1 /*
2 * Licensed under GNU GPL version 2 Copyright Magnus Boden <mb@ozaba.mine.nu>
3 * Version: 0.0.7
4 *
5 * Thu 21 Mar 2002 Harald Welte <laforge@gnumonks.org>
6 * - Port to newnat API
7 *
8 * This module currently supports DNAT:
9 * iptables -t nat -A PREROUTING -d x.x.x.x -j DNAT --to-dest x.x.x.y
10 *
11 * and SNAT:
12 * iptables -t nat -A POSTROUTING { -j MASQUERADE , -j SNAT --to-source x.x.x.x }
13 *
14 * It has not been tested with
15 * -j SNAT --to-source x.x.x.x-x.x.x.y since I only have one external ip
16 * If you do test this please let me know if it works or not.
17 *
18 */
19
20 #include <linux/module.h>
21 #include <linux/netfilter_ipv4.h>
22 #include <linux/ip.h>
23 #include <linux/udp.h>
24
25 #include <linux/netfilter.h>
26 #include <linux/netfilter_ipv4/ip_tables.h>
27 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
28 #include <linux/netfilter_ipv4/ip_conntrack_tftp.h>
29 #include <linux/netfilter_ipv4/ip_nat_helper.h>
30 #include <linux/netfilter_ipv4/ip_nat_rule.h>
31
32 MODULE_AUTHOR("Magnus Boden <mb@ozaba.mine.nu>");
33 MODULE_DESCRIPTION("Netfilter NAT helper for tftp");
34 MODULE_LICENSE("GPL");
35
36 #define MAX_PORTS 8
37
38 static int ports[MAX_PORTS];
39 static int ports_c = 0;
40 #ifdef MODULE_PARM
41 MODULE_PARM(ports,"1-" __MODULE_STRING(MAX_PORTS) "i");
42 MODULE_PARM_DESC(ports, "port numbers of tftp servers");
43 #endif
44
45 #if 0
46 #define DEBUGP(format, args...) printk(__FILE__ ":" __FUNCTION__ ": " \
47 format, ## args)
48 #else
49 #define DEBUGP(format, args...)
50 #endif
51 static unsigned int
tftp_nat_help(struct ip_conntrack * ct,struct ip_conntrack_expect * exp,struct ip_nat_info * info,enum ip_conntrack_info ctinfo,unsigned int hooknum,struct sk_buff ** pskb)52 tftp_nat_help(struct ip_conntrack *ct,
53 struct ip_conntrack_expect *exp,
54 struct ip_nat_info *info,
55 enum ip_conntrack_info ctinfo,
56 unsigned int hooknum,
57 struct sk_buff **pskb)
58 {
59 int dir = CTINFO2DIR(ctinfo);
60 struct iphdr *iph = (*pskb)->nh.iph;
61 struct udphdr *udph = (void *)iph + iph->ihl * 4;
62 struct tftphdr *tftph = (void *)udph + 8;
63 struct ip_conntrack_tuple repl;
64
65 if (!((hooknum == NF_IP_POST_ROUTING && dir == IP_CT_DIR_ORIGINAL)
66 || (hooknum == NF_IP_PRE_ROUTING && dir == IP_CT_DIR_REPLY)))
67 return NF_ACCEPT;
68
69 if (!exp) {
70 DEBUGP("no conntrack expectation to modify\n");
71 return NF_ACCEPT;
72 }
73
74 switch (ntohs(tftph->opcode)) {
75 /* RRQ and WRQ works the same way */
76 case TFTP_OPCODE_READ:
77 case TFTP_OPCODE_WRITE:
78 repl = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
79 DEBUGP("");
80 DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
81 DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
82 DEBUGP("expecting: ");
83 DUMP_TUPLE(&repl);
84 DUMP_TUPLE(&exp->mask);
85 ip_conntrack_change_expect(exp, &repl);
86 break;
87 default:
88 DEBUGP("Unknown opcode\n");
89 }
90
91 return NF_ACCEPT;
92 }
93
94 static unsigned int
