[linux-2.6-block.git] / net / netfilter / xt_nat.c

/*
 * (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
 * (C) 2011 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/netfilter.h>
#include <linux/netfilter/x_tables.h>
#include <net/netfilter/nf_nat_core.h>

static int xt_nat_checkentry_v0(const struct xt_tgchk_param *par)
{
	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;

	if (mr->rangesize != 1) {
		pr_info_ratelimited("multiple ranges no longer supported\n");
		return -EINVAL;
	}
	return nf_ct_netns_get(par->net, par->family);
}

static int xt_nat_checkentry(const struct xt_tgchk_param *par)
{
	return nf_ct_netns_get(par->net, par->family);
}

static void xt_nat_destroy(const struct xt_tgdtor_param *par)
{
	nf_ct_netns_put(par->net, par->family);
}

static void xt_nat_convert_range(struct nf_nat_range2 *dst,
				 const struct nf_nat_ipv4_range *src)
{
	memset(&dst->min_addr, 0, sizeof(dst->min_addr));
	memset(&dst->max_addr, 0, sizeof(dst->max_addr));
	memset(&dst->base_proto, 0, sizeof(dst->base_proto));

	dst->flags	 = src->flags;
	dst->min_addr.ip = src->min_ip;
	dst->max_addr.ip = src->max_ip;
	dst->min_proto	 = src->min;
	dst->max_proto	 = src->max;
}

static unsigned int
xt_snat_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
	struct nf_nat_range2 range;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
		  ctinfo == IP_CT_RELATED_REPLY)));

	xt_nat_convert_range(&range, &mr->range[0]);
	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
}

static unsigned int
xt_dnat_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
	struct nf_nat_range2 range;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED)));

	xt_nat_convert_range(&range, &mr->range[0]);
	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
}

static unsigned int
xt_snat_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_range *range_v1 = par->targinfo;
	struct nf_nat_range2 range;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
		  ctinfo == IP_CT_RELATED_REPLY)));

	memcpy(&range, range_v1, sizeof(*range_v1));
	memset(&range.base_proto, 0, sizeof(range.base_proto));

	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
}

static unsigned int
xt_dnat_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_range *range_v1 = par->targinfo;
	struct nf_nat_range2 range;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED)));

	memcpy(&range, range_v1, sizeof(*range_v1));
	memset(&range.base_proto, 0, sizeof(range.base_proto));

	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
}

static unsigned int
xt_snat_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_range2 *range = par->targinfo;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
		  ctinfo == IP_CT_RELATED_REPLY)));

	return nf_nat_setup_info(ct, range, NF_NAT_MANIP_SRC);
}

static unsigned int
xt_dnat_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_range2 *range = par->targinfo;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED)));

	return nf_nat_setup_info(ct, range, NF_NAT_MANIP_DST);
}

static struct xt_target xt_nat_target_reg[] __read_mostly = {
	{
		.name		= "SNAT",
		.revision	= 0,
		.checkentry	= xt_nat_checkentry_v0,
		.destroy	= xt_nat_destroy,
		.target		= xt_snat_target_v0,
		.targetsize	= sizeof(struct nf_nat_ipv4_multi_range_compat),
		.family		= NFPROTO_IPV4,
		.table		= "nat",
		.hooks		= (1 << NF_INET_POST_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
	{
		.name		= "DNAT",
		.revision	= 0,
		.checkentry	= xt_nat_checkentry_v0,
		.destroy	= xt_nat_destroy,
		.target		= xt_dnat_target_v0,
		.targetsize	= sizeof(struct nf_nat_ipv4_multi_range_compat),
		.family		= NFPROTO_IPV4,
		.table		= "nat",
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_OUT),
		.me		= THIS_MODULE,
	},
	{
		.name		= "SNAT",
		.revision	= 1,
		.checkentry	= xt_nat_checkentry,
		.destroy	= xt_nat_destroy,
		.target		= xt_snat_target_v1,
		.targetsize	= sizeof(struct nf_nat_range),
		.table		= "nat",
		.hooks		= (1 << NF_INET_POST_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
	{
		.name		= "DNAT",
		.revision	= 1,
		.checkentry	= xt_nat_checkentry,
		.destroy	= xt_nat_destroy,
		.target		= xt_dnat_target_v1,
		.targetsize	= sizeof(struct nf_nat_range),
		.table		= "nat",
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_OUT),
		.me		= THIS_MODULE,
	},
	{
		.name		= "SNAT",
		.revision	= 2,
		.checkentry	= xt_nat_checkentry,
		.destroy	= xt_nat_destroy,
		.target		= xt_snat_target_v2,
		.targetsize	= sizeof(struct nf_nat_range2),
		.table		= "nat",
		.hooks		= (1 << NF_INET_POST_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
	{
		.name		= "DNAT",
		.revision	= 2,
		.checkentry	= xt_nat_checkentry,
		.destroy	= xt_nat_destroy,
		.target		= xt_dnat_target_v2,
		.targetsize	= sizeof(struct nf_nat_range2),
		.table		= "nat",
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_OUT),
		.me		= THIS_MODULE,
	},
};

