkt(skb, 0, &target, mtype))
431 			return NF_ACCEPT;
432 		break;
433 	case NFPROTO_IPV4:
434 		if (nf_nat_ipv4_manip_pkt(skb, 0, &target, mtype))
435 			return NF_ACCEPT;
436 		break;
437 	default:
438 		WARN_ON_ONCE(1);
439 		break;
440 	}
441 
442 	return NF_DROP;
443 }
444 
nf_nat_ipv4_csum_update(struct sk_buff * skb,unsigned int iphdroff,__sum16 * check,const struct nf_conntrack_tuple * t,enum nf_nat_manip_type maniptype)445 static void nf_nat_ipv4_csum_update(struct sk_buff *skb,
446 				    unsigned int iphdroff, __sum16 *check,
447 				    const struct nf_conntrack_tuple *t,
448 				    enum nf_nat_manip_type maniptype)
449 {
450 	struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
451 	__be32 oldip, newip;
452 
453 	if (maniptype == NF_NAT_MANIP_SRC) {
454 		oldip = iph->saddr;
455 		newip = t->src.u3.ip;
456 	} else {
457 		oldip = iph->daddr;
458 		newip = t->dst.u3.ip;
459 	}
460 	inet_proto_csum_replace4(check, skb, oldip, newip, true);
461 }
462 
nf_nat_ipv6_csum_update(struct sk_buff * skb,unsigned int iphdroff,__sum16 * check,const struct nf_conntrack_tuple * t,enum nf_nat_manip_type maniptype)463 static void nf_nat_ipv6_csum_update(struct sk_buff *skb,
464 				    unsigned int iphdroff, __sum16 *check,
465 				    const struct nf_conntrack_tuple *t,
466 				    enum nf_nat_manip_type maniptype)
467 {
468 #if IS_ENABLED(CONFIG_IPV6)
469 	const struct ipv6hdr *ipv6h = (struct ipv6hdr *)(skb->data + iphdroff);
470 	const struct in6_addr *oldip, *newip;
471 
472 	if (maniptype == NF_NAT_MANIP_SRC) {
473 		oldip = &ipv6h->saddr;
474 		newip = &t->src.u3.in6;
475 	} else {
476 		oldip = &ipv6h->daddr;
477 		newip = &t->dst.u3.in6;
478 	}
479 	inet_proto_csum_replace16(check, skb, oldip->s6_addr32,
480 				  newip->s6_addr32, true);
481 #endif
482 }
483 
nf_csum_update(struct sk_buff * skb,unsigned int iphdroff,__sum16 * check,const struct nf_conntrack_tuple * t,enum nf_nat_manip_type maniptype)484 static void nf_csum_update(struct sk_buff *skb,
485 			   unsigned int iphdroff, __sum16 *check,
486 			   const struct nf_conntrack_tuple *t,
487 			   enum nf_nat_manip_type maniptype)
488 {
489 	switch (t->src.l3num) {
490 	case NFPROTO_IPV4:
491 		nf_nat_ipv4_csum_update(skb, iphdroff, check, t, maniptype);
492 		return;
493 	case NFPROTO_IPV6:
494 		nf_nat_ipv6_csum_update(skb, iphdroff, check, t, maniptype);
495 		return;
496 	}
497 }
498 
nf_nat_ipv4_csum_recalc(struct sk_buff * skb,u8 proto,void * data,__sum16 * check,int datalen,int oldlen)499 static void nf_nat_ipv4_csum_recalc(struct sk_buff *skb,
500 				    u8 proto, void *data, __sum16 *check,
501 				    int datalen, int oldlen)
502 {
503 	if (skb->ip_summed != CHECKSUM_PARTIAL) {
504 		const struct iphdr *iph = ip_hdr(skb);
505 
506 		skb->ip_summed = CHECKSUM_PARTIAL;
507 		skb->csum_start = skb_headroom(skb) + skb_network_offset(skb) +
508 			ip_hdrlen(skb);
509 		skb->csum_offset = (void *)check - data;
510 		*check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, datalen,
511 					    proto, 0);
512 	} else {
513 		inet_proto_csum_replace2(check, skb,
514 					 htons(oldlen), htons(datalen), true);
515 	}
516 }
517 
