~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv4/netfilter/iptable_nat.c

Version: ~ [ linux-5.10-rc5 ] ~ [ linux-5.9.10 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.79 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.159 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.208 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.245 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.245 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* (C) 1999-2001 Paul `Rusty' Russell
  2  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
  3  * (C) 2011 Patrick McHardy <kaber@trash.net>
  4  *
  5  * This program is free software; you can redistribute it and/or modify
  6  * it under the terms of the GNU General Public License version 2 as
  7  * published by the Free Software Foundation.
  8  */
  9 
 10 #include <linux/module.h>
 11 #include <linux/netfilter.h>
 12 #include <linux/netfilter_ipv4.h>
 13 #include <linux/netfilter_ipv4/ip_tables.h>
 14 #include <linux/ip.h>
 15 #include <net/ip.h>
 16 
 17 #include <net/netfilter/nf_nat.h>
 18 #include <net/netfilter/nf_nat_core.h>
 19 #include <net/netfilter/nf_nat_l3proto.h>
 20 
 21 static const struct xt_table nf_nat_ipv4_table = {
 22         .name           = "nat",
 23         .valid_hooks    = (1 << NF_INET_PRE_ROUTING) |
 24                           (1 << NF_INET_POST_ROUTING) |
 25                           (1 << NF_INET_LOCAL_OUT) |
 26                           (1 << NF_INET_LOCAL_IN),
 27         .me             = THIS_MODULE,
 28         .af             = NFPROTO_IPV4,
 29 };
 30 
 31 static unsigned int alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
 32 {
 33         /* Force range to this IP; let proto decide mapping for
 34          * per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
 35          */
 36         struct nf_nat_range range;
 37 
 38         range.flags = 0;
 39         pr_debug("Allocating NULL binding for %p (%pI4)\n", ct,
 40                  HOOK2MANIP(hooknum) == NF_NAT_MANIP_SRC ?
 41                  &ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip :
 42                  &ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);
 43 
 44         return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
 45 }
 46 
 47 static unsigned int nf_nat_rule_find(struct sk_buff *skb, unsigned int hooknum,
 48                                      const struct net_device *in,
 49                                      const struct net_device *out,
 50                                      struct nf_conn *ct)
 51 {
 52         struct net *net = nf_ct_net(ct);
 53         unsigned int ret;
 54 
 55         ret = ipt_do_table(skb, hooknum, in, out, net->ipv4.nat_table);
 56         if (ret == NF_ACCEPT) {
 57                 if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
 58                         ret = alloc_null_binding(ct, hooknum);
 59         }
 60         return ret;
 61 }
 62 
 63 static unsigned int
 64 nf_nat_ipv4_fn(const struct nf_hook_ops *ops,
 65                struct sk_buff *skb,
 66                const struct net_device *in,
 67                const struct net_device *out,
 68                int (*okfn)(struct sk_buff *))
 69 {
 70         struct nf_conn *ct;
 71         enum ip_conntrack_info ctinfo;
 72         struct nf_conn_nat *nat;
 73         /* maniptype == SRC for postrouting. */
 74         enum nf_nat_manip_type maniptype = HOOK2MANIP(ops->hooknum);
 75 
 76         /* We never see fragments: conntrack defrags on pre-routing
 77          * and local-out, and nf_nat_out protects post-routing.
 78          */
 79         NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));
 80 
 81         ct = nf_ct_get(skb, &ctinfo);
 82         /* Can't track?  It's not due to stress, or conntrack would
 83          * have dropped it.  Hence it's the user's responsibilty to
 84          * packet filter it out, or implement conntrack/NAT for that
 85          * protocol. 8) --RR
 86          */
 87         if (!ct)
 88                 return NF_ACCEPT;
 89 
 90         /* Don't try to NAT if this packet is not conntracked */
 91         if (nf_ct_is_untracked(ct))
 92                 return NF_ACCEPT;
 93 
 94         nat = nfct_nat(ct);
 95         if (!nat) {
 96                 /* NAT module was loaded late. */
 97                 if (nf_ct_is_confirmed(ct))
 98                         return NF_ACCEPT;
 99                 nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
100                 if (nat == NULL) {
101                         pr_debug("failed to add NAT extension\n");
102                         return NF_ACCEPT;
103                 }
104         }
105 
106         switch (ctinfo) {
107         case IP_CT_RELATED:
108         case IP_CT_RELATED_REPLY:
109                 if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
110                         if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
111                                                            ops->hooknum))
112                                 return NF_DROP;
113                         else
114                                 return NF_ACCEPT;
115                 }
116                 /* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
117         case IP_CT_NEW:
118                 /* Seen it before?  This can happen for loopback, retrans,
119                  * or local packets.