static int __init xt_nat_init(void)
{
	return xt_register_targets(xt_nat_target_reg,
				   ARRAY_SIZE(xt_nat_target_reg));
}

static void __exit xt_nat_exit(void)
{
	xt_unregister_targets(xt_nat_target_reg, ARRAY_SIZE(xt_nat_target_reg));
}

module_init(xt_nat_init);
module_exit(xt_nat_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_ALIAS("ipt_SNAT");
MODULE_ALIAS("ipt_DNAT");
MODULE_ALIAS("ip6t_SNAT");
MODULE_ALIAS("ip6t_DNAT");
Commit	Line	Data
c7232c99 PM	1	/*
	2	* (C) 1999-2001 Paul `Rusty' Russell
	3	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
	4	* (C) 2011 Patrick McHardy <kaber@trash.net>
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
b2606644 FW	11	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
b2606644 FW	12
c7232c99 PM	13	#include <linux/module.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/netfilter.h>
	16	#include <linux/netfilter/x_tables.h>
	17	#include <net/netfilter/nf_nat_core.h>
	18
	19	static int xt_nat_checkentry_v0(const struct xt_tgchk_param *par)
	20	{
	21	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
	22
	23	if (mr->rangesize != 1) {
b2606644	24	pr_info_ratelimited("multiple ranges no longer supported\n");
c7232c99 PM	25	return -EINVAL;
c7232c99 PM	26	}
a357b3f8 FW	27	return nf_ct_netns_get(par->net, par->family);
	28	}
	29
	30	static int xt_nat_checkentry(const struct xt_tgchk_param *par)
	31	{
	32	return nf_ct_netns_get(par->net, par->family);
	33	}
	34
	35	static void xt_nat_destroy(const struct xt_tgdtor_param *par)
	36	{
	37	nf_ct_netns_put(par->net, par->family);
c7232c99 PM	38	}
c7232c99 PM	39
2eb0f624	40	static void xt_nat_convert_range(struct nf_nat_range2 *dst,
c7232c99 PM	41	const struct nf_nat_ipv4_range *src)
	42	{
	43	memset(&dst->min_addr, 0, sizeof(dst->min_addr));
	44	memset(&dst->max_addr, 0, sizeof(dst->max_addr));
2eb0f624	45	memset(&dst->base_proto, 0, sizeof(dst->base_proto));
c7232c99 PM	46
	47	dst->flags = src->flags;
	48	dst->min_addr.ip = src->min_ip;
	49	dst->max_addr.ip = src->max_ip;
	50	dst->min_proto = src->min;
	51	dst->max_proto = src->max;
	52	}
	53
	54	static unsigned int
	55	xt_snat_target_v0(struct sk_buff skb, const struct xt_action_param par)
	56	{
	57	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
2eb0f624	58	struct nf_nat_range2 range;
c7232c99 PM	59	enum ip_conntrack_info ctinfo;
	60	struct nf_conn *ct;
	61
	62	ct = nf_ct_get(skb, &ctinfo);
44d6e2f2 VR	63	WARN_ON(!(ct != NULL &&
	64	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED \|\|
	65	ctinfo == IP_CT_RELATED_REPLY)));
c7232c99 PM	66
	67	xt_nat_convert_range(&range, &mr->range[0]);
	68	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
	69	}
	70
	71	static unsigned int
	72	xt_dnat_target_v0(struct sk_buff skb, const struct xt_action_param par)
	73	{
	74	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