518 #if IS_ENABLED(CONFIG_IPV6)
nf_nat_ipv6_csum_recalc(struct sk_buff * skb,u8 proto,void * data,__sum16 * check,int datalen,int oldlen)519 static void nf_nat_ipv6_csum_recalc(struct sk_buff *skb,
520 				    u8 proto, void *data, __sum16 *check,
521 				    int datalen, int oldlen)
522 {
523 	if (skb->ip_summed != CHECKSUM_PARTIAL) {
524 		const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
525 
526 		skb->ip_summed = CHECKSUM_PARTIAL;
527 		skb->csum_start = skb_headroom(skb) + skb_network_offset(skb) +
528 			(data - (void *)skb->data);
529 		skb->csum_offset = (void *)check - data;
530 		*check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
531 					  datalen, proto, 0);
532 	} else {
533 		inet_proto_csum_replace2(check, skb,
534 					 htons(oldlen), htons(datalen), true);
535 	}
536 }
537 #endif
538 
nf_nat_csum_recalc(struct sk_buff * skb,u8 nfproto,u8 proto,void * data,__sum16 * check,int datalen,int oldlen)539 void nf_nat_csum_recalc(struct sk_buff *skb,
540 			u8 nfproto, u8 proto, void *data, __sum16 *check,
541 			int datalen, int oldlen)
542 {
543 	switch (nfproto) {
544 	case NFPROTO_IPV4:
545 		nf_nat_ipv4_csum_recalc(skb, proto, data, check,
546 					datalen, oldlen);
547 		return;
548 #if IS_ENABLED(CONFIG_IPV6)
549 	case NFPROTO_IPV6:
550 		nf_nat_ipv6_csum_recalc(skb, proto, data, check,
551 					datalen, oldlen);
552 		return;
553 #endif
554 	}
555 
556 	WARN_ON_ONCE(1);
557 }
558 
nf_nat_icmp_reply_translation(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int hooknum)559 int nf_nat_icmp_reply_translation(struct sk_buff *skb,
560 				  struct nf_conn *ct,
561 				  enum ip_conntrack_info ctinfo,
562 				  unsigned int hooknum)
563 {
564 	struct {
565 		struct icmphdr	icmp;
566 		struct iphdr	ip;
567 	} *inside;
568 	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
569 	enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
570 	unsigned int hdrlen = ip_hdrlen(skb);
571 	struct nf_conntrack_tuple target;
572 	unsigned long statusbit;
573 
574 	WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY);
575 
576 	if (skb_ensure_writable(skb, hdrlen + sizeof(*inside)))
577 		return 0;
578 	if (nf_ip_checksum(skb, hooknum, hdrlen, IPPROTO_ICMP))
579 		return 0;
580 
581 	inside = (void *)skb->data + hdrlen;
582 	if (inside->icmp.type == ICMP_REDIRECT) {
583 		if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
584 			return 0;
585 		if (ct->status & IPS_NAT_MASK)
586 			return 0;
587 	}
588 
589 	if (manip == NF_NAT_MANIP_SRC)
590 		statusbit = IPS_SRC_NAT;
591 	else
592 		statusbit = IPS_DST_NAT;
593 
594 	/* Invert if this is reply direction */
595 	if (dir == IP_CT_DIR_REPLY)
596 		statusbit ^= IPS_NAT_MASK;
597 
598 	if (!(ct->status & statusbit))
599 		return 1;
600 
601 	if (!nf_nat_ipv4_manip_pkt(skb, hdrlen + sizeof(inside->icmp),
602 				   &ct->tuplehash[!dir].tuple, !manip))
603 		return 0;
604 
605 	if (skb->ip_summed != CHECKSUM_PARTIAL) {
606 		/* Reloading "inside" here since manip_pkt may reallocate */
607 		inside = (void *)skb->data + hdrlen;
608 		inside->icmp.checksum = 0;
609 		inside->icmp.checksum =
610 			csum_fold(skb_checksum(skb, hdrlen,