tftp_nat_expected(struct sk_buff ** pskb,unsigned int hooknum,struct ip_conntrack * ct,struct ip_nat_info * info)95 tftp_nat_expected(struct sk_buff **pskb,
96 unsigned int hooknum,
97 struct ip_conntrack *ct,
98 struct ip_nat_info *info)
99 {
100 const struct ip_conntrack *master = ct->master->expectant;
101 const struct ip_conntrack_tuple *orig =
102 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
103 struct ip_nat_multi_range mr;
104 #if 0
105 const struct ip_conntrack_tuple *repl =
106 &master->tuplehash[IP_CT_DIR_REPLY].tuple;
107 struct iphdr *iph = (*pskb)->nh.iph;
108 struct udphdr *udph = (void *)iph + iph->ihl*4;
109 #endif
110
111 IP_NF_ASSERT(info);
112 IP_NF_ASSERT(master);
113 IP_NF_ASSERT(!(info->initialized & (1 << HOOK2MANIP(hooknum))));
114
115 mr.rangesize = 1;
116 mr.range[0].flags = IP_NAT_RANGE_MAP_IPS;
117
118 if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC) {
119 mr.range[0].min_ip = mr.range[0].max_ip = orig->dst.ip;
120 DEBUGP("orig: %u.%u.%u.%u:%u <-> %u.%u.%u.%u:%u "
121 "newsrc: %u.%u.%u.%u\n",
122 NIPQUAD((*pskb)->nh.iph->saddr), ntohs(udph->source),
123 NIPQUAD((*pskb)->nh.iph->daddr), ntohs(udph->dest),
124 NIPQUAD(orig->dst.ip));
125 } else {
126 mr.range[0].min_ip = mr.range[0].max_ip = orig->src.ip;
127 mr.range[0].min.udp.port = mr.range[0].max.udp.port =
128 orig->src.u.udp.port;
129 mr.range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
130
131 DEBUGP("orig: %u.%u.%u.%u:%u <-> %u.%u.%u.%u:%u "
132 "newdst: %u.%u.%u.%u:%u\n",
133 NIPQUAD((*pskb)->nh.iph->saddr), ntohs(udph->source),
134 NIPQUAD((*pskb)->nh.iph->daddr), ntohs(udph->dest),
135 NIPQUAD(orig->src.ip), ntohs(orig->src.u.udp.port));
136 }
137
138 return ip_nat_setup_info(ct,&mr,hooknum);
139 }
140
141 static struct ip_nat_helper tftp[MAX_PORTS];
142 static char tftp_names[MAX_PORTS][10];
143
fini(void)144 static void fini(void)
145 {
146 int i;
147
148 for (i = 0 ; i < ports_c; i++) {
149 DEBUGP("unregistering helper for port %d\n", ports[i]);
150 ip_nat_helper_unregister(&tftp[i]);
151 }
152 }
153
init(void)154 static int __init init(void)
155 {
156 int i, ret = 0;
157 char *tmpname;
158
159 if (!ports[0])
160 ports[0] = TFTP_PORT;
161
162 for (i = 0 ; (i < MAX_PORTS) && ports[i] ; i++) {
163 tftp[i].tuple.dst.protonum = IPPROTO_UDP;
164 tftp[i].tuple.src.u.udp.port = htons(ports[i]);
165 tftp[i].mask.dst.protonum = 0xFFFF;
166 tftp[i].mask.src.u.udp.port = 0xFFFF;
167 tftp[i].help = tftp_nat_help;
168 tftp[i].flags = 0;
169 tftp[i].me = THIS_MODULE;
170 tftp[i].expect = tftp_nat_expected;
171
172 tmpname = &tftp_names[i][0];
173 if (ports[i] == TFTP_PORT)
174 sprintf(tmpname, "tftp");
175 else
176 sprintf(tmpname, "tftp-%d", i);
177 tftp[i].name = tmpname;
178
179 DEBUGP("ip_nat_tftp: registering for port %d: name %s\n",
180 ports[i], tftp[i].name);
181 ret = ip_nat_helper_register(&tftp[i]);
182
183 if (ret) {
184 printk("ip_nat_tftp: unable to register for port %d\n",
185 ports[i]);
186 fini();
187 return ret;
188 }
189 ports_c++;
190 }
191 return ret;
192 }
193
194 module_init(init);
195 module_exit(fini);
196