[linux-block.git] / net / netfilter / xt_nat.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
 * (C) 2011 Patrick McHardy <kaber@trash.net>
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/netfilter.h>
#include <linux/netfilter/x_tables.h>
#include <net/netfilter/nf_nat.h>

static int xt_nat_checkentry_v0(const struct xt_tgchk_param *par)
{
	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;

	if (mr->rangesize != 1) {
		pr_info_ratelimited("multiple ranges no longer supported\n");
		return -EINVAL;
	}
	return nf_ct_netns_get(par->net, par->family);
}

static int xt_nat_checkentry(const struct xt_tgchk_param *par)
{
	return nf_ct_netns_get(par->net, par->family);
}

static void xt_nat_destroy(const struct xt_tgdtor_param *par)
{
	nf_ct_netns_put(par->net, par->family);
}

static void xt_nat_convert_range(struct nf_nat_range2 *dst,
				 const struct nf_nat_ipv4_range *src)
{
	memset(&dst->min_addr, 0, sizeof(dst->min_addr));
	memset(&dst->max_addr, 0, sizeof(dst->max_addr));
	memset(&dst->base_proto, 0, sizeof(dst->base_proto));

	dst->flags	 = src->flags;
	dst->min_addr.ip = src->min_ip;
	dst->max_addr.ip = src->max_ip;
	dst->min_proto	 = src->min;
	dst->max_proto	 = src->max;
}

static unsigned int
xt_snat_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
	struct nf_nat_range2 range;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
		  ctinfo == IP_CT_RELATED_REPLY)));

	xt_nat_convert_range(&range, &mr->range[0]);
	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
}

static unsigned int
xt_dnat_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
	struct nf_nat_range2 range;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED)));

	xt_nat_convert_range(&range, &mr->range[0]);
	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
}

static unsigned int
xt_snat_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_range *range_v1 = par->targinfo;
	struct nf_nat_range2 range;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
		  ctinfo == IP_CT_RELATED_REPLY)));

	memcpy(&range, range_v1, sizeof(*range_v1));
	memset(&range.base_proto, 0, sizeof(range.base_proto));

	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
}

static unsigned int
xt_dnat_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_range *range_v1 = par->targinfo;
	struct nf_nat_range2 range;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED)));

	memcpy(&range, range_v1, sizeof(*range_v1));
	memset(&range.base_proto, 0, sizeof(range.base_proto));

	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
}

static unsigned int
xt_snat_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_range2 *range = par->targinfo;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
		  ctinfo == IP_CT_RELATED_REPLY)));

	return nf_nat_setup_info(ct, range, NF_NAT_MANIP_SRC);
}

static unsigned int
xt_dnat_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct nf_nat_range2 *range = par->targinfo;
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	WARN_ON(!(ct != NULL &&
		 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED)));

	return nf_nat_setup_info(ct, range, NF_NAT_MANIP_DST);
}

static struct xt_target xt_nat_target_reg[] __read_mostly = {
	{
		.name		= "SNAT",
		.revision	= 0,
		.checkentry	= xt_nat_checkentry_v0,
		.destroy	= xt_nat_destroy,
		.target		= xt_snat_target_v0,
		.targetsize	= sizeof(struct nf_nat_ipv4_multi_range_compat),
		.family		= NFPROTO_IPV4,
		.table		= "nat",
		.hooks		= (1 << NF_INET_POST_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
	{
		.name		= "DNAT",
		.revision	= 0,
		.checkentry	= xt_nat_checkentry_v0,
		.destroy	= xt_nat_destroy,
		.target		= xt_dnat_target_v0,
		.targetsize	= sizeof(struct nf_nat_ipv4_multi_range_compat),
		.family		= NFPROTO_IPV4,
		.table		= "nat",
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_OUT),
		.me		= THIS_MODULE,
	},
	{
		.name		= "SNAT",
		.revision	= 1,
		.checkentry	= xt_nat_checkentry,
		.destroy	= xt_nat_destroy,
		.target		= xt_snat_target_v1,
		.targetsize	= sizeof(struct nf_nat_range),
		.table		= "nat",
		.hooks		= (1 << NF_INET_POST_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
	{
		.name		= "DNAT",
		.revision	= 1,
		.checkentry	= xt_nat_checkentry,
		.destroy	= xt_nat_destroy,
		.target		= xt_dnat_target_v1,
		.targetsize	= sizeof(struct nf_nat_range),
		.table		= "nat",
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_OUT),
		.me		= THIS_MODULE,
	},
	{
		.name		= "SNAT",
		.revision	= 2,
		.checkentry	= xt_nat_checkentry,
		.destroy	= xt_nat_destroy,
		.target		= xt_snat_target_v2,
		.targetsize	= sizeof(struct nf_nat_range2),
		.table		= "nat",
		.hooks		= (1 << NF_INET_POST_ROUTING) |
				  (1 << NF_INET_LOCAL_IN),
		.me		= THIS_MODULE,
	},
	{
		.name		= "DNAT",
		.revision	= 2,
		.checkentry	= xt_nat_checkentry,
		.destroy	= xt_nat_destroy,
		.target		= xt_dnat_target_v2,
		.targetsize	= sizeof(struct nf_nat_range2),
		.table		= "nat",
		.hooks		= (1 << NF_INET_PRE_ROUTING) |
				  (1 << NF_INET_LOCAL_OUT),
		.me		= THIS_MODULE,
	},
};

static int __init xt_nat_init(void)
{
	return xt_register_targets(xt_nat_target_reg,
				   ARRAY_SIZE(xt_nat_target_reg));
}

static void __exit xt_nat_exit(void)
{
	xt_unregister_targets(xt_nat_target_reg, ARRAY_SIZE(xt_nat_target_reg));
}

module_init(xt_nat_init);
module_exit(xt_nat_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_ALIAS("ipt_SNAT");
MODULE_ALIAS("ipt_DNAT");
MODULE_ALIAS("ip6t_SNAT");
MODULE_ALIAS("ip6t_DNAT");
MODULE_DESCRIPTION("SNAT and DNAT targets support");
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
c7232c99 PM	2	/*
	3	* (C) 1999-2001 Paul `Rusty' Russell
	4	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
	5	* (C) 2011 Patrick McHardy <kaber@trash.net>
c7232c99 PM	6	*/
c7232c99 PM	7
b2606644 FW	8	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
b2606644 FW	9
c7232c99 PM	10	#include <linux/module.h>
	11	#include <linux/skbuff.h>
	12	#include <linux/netfilter.h>
	13	#include <linux/netfilter/x_tables.h>
d2c5c103	14	#include <net/netfilter/nf_nat.h>
c7232c99 PM	15
	16	static int xt_nat_checkentry_v0(const struct xt_tgchk_param *par)
	17	{
	18	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
	19
	20	if (mr->rangesize != 1) {
b2606644	21	pr_info_ratelimited("multiple ranges no longer supported\n");
c7232c99 PM	22	return -EINVAL;
c7232c99 PM	23	}
a357b3f8 FW	24	return nf_ct_netns_get(par->net, par->family);
	25	}
	26
	27	static int xt_nat_checkentry(const struct xt_tgchk_param *par)
	28	{
	29	return nf_ct_netns_get(par->net, par->family);
	30	}
	31
	32	static void xt_nat_destroy(const struct xt_tgdtor_param *par)
	33	{
	34	nf_ct_netns_put(par->net, par->family);
c7232c99 PM	35	}
c7232c99 PM	36
2eb0f624	37	static void xt_nat_convert_range(struct nf_nat_range2 *dst,
c7232c99 PM	38	const struct nf_nat_ipv4_range *src)
	39	{
	40	memset(&dst->min_addr, 0, sizeof(dst->min_addr));
	41	memset(&dst->max_addr, 0, sizeof(dst->max_addr));
2eb0f624	42	memset(&dst->base_proto, 0, sizeof(dst->base_proto));
c7232c99 PM	43
	44	dst->flags = src->flags;
	45	dst->min_addr.ip = src->min_ip;
	46	dst->max_addr.ip = src->max_ip;
	47	dst->min_proto = src->min;
	48	dst->max_proto = src->max;
	49	}
	50
	51	static unsigned int
	52	xt_snat_target_v0(struct sk_buff skb, const struct xt_action_param par)
	53	{
	54	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
2eb0f624	55	struct nf_nat_range2 range;
c7232c99 PM	56	enum ip_conntrack_info ctinfo;
	57	struct nf_conn *ct;
	58
	59	ct = nf_ct_get(skb, &ctinfo);
44d6e2f2 VR	60	WARN_ON(!(ct != NULL &&
	61	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED \|\|
	62	ctinfo == IP_CT_RELATED_REPLY)));
c7232c99 PM	63
	64	xt_nat_convert_range(&range, &mr->range[0]);
	65	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
	66	}
	67
	68	static unsigned int
	69	xt_dnat_target_v0(struct sk_buff skb, const struct xt_action_param par)
	70	{
	71	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
2eb0f624	72	struct nf_nat_range2 range;
c7232c99 PM	73	enum ip_conntrack_info ctinfo;
	74	struct nf_conn *ct;
	75
	76	ct = nf_ct_get(skb, &ctinfo);
44d6e2f2 VR	77	WARN_ON(!(ct != NULL &&
44d6e2f2 VR	78	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED)));
c7232c99 PM	79
	80	xt_nat_convert_range(&range, &mr->range[0]);
	81	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
	82	}
	83
	84	static unsigned int
	85	xt_snat_target_v1(struct sk_buff skb, const struct xt_action_param par)
	86	{
2eb0f624 TDT	87	const struct nf_nat_range *range_v1 = par->targinfo;
2eb0f624 TDT	88	struct nf_nat_range2 range;
c7232c99 PM	89	enum ip_conntrack_info ctinfo;
	90	struct nf_conn *ct;
	91
	92	ct = nf_ct_get(skb, &ctinfo);
44d6e2f2 VR	93	WARN_ON(!(ct != NULL &&
	94	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED \|\|
	95	ctinfo == IP_CT_RELATED_REPLY)));
c7232c99	96
2eb0f624 TDT	97	memcpy(&range, range_v1, sizeof(*range_v1));
	98	memset(&range.base_proto, 0, sizeof(range.base_proto));
	99
	100	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
c7232c99 PM	101	}
	102
	103	static unsigned int
	104	xt_dnat_target_v1(struct sk_buff skb, const struct xt_action_param par)
	105	{
2eb0f624 TDT	106	const struct nf_nat_range *range_v1 = par->targinfo;
	107	struct nf_nat_range2 range;
	108	enum ip_conntrack_info ctinfo;
	109	struct nf_conn *ct;
	110
	111	ct = nf_ct_get(skb, &ctinfo);
	112	WARN_ON(!(ct != NULL &&
	113	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED)));
	114
	115	memcpy(&range, range_v1, sizeof(*range_v1));
	116	memset(&range.base_proto, 0, sizeof(range.base_proto));
	117
	118	return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
	119	}
	120
	121	static unsigned int
	122	xt_snat_target_v2(struct sk_buff skb, const struct xt_action_param par)
	123	{
	124	const struct nf_nat_range2 *range = par->targinfo;
	125	enum ip_conntrack_info ctinfo;
	126	struct nf_conn *ct;
	127
	128	ct = nf_ct_get(skb, &ctinfo);
	129	WARN_ON(!(ct != NULL &&
	130	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED \|\|
	131	ctinfo == IP_CT_RELATED_REPLY)));
	132
	133	return nf_nat_setup_info(ct, range, NF_NAT_MANIP_SRC);
	134	}
	135
	136	static unsigned int
	137	xt_dnat_target_v2(struct sk_buff skb, const struct xt_action_param par)
	138	{
	139	const struct nf_nat_range2 *range = par->targinfo;
c7232c99 PM	140	enum ip_conntrack_info ctinfo;
	141	struct nf_conn *ct;
	142
	143	ct = nf_ct_get(skb, &ctinfo);
44d6e2f2 VR	144	WARN_ON(!(ct != NULL &&
44d6e2f2 VR	145	(ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED)));
c7232c99 PM	146
	147	return nf_nat_setup_info(ct, range, NF_NAT_MANIP_DST);
	148	}
	149
	150	static struct xt_target xt_nat_target_reg[] __read_mostly = {
	151	{
	152	.name = "SNAT",
	153	.revision = 0,
	154	.checkentry = xt_nat_checkentry_v0,
a357b3f8	155	.destroy = xt_nat_destroy,