611 					       skb->len - hdrlen, 0));
612 	}
613 
614 	/* Change outer to look like the reply to an incoming packet */
615 	nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple);
616 	target.dst.protonum = IPPROTO_ICMP;
617 	if (!nf_nat_ipv4_manip_pkt(skb, 0, &target, manip))
618 		return 0;
619 
620 	return 1;
621 }
622 EXPORT_SYMBOL_GPL(nf_nat_icmp_reply_translation);
623 
624 static unsigned int
nf_nat_ipv4_fn(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)625 nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
626 	       const struct nf_hook_state *state)
627 {
628 	struct nf_conn *ct;
629 	enum ip_conntrack_info ctinfo;
630 
631 	ct = nf_ct_get(skb, &ctinfo);
632 	if (!ct)
633 		return NF_ACCEPT;
634 
635 	if (ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY) {
636 		if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
637 			if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
638 							   state->hook))
639 				return NF_DROP;
640 			else
641 				return NF_ACCEPT;
642 		}
643 	}
644 
645 	return nf_nat_inet_fn(priv, skb, state);
646 }
647 
648 static unsigned int
nf_nat_ipv4_pre_routing(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)649 nf_nat_ipv4_pre_routing(void *priv, struct sk_buff *skb,
650 			const struct nf_hook_state *state)
651 {
652 	unsigned int ret;
653 	__be32 daddr = ip_hdr(skb)->daddr;
654 
655 	ret = nf_nat_ipv4_fn(priv, skb, state);
656 	if (ret == NF_ACCEPT && daddr != ip_hdr(skb)->daddr)
657 		skb_dst_drop(skb);
658 
659 	return ret;
660 }
661 
662 #ifdef CONFIG_XFRM
nf_xfrm_me_harder(struct net * net,struct sk_buff * skb,unsigned int family)663 static int nf_xfrm_me_harder(struct net *net, struct sk_buff *skb, unsigned int family)
664 {
665 	struct sock *sk = skb->sk;
666 	struct dst_entry *dst;
667 	unsigned int hh_len;
668 	struct flowi fl;
669 	int err;
670 
671 	err = xfrm_decode_session(skb, &fl, family);
672 	if (err < 0)
673 		return err;
674 
675 	dst = skb_dst(skb);
676 	if (dst->xfrm)
677 		dst = ((struct xfrm_dst *)dst)->route;
678 	if (!dst_hold_safe(dst))
679 		return -EHOSTUNREACH;
680 
681 	if (sk && !net_eq(net, sock_net(sk)))
682 		sk = NULL;
683 
684 	dst = xfrm_lookup(net, dst, &fl, sk, 0);
685 	if (IS_ERR(dst))
686 		return PTR_ERR(dst);
687 
688 	skb_dst_drop(skb);
689 	skb_dst_set(skb, dst);
690 
691 	/* Change in oif may mean change in hh_len. */
692 	hh_len = skb_dst(skb)->dev->hard_header_len;
693 	if (skb_headroom(skb) < hh_len &&
694 	    pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
695 		return -ENOMEM;
696 	return 0;
697 }
698 #endif
699 
700 static unsigned int
nf_nat_ipv4_local_in(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)701 nf_nat_ipv4_local_in(void *priv, struct sk_buff *skb,
702 		     const struct nf_hook_state *state)
703 {
704 	__be32 saddr = ip_hdr(skb)->saddr;
705 	struct sock *sk = skb->sk;
706 	unsigned int ret;
707 
708 	ret = nf_nat_ipv4_fn(priv, skb, state);
709 
710 	if (ret == NF_ACCEPT && sk && saddr != ip_hdr(skb)->saddr &&
711 	    !inet_sk_transparent(sk))
712 		skb_orphan(skb); /* TCP edemux obtained wrong socket */
713 
714 	return ret;
715 }
716 
717 static unsigned int
nf_nat_ipv4_out(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)718 nf_nat_ipv4_out(void *priv, struct sk_buff *skb,
719 		const struct nf_hook_state *state)
720 {
721 #ifdef CONFIG_XFRM
722 	const struct nf_conn *ct;
723 	enum ip_conntrack_info ctinfo;
724 	int err;
725 #endif
726 	unsigned int ret;
727 
728 	ret = nf_nat_ipv4_fn(priv, skb, state);
729 #ifdef CONFIG_XFRM
730 	if (ret != NF_ACCEPT)
731 		return ret;
732 
733 	if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
734 		return ret;
735 
736 	ct = nf_ct_get(skb, &ctinfo);
737 	if (ct) {
738 		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
739 
740 		if (ct->tuplehash[dir].tuple.src.u3.ip !=
741 		     ct->tuplehash[!dir].tuple.dst.u3.ip ||
742 		    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
743 		     ct->tuplehash[dir].tuple.src.u.all !=
744 		     ct->tuplehash[!dir].tuple.dst.u.all)) {
745 			err = nf_xfrm_me_harder(state->net, skb, AF_INET);
746 			if (err < 0)
747 				ret = NF_DROP_ERR(err);
748 		}
749 	}
750 #endif
751 	return ret;
752 }
753 
754 static unsigned int
nf_nat_ipv4_local_fn(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)755 nf_nat_ipv4_local_fn(void *priv, struct sk_buff *skb,
756 		     const struct nf_hook_state *state)
757 {
758 	const struct nf_conn *ct;
759 	enum ip_conntrack_info ctinfo;
760 	unsigned int ret;
761 	int err;
762 
763 	ret = nf_nat_ipv4_fn(priv, skb, state);
764 	if (ret != NF_ACCEPT)
765 		return ret;
766 
767 	ct = nf_ct_get(skb, &ctinfo);
768 	if (ct) {
769 		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
770 
771 		if (ct->tuplehash[dir].tuple.dst.u3.ip !=
772 		    ct->tuplehash[!dir].tuple.src.u3.ip) {
773 			err = ip_route_me_harder(state->net, state->sk, skb, RTN_UNSPEC);
774 			if (err < 0)
775 				ret = NF_DROP_ERR(err);
776 		}
777 #ifdef CONFIG_XFRM
778 		else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
779 			 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
780 			 ct->tuplehash[dir].tuple.dst.u.all !=
781 			 ct->tuplehash[!dir].tuple.src.u.all) {
782 			err = nf_xfrm_me_harder(state->net, skb, AF_INET);
783 			if (err < 0)
784 				ret = NF_DROP_ERR(err);
785 		}
786 #endif
787 	}
788 	return ret;
789 }
790 
791 static const struct nf_hook_ops nf_nat_ipv4_ops[] = {
792 	/* Before packet filtering, change destination */
793 	{
794 		.hook		= nf_nat_ipv4_pre_routing,
795 		.pf		= NFPROTO_IPV4,
796 		.hooknum	= NF_INET_PRE_ROUTING,
797 		.priority	= NF_IP_PRI_NAT_DST,
798 	},
799 	/* After packet filtering, change source */
800 	{
801 		.hook		= nf_nat_ipv4_out,
802 		.pf		= NFPROTO_IPV4,
803 		.hooknum	= NF_INET_POST_ROUTING,
804 		.priority	= NF_IP_PRI_NAT_SRC,
805 	},
806 	/* Before packet filtering, change destination */
807 	{
808 		.hook		= nf_nat_ipv4_local_fn,
809 		.pf		= NFPROTO_IPV4,
810 		.hooknum	= NF_INET_LOCAL_OUT,
811 		.priority	= NF_IP_PRI_NAT_DST,
812 	},
813 	/* After packet filtering, change source */
814 	{
815 		.hook		= nf_nat_ipv4_local_in,
816 		.pf		= NFPROTO_IPV4,
817 		.hooknum	= NF_INET_LOCAL_IN,
818 		.priority	= NF_IP_PRI_NAT_SRC,
819 	},
820 };
821 