2eb0f624	75	struct nf_nat_range2 range;
c7232c99 PM	76	enum ip_conntrack_info ctinfo;
	77	struct nf_conn *ct;
	78
	79	ct = nf_ct_get(skb, &ctinfo);
44d6e2f2 VR	80	WARN_ON(!(ct != NULL &&
44d6e2f2 VR	81	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED)));
c7232c99 PM	82
	83	xt_nat_convert_range(&range, &mr->range[0]);
	84	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
	85	}
	86
	87	static unsigned int
	88	xt_snat_target_v1(struct sk_buff skb, const struct xt_action_param par)
	89	{
2eb0f624 TDT	90	const struct nf_nat_range *range_v1 = par->targinfo;
2eb0f624 TDT	91	struct nf_nat_range2 range;
c7232c99 PM	92	enum ip_conntrack_info ctinfo;
	93	struct nf_conn *ct;
	94
	95	ct = nf_ct_get(skb, &ctinfo);
44d6e2f2 VR	96	WARN_ON(!(ct != NULL &&
	97	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED \|\|
	98	ctinfo == IP_CT_RELATED_REPLY)));
c7232c99	99
2eb0f624 TDT	100	memcpy(&range, range_v1, sizeof(*range_v1));
	101	memset(&range.base_proto, 0, sizeof(range.base_proto));
	102
	103	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
c7232c99 PM	104	}
	105
	106	static unsigned int
	107	xt_dnat_target_v1(struct sk_buff skb, const struct xt_action_param par)
	108	{
2eb0f624 TDT	109	const struct nf_nat_range *range_v1 = par->targinfo;
	110	struct nf_nat_range2 range;
	111	enum ip_conntrack_info ctinfo;
	112	struct nf_conn *ct;
	113
	114	ct = nf_ct_get(skb, &ctinfo);
	115	WARN_ON(!(ct != NULL &&
	116	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED)));
	117
	118	memcpy(&range, range_v1, sizeof(*range_v1));
	119	memset(&range.base_proto, 0, sizeof(range.base_proto));
	120
	121	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
	122	}
	123
	124	static unsigned int
	125	xt_snat_target_v2(struct sk_buff skb, const struct xt_action_param par)
	126	{
	127	const struct nf_nat_range2 *range = par->targinfo;
	128	enum ip_conntrack_info ctinfo;
	129	struct nf_conn *ct;
	130
	131	ct = nf_ct_get(skb, &ctinfo);
	132	WARN_ON(!(ct != NULL &&
	133	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED \|\|
	134	ctinfo == IP_CT_RELATED_REPLY)));
	135
	136	return nf_nat_setup_info(ct, range, NF_NAT_MANIP_SRC);
	137	}
	138
	139	static unsigned int
	140	xt_dnat_target_v2(struct sk_buff skb, const struct xt_action_param par)
	141	{
	142	const struct nf_nat_range2 *range = par->targinfo;
c7232c99 PM	143	enum ip_conntrack_info ctinfo;
	144	struct nf_conn *ct;
	145
	146	ct = nf_ct_get(skb, &ctinfo);
44d6e2f2 VR	147	WARN_ON(!(ct != NULL &&
44d6e2f2 VR	148	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED)));
c7232c99 PM	149
	150	return nf_nat_setup_info(ct, range, NF_NAT_MANIP_DST);
	151	}
	152
	153	static struct xt_target xt_nat_target_reg[] __read_mostly = {
	154	{
	155	.name = "SNAT",
	156	.revision = 0,
	157	.checkentry = xt_nat_checkentry_v0,
a357b3f8	158	.destroy = xt_nat_destroy,
