net/netfilter/nf_nat_ovs.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /* Support nat functions for openvswitch and used by OVS and TC conntrack. */
   3
   4 #include <net/netfilter/nf_nat.h>
   5
   6 /* Modelled after nf_nat_ipv[46]_fn().
   7  * range is only used for new, uninitialized NAT state.
   8  * Returns either NF_ACCEPT or NF_DROP.
   9  */
  10 static int nf_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
  11                              enum ip_conntrack_info ctinfo, int *action,
  12                              const struct nf_nat_range2 *range,
  13                              enum nf_nat_manip_type maniptype)
  14 {
  15         __be16 proto = skb_protocol(skb, true);
  16         int hooknum, err = NF_ACCEPT;
  17
  18         /* See HOOK2MANIP(). */
  19         if (maniptype == NF_NAT_MANIP_SRC)
  20                 hooknum = NF_INET_LOCAL_IN; /* Source NAT */
  21         else
  22                 hooknum = NF_INET_LOCAL_OUT; /* Destination NAT */
  23
  24         switch (ctinfo) {
  25         case IP_CT_RELATED:
  26         case IP_CT_RELATED_REPLY:
  27                 if (proto == htons(ETH_P_IP) &&
  28                     ip_hdr(skb)->protocol == IPPROTO_ICMP) {
  29                         if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
  30                                                            hooknum))
  31                                 err = NF_DROP;
  32                         goto out;
  33                 } else if (IS_ENABLED(CONFIG_IPV6) && proto == htons(ETH_P_IPV6)) {
  34                         __be16 frag_off;
  35                         u8 nexthdr = ipv6_hdr(skb)->nexthdr;
  36                         int hdrlen = ipv6_skip_exthdr(skb,
  37                                                       sizeof(struct ipv6hdr),
  38                                                       &nexthdr, &frag_off);
  39
  40                         if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
  41                                 if (!nf_nat_icmpv6_reply_translation(skb, ct,
  42                                                                      ctinfo,
  43                                                                      hooknum,
  44                                                                      hdrlen))
  45                                         err = NF_DROP;
  46                                 goto out;
  47                         }
  48                 }
  49                 /* Non-ICMP, fall thru to initialize if needed. */
  50                 fallthrough;
  51         case IP_CT_NEW:
  52                 /* Seen it before?  This can happen for loopback, retrans,
  53                  * or local packets.
  54                  */
  55                 if (!nf_nat_initialized(ct, maniptype)) {
  56                         /* Initialize according to the NAT action. */
  57                         err = (range && range->flags & NF_NAT_RANGE_MAP_IPS)
  58                                 /* Action is set up to establish a new
  59                                  * mapping.
  60                                  */
  61                                 ? nf_nat_setup_info(ct, range, maniptype)
  62                                 : nf_nat_alloc_null_binding(ct, hooknum);
  63                         if (err != NF_ACCEPT)
  64                                 goto out;
  65                 }
  66                 break;
  67
  68         case IP_CT_ESTABLISHED:
  69         case IP_CT_ESTABLISHED_REPLY:
  70                 break;
  71
  72         default:
  73                 err = NF_DROP;
  74                 goto out;
  75         }
  76
  77         err = nf_nat_packet(ct, ctinfo, hooknum, skb);
  78 out:
  79         if (err == NF_ACCEPT)
  80                 *action |= BIT(maniptype);
  81
  82         return err;
  83 }
  84
  85 int nf_ct_nat(struct sk_buff *skb, struct nf_conn *ct,
  86               enum ip_conntrack_info ctinfo, int *action,
  87               const struct nf_nat_range2 *range, bool commit)
  88 {
  89         enum nf_nat_manip_type maniptype;
  90         int err, ct_action = *action;
  91
  92         *action = 0;
  93
  94         /* Add NAT extension if not confirmed yet. */
  95         if (!nf_ct_is_confirmed(ct) && !nf_ct_nat_ext_add(ct))
  96                 return NF_DROP;   /* Can't NAT. */
  97
  98         if (ctinfo != IP_CT_NEW && (ct->status & IPS_NAT_MASK) &&
  99             (ctinfo != IP_CT_RELATED || commit)) {
 100                 /* NAT an established or related connection like before. */
 101                 if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY)
 102                         /* This is the REPLY direction for a connection
 103                          * for which NAT was applied in the forward
 104                          * direction.  Do the reverse NAT.
 105                          */
 106                         maniptype = ct->status & IPS_SRC_NAT
 107                                 ? NF_NAT_MANIP_DST : NF_NAT_MANIP_SRC;
 108                 else
 109                         maniptype = ct->status & IPS_SRC_NAT
 110                                 ? NF_NAT_MANIP_SRC : NF_NAT_MANIP_DST;
 111         } else if (ct_action & BIT(NF_NAT_MANIP_SRC)) {
 112                 maniptype = NF_NAT_MANIP_SRC;
 113         } else if (ct_action & BIT(NF_NAT_MANIP_DST)) {
 114                 maniptype = NF_NAT_MANIP_DST;
 115         } else {
 116                 return NF_ACCEPT;
 117         }
 118
 119         err = nf_ct_nat_execute(skb, ct, ctinfo, action, range, maniptype);
 120         if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
 121                 if (ct->status & IPS_SRC_NAT) {
 122                         if (maniptype == NF_NAT_MANIP_SRC)
 123                                 maniptype = NF_NAT_MANIP_DST;
 124                         else
 125                                 maniptype = NF_NAT_MANIP_SRC;
 126
 127                         err = nf_ct_nat_execute(skb, ct, ctinfo, action, range,
 128                                                 maniptype);
 129                 } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
 130                         err = nf_ct_nat_execute(skb, ct, ctinfo, action, NULL,
 131                                                 NF_NAT_MANIP_SRC);
 132                 }
 133         }
 134         return err;
 135 }
 136 EXPORT_SYMBOL_GPL(nf_ct_nat);