net/ipv4/netfilter/ip_nat_standalone.c

   1 /* This file contains all the functions required for the standalone
   2    ip_nat module.
   3
   4    These are not required by the compatibility layer.
   5 */
   6
   7 /* (C) 1999-2001 Paul `Rusty' Russell
   8  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License version 2 as
  12  * published by the Free Software Foundation.
  13  */
  14
  15 /*
  16  * 23 Apr 2001: Harald Welte <laforge@gnumonks.org>
  17  *      - new API and handling of conntrack/nat helpers
  18  *      - now capable of multiple expectations for one master
  19  * */
  20
  21 #include <linux/types.h>
  22 #include <linux/icmp.h>
  23 #include <linux/ip.h>
  24 #include <linux/netfilter.h>
  25 #include <linux/netfilter_ipv4.h>
  26 #include <linux/module.h>
  27 #include <linux/skbuff.h>
  28 #include <linux/proc_fs.h>
  29 #include <net/ip.h>
  30 #include <net/checksum.h>
  31 #include <linux/spinlock.h>
  32
  33 #include <linux/netfilter_ipv4/ip_nat.h>
  34 #include <linux/netfilter_ipv4/ip_nat_rule.h>
  35 #include <linux/netfilter_ipv4/ip_nat_protocol.h>
  36 #include <linux/netfilter_ipv4/ip_nat_core.h>
  37 #include <linux/netfilter_ipv4/ip_nat_helper.h>
  38 #include <linux/netfilter_ipv4/ip_tables.h>
  39 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
  40 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
  41
  42 #if 0
  43 #define DEBUGP printk
  44 #else
  45 #define DEBUGP(format, args...)
  46 #endif
  47
  48 #define HOOKNAME(hooknum) ((hooknum) == NF_IP_POST_ROUTING ? "POST_ROUTING"  \
  49                            : ((hooknum) == NF_IP_PRE_ROUTING ? "PRE_ROUTING" \
  50                               : ((hooknum) == NF_IP_LOCAL_OUT ? "LOCAL_OUT"  \
  51                                  : ((hooknum) == NF_IP_LOCAL_IN ? "LOCAL_IN"  \
  52                                     : "*ERROR*")))
  53
  54 #ifdef CONFIG_XFRM
  55 static void nat_decode_session(struct sk_buff *skb, struct flowi *fl)
  56 {
  57         struct ip_conntrack *ct;
  58         struct ip_conntrack_tuple *t;
  59         enum ip_conntrack_info ctinfo;
  60         enum ip_conntrack_dir dir;
  61         unsigned long statusbit;
  62
  63         ct = ip_conntrack_get(skb, &ctinfo);
  64         if (ct == NULL)
  65                 return;
  66         dir = CTINFO2DIR(ctinfo);
  67         t = &ct->tuplehash[dir].tuple;
  68
  69         if (dir == IP_CT_DIR_ORIGINAL)
  70                 statusbit = IPS_DST_NAT;
  71         else
  72                 statusbit = IPS_SRC_NAT;
  73
  74         if (ct->status & statusbit) {
  75                 fl->fl4_dst = t->dst.ip;
  76                 if (t->dst.protonum == IPPROTO_TCP ||
  77                     t->dst.protonum == IPPROTO_UDP)
  78                         fl->fl_ip_dport = t->dst.u.tcp.port;
  79         }
  80
  81         statusbit ^= IPS_NAT_MASK;
  82
  83         if (ct->status & statusbit) {
  84                 fl->fl4_src = t->src.ip;
  85                 if (t->dst.protonum == IPPROTO_TCP ||
  86                     t->dst.protonum == IPPROTO_UDP)
  87                         fl->fl_ip_sport = t->src.u.tcp.port;
  88         }
  89 }
  90 #endif
  91
  92 static unsigned int
  93 ip_nat_fn(unsigned int hooknum,
  94           struct sk_buff **pskb,
  95           const struct net_device *in,
  96           const struct net_device *out,
  97           int (*okfn)(struct sk_buff *))
  98 {
  99         struct ip_conntrack *ct;
 100         enum ip_conntrack_info ctinfo;
 101         struct ip_nat_info *info;
 102         /* maniptype == SRC for postrouting. */
 103         enum ip_nat_manip_type maniptype = HOOK2MANIP(hooknum);
 104
 105         /* We never see fragments: conntrack defrags on pre-routing
 106            and local-out, and ip_nat_out protects post-routing. */
 107         IP_NF_ASSERT(!((*pskb)->nh.iph->frag_off
 108                        & htons(IP_MF|IP_OFFSET)));
 109