nf_nat_ipv4_register_fn(struct net * net,const struct nf_hook_ops * ops)822 int nf_nat_ipv4_register_fn(struct net *net, const struct nf_hook_ops *ops)
823 {
824 	return nf_nat_register_fn(net, ops->pf, ops, nf_nat_ipv4_ops,
825 				  ARRAY_SIZE(nf_nat_ipv4_ops));
826 }
827 EXPORT_SYMBOL_GPL(nf_nat_ipv4_register_fn);
828 
nf_nat_ipv4_unregister_fn(struct net * net,const struct nf_hook_ops * ops)829 void nf_nat_ipv4_unregister_fn(struct net *net, const struct nf_hook_ops *ops)
830 {
831 	nf_nat_unregister_fn(net, ops->pf, ops, ARRAY_SIZE(nf_nat_ipv4_ops));
832 }
833 EXPORT_SYMBOL_GPL(nf_nat_ipv4_unregister_fn);
834 
835 #if IS_ENABLED(CONFIG_IPV6)
nf_nat_icmpv6_reply_translation(struct sk_buff * skb,struct nf_conn * ct,enum ip_conntrack_info ctinfo,unsigned int hooknum,unsigned int hdrlen)836 int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
837 				    struct nf_conn *ct,
838 				    enum ip_conntrack_info ctinfo,
839 				    unsigned int hooknum,
840 				    unsigned int hdrlen)
841 {
842 	struct {
843 		struct icmp6hdr	icmp6;
844 		struct ipv6hdr	ip6;
845 	} *inside;
846 	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
847 	enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
848 	struct nf_conntrack_tuple target;
849 	unsigned long statusbit;
850 
851 	WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY);
852 
853 	if (skb_ensure_writable(skb, hdrlen + sizeof(*inside)))
854 		return 0;
855 	if (nf_ip6_checksum(skb, hooknum, hdrlen, IPPROTO_ICMPV6))
856 		return 0;
857 
858 	inside = (void *)skb->data + hdrlen;
859 	if (inside->icmp6.icmp6_type == NDISC_REDIRECT) {
860 		if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
861 			return 0;
862 		if (ct->status & IPS_NAT_MASK)
863 			return 0;
864 	}
865 
866 	if (manip == NF_NAT_MANIP_SRC)
867 		statusbit = IPS_SRC_NAT;
868 	else
869 		statusbit = IPS_DST_NAT;
870 
871 	/* Invert if this is reply direction */
872 	if (dir == IP_CT_DIR_REPLY)
873 		statusbit ^= IPS_NAT_MASK;
874 
875 	if (!(ct->status & statusbit))
876 		return 1;
877 
878 	if (!nf_nat_ipv6_manip_pkt(skb, hdrlen + sizeof(inside->icmp6),
879 				   &ct->tuplehash[!dir].tuple, !manip))
880 		return 0;
881 
882 	if (skb->ip_summed != CHECKSUM_PARTIAL) {
883 		struct ipv6hdr *ipv6h = ipv6_hdr(skb);
884 
885 		inside = (void *)skb->data + hdrlen;
886 		inside->icmp6.icmp6_cksum = 0;
887 		inside->icmp6.icmp6_cksum =
888 			csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
889 					skb->len - hdrlen, IPPROTO_ICMPV6,
890 					skb_checksum(skb, hdrlen,
891 						     skb->len - hdrlen, 0));
892 	}
893 
894 	nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple);
895 	target.dst.protonum = IPPROTO_ICMPV6;
896 	if (!nf_nat_ipv6_manip_pkt(skb, 0, &target, manip))
897 		return 0;
898 
899 	return 1;
900 }
901 EXPORT_SYMBOL_GPL(nf_nat_icmpv6_reply_translation);
902 
903 static unsigned int
nf_nat_ipv6_fn(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)904 nf_nat_ipv6_fn(void *priv, struct sk_buff *skb,
905 	       const struct nf_hook_state *state)
906 {
907 	struct nf_conn *ct;
908 	enum ip_conntrack_info ctinfo;
909 	__be16 frag_off;
910 	int hdrlen;
911 	u8 nexthdr;
912 
913 	ct = nf_ct_get(skb, &ctinfo);