c7232c99 PM	156	.target = xt_snat_target_v0,
	157	.targetsize = sizeof(struct nf_nat_ipv4_multi_range_compat),
	158	.family = NFPROTO_IPV4,
	159	.table = "nat",
	160	.hooks = (1 << NF_INET_POST_ROUTING) \|
939ccba4	161	(1 << NF_INET_LOCAL_IN),
c7232c99 PM	162	.me = THIS_MODULE,
	163	},
	164	{
	165	.name = "DNAT",
	166	.revision = 0,
	167	.checkentry = xt_nat_checkentry_v0,
a357b3f8	168	.destroy = xt_nat_destroy,
c7232c99 PM	169	.target = xt_dnat_target_v0,
	170	.targetsize = sizeof(struct nf_nat_ipv4_multi_range_compat),
	171	.family = NFPROTO_IPV4,
	172	.table = "nat",
	173	.hooks = (1 << NF_INET_PRE_ROUTING) \|
939ccba4	174	(1 << NF_INET_LOCAL_OUT),
c7232c99 PM	175	.me = THIS_MODULE,
	176	},
	177	{
	178	.name = "SNAT",
	179	.revision = 1,
a357b3f8 FW	180	.checkentry = xt_nat_checkentry,
a357b3f8 FW	181	.destroy = xt_nat_destroy,
c7232c99 PM	182	.target = xt_snat_target_v1,
	183	.targetsize = sizeof(struct nf_nat_range),
	184	.table = "nat",
	185	.hooks = (1 << NF_INET_POST_ROUTING) \|
939ccba4	186	(1 << NF_INET_LOCAL_IN),
c7232c99 PM	187	.me = THIS_MODULE,
	188	},
	189	{
	190	.name = "DNAT",
	191	.revision = 1,
a357b3f8 FW	192	.checkentry = xt_nat_checkentry,
a357b3f8 FW	193	.destroy = xt_nat_destroy,
c7232c99 PM	194	.target = xt_dnat_target_v1,
	195	.targetsize = sizeof(struct nf_nat_range),
	196	.table = "nat",
	197	.hooks = (1 << NF_INET_PRE_ROUTING) \|
939ccba4	198	(1 << NF_INET_LOCAL_OUT),
c7232c99 PM	199	.me = THIS_MODULE,
c7232c99 PM	200	},
2eb0f624 TDT	201	{
	202	.name = "SNAT",
	203	.revision = 2,
	204	.checkentry = xt_nat_checkentry,
	205	.destroy = xt_nat_destroy,
	206	.target = xt_snat_target_v2,
	207	.targetsize = sizeof(struct nf_nat_range2),
	208	.table = "nat",
	209	.hooks = (1 << NF_INET_POST_ROUTING) \|
	210	(1 << NF_INET_LOCAL_IN),
	211	.me = THIS_MODULE,
	212	},
	213	{
	214	.name = "DNAT",
	215	.revision = 2,
cb20f2d2 PA	216	.checkentry = xt_nat_checkentry,
cb20f2d2 PA	217	.destroy = xt_nat_destroy,
2eb0f624 TDT	218	.target = xt_dnat_target_v2,
	219	.targetsize = sizeof(struct nf_nat_range2),
	220	.table = "nat",
	221	.hooks = (1 << NF_INET_PRE_ROUTING) \|
	222	(1 << NF_INET_LOCAL_OUT),
	223	.me = THIS_MODULE,
	224	},
c7232c99 PM	225	};
	226
	227	static int __init xt_nat_init(void)
	228	{
	229	return xt_register_targets(xt_nat_target_reg,
	230	ARRAY_SIZE(xt_nat_target_reg));
	231	}
	232
	233	static void __exit xt_nat_exit(void)
	234	{
	235	xt_unregister_targets(xt_nat_target_reg, ARRAY_SIZE(xt_nat_target_reg));
	236	}
	237
	238	module_init(xt_nat_init);
	239	module_exit(xt_nat_exit);
	240
	241	MODULE_LICENSE("GPL");
58a317f1	242	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
c7232c99 PM	243	MODULE_ALIAS("ipt_SNAT");
c7232c99 PM	244	MODULE_ALIAS("ipt_DNAT");
58a317f1 PM	245	MODULE_ALIAS("ip6t_SNAT");
58a317f1 PM	246	MODULE_ALIAS("ip6t_DNAT");
4cacc395	247	MODULE_DESCRIPTION("SNAT and DNAT targets support");