Commit | Line | Data |
---|---|---|
eb31628e TB |
1 | /* |
2 | * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> | |
3 | * Copyright (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org> | |
4 | * Copyright (c) 2012 Intel Corporation | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify it | |
7 | * under the terms and conditions of the GNU General Public License, | |
8 | * version 2, as published by the Free Software Foundation. | |
9 | * | |
10 | */ | |
11 | ||
12 | #include <linux/module.h> | |
13 | #include <linux/init.h> | |
14 | #include <linux/skbuff.h> | |
15 | #include <linux/ip.h> | |
16 | #include <linux/string.h> | |
17 | #include <linux/netlink.h> | |
18 | #include <linux/netfilter.h> | |
19 | #include <linux/netfilter_ipv4.h> | |
20 | #include <linux/netfilter/nfnetlink.h> | |
21 | #include <linux/netfilter/nf_tables.h> | |
22 | #include <net/netfilter/nf_conntrack.h> | |
23 | #include <net/netfilter/nf_nat.h> | |
eb31628e | 24 | #include <net/netfilter/nf_tables.h> |
eb31628e TB |
25 | #include <net/ip.h> |
26 | ||
27 | struct nft_nat { | |
28 | enum nft_registers sreg_addr_min:8; | |
29 | enum nft_registers sreg_addr_max:8; | |
30 | enum nft_registers sreg_proto_min:8; | |
31 | enum nft_registers sreg_proto_max:8; | |
a4c2e8be PM |
32 | enum nf_nat_manip_type type:8; |
33 | u8 family; | |
e42eff8a | 34 | u16 flags; |
eb31628e TB |
35 | }; |
36 | ||
37 | static void nft_nat_eval(const struct nft_expr *expr, | |
a55e22e9 | 38 | struct nft_regs *regs, |
eb31628e TB |
39 | const struct nft_pktinfo *pkt) |
40 | { | |
41 | const struct nft_nat *priv = nft_expr_priv(expr); | |
42 | enum ip_conntrack_info ctinfo; | |
43 | struct nf_conn *ct = nf_ct_get(pkt->skb, &ctinfo); | |
2eb0f624 | 44 | struct nf_nat_range2 range; |
eb31628e TB |
45 | |
46 | memset(&range, 0, sizeof(range)); | |
47 | if (priv->sreg_addr_min) { | |
48 | if (priv->family == AF_INET) { | |
98c37b6b | 49 | range.min_addr.ip = (__force __be32) |
49499c3e | 50 | regs->data[priv->sreg_addr_min]; |
98c37b6b | 51 | range.max_addr.ip = (__force __be32) |
49499c3e | 52 | regs->data[priv->sreg_addr_max]; |
eb31628e TB |
53 | |
54 | } else { | |
55 | memcpy(range.min_addr.ip6, | |
49499c3e PM |
56 | ®s->data[priv->sreg_addr_min], |
57 | sizeof(range.min_addr.ip6)); | |
eb31628e | 58 | memcpy(range.max_addr.ip6, |
49499c3e PM |
59 | ®s->data[priv->sreg_addr_max], |
60 | sizeof(range.max_addr.ip6)); | |
eb31628e TB |
61 | } |
62 | range.flags |= NF_NAT_RANGE_MAP_IPS; | |
63 | } | |
64 | ||
65 | if (priv->sreg_proto_min) { | |
10596608 LZ |
66 | range.min_proto.all = (__force __be16)nft_reg_load16( |
67 | ®s->data[priv->sreg_proto_min]); | |
68 | range.max_proto.all = (__force __be16)nft_reg_load16( | |
69 | ®s->data[priv->sreg_proto_max]); | |
eb31628e TB |
70 | range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; |
71 | } | |
72 | ||
e42eff8a AB |
73 | range.flags |= priv->flags; |
74 | ||
a55e22e9 | 75 | regs->verdict.code = nf_nat_setup_info(ct, &range, priv->type); |
eb31628e TB |
76 | } |
77 | ||
78 | static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = { | |
79 | [NFTA_NAT_TYPE] = { .type = NLA_U32 }, | |
80 | [NFTA_NAT_FAMILY] = { .type = NLA_U32 }, | |
81 | [NFTA_NAT_REG_ADDR_MIN] = { .type = NLA_U32 }, | |
82 | [NFTA_NAT_REG_ADDR_MAX] = { .type = NLA_U32 }, | |
83 | [NFTA_NAT_REG_PROTO_MIN] = { .type = NLA_U32 }, | |
84 | [NFTA_NAT_REG_PROTO_MAX] = { .type = NLA_U32 }, | |
e42eff8a | 85 | [NFTA_NAT_FLAGS] = { .type = NLA_U32 }, |
eb31628e TB |
86 | }; |
87 | ||
75e8d06d PNA |
88 | static int nft_nat_validate(const struct nft_ctx *ctx, |