914 	/* Can't track?  It's not due to stress, or conntrack would
915 	 * have dropped it.  Hence it's the user's responsibilty to
916 	 * packet filter it out, or implement conntrack/NAT for that
917 	 * protocol. 8) --RR
918 	 */
919 	if (!ct)
920 		return NF_ACCEPT;
921 
922 	if (ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY) {
923 		nexthdr = ipv6_hdr(skb)->nexthdr;
924 		hdrlen = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
925 					  &nexthdr, &frag_off);
926 
927 		if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
928 			if (!nf_nat_icmpv6_reply_translation(skb, ct, ctinfo,
929 							     state->hook,
930 							     hdrlen))
931 				return NF_DROP;
932 			else
933 				return NF_ACCEPT;
934 		}
935 	}
936 
937 	return nf_nat_inet_fn(priv, skb, state);
938 }
939 
940 static unsigned int
nf_nat_ipv6_in(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)941 nf_nat_ipv6_in(void *priv, struct sk_buff *skb,
942 	       const struct nf_hook_state *state)
943 {
944 	unsigned int ret;
945 	struct in6_addr daddr = ipv6_hdr(skb)->daddr;
946 
947 	ret = nf_nat_ipv6_fn(priv, skb, state);
948 	if (ret != NF_DROP && ret != NF_STOLEN &&
949 	    ipv6_addr_cmp(&daddr, &ipv6_hdr(skb)->daddr))
950 		skb_dst_drop(skb);
951 
952 	return ret;
953 }
954 
955 static unsigned int
nf_nat_ipv6_out(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)956 nf_nat_ipv6_out(void *priv, struct sk_buff *skb,
957 		const struct nf_hook_state *state)
958 {
959 #ifdef CONFIG_XFRM
960 	const struct nf_conn *ct;
961 	enum ip_conntrack_info ctinfo;
962 	int err;
963 #endif
964 	unsigned int ret;
965 
966 	ret = nf_nat_ipv6_fn(priv, skb, state);
967 #ifdef CONFIG_XFRM
968 	if (ret != NF_ACCEPT)
969 		return ret;
970 
971 	if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
972 		return ret;
973 	ct = nf_ct_get(skb, &ctinfo);
974 	if (ct) {
975 		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
976 
977 		if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
978 				      &ct->tuplehash[!dir].tuple.dst.u3) ||
979 		    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
980 		     ct->tuplehash[dir].tuple.src.u.all !=
981 		     ct->tuplehash[!dir].tuple.dst.u.all)) {
982 			err = nf_xfrm_me_harder(state->net, skb, AF_INET6);
983 			if (err < 0)
984 				ret = NF_DROP_ERR(err);
985 		}
986 	}
987 #endif
988 
989 	return ret;
990 }
991 
992 static unsigned int
nf_nat_ipv6_local_fn(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)993 nf_nat_ipv6_local_fn(void *priv, struct sk_buff *skb,
994 		     const struct nf_hook_state *state)
995 {
996 	const struct nf_conn *ct;
997 	enum ip_conntrack_info ctinfo;
998 	unsigned int ret;
999 	int err;
1000 
1001 	ret = nf_nat_ipv6_fn(priv, skb, state);
1002 	if (ret != NF_ACCEPT)
1003 		return ret;
1004 
1005 	ct = nf_ct_get(skb, &ctinfo);
1006 	if (ct) {
1007 		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
1008 
1009 		if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3,
1010 				      &ct->tuplehash[!dir].tuple.src.u3)) {
1011 			err = nf_ip6_route_me_harder(state->net, state->sk, skb);
1012 			if (err < 0)
1013 				ret = NF_DROP_ERR(err);
1014 		}
1015 #ifdef CONFIG_XFRM