 110         ct = ip_conntrack_get(*pskb, &ctinfo);
 111         /* Can't track?  It's not due to stress, or conntrack would
 112            have dropped it.  Hence it's the user's responsibilty to
 113            packet filter it out, or implement conntrack/NAT for that
 114            protocol. 8) --RR */
 115         if (!ct) {
 116                 /* Exception: ICMP redirect to new connection (not in
 117                    hash table yet).  We must not let this through, in
 118                    case we're doing NAT to the same network. */
 119                 if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
 120                         struct icmphdr _hdr, *hp;
 121
 122                         hp = skb_header_pointer(*pskb,
 123                                                 (*pskb)->nh.iph->ihl*4,
 124                                                 sizeof(_hdr), &_hdr);
 125                         if (hp != NULL &&
 126                             hp->type == ICMP_REDIRECT) {
 127                                 if (LOG_INVALID(IPPROTO_ICMP))
 128                                         nf_log_packet(PF_INET, 0, *pskb,
 129                                                 NULL, NULL, NULL, "ip_nat_fn: "
 130                                                 "untracked ICMP redirect ");
 131                                 return NF_DROP;
 132                         }
 133                 }
 134                 return NF_ACCEPT;
 135         }
 136
 137         /* Don't try to NAT if this packet is not conntracked */
 138         if (ct == &ip_conntrack_untracked)
 139                 return NF_ACCEPT;
 140
 141         switch (ctinfo) {
 142         case IP_CT_RELATED:
 143         case IP_CT_RELATED+IP_CT_IS_REPLY:
 144                 if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
 145                         if (!ip_nat_icmp_reply_translation(ct, ctinfo,
 146                                                            hooknum, pskb))
 147                                 return NF_DROP;
 148                         else
 149                                 return NF_ACCEPT;
 150                 }
 151                 /* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
 152         case IP_CT_NEW:
 153                 info = &ct->nat.info;
 154
 155                 /* Seen it before?  This can happen for loopback, retrans,
 156                    or local packets.. */
 157                 if (!ip_nat_initialized(ct, maniptype)) {
 158                         unsigned int ret;
 159
 160                         if (unlikely(is_confirmed(ct)))
 161                                 /* NAT module was loaded late */
 162                                 ret = alloc_null_binding_confirmed(ct, info,
 163                                                                    hooknum);
 164                         else if (hooknum == NF_IP_LOCAL_IN)
 165                                 /* LOCAL_IN hook doesn't have a chain!  */
 166                                 ret = alloc_null_binding(ct, info, hooknum);
 167                         else
 168                                 ret = ip_nat_rule_find(pskb, hooknum,
 169                                                        in, out, ct,
 170                                                        info);
 171
 172                         if (ret != NF_ACCEPT) {
 173                                 return ret;
 174                         }
 175                 } else
 176                         DEBUGP("Already setup manip %s for ct %p\n",
 177                                maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
 178                                ct);
 179                 break;
 180
 181         default:
 182                 /* ESTABLISHED */
 183                 IP_NF_ASSERT(ctinfo == IP_CT_ESTABLISHED
 184                              || ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