89 | const struct nft_expr *expr, | |
90 | const struct nft_data **data) | |
eb31628e TB |
91 | { |
92 | struct nft_nat *priv = nft_expr_priv(expr); | |
93 | int err; | |
94 | ||
7210e4e3 PNA |
95 | err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT); |
96 | if (err < 0) | |
97 | return err; | |
98 | ||
75e8d06d PNA |
99 | switch (priv->type) { |
100 | case NFT_NAT_SNAT: | |
101 | err = nft_chain_validate_hooks(ctx->chain, | |
102 | (1 << NF_INET_POST_ROUTING) | | |
103 | (1 << NF_INET_LOCAL_IN)); | |
104 | break; | |
105 | case NFT_NAT_DNAT: | |
106 | err = nft_chain_validate_hooks(ctx->chain, | |
107 | (1 << NF_INET_PRE_ROUTING) | | |
108 | (1 << NF_INET_LOCAL_OUT)); | |
109 | break; | |
110 | } | |
111 | ||
112 | return err; | |
113 | } | |
114 | ||
115 | static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
116 | const struct nlattr * const tb[]) | |
117 | { | |
118 | struct nft_nat *priv = nft_expr_priv(expr); | |
d07db988 | 119 | unsigned int alen, plen; |
75e8d06d PNA |
120 | u32 family; |
121 | int err; | |
122 | ||
5c819a39 PNA |
123 | if (tb[NFTA_NAT_TYPE] == NULL || |
124 | (tb[NFTA_NAT_REG_ADDR_MIN] == NULL && | |
125 | tb[NFTA_NAT_REG_PROTO_MIN] == NULL)) | |
eb31628e TB |
126 | return -EINVAL; |
127 | ||
128 | switch (ntohl(nla_get_be32(tb[NFTA_NAT_TYPE]))) { | |
129 | case NFT_NAT_SNAT: | |
130 | priv->type = NF_NAT_MANIP_SRC; | |
131 | break; | |
132 | case NFT_NAT_DNAT: | |
133 | priv->type = NF_NAT_MANIP_DST; | |
134 | break; | |
135 | default: | |
136 | return -EINVAL; | |
137 | } | |
138 | ||
139 | if (tb[NFTA_NAT_FAMILY] == NULL) | |
140 | return -EINVAL; | |
141 | ||
a4c2e8be | 142 | family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY])); |
36596dad | 143 | if (family != ctx->family) |
a4c2e8be | 144 | return -EOPNOTSUPP; |
d07db988 PM |
145 | |
146 | switch (family) { | |
147 | case NFPROTO_IPV4: | |
148 | alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip); | |
149 | break; | |
150 | case NFPROTO_IPV6: | |
151 | alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip6); | |
152 | break; | |
153 | default: | |
154 | return -EAFNOSUPPORT; | |
155 | } | |
a4c2e8be | 156 | priv->family = family; |
eb31628e TB |
157 | |
158 | if (tb[NFTA_NAT_REG_ADDR_MIN]) { | |
61cfac6b | 159 | priv->sreg_addr_min = |
b1c96ed3 | 160 | nft_parse_register(tb[NFTA_NAT_REG_ADDR_MIN]); |
d07db988 | 161 | err = nft_validate_register_load(priv->sreg_addr_min, alen); |
eb31628e TB |
162 | if (err < 0) |
163 | return err; | |
eb31628e | 164 | |
61cfac6b PNA |
165 | if (tb[NFTA_NAT_REG_ADDR_MAX]) { |
166 | priv->sreg_addr_max = | |
b1c96ed3 | 167 | nft_parse_register(tb[NFTA_NAT_REG_ADDR_MAX]); |
61cfac6b | 168 | |
d07db988 PM |
169 | err = nft_validate_register_load(priv->sreg_addr_max, |
170 | alen); | |
61cfac6b PNA |
171 | if (err < 0) |
172 | return err; | |
173 | } else { | |
174 | priv->sreg_addr_max = priv->sreg_addr_min; | |
175 | } | |
176 | } | |
eb31628e | 177 | |
d07db988 | 178 | plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all); |
eb31628e | 179 | if (tb[NFTA_NAT_REG_PROTO_MIN]) { |
61cfac6b | 180 | priv->sreg_proto_min = |
b1c96ed3 | 181 | nft_parse_register(tb[NFTA_NAT_REG_PROTO_MIN]); |
61cfac6b | 182 | |
d07db988 | 183 | err = nft_validate_register_load(priv->sreg_proto_min, plen); |
eb31628e TB |
184 | if (err < 0) |
185 | return err; | |
eb31628e | 186 | |
61cfac6b PNA |
187 | if (tb[NFTA_NAT_REG_PROTO_MAX]) { |
188 | priv->sreg_proto_max = | |
b1c96ed3 | 189 | nft_parse_register(tb[NFTA_NAT_REG_PROTO_MAX]); |
61cfac6b | 190 | |
d07db988 PM |