120                  */
121                 if (!nf_nat_initialized(ct, maniptype)) {
122                         unsigned int ret;
123 
124                         ret = nf_nat_rule_find(skb, ops->hooknum, in, out, ct);
125                         if (ret != NF_ACCEPT)
126                                 return ret;
127                 } else {
128                         pr_debug("Already setup manip %s for ct %p\n",
129                                  maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
130                                  ct);
131                         if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out))
132                                 goto oif_changed;
133                 }
134                 break;
135 
136         default:
137                 /* ESTABLISHED */
138                 NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
139                              ctinfo == IP_CT_ESTABLISHED_REPLY);
140                 if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out))
141                         goto oif_changed;
142         }
143 
144         return nf_nat_packet(ct, ctinfo, ops->hooknum, skb);
145 
146 oif_changed:
147         nf_ct_kill_acct(ct, ctinfo, skb);
148         return NF_DROP;
149 }
150 
151 static unsigned int
152 nf_nat_ipv4_in(const struct nf_hook_ops *ops,
153                struct sk_buff *skb,
154                const struct net_device *in,
155                const struct net_device *out,
156                int (*okfn)(struct sk_buff *))
157 {
158         unsigned int ret;
159         __be32 daddr = ip_hdr(skb)->daddr;
160 
161         ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn);
162         if (ret != NF_DROP && ret != NF_STOLEN &&
163             daddr != ip_hdr(skb)->daddr)
164                 skb_dst_drop(skb);
165 
166         return ret;
167 }
168 
169 static unsigned int
170 nf_nat_ipv4_out(const struct nf_hook_ops *ops,
171                 struct sk_buff *skb,
172                 const struct net_device *in,
173                 const struct net_device *out,
174                 int (*okfn)(struct sk_buff *))
175 {
176 #ifdef CONFIG_XFRM
177         const struct nf_conn *ct;
178         enum ip_conntrack_info ctinfo;
179         int err;
180 #endif
181         unsigned int ret;
182 
183         /* root is playing with raw sockets. */
184         if (skb->len < sizeof(struct iphdr) ||
185             ip_hdrlen(skb) < sizeof(struct iphdr))
186                 return NF_ACCEPT;
187 
188         ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn);
189 #ifdef CONFIG_XFRM
190         if (ret != NF_DROP && ret != NF_STOLEN &&
191             !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
192             (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
193                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
194 
195                 if ((ct->tuplehash[dir].tuple.src.u3.ip !=
196                      ct->tuplehash[!dir].tuple.dst.u3.ip) ||
197                     (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
198                      ct->tuplehash[dir].tuple.src.u.all !=
199                      ct->tuplehash[!dir].tuple.dst.u.all)) {
200                         err = nf_xfrm_me_harder(skb, AF_INET);
201                         if (err < 0)
202                                 ret = NF_DROP_ERR(err);
203                 }
204         }
205 #endif
206         return ret;
207 }
208 
209 static unsigned int
210 nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops,
211                      struct sk_buff *skb,
212                      const struct net_device *in,
213                      const struct net_device *out,
214                      int (*okfn)(struct sk_buff *))
215 {
216         const struct nf_conn *ct;
217         enum ip_conntrack_info ctinfo;
218         unsigned int ret;
219         int err;
220 
221         /* root is playing with raw sockets. */
222         if (skb->len < sizeof(struct iphdr) ||
223             ip_hdrlen(skb) < sizeof(struct iphdr))
224                 return NF_ACCEPT;
225 
226         ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn);
