[linux-2.6-block.git] / net / ipv4 / netfilter / nf_nat_masquerade_ipv4.c

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/types.h>
#include <linux/module.h>
#include <linux/atomic.h>
#include <linux/inetdevice.h>
#include <linux/ip.h>
#include <linux/timer.h>
#include <linux/netfilter.h>
#include <net/protocol.h>
#include <net/ip.h>
#include <net/checksum.h>
#include <net/route.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter/x_tables.h>
#include <net/netfilter/nf_nat.h>
#include <net/netfilter/ipv4/nf_nat_masquerade.h>

unsigned int
nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
		       const struct nf_nat_range *range,
		       const struct net_device *out)
{
	struct nf_conn *ct;
	struct nf_conn_nat *nat;
	enum ip_conntrack_info ctinfo;
	struct nf_nat_range newrange;
	const struct rtable *rt;
	__be32 newsrc, nh;

	NF_CT_ASSERT(hooknum == NF_INET_POST_ROUTING);

	ct = nf_ct_get(skb, &ctinfo);
	nat = nfct_nat(ct);

	NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
			    ctinfo == IP_CT_RELATED_REPLY));

	/* Source address is 0.0.0.0 - locally generated packet that is
	 * probably not supposed to be masqueraded.
	 */
	if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip == 0)
		return NF_ACCEPT;

	rt = skb_rtable(skb);
	nh = rt_nexthop(rt, ip_hdr(skb)->daddr);
	newsrc = inet_select_addr(out, nh, RT_SCOPE_UNIVERSE);
	if (!newsrc) {
		pr_info("%s ate my IP address\n", out->name);
		return NF_DROP;
	}

	nat->masq_index = out->ifindex;

	/* Transfer from original range. */
	memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
	memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
	newrange.flags       = range->flags | NF_NAT_RANGE_MAP_IPS;
	newrange.min_addr.ip = newsrc;
	newrange.max_addr.ip = newsrc;
	newrange.min_proto   = range->min_proto;
	newrange.max_proto   = range->max_proto;

	/* Hand modified range to generic setup. */
	return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_SRC);
}
EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4);

static int device_cmp(struct nf_conn *i, void *ifindex)
{
	const struct nf_conn_nat *nat = nfct_nat(i);

	if (!nat)
		return 0;
	if (nf_ct_l3num(i) != NFPROTO_IPV4)
		return 0;
	return nat->masq_index == (int)(long)ifindex;
}

static int masq_device_event(struct notifier_block *this,
			     unsigned long event,
			     void *ptr)
{
	const struct net_device *dev = netdev_notifier_info_to_dev(ptr);
	struct net *net = dev_net(dev);

	if (event == NETDEV_DOWN) {
		/* Device was downed.  Search entire table for
		 * conntracks which were associated with that device,
		 * and forget them.
		 */
		NF_CT_ASSERT(dev->ifindex != 0);

		nf_ct_iterate_cleanup(net, device_cmp,
				      (void *)(long)dev->ifindex, 0, 0);
	}

	return NOTIFY_DONE;
}

static int masq_inet_event(struct notifier_block *this,
			   unsigned long event,
			   void *ptr)
{
	struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
	struct netdev_notifier_info info;

	netdev_notifier_info_init(&info, dev);
	return masq_device_event(this, event, &info);
}

static struct notifier_block masq_dev_notifier = {
	.notifier_call	= masq_device_event,
};

static struct notifier_block masq_inet_notifier = {
	.notifier_call	= masq_inet_event,
};

static atomic_t masquerade_notifier_refcount = ATOMIC_INIT(0);

void nf_nat_masquerade_ipv4_register_notifier(void)
{
	/* check if the notifier was already set */
	if (atomic_inc_return(&masquerade_notifier_refcount) > 1)
		return;

	/* Register for device down reports */
	register_netdevice_notifier(&masq_dev_notifier);
	/* Register IP address change reports */
	register_inetaddr_notifier(&masq_inet_notifier);
}
EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_register_notifier);

void nf_nat_masquerade_ipv4_unregister_notifier(void)
{
	/* check if the notifier still has clients */
	if (atomic_dec_return(&masquerade_notifier_refcount) > 0)
		return;

	unregister_netdevice_notifier(&masq_dev_notifier);
	unregister_inetaddr_notifier(&masq_inet_notifier);
}
EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_unregister_notifier);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
Commit	Line	Data
8dd33cc9 AB	1	/* (C) 1999-2001 Paul `Rusty' Russell
	2	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8
	9	#include <linux/types.h>
	10	#include <linux/module.h>
	11	#include <linux/atomic.h>
	12	#include <linux/inetdevice.h>
	13	#include <linux/ip.h>
	14	#include <linux/timer.h>
	15	#include <linux/netfilter.h>
	16	#include <net/protocol.h>
	17	#include <net/ip.h>
	18	#include <net/checksum.h>
	19	#include <net/route.h>
	20	#include <linux/netfilter_ipv4.h>
	21	#include <linux/netfilter/x_tables.h>
	22	#include <net/netfilter/nf_nat.h>
	23	#include <net/netfilter/ipv4/nf_nat_masquerade.h>
	24
	25	unsigned int
	26	nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
	27	const struct nf_nat_range *range,
	28	const struct net_device *out)
	29	{
	30	struct nf_conn *ct;
	31	struct nf_conn_nat *nat;
	32	enum ip_conntrack_info ctinfo;
	33	struct nf_nat_range newrange;
	34	const struct rtable *rt;
	35	__be32 newsrc, nh;
	36
	37	NF_CT_ASSERT(hooknum == NF_INET_POST_ROUTING);
	38
	39	ct = nf_ct_get(skb, &ctinfo);
	40	nat = nfct_nat(ct);
	41
	42	NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED \|\|
	43	ctinfo == IP_CT_RELATED_REPLY));
	44
	45	/* Source address is 0.0.0.0 - locally generated packet that is
	46	* probably not supposed to be masqueraded.
	47	*/
	48	if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip == 0)
	49	return NF_ACCEPT;
	50
	51	rt = skb_rtable(skb);
	52	nh = rt_nexthop(rt, ip_hdr(skb)->daddr);
	53	newsrc = inet_select_addr(out, nh, RT_SCOPE_UNIVERSE);
	54	if (!newsrc) {
	55	pr_info("%s ate my IP address\n", out->name);
	56	return NF_DROP;
	57	}
	58
	59	nat->masq_index = out->ifindex;
	60
	61	/* Transfer from original range. */
	62	memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
	63	memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
	64	newrange.flags = range->flags \| NF_NAT_RANGE_MAP_IPS;
65	newrange.min_addr.ip = newsrc;
66	newrange.max_addr.ip = newsrc;
67	newrange.min_proto = range->min_proto;
68	newrange.max_proto = range->max_proto;
69
70	/* Hand modified range to generic setup. */
71	return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_SRC);
72	}
73	EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4);
74
75	static int device_cmp(struct nf_conn i, void ifindex)
76	{
77	const struct nf_conn_nat *nat = nfct_nat(i);
78
79	if (!nat)
80	return 0;
81	if (nf_ct_l3num(i) != NFPROTO_IPV4)
82	return 0;
83	return nat->masq_index == (int)(long)ifindex;
84	}
85
86	static int masq_device_event(struct notifier_block *this,
87	unsigned long event,
88	void *ptr)
89	{
90	const struct net_device *dev = netdev_notifier_info_to_dev(ptr);
91	struct net *net = dev_net(dev);
92
93	if (event == NETDEV_DOWN) {
94	/* Device was downed. Search entire table for
95	* conntracks which were associated with that device,
96	* and forget them.
97	*/
98	NF_CT_ASSERT(dev->ifindex != 0);
99
100	nf_ct_iterate_cleanup(net, device_cmp,
101	(void *)(long)dev->ifindex, 0, 0);
102	}
103
104	return NOTIFY_DONE;
105	}
106
107	static int masq_inet_event(struct notifier_block *this,
108	unsigned long event,
109	void *ptr)
110	{
111	struct net_device dev = ((struct in_ifaddr )ptr)->ifa_dev->dev;
112	struct netdev_notifier_info info;
113
114	netdev_notifier_info_init(&info, dev);
115	return masq_device_event(this, event, &info);
116	}
117
118	static struct notifier_block masq_dev_notifier = {
119	.notifier_call = masq_device_event,
120	};
121
122	static struct notifier_block masq_inet_notifier = {
123	.notifier_call = masq_inet_event,
124	};
125
126	static atomic_t masquerade_notifier_refcount = ATOMIC_INIT(0);
127
128	void nf_nat_masquerade_ipv4_register_notifier(void)
129	{
130	/* check if the notifier was already set */
131	if (atomic_inc_return(&masquerade_notifier_refcount) > 1)
132	return;
133
134	/* Register for device down reports */
135	register_netdevice_notifier(&masq_dev_notifier);
136	/* Register IP address change reports */
137	register_inetaddr_notifier(&masq_inet_notifier);
138	}
139	EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_register_notifier);
140
141	void nf_nat_masquerade_ipv4_unregister_notifier(void)
142	{
143	/* check if the notifier still has clients */
144	if (atomic_dec_return(&masquerade_notifier_refcount) > 0)
145	return;
146
147	unregister_netdevice_notifier(&masq_dev_notifier);
148	unregister_inetaddr_notifier(&masq_inet_notifier);
149	}
150	EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_unregister_notifier);
151
152	MODULE_LICENSE("GPL");
153	MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");