191 | err = nft_validate_register_load(priv->sreg_proto_max, |
192 | plen); | |
61cfac6b PNA |
193 | if (err < 0) |
194 | return err; | |
195 | } else { | |
196 | priv->sreg_proto_max = priv->sreg_proto_min; | |
197 | } | |
198 | } | |
eb31628e | 199 | |
e42eff8a AB |
200 | if (tb[NFTA_NAT_FLAGS]) { |
201 | priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS])); | |
202 | if (priv->flags & ~NF_NAT_RANGE_MASK) | |
203 | return -EINVAL; | |
204 | } | |
205 | ||
20afd423 | 206 | return nf_ct_netns_get(ctx->net, family); |
eb31628e TB |
207 | } |
208 | ||
209 | static int nft_nat_dump(struct sk_buff *skb, const struct nft_expr *expr) | |
210 | { | |
211 | const struct nft_nat *priv = nft_expr_priv(expr); | |
212 | ||
213 | switch (priv->type) { | |
214 | case NF_NAT_MANIP_SRC: | |
215 | if (nla_put_be32(skb, NFTA_NAT_TYPE, htonl(NFT_NAT_SNAT))) | |
216 | goto nla_put_failure; | |
217 | break; | |
218 | case NF_NAT_MANIP_DST: | |
219 | if (nla_put_be32(skb, NFTA_NAT_TYPE, htonl(NFT_NAT_DNAT))) | |
220 | goto nla_put_failure; | |
221 | break; | |
222 | } | |
223 | ||
224 | if (nla_put_be32(skb, NFTA_NAT_FAMILY, htonl(priv->family))) | |
225 | goto nla_put_failure; | |
1e2d56a5 PNA |
226 | |
227 | if (priv->sreg_addr_min) { | |
b1c96ed3 PM |
228 | if (nft_dump_register(skb, NFTA_NAT_REG_ADDR_MIN, |
229 | priv->sreg_addr_min) || | |
230 | nft_dump_register(skb, NFTA_NAT_REG_ADDR_MAX, | |
231 | priv->sreg_addr_max)) | |
1e2d56a5 PNA |
232 | goto nla_put_failure; |
233 | } | |
234 | ||
91513606 | 235 | if (priv->sreg_proto_min) { |
b1c96ed3 PM |
236 | if (nft_dump_register(skb, NFTA_NAT_REG_PROTO_MIN, |
237 | priv->sreg_proto_min) || | |
238 | nft_dump_register(skb, NFTA_NAT_REG_PROTO_MAX, | |
239 | priv->sreg_proto_max)) | |
91513606 PNA |
240 | goto nla_put_failure; |
241 | } | |
e42eff8a AB |
242 | |
243 | if (priv->flags != 0) { | |
244 | if (nla_put_be32(skb, NFTA_NAT_FLAGS, htonl(priv->flags))) | |
245 | goto nla_put_failure; | |
246 | } | |
247 | ||
eb31628e TB |
248 | return 0; |
249 | ||
250 | nla_put_failure: | |
251 | return -1; | |
252 | } | |
253 | ||
20afd423 FW |
254 | static void |
255 | nft_nat_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) | |
256 | { | |
257 | const struct nft_nat *priv = nft_expr_priv(expr); | |
258 | ||
259 | nf_ct_netns_put(ctx->net, priv->family); | |
260 | } | |
261 | ||
eb31628e TB |
262 | static struct nft_expr_type nft_nat_type; |
263 | static const struct nft_expr_ops nft_nat_ops = { | |
264 | .type = &nft_nat_type, | |
265 | .size = NFT_EXPR_SIZE(sizeof(struct nft_nat)), | |
266 | .eval = nft_nat_eval, | |
267 | .init = nft_nat_init, | |
20afd423 | 268 | .destroy = nft_nat_destroy, |
eb31628e | 269 | .dump = nft_nat_dump, |
7210e4e3 | 270 | .validate = nft_nat_validate, |
eb31628e TB |
271 | }; |
272 | ||
273 | static struct nft_expr_type nft_nat_type __read_mostly = { | |
274 | .name = "nat", | |
275 | .ops = &nft_nat_ops, | |
276 | .policy = nft_nat_policy, | |
277 | .maxattr = NFTA_NAT_MAX, | |
278 | .owner = THIS_MODULE, | |
279 | }; | |
280 | ||
281 | static int __init nft_nat_module_init(void) | |
282 | { | |
a4c2e8be | 283 | return nft_register_expr(&nft_nat_type); |
eb31628e TB |
284 | } |
285 | ||
286 | static void __exit nft_nat_module_exit(void) | |
287 | { | |
288 | nft_unregister_expr(&nft_nat_type); | |
289 | } | |
290 | ||
291 | module_init(nft_nat_module_init); | |
292 | module_exit(nft_nat_module_exit); | |
293 | ||
294 | MODULE_LICENSE("GPL"); | |
295 | MODULE_AUTHOR("Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>"); | |
296 | MODULE_ALIAS_NFT_EXPR("nat"); |