 185                 info = &ct->nat.info;
 186         }
 187
 188         IP_NF_ASSERT(info);
 189         return ip_nat_packet(ct, ctinfo, hooknum, pskb);
 190 }
 191
 192 static unsigned int
 193 ip_nat_in(unsigned int hooknum,
 194           struct sk_buff **pskb,
 195           const struct net_device *in,
 196           const struct net_device *out,
 197           int (*okfn)(struct sk_buff *))
 198 {
 199         unsigned int ret;
 200         __be32 daddr = (*pskb)->nh.iph->daddr;
 201
 202         ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
 203         if (ret != NF_DROP && ret != NF_STOLEN
 204             && daddr != (*pskb)->nh.iph->daddr) {
 205                 dst_release((*pskb)->dst);
 206                 (*pskb)->dst = NULL;
 207         }
 208         return ret;
 209 }
 210
 211 static unsigned int
 212 ip_nat_out(unsigned int hooknum,
 213            struct sk_buff **pskb,
 214            const struct net_device *in,
 215            const struct net_device *out,
 216            int (*okfn)(struct sk_buff *))
 217 {
 218 #ifdef CONFIG_XFRM
 219         struct ip_conntrack *ct;
 220         enum ip_conntrack_info ctinfo;
 221 #endif
 222         unsigned int ret;
 223
 224         /* root is playing with raw sockets. */
 225         if ((*pskb)->len < sizeof(struct iphdr)
 226             || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr))
 227                 return NF_ACCEPT;
 228
 229         ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
 230 #ifdef CONFIG_XFRM
 231         if (ret != NF_DROP && ret != NF_STOLEN
 232             && (ct = ip_conntrack_get(*pskb, &ctinfo)) != NULL) {
 233                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 234
 235                 if (ct->tuplehash[dir].tuple.src.ip !=
 236                     ct->tuplehash[!dir].tuple.dst.ip
 237                     || ct->tuplehash[dir].tuple.src.u.all !=
 238                        ct->tuplehash[!dir].tuple.dst.u.all
 239                     )
 240                         return ip_xfrm_me_harder(pskb) == 0 ? ret : NF_DROP;
 241         }
 242 #endif
 243         return ret;
 244 }
 245
 246 static unsigned int
 247 ip_nat_local_fn(unsigned int hooknum,
 248                 struct sk_buff **pskb,
 249                 const struct net_device *in,
 250                 const struct net_device *out,
 251                 int (*okfn)(struct sk_buff *))
 252 {
 253         struct ip_conntrack *ct;
 254         enum ip_conntrack_info ctinfo;
 255         unsigned int ret;
 256
 257         /* root is playing with raw sockets. */
 258         if ((*pskb)->len < sizeof(struct iphdr)
 259             || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr))
 260                 return NF_ACCEPT;
 261
 262         ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
 263         if (ret != NF_DROP && ret != NF_STOLEN
 264             && (ct = ip_conntrack_get(*pskb, &ctinfo)) != NULL) {
 265                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 266
 267                 if (ct->tuplehash[dir].tuple.dst.ip !=
 268                     ct->tuplehash[!dir].tuple.src.ip
 269 #ifdef CONFIG_XFRM
 270                     || ct->tuplehash[dir].tuple.dst.u.all !=
 271                        ct->tuplehash[!dir].tuple.src.u.all
 272 #endif
 273                     )
 274                         if (ip_route_me_harder(pskb, RTN_UNSPEC))
 275                                 ret = NF_DROP;
 276         }
 277         return ret;
 278 }
 279
 280 static unsigned int
 281 ip_nat_adjust(unsigned int hooknum,
 282               struct sk_buff **pskb,
 283               const struct net_device *in,
 284               const struct net_device *out,
 285               int (*okfn)(struct sk_buff *))
 286 {
 287         struct ip_conntrack *ct;
 288         enum ip_conntrack_info ctinfo;
 289
 290         ct = ip_conntrack_get(*pskb, &ctinfo);
 291         if (ct && test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
 292                 DEBUGP("ip_nat_standalone: adjusting sequence number\n");
 293                 if (!ip_nat_seq_adjust(pskb, ct, ctinfo))
 294                         return NF_DROP;
 295         }
 296         return NF_ACCEPT;
 297 }
 298
 299 /* We must be after connection tracking and before packet filtering. */
 300
 301 static struct nf_hook_ops ip_nat_ops[] = {
 302         /* Before packet filtering, change destination */
 303         {
 304                 .hook           = ip_nat_in,
 305                 .owner          = THIS_MODULE,
 306                 .pf             = PF_INET,
 307                 .hooknum        = NF_IP_PRE_ROUTING,
 308                 .priority       = NF_IP_PRI_NAT_DST,
 309         },
 310         /* After packet filtering, change source */
 311         {
 312                 .hook           = ip_nat_out,
 313                 .owner          = THIS_MODULE,
 314                 .pf             = PF_INET,
 315                 .hooknum        = NF_IP_POST_ROUTING,
 316                 .priority       = NF_IP_PRI_NAT_SRC,
 317         },
 318         /* After conntrack, adjust sequence number */
 319         {
 320                 .hook           = ip_nat_adjust,
 321                 .owner          = THIS_MODULE,
 322                 .pf             = PF_INET,
 323                 .hooknum        = NF_IP_POST_ROUTING,
 324                 .priority       = NF_IP_PRI_NAT_SEQ_ADJUST,
 325         },
 326         /* Before packet filtering, change destination */
 327         {
 328                 .hook           = ip_nat_local_fn,
 329                 .owner          = THIS_MODULE,
 330                 .pf             = PF_INET,
 331                 .hooknum        = NF_IP_LOCAL_OUT,
 332                 .priority       = NF_IP_PRI_NAT_DST,
 333         },
 334         /* After packet filtering, change source */
 335         {
 336                 .hook           = ip_nat_fn,
 337                 .owner          = THIS_MODULE,
 338                 .pf             = PF_INET,
 339                 .hooknum        = NF_IP_LOCAL_IN,
 340                 .priority       = NF_IP_PRI_NAT_SRC,
 341         },
 342         /* After conntrack, adjust sequence number */
 343         {
 344                 .hook           = ip_nat_adjust,
 345                 .owner          = THIS_MODULE,
 346                 .pf             = PF_INET,
 347                 .hooknum        = NF_IP_LOCAL_IN,
 348                 .priority       = NF_IP_PRI_NAT_SEQ_ADJUST,
 349         },
 350 };
 351
 352 static int __init ip_nat_standalone_init(void)
 353 {
 354         int ret = 0;
 355
 356         need_conntrack();
 357
 358 #ifdef CONFIG_XFRM
 359         BUG_ON(ip_nat_decode_session != NULL);
 360         ip_nat_decode_session = nat_decode_session;
 361 #endif
 362         ret = ip_nat_rule_init();
 363         if (ret < 0) {
 364                 printk("ip_nat_init: can't setup rules.\n");
 365                 goto cleanup_decode_session;
 366         }
 367         ret = nf_register_hooks(ip_nat_ops, ARRAY_SIZE(ip_nat_ops));
 368         if (ret < 0) {
 369                 printk("ip_nat_init: can't register hooks.\n");
 370                 goto cleanup_rule_init;
 371         }
 372         return ret;
 373
 374  cleanup_rule_init:
 375         ip_nat_rule_cleanup();
 376  cleanup_decode_session:
 377 #ifdef CONFIG_XFRM
 378         ip_nat_decode_session = NULL;
 379         synchronize_net();
 380 #endif
 381         return ret;
 382 }
 383
 384 static void __exit ip_nat_standalone_fini(void)
 385 {
 386         nf_unregister_hooks(ip_nat_ops, ARRAY_SIZE(ip_nat_ops));
 387         ip_nat_rule_cleanup();
 388 #ifdef CONFIG_XFRM
 389         ip_nat_decode_session = NULL;
 390         synchronize_net();
 391 #endif
 392 }
 393
 394 module_init(ip_nat_standalone_init);
 395 module_exit(ip_nat_standalone_fini);
 396
 397 MODULE_LICENSE("GPL");