~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/xt_NETMAP.c

Version: ~ [ linux-6.0-rc6 ] ~ [ linux-5.19.10 ] ~ [ linux-5.18.19 ] ~ [ linux-5.17.15 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.69 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.144 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.214 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.259 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.294 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.329 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.302 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.9 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-only
  2 /*
  3  * (C) 2000-2001 Svenning Soerensen <svenning@post5.tele.dk>
  4  * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
  5  */
  6 
  7 #include <linux/ip.h>
  8 #include <linux/kernel.h>
  9 #include <linux/module.h>
 10 #include <linux/netdevice.h>
 11 #include <linux/ipv6.h>
 12 #include <linux/netfilter.h>
 13 #include <linux/netfilter_ipv4.h>
 14 #include <linux/netfilter_ipv6.h>
 15 #include <linux/netfilter/x_tables.h>
 16 #include <net/netfilter/nf_nat.h>
 17 
 18 static unsigned int
 19 netmap_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 20 {
 21         const struct nf_nat_range2 *range = par->targinfo;
 22         struct nf_nat_range2 newrange;
 23         struct nf_conn *ct;
 24         enum ip_conntrack_info ctinfo;
 25         union nf_inet_addr new_addr, netmask;
 26         unsigned int i;
 27 
 28         ct = nf_ct_get(skb, &ctinfo);
 29         for (i = 0; i < ARRAY_SIZE(range->min_addr.ip6); i++)
 30                 netmask.ip6[i] = ~(range->min_addr.ip6[i] ^
 31                                    range->max_addr.ip6[i]);
 32 
 33         if (xt_hooknum(par) == NF_INET_PRE_ROUTING ||
 34             xt_hooknum(par) == NF_INET_LOCAL_OUT)
 35                 new_addr.in6 = ipv6_hdr(skb)->daddr;
 36         else
 37                 new_addr.in6 = ipv6_hdr(skb)->saddr;
 38 
 39         for (i = 0; i < ARRAY_SIZE(new_addr.ip6); i++) {
 40                 new_addr.ip6[i] &= ~netmask.ip6[i];
 41                 new_addr.ip6[i] |= range->min_addr.ip6[i] &
 42                                    netmask.ip6[i];
 43         }
 44 
 45         newrange.flags  = range->flags | NF_NAT_RANGE_MAP_IPS;
 46         newrange.min_addr       = new_addr;
 47         newrange.max_addr       = new_addr;
 48         newrange.min_proto      = range->min_proto;
 49         newrange.max_proto      = range->max_proto;
 50 
 51         return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(xt_hooknum(par)));
 52 }
 53 
 54 static int netmap_tg6_checkentry(const struct xt_tgchk_param *par)
 55 {
 56         const struct nf_nat_range2 *range = par->targinfo;
 57 
 58         if (!(range->flags & NF_NAT_RANGE_MAP_IPS))
 59                 return -EINVAL;
 60         return nf_ct_netns_get(par->net, par->family);
 61 }
 62 
 63 static void netmap_tg_destroy(const struct xt_tgdtor_param *par)
 64 {
 65         nf_ct_netns_put(par->net, par->family);
 66 }
 67 
 68 static unsigned int
 69 netmap_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 70 {
 71         struct nf_conn *ct;
 72         enum ip_conntrack_info ctinfo;
 73         __be32 new_ip, netmask;
 74         const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 75         struct nf_nat_range2 newrange;
 76 
 77         WARN_ON(xt_hooknum(par) != NF_INET_PRE_ROUTING &&
 78                 xt_hooknum(par) != NF_INET_POST_ROUTING &&
 79                 xt_hooknum(par) != NF_INET_LOCAL_OUT &&
 80                 xt_hooknum(par) != NF_INET_LOCAL_IN);
 81         ct = nf_ct_get(skb, &ctinfo);
 82 
 83         netmask = ~(mr->range[0].min_ip ^ mr->range[0].max_ip);
 84 
 85         if (xt_hooknum(par) == NF_INET_PRE_ROUTING ||
 86             xt_hooknum(par) == NF_INET_LOCAL_OUT)
 87                 new_ip = ip_hdr(skb)->daddr & ~netmask;
 88         else
 89                 new_ip = ip_hdr(skb)->saddr & ~netmask;
 90         new_ip |= mr->range[0].min_ip & netmask;
 91 
 92         memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
 93         memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
 94         newrange.flags       = mr->range[0].flags | NF_NAT_RANGE_MAP_IPS;
 95         newrange.min_addr.ip = new_ip;
 96         newrange.max_addr.ip = new_ip;
 97         newrange.min_proto   = mr->range[0].min;
 98         newrange.max_proto   = mr->range[0].max;
 99 
100         /* Hand modified range to generic setup. */
101         return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(xt_hooknum(par)));
102 }
103 
104 static int netmap_tg4_check(const struct xt_tgchk_param *par)
105 {
106         const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
107 
108         if (!(mr->range[0].flags & NF_NAT_RANGE_MAP_IPS)) {
109                 pr_debug("bad MAP_IPS.\n");
110                 return -EINVAL;
111         }
112         if (mr->rangesize != 1) {
113                 pr_debug("bad rangesize %u.\n", mr->rangesize);
114                 return -EINVAL;
115         }
116         return nf_ct_netns_get(par->net, par->family);
117 }
118 
119 static struct xt_target netmap_tg_reg[] __read_mostly = {
120         {
121                 .name       = "NETMAP",
122                 .family     = NFPROTO_IPV6,
123                 .revision   = 0,
124                 .target     = netmap_tg6,
125                 .targetsize = sizeof(struct nf_nat_range),
126                 .table      = "nat",
127                 .hooks      = (1 << NF_INET_PRE_ROUTING) |
128                               (1 << NF_INET_POST_ROUTING) |
129                               (1 << NF_INET_LOCAL_OUT) |
130                               (1 << NF_INET_LOCAL_IN),
131                 .checkentry = netmap_tg6_checkentry,
132                 .destroy    = netmap_tg_destroy,
133                 .me         = THIS_MODULE,
134         },
135         {
136                 .name       = "NETMAP",
137                 .family     = NFPROTO_IPV4,
138                 .revision   = 0,
139                 .target     = netmap_tg4,
140                 .targetsize = sizeof(struct nf_nat_ipv4_multi_range_compat),
141                 .table      = "nat",
142                 .hooks      = (1 << NF_INET_PRE_ROUTING) |
143                               (1 << NF_INET_POST_ROUTING) |
144                               (1 << NF_INET_LOCAL_OUT) |
145                               (1 << NF_INET_LOCAL_IN),
146                 .checkentry = netmap_tg4_check,
147                 .destroy    = netmap_tg_destroy,
148                 .me         = THIS_MODULE,
149         },
150 };
151 
152 static int __init netmap_tg_init(void)
153 {
154         return xt_register_targets(netmap_tg_reg, ARRAY_SIZE(netmap_tg_reg));
155 }
156 
157 static void netmap_tg_exit(void)
158 {
159         xt_unregister_targets(netmap_tg_reg, ARRAY_SIZE(netmap_tg_reg));
160 }
161 
162 module_init(netmap_tg_init);
163 module_exit(netmap_tg_exit);
164 
165 MODULE_LICENSE("GPL");
166 MODULE_DESCRIPTION("Xtables: 1:1 NAT mapping of subnets");
167 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
168 MODULE_ALIAS("ip6t_NETMAP");
169 MODULE_ALIAS("ipt_NETMAP");
170 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp