[linux-2.6-block.git] / net / sched / act_nat.c

/*
 * Stateless NAT actions
 *
 * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the Free
 * Software Foundation; either version 2 of the License, or (at your option)
 * any later version.
 */

#include <linux/errno.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/netfilter.h>
#include <linux/rtnetlink.h>
#include <linux/skbuff.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
#include <linux/string.h>
#include <linux/tc_act/tc_nat.h>
#include <net/act_api.h>
#include <net/icmp.h>
#include <net/ip.h>
#include <net/netlink.h>
#include <net/tc_act/tc_nat.h>
#include <net/tcp.h>
#include <net/udp.h>


static unsigned int nat_net_id;
static struct tc_action_ops act_nat_ops;

static const struct nla_policy nat_policy[TCA_NAT_MAX + 1] = {
	[TCA_NAT_PARMS]	= { .len = sizeof(struct tc_nat) },
};

static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
			struct tc_action **a, int ovr, int bind,
			struct netlink_ext_ack *extack)
{
	struct tc_action_net *tn = net_generic(net, nat_net_id);
	struct nlattr *tb[TCA_NAT_MAX + 1];
	struct tc_nat *parm;
	int ret = 0, err;
	struct tcf_nat *p;

	if (nla == NULL)
		return -EINVAL;

	err = nla_parse_nested(tb, TCA_NAT_MAX, nla, nat_policy, NULL);
	if (err < 0)
		return err;

	if (tb[TCA_NAT_PARMS] == NULL)
		return -EINVAL;
	parm = nla_data(tb[TCA_NAT_PARMS]);

	if (!tcf_idr_check(tn, parm->index, a, bind)) {
		ret = tcf_idr_create(tn, parm->index, est, a,
				     &act_nat_ops, bind, false);
		if (ret)
			return ret;
		ret = ACT_P_CREATED;
	} else {
		if (bind)
			return 0;
		tcf_idr_release(*a, bind);
		if (!ovr)
			return -EEXIST;
	}
	p = to_tcf_nat(*a);

	spin_lock_bh(&p->tcf_lock);
	p->old_addr = parm->old_addr;
	p->new_addr = parm->new_addr;
	p->mask = parm->mask;
	p->flags = parm->flags;

	p->tcf_action = parm->action;
	spin_unlock_bh(&p->tcf_lock);

	if (ret == ACT_P_CREATED)
		tcf_idr_insert(tn, *a);

	return ret;
}

static int tcf_nat(struct sk_buff *skb, const struct tc_action *a,
		   struct tcf_result *res)
{
	struct tcf_nat *p = to_tcf_nat(a);
	struct iphdr *iph;
	__be32 old_addr;
	__be32 new_addr;
	__be32 mask;
	__be32 addr;
	int egress;
	int action;
	int ihl;
	int noff;

	spin_lock(&p->tcf_lock);

	tcf_lastuse_update(&p->tcf_tm);
	old_addr = p->old_addr;
	new_addr = p->new_addr;
	mask = p->mask;
	egress = p->flags & TCA_NAT_FLAG_EGRESS;
	action = p->tcf_action;

	bstats_update(&p->tcf_bstats, skb);

	spin_unlock(&p->tcf_lock);

	if (unlikely(action == TC_ACT_SHOT))
		goto drop;

	noff = skb_network_offset(skb);
	if (!pskb_may_pull(skb, sizeof(*iph) + noff))
		goto drop;

	iph = ip_hdr(skb);

	if (egress)
		addr = iph->saddr;
	else
		addr = iph->daddr;

	if (!((old_addr ^ addr) & mask)) {
		if (skb_try_make_writable(skb, sizeof(*iph) + noff))
			goto drop;

		new_addr &= mask;
		new_addr |= addr & ~mask;

		/* Rewrite IP header */
		iph = ip_hdr(skb);
		if (egress)
			iph->saddr = new_addr;
		else
			iph->daddr = new_addr;

		csum_replace4(&iph->check, addr, new_addr);
	} else if ((iph->frag_off & htons(IP_OFFSET)) ||
		   iph->protocol != IPPROTO_ICMP) {
		goto out;
	}

	ihl = iph->ihl * 4;

	/* It would be nice to share code with stateful NAT. */
	switch (iph->frag_off & htons(IP_OFFSET) ? 0 : iph->protocol) {
	case IPPROTO_TCP:
	{
		struct tcphdr *tcph;

		if (!pskb_may_pull(skb, ihl + sizeof(*tcph) + noff) ||
		    skb_try_make_writable(skb, ihl + sizeof(*tcph) + noff))
			goto drop;

		tcph = (void *)(skb_network_header(skb) + ihl);
		inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr,
					 true);
		break;
	}
	case IPPROTO_UDP:
	{
		struct udphdr *udph;

		if (!pskb_may_pull(skb, ihl + sizeof(*udph) + noff) ||
		    skb_try_make_writable(skb, ihl + sizeof(*udph) + noff))
			goto drop;

		udph = (void *)(skb_network_header(skb) + ihl);
		if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
			inet_proto_csum_replace4(&udph->check, skb, addr,
						 new_addr, true);
			if (!udph->check)
				udph->check = CSUM_MANGLED_0;
		}
		break;
	}
	case IPPROTO_ICMP:
	{
		struct icmphdr *icmph;

		if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + noff))
			goto drop;

		icmph = (void *)(skb_network_header(skb) + ihl);

		if ((icmph->type != ICMP_DEST_UNREACH) &&
		    (icmph->type != ICMP_TIME_EXCEEDED) &&
		    (icmph->type != ICMP_PARAMETERPROB))
			break;

		if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph) +
					noff))
			goto drop;

		icmph = (void *)(skb_network_header(skb) + ihl);
		iph = (void *)(icmph + 1);
		if (egress)
			addr = iph->daddr;
		else
			addr = iph->saddr;

		if ((old_addr ^ addr) & mask)
			break;

		if (skb_try_make_writable(skb, ihl + sizeof(*icmph) +
					  sizeof(*iph) + noff))
			goto drop;

		icmph = (void *)(skb_network_header(skb) + ihl);
		iph = (void *)(icmph + 1);

		new_addr &= mask;
		new_addr |= addr & ~mask;

		/* XXX Fix up the inner checksums. */
		if (egress)
			iph->daddr = new_addr;
		else
			iph->saddr = new_addr;

		inet_proto_csum_replace4(&icmph->checksum, skb, addr, new_addr,
					 false);
		break;
	}
	default:
		break;
	}

out:
	return action;

drop:
	spin_lock(&p->tcf_lock);
	p->tcf_qstats.drops++;
	spin_unlock(&p->tcf_lock);
	return TC_ACT_SHOT;
}

static int tcf_nat_dump(struct sk_buff *skb, struct tc_action *a,
			int bind, int ref)
{
	unsigned char *b = skb_tail_pointer(skb);
	struct tcf_nat *p = to_tcf_nat(a);
	struct tc_nat opt = {
		.old_addr = p->old_addr,
		.new_addr = p->new_addr,
		.mask     = p->mask,
		.flags    = p->flags,

		.index    = p->tcf_index,
		.action   = p->tcf_action,
		.refcnt   = p->tcf_refcnt - ref,
		.bindcnt  = p->tcf_bindcnt - bind,
	};
	struct tcf_t t;

	if (nla_put(skb, TCA_NAT_PARMS, sizeof(opt), &opt))
		goto nla_put_failure;

	tcf_tm_dump(&t, &p->tcf_tm);
	if (nla_put_64bit(skb, TCA_NAT_TM, sizeof(t), &t, TCA_NAT_PAD))
		goto nla_put_failure;

	return skb->len;

nla_put_failure:
	nlmsg_trim(skb, b);
	return -1;
}

static int tcf_nat_walker(struct net *net, struct sk_buff *skb,
			  struct netlink_callback *cb, int type,
			  const struct tc_action_ops *ops)
{
	struct tc_action_net *tn = net_generic(net, nat_net_id);

	return tcf_generic_walker(tn, skb, cb, type, ops);
}

static int tcf_nat_search(struct net *net, struct tc_action **a, u32 index,
			  struct netlink_ext_ack *extack)
{
	struct tc_action_net *tn = net_generic(net, nat_net_id);

	return tcf_idr_search(tn, a, index);
}

static struct tc_action_ops act_nat_ops = {
	.kind		=	"nat",
	.type		=	TCA_ACT_NAT,
	.owner		=	THIS_MODULE,
	.act		=	tcf_nat,
	.dump		=	tcf_nat_dump,
	.init		=	tcf_nat_init,
	.walk		=	tcf_nat_walker,
	.lookup		=	tcf_nat_search,
	.size		=	sizeof(struct tcf_nat),
};

static __net_init int nat_init_net(struct net *net)
{
	struct tc_action_net *tn = net_generic(net, nat_net_id);

	return tc_action_net_init(tn, &act_nat_ops);
}

static void __net_exit nat_exit_net(struct list_head *net_list)
{
	tc_action_net_exit(net_list, nat_net_id);
}

static struct pernet_operations nat_net_ops = {
	.init = nat_init_net,
	.exit_batch = nat_exit_net,
	.id   = &nat_net_id,
	.size = sizeof(struct tc_action_net),
};

MODULE_DESCRIPTION("Stateless NAT actions");
MODULE_LICENSE("GPL");

static int __init nat_init_module(void)
{
	return tcf_register_action(&act_nat_ops, &nat_net_ops);
}

static void __exit nat_cleanup_module(void)
{
	tcf_unregister_action(&act_nat_ops, &nat_net_ops);
}

module_init(nat_init_module);
module_exit(nat_cleanup_module);
Commit	Line	Data
b4219952 HX	1	/*
	2	* Stateless NAT actions
	3	*
	4	* Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>
	5	*
	6	* This program is free software; you can redistribute it and/or modify it
	7	* under the terms of the GNU General Public License as published by the Free
	8	* Software Foundation; either version 2 of the License, or (at your option)
	9	* any later version.
	10	*/
	11
	12	#include <linux/errno.h>
	13	#include <linux/init.h>
	14	#include <linux/kernel.h>
	15	#include <linux/module.h>
	16	#include <linux/netfilter.h>
	17	#include <linux/rtnetlink.h>
	18	#include <linux/skbuff.h>
	19	#include <linux/slab.h>
	20	#include <linux/spinlock.h>
	21	#include <linux/string.h>
	22	#include <linux/tc_act/tc_nat.h>
	23	#include <net/act_api.h>
	24	#include <net/icmp.h>
	25	#include <net/ip.h>
	26	#include <net/netlink.h>
	27	#include <net/tc_act/tc_nat.h>
	28	#include <net/tcp.h>
	29	#include <net/udp.h>
	30
	31
c7d03a00	32	static unsigned int nat_net_id;
a85a970a	33	static struct tc_action_ops act_nat_ops;
ddf97ccd	34
53b2bf3f PM	35	static const struct nla_policy nat_policy[TCA_NAT_MAX + 1] = {
	36	[TCA_NAT_PARMS] = { .len = sizeof(struct tc_nat) },
	37	};
	38
c1b52739	39	static int tcf_nat_init(struct net net, struct nlattr nla, struct nlattr *est,
589dad6d AA	40	struct tc_action **a, int ovr, int bind,
589dad6d AA	41	struct netlink_ext_ack *extack)
b4219952	42	{
ddf97ccd	43	struct tc_action_net *tn = net_generic(net, nat_net_id);
7ba699c6	44	struct nlattr *tb[TCA_NAT_MAX + 1];
b4219952	45	struct tc_nat *parm;
cee63723	46	int ret = 0, err;
b4219952	47	struct tcf_nat *p;
b4219952	48
cee63723	49	if (nla == NULL)
b4219952 HX	50	return -EINVAL;
b4219952 HX	51
fceb6435	52	err = nla_parse_nested(tb, TCA_NAT_MAX, nla, nat_policy, NULL);
cee63723 PM	53	if (err < 0)
	54	return err;
	55
53b2bf3f	56	if (tb[TCA_NAT_PARMS] == NULL)
b4219952	57	return -EINVAL;
7ba699c6	58	parm = nla_data(tb[TCA_NAT_PARMS]);
b4219952	59
65a206c0 CM	60	if (!tcf_idr_check(tn, parm->index, a, bind)) {
	61	ret = tcf_idr_create(tn, parm->index, est, a,
	62	&act_nat_ops, bind, false);
86062033 WC	63	if (ret)
86062033 WC	64	return ret;
b4219952 HX	65	ret = ACT_P_CREATED;
b4219952 HX	66	} else {
1a29321e JHS	67	if (bind)
1a29321e JHS	68	return 0;
65a206c0	69	tcf_idr_release(*a, bind);
1a29321e	70	if (!ovr)
b4219952	71	return -EEXIST;
b4219952	72	}
a85a970a	73	p = to_tcf_nat(*a);
b4219952 HX	74
	75	spin_lock_bh(&p->tcf_lock);
	76	p->old_addr = parm->old_addr;
	77	p->new_addr = parm->new_addr;
	78	p->mask = parm->mask;
	79	p->flags = parm->flags;
	80
	81	p->tcf_action = parm->action;
	82	spin_unlock_bh(&p->tcf_lock);
	83
	84	if (ret == ACT_P_CREATED)
65a206c0	85	tcf_idr_insert(tn, *a);
b4219952 HX	86
	87	return ret;
	88	}
	89
dc7f9f6e	90	static int tcf_nat(struct sk_buff skb, const struct tc_action a,
b4219952 HX	91	struct tcf_result *res)
b4219952 HX	92	{
a85a970a	93	struct tcf_nat *p = to_tcf_nat(a);
b4219952 HX	94	struct iphdr *iph;
	95	__be32 old_addr;
	96	__be32 new_addr;
	97	__be32 mask;
	98	__be32 addr;
	99	int egress;
	100	int action;
	101	int ihl;
36d12690	102	int noff;
b4219952 HX	103
	104	spin_lock(&p->tcf_lock);
	105
9c4a4e48	106	tcf_lastuse_update(&p->tcf_tm);
b4219952 HX	107	old_addr = p->old_addr;
	108	new_addr = p->new_addr;
	109	mask = p->mask;
	110	egress = p->flags & TCA_NAT_FLAG_EGRESS;
	111	action = p->tcf_action;
	112
bfe0d029	113	bstats_update(&p->tcf_bstats, skb);
b4219952 HX	114
	115	spin_unlock(&p->tcf_lock);
	116
	117	if (unlikely(action == TC_ACT_SHOT))
	118	goto drop;
	119
36d12690 CG	120	noff = skb_network_offset(skb);
36d12690 CG	121	if (!pskb_may_pull(skb, sizeof(*iph) + noff))
b4219952 HX	122	goto drop;
	123
	124	iph = ip_hdr(skb);
	125
	126	if (egress)
	127	addr = iph->saddr;
	128	else
	129	addr = iph->daddr;
	130
	131	if (!((old_addr ^ addr) & mask)) {
3697649f	132	if (skb_try_make_writable(skb, sizeof(*iph) + noff))
b4219952 HX	133	goto drop;
	134
	135	new_addr &= mask;
	136	new_addr \|= addr & ~mask;
	137
	138	/* Rewrite IP header */
	139	iph = ip_hdr(skb);
	140	if (egress)
	141	iph->saddr = new_addr;
	142	else
	143	iph->daddr = new_addr;
	144
be0ea7d5	145	csum_replace4(&iph->check, addr, new_addr);
33c29dde CG	146	} else if ((iph->frag_off & htons(IP_OFFSET)) \|\|
	147	iph->protocol != IPPROTO_ICMP) {
	148	goto out;
b4219952 HX	149	}
	150
	151	ihl = iph->ihl * 4;
	152
	153	/* It would be nice to share code with stateful NAT. */
	154	switch (iph->frag_off & htons(IP_OFFSET) ? 0 : iph->protocol) {
	155	case IPPROTO_TCP:
	156	{
	157	struct tcphdr *tcph;
	158
36d12690	159	if (!pskb_may_pull(skb, ihl + sizeof(*tcph) + noff) \|\|
3697649f	160	skb_try_make_writable(skb, ihl + sizeof(*tcph) + noff))
b4219952 HX	161	goto drop;
	162
	163	tcph = (void *)(skb_network_header(skb) + ihl);
4b048d6d TH	164	inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr,
4b048d6d TH	165	true);
b4219952 HX	166	break;
	167	}
	168	case IPPROTO_UDP:
	169	{
	170	struct udphdr *udph;
	171
36d12690	172	if (!pskb_may_pull(skb, ihl + sizeof(*udph) + noff) \|\|
3697649f	173	skb_try_make_writable(skb, ihl + sizeof(*udph) + noff))
b4219952 HX	174	goto drop;
	175
	176	udph = (void *)(skb_network_header(skb) + ihl);
	177	if (udph->check \|\| skb->ip_summed == CHECKSUM_PARTIAL) {
be0ea7d5	178	inet_proto_csum_replace4(&udph->check, skb, addr,
4b048d6d	179	new_addr, true);
b4219952 HX	180	if (!udph->check)
	181	udph->check = CSUM_MANGLED_0;
	182	}
	183	break;
	184	}
	185	case IPPROTO_ICMP:
	186	{
	187	struct icmphdr *icmph;
	188
36d12690	189	if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + noff))
b4219952 HX	190	goto drop;
	191
	192	icmph = (void *)(skb_network_header(skb) + ihl);
	193
	194	if ((icmph->type != ICMP_DEST_UNREACH) &&
	195	(icmph->type != ICMP_TIME_EXCEEDED) &&
	196	(icmph->type != ICMP_PARAMETERPROB))
	197	break;
	198
36d12690 CG	199	if (!pskb_may_pull(skb, ihl + sizeof(icmph) + sizeof(iph) +
36d12690 CG	200	noff))
70c2efa5 CG	201	goto drop;
70c2efa5 CG	202
072d79a3	203	icmph = (void *)(skb_network_header(skb) + ihl);
b4219952 HX	204	iph = (void *)(icmph + 1);
	205	if (egress)
	206	addr = iph->daddr;
	207	else
	208	addr = iph->saddr;
	209
	210	if ((old_addr ^ addr) & mask)
	211	break;
	212
3697649f DB	213	if (skb_try_make_writable(skb, ihl + sizeof(*icmph) +
3697649f DB	214	sizeof(*iph) + noff))
b4219952 HX	215	goto drop;
	216
	217	icmph = (void *)(skb_network_header(skb) + ihl);
	218	iph = (void *)(icmph + 1);
	219
	220	new_addr &= mask;
	221	new_addr \|= addr & ~mask;
	222
	223	/* XXX Fix up the inner checksums. */
	224	if (egress)
	225	iph->daddr = new_addr;
	226	else
	227	iph->saddr = new_addr;
	228
be0ea7d5	229	inet_proto_csum_replace4(&icmph->checksum, skb, addr, new_addr,
4b048d6d	230	false);
b4219952 HX	231	break;
	232	}
	233	default:
	234	break;
	235	}
	236
33c29dde	237	out:
b4219952 HX	238	return action;
	239
	240	drop:
	241	spin_lock(&p->tcf_lock);
	242	p->tcf_qstats.drops++;
	243	spin_unlock(&p->tcf_lock);
	244	return TC_ACT_SHOT;
	245	}
	246
	247	static int tcf_nat_dump(struct sk_buff skb, struct tc_action a,
	248	int bind, int ref)
	249	{
	250	unsigned char *b = skb_tail_pointer(skb);
a85a970a	251	struct tcf_nat *p = to_tcf_nat(a);
1c40be12 ED	252	struct tc_nat opt = {
	253	.old_addr = p->old_addr,
	254	.new_addr = p->new_addr,
	255	.mask = p->mask,
	256	.flags = p->flags,
	257
	258	.index = p->tcf_index,
	259	.action = p->tcf_action,
	260	.refcnt = p->tcf_refcnt - ref,
	261	.bindcnt = p->tcf_bindcnt - bind,
	262	};
b4219952	263	struct tcf_t t;
b4219952	264
1b34ec43 DM	265	if (nla_put(skb, TCA_NAT_PARMS, sizeof(opt), &opt))
1b34ec43 DM	266	goto nla_put_failure;
48d8ee16 JHS	267
48d8ee16 JHS	268	tcf_tm_dump(&t, &p->tcf_tm);
9854518e	269	if (nla_put_64bit(skb, TCA_NAT_TM, sizeof(t), &t, TCA_NAT_PAD))
1b34ec43	270	goto nla_put_failure;
b4219952	271
b4219952 HX	272	return skb->len;
b4219952 HX	273
7ba699c6	274	nla_put_failure:
b4219952	275	nlmsg_trim(skb, b);
b4219952 HX	276	return -1;
	277	}
	278
ddf97ccd WC	279	static int tcf_nat_walker(struct net net, struct sk_buff skb,
ddf97ccd WC	280	struct netlink_callback *cb, int type,
a85a970a	281	const struct tc_action_ops *ops)
ddf97ccd WC	282	{
	283	struct tc_action_net *tn = net_generic(net, nat_net_id);
	284
a85a970a	285	return tcf_generic_walker(tn, skb, cb, type, ops);
ddf97ccd WC	286	}
ddf97ccd WC	287
331a9295 AA	288	static int tcf_nat_search(struct net net, struct tc_action *a, u32 index,
331a9295 AA	289	struct netlink_ext_ack *extack)
ddf97ccd WC	290	{
	291	struct tc_action_net *tn = net_generic(net, nat_net_id);
	292
65a206c0	293	return tcf_idr_search(tn, a, index);
ddf97ccd WC	294	}
ddf97ccd WC	295
b4219952 HX	296	static struct tc_action_ops act_nat_ops = {
b4219952 HX	297	.kind = "nat",
b4219952	298	.type = TCA_ACT_NAT,
b4219952 HX	299	.owner = THIS_MODULE,
	300	.act = tcf_nat,
	301	.dump = tcf_nat_dump,
b4219952	302	.init = tcf_nat_init,
ddf97ccd WC	303	.walk = tcf_nat_walker,
ddf97ccd WC	304	.lookup = tcf_nat_search,
a85a970a	305	.size = sizeof(struct tcf_nat),
ddf97ccd WC	306	};
	307
	308	static __net_init int nat_init_net(struct net *net)
	309	{
	310	struct tc_action_net *tn = net_generic(net, nat_net_id);
	311
c7e460ce	312	return tc_action_net_init(tn, &act_nat_ops);
ddf97ccd WC	313	}
ddf97ccd WC	314
039af9c6	315	static void __net_exit nat_exit_net(struct list_head *net_list)
ddf97ccd	316	{
039af9c6	317	tc_action_net_exit(net_list, nat_net_id);
ddf97ccd WC	318	}
	319
	320	static struct pernet_operations nat_net_ops = {
	321	.init = nat_init_net,
039af9c6	322	.exit_batch = nat_exit_net,
ddf97ccd WC	323	.id = &nat_net_id,
ddf97ccd WC	324	.size = sizeof(struct tc_action_net),
b4219952 HX	325	};
	326
	327	MODULE_DESCRIPTION("Stateless NAT actions");
	328	MODULE_LICENSE("GPL");
	329
	330	static int __init nat_init_module(void)
	331	{
ddf97ccd	332	return tcf_register_action(&act_nat_ops, &nat_net_ops);
b4219952 HX	333	}
	334
	335	static void __exit nat_cleanup_module(void)
	336	{
ddf97ccd	337	tcf_unregister_action(&act_nat_ops, &nat_net_ops);
b4219952 HX	338	}
	339
	340	module_init(nat_init_module);
	341	module_exit(nat_cleanup_module);