c7232c99 PM	159	.target = xt_snat_target_v0,
	160	.targetsize = sizeof(struct nf_nat_ipv4_multi_range_compat),
	161	.family = NFPROTO_IPV4,
	162	.table = "nat",
	163	.hooks = (1 << NF_INET_POST_ROUTING) \|
939ccba4	164	(1 << NF_INET_LOCAL_IN),
c7232c99 PM	165	.me = THIS_MODULE,
	166	},
	167	{
	168	.name = "DNAT",
	169	.revision = 0,
	170	.checkentry = xt_nat_checkentry_v0,
a357b3f8	171	.destroy = xt_nat_destroy,
c7232c99 PM	172	.target = xt_dnat_target_v0,
	173	.targetsize = sizeof(struct nf_nat_ipv4_multi_range_compat),
	174	.family = NFPROTO_IPV4,
	175	.table = "nat",
	176	.hooks = (1 << NF_INET_PRE_ROUTING) \|
939ccba4	177	(1 << NF_INET_LOCAL_OUT),
c7232c99 PM	178	.me = THIS_MODULE,
	179	},
	180	{
	181	.name = "SNAT",
	182	.revision = 1,
a357b3f8 FW	183	.checkentry = xt_nat_checkentry,
a357b3f8 FW	184	.destroy = xt_nat_destroy,
c7232c99 PM	185	.target = xt_snat_target_v1,
	186	.targetsize = sizeof(struct nf_nat_range),
	187	.table = "nat",
	188	.hooks = (1 << NF_INET_POST_ROUTING) \|
939ccba4	189	(1 << NF_INET_LOCAL_IN),
c7232c99 PM	190	.me = THIS_MODULE,
	191	},
	192	{
	193	.name = "DNAT",
	194	.revision = 1,
a357b3f8 FW	195	.checkentry = xt_nat_checkentry,
a357b3f8 FW	196	.destroy = xt_nat_destroy,
c7232c99 PM	197	.target = xt_dnat_target_v1,
	198	.targetsize = sizeof(struct nf_nat_range),
	199	.table = "nat",
	200	.hooks = (1 << NF_INET_PRE_ROUTING) \|
939ccba4	201	(1 << NF_INET_LOCAL_OUT),
c7232c99 PM	202	.me = THIS_MODULE,
c7232c99 PM	203	},
2eb0f624 TDT	204	{
	205	.name = "SNAT",
	206	.revision = 2,
	207	.checkentry = xt_nat_checkentry,
	208	.destroy = xt_nat_destroy,
	209	.target = xt_snat_target_v2,
	210	.targetsize = sizeof(struct nf_nat_range2),
	211	.table = "nat",
	212	.hooks = (1 << NF_INET_POST_ROUTING) \|
	213	(1 << NF_INET_LOCAL_IN),
	214	.me = THIS_MODULE,
	215	},
	216	{
	217	.name = "DNAT",
	218	.revision = 2,
cb20f2d2 PA	219	.checkentry = xt_nat_checkentry,
cb20f2d2 PA	220	.destroy = xt_nat_destroy,
2eb0f624 TDT	221	.target = xt_dnat_target_v2,
	222	.targetsize = sizeof(struct nf_nat_range2),
	223	.table = "nat",
	224	.hooks = (1 << NF_INET_PRE_ROUTING) \|
	225	(1 << NF_INET_LOCAL_OUT),
	226	.me = THIS_MODULE,
	227	},
c7232c99 PM	228	};
	229
	230	static int __init xt_nat_init(void)
	231	{
	232	return xt_register_targets(xt_nat_target_reg,
	233	ARRAY_SIZE(xt_nat_target_reg));
	234	}
	235
	236	static void __exit xt_nat_exit(void)
	237	{
	238	xt_unregister_targets(xt_nat_target_reg, ARRAY_SIZE(xt_nat_target_reg));
	239	}
	240
	241	module_init(xt_nat_init);
	242	module_exit(xt_nat_exit);
	243
	244	MODULE_LICENSE("GPL");
58a317f1	245	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
c7232c99 PM	246	MODULE_ALIAS("ipt_SNAT");
c7232c99 PM	247	MODULE_ALIAS("ipt_DNAT");
58a317f1 PM	248	MODULE_ALIAS("ip6t_SNAT");
58a317f1 PM	249	MODULE_ALIAS("ip6t_DNAT");