1016 		else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
1017 			 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
1018 			 ct->tuplehash[dir].tuple.dst.u.all !=
1019 			 ct->tuplehash[!dir].tuple.src.u.all) {
1020 			err = nf_xfrm_me_harder(state->net, skb, AF_INET6);
1021 			if (err < 0)
1022 				ret = NF_DROP_ERR(err);
1023 		}
1024 #endif
1025 	}
1026 
1027 	return ret;
1028 }
1029 
1030 static const struct nf_hook_ops nf_nat_ipv6_ops[] = {
1031 	/* Before packet filtering, change destination */
1032 	{
1033 		.hook		= nf_nat_ipv6_in,
1034 		.pf		= NFPROTO_IPV6,
1035 		.hooknum	= NF_INET_PRE_ROUTING,
1036 		.priority	= NF_IP6_PRI_NAT_DST,
1037 	},
1038 	/* After packet filtering, change source */
1039 	{
1040 		.hook		= nf_nat_ipv6_out,
1041 		.pf		= NFPROTO_IPV6,
1042 		.hooknum	= NF_INET_POST_ROUTING,
1043 		.priority	= NF_IP6_PRI_NAT_SRC,
1044 	},
1045 	/* Before packet filtering, change destination */
1046 	{
1047 		.hook		= nf_nat_ipv6_local_fn,
1048 		.pf		= NFPROTO_IPV6,
1049 		.hooknum	= NF_INET_LOCAL_OUT,
1050 		.priority	= NF_IP6_PRI_NAT_DST,
1051 	},
1052 	/* After packet filtering, change source */
1053 	{
1054 		.hook		= nf_nat_ipv6_fn,
1055 		.pf		= NFPROTO_IPV6,
1056 		.hooknum	= NF_INET_LOCAL_IN,
1057 		.priority	= NF_IP6_PRI_NAT_SRC,
1058 	},
1059 };
1060 
nf_nat_ipv6_register_fn(struct net * net,const struct nf_hook_ops * ops)1061 int nf_nat_ipv6_register_fn(struct net *net, const struct nf_hook_ops *ops)
1062 {
1063 	return nf_nat_register_fn(net, ops->pf, ops, nf_nat_ipv6_ops,
1064 				  ARRAY_SIZE(nf_nat_ipv6_ops));
1065 }
1066 EXPORT_SYMBOL_GPL(nf_nat_ipv6_register_fn);
1067 
nf_nat_ipv6_unregister_fn(struct net * net,const struct nf_hook_ops * ops)1068 void nf_nat_ipv6_unregister_fn(struct net *net, const struct nf_hook_ops *ops)
1069 {
1070 	nf_nat_unregister_fn(net, ops->pf, ops, ARRAY_SIZE(nf_nat_ipv6_ops));
1071 }
1072 EXPORT_SYMBOL_GPL(nf_nat_ipv6_unregister_fn);
1073 #endif /* CONFIG_IPV6 */
1074 
1075 #if defined(CONFIG_NF_TABLES_INET) && IS_ENABLED(CONFIG_NFT_NAT)
nf_nat_inet_register_fn(struct net * net,const struct nf_hook_ops * ops)1076 int nf_nat_inet_register_fn(struct net *net, const struct nf_hook_ops *ops)
1077 {
1078 	int ret;
1079 
1080 	if (WARN_ON_ONCE(ops->pf != NFPROTO_INET))
1081 		return -EINVAL;
1082 
1083 	ret = nf_nat_register_fn(net, NFPROTO_IPV6, ops, nf_nat_ipv6_ops,
1084 				 ARRAY_SIZE(nf_nat_ipv6_ops));
1085 	if (ret)
1086 		return ret;
1087 
1088 	ret = nf_nat_register_fn(net, NFPROTO_IPV4, ops, nf_nat_ipv4_ops,
1089 				 ARRAY_SIZE(nf_nat_ipv4_ops));
1090 	if (ret)
1091 		nf_nat_unregister_fn(net, NFPROTO_IPV6, ops,
1092 					ARRAY_SIZE(nf_nat_ipv6_ops));
1093 	return ret;
1094 }
1095 EXPORT_SYMBOL_GPL(nf_nat_inet_register_fn);
1096 
nf_nat_inet_unregister_fn(struct net * net,const struct nf_hook_ops * ops)1097 void nf_nat_inet_unregister_fn(struct net *net, const struct nf_hook_ops *ops)
1098 {
1099 	nf_nat_unregister_fn(net, NFPROTO_IPV4, ops, ARRAY_SIZE(nf_nat_ipv4_ops));
1100 	nf_nat_unregister_fn(net, NFPROTO_IPV6, ops, ARRAY_SIZE(nf_nat_ipv6_ops));
1101 }
1102 EXPORT_SYMBOL_GPL(nf_nat_inet_unregister_fn);
1103 #endif /* NFT INET NAT */
1104