227         if (ret != NF_DROP && ret != NF_STOLEN &&
228             (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
229                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
230 
231                 if (ct->tuplehash[dir].tuple.dst.u3.ip !=
232                     ct->tuplehash[!dir].tuple.src.u3.ip) {
233                         err = ip_route_me_harder(skb, RTN_UNSPEC);
234                         if (err < 0)
235                                 ret = NF_DROP_ERR(err);
236                 }
237 #ifdef CONFIG_XFRM
238                 else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
239                          ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
240                          ct->tuplehash[dir].tuple.dst.u.all !=
241                          ct->tuplehash[!dir].tuple.src.u.all) {
242                         err = nf_xfrm_me_harder(skb, AF_INET);
243                         if (err < 0)
244                                 ret = NF_DROP_ERR(err);
245                 }
246 #endif
247         }
248         return ret;
249 }
250 
251 static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
252         /* Before packet filtering, change destination */
253         {
254                 .hook           = nf_nat_ipv4_in,
255                 .owner          = THIS_MODULE,
256                 .pf             = NFPROTO_IPV4,
257                 .hooknum        = NF_INET_PRE_ROUTING,
258                 .priority       = NF_IP_PRI_NAT_DST,
259         },
260         /* After packet filtering, change source */
261         {
262                 .hook           = nf_nat_ipv4_out,
263                 .owner          = THIS_MODULE,
264                 .pf             = NFPROTO_IPV4,
265                 .hooknum        = NF_INET_POST_ROUTING,
266                 .priority       = NF_IP_PRI_NAT_SRC,
267         },
268         /* Before packet filtering, change destination */
269         {
270                 .hook           = nf_nat_ipv4_local_fn,
271                 .owner          = THIS_MODULE,
272                 .pf             = NFPROTO_IPV4,
273                 .hooknum        = NF_INET_LOCAL_OUT,
274                 .priority       = NF_IP_PRI_NAT_DST,
275         },
276         /* After packet filtering, change source */
277         {
278                 .hook           = nf_nat_ipv4_fn,
279                 .owner          = THIS_MODULE,
280                 .pf             = NFPROTO_IPV4,
281                 .hooknum        = NF_INET_LOCAL_IN,
282                 .priority       = NF_IP_PRI_NAT_SRC,
283         },
284 };
285 
286 static int __net_init iptable_nat_net_init(struct net *net)
287 {
288         struct ipt_replace *repl;
289 
290         repl = ipt_alloc_initial_table(&nf_nat_ipv4_table);
291         if (repl == NULL)
292                 return -ENOMEM;
293         net->ipv4.nat_table = ipt_register_table(net, &nf_nat_ipv4_table, repl);
294         kfree(repl);
295         return PTR_ERR_OR_ZERO(net->ipv4.nat_table);
296 }
297 
298 static void __net_exit iptable_nat_net_exit(struct net *net)
299 {
300         ipt_unregister_table(net, net->ipv4.nat_table);
301 }
302 
303 static struct pernet_operations iptable_nat_net_ops = {
304         .init   = iptable_nat_net_init,
305         .exit   = iptable_nat_net_exit,
306 };
307 
308 static int __init iptable_nat_init(void)
309 {
310         int err;
311 
312         err = register_pernet_subsys(&iptable_nat_net_ops);
313         if (err < 0)
314                 goto err1;
315 
316         err = nf_register_hooks(nf_nat_ipv4_ops, ARRAY_SIZE(nf_nat_ipv4_ops));
317         if (err < 0)
318                 goto err2;
319         return 0;
320 
321 err2:
322         unregister_pernet_subsys(&iptable_nat_net_ops);
323 err1:
324         return err;
325 }
326 
327 static void __exit iptable_nat_exit(void)
328 {
329         nf_unregister_hooks(nf_nat_ipv4_ops, ARRAY_SIZE(nf_nat_ipv4_ops));
330         unregister_pernet_subsys(&iptable_nat_net_ops);
331 }
332 
333 module_init(iptable_nat_init);
334 module_exit(iptable_nat_exit);
335 
336 MODULE_LICENSE("GPL");
337 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp