[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / sched / act_nat.c

/*
 * Stateless NAT actions
 *
 * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the Free
 * Software Foundation; either version 2 of the License, or (at your option)
 * any later version.
 */

#include <linux/errno.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/netfilter.h>
#include <linux/rtnetlink.h>
#include <linux/skbuff.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
#include <linux/string.h>
#include <linux/tc_act/tc_nat.h>
#include <net/act_api.h>
#include <net/icmp.h>
#include <net/ip.h>
#include <net/netlink.h>
#include <net/tc_act/tc_nat.h>
#include <net/tcp.h>
#include <net/udp.h>


#define NAT_TAB_MASK	15
static struct tcf_common *tcf_nat_ht[NAT_TAB_MASK + 1];
static u32 nat_idx_gen;
static DEFINE_RWLOCK(nat_lock);

static struct tcf_hashinfo nat_hash_info = {
	.htab	=	tcf_nat_ht,
	.hmask	=	NAT_TAB_MASK,
	.lock	=	&nat_lock,
};

static const struct nla_policy nat_policy[TCA_NAT_MAX + 1] = {
	[TCA_NAT_PARMS]	= { .len = sizeof(struct tc_nat) },
};

static int tcf_nat_init(struct nlattr *nla, struct nlattr *est,
			struct tc_action *a, int ovr, int bind)
{
	struct nlattr *tb[TCA_NAT_MAX + 1];
	struct tc_nat *parm;
	int ret = 0, err;
	struct tcf_nat *p;
	struct tcf_common *pc;

	if (nla == NULL)
		return -EINVAL;

	err = nla_parse_nested(tb, TCA_NAT_MAX, nla, nat_policy);
	if (err < 0)
		return err;

	if (tb[TCA_NAT_PARMS] == NULL)
		return -EINVAL;
	parm = nla_data(tb[TCA_NAT_PARMS]);

	pc = tcf_hash_check(parm->index, a, bind, &nat_hash_info);
	if (!pc) {
		pc = tcf_hash_create(parm->index, est, a, sizeof(*p), bind,
				     &nat_idx_gen, &nat_hash_info);
		if (IS_ERR(pc))
		    return PTR_ERR(pc);
		p = to_tcf_nat(pc);
		ret = ACT_P_CREATED;
	} else {
		p = to_tcf_nat(pc);
		if (!ovr) {
			tcf_hash_release(pc, bind, &nat_hash_info);
			return -EEXIST;
		}
	}

	spin_lock_bh(&p->tcf_lock);
	p->old_addr = parm->old_addr;
	p->new_addr = parm->new_addr;
	p->mask = parm->mask;
	p->flags = parm->flags;

	p->tcf_action = parm->action;
	spin_unlock_bh(&p->tcf_lock);

	if (ret == ACT_P_CREATED)
		tcf_hash_insert(pc, &nat_hash_info);

	return ret;
}

static int tcf_nat_cleanup(struct tc_action *a, int bind)
{
	struct tcf_nat *p = a->priv;

	return tcf_hash_release(&p->common, bind, &nat_hash_info);
}

static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
		   struct tcf_result *res)
{
	struct tcf_nat *p = a->priv;
	struct iphdr *iph;
	__be32 old_addr;
	__be32 new_addr;
	__be32 mask;
	__be32 addr;
	int egress;
	int action;
	int ihl;

	spin_lock(&p->tcf_lock);

	p->tcf_tm.lastuse = jiffies;
	old_addr = p->old_addr;
	new_addr = p->new_addr;
	mask = p->mask;
	egress = p->flags & TCA_NAT_FLAG_EGRESS;
	action = p->tcf_action;

	p->tcf_bstats.bytes += qdisc_pkt_len(skb);
	p->tcf_bstats.packets++;

	spin_unlock(&p->tcf_lock);

	if (unlikely(action == TC_ACT_SHOT))
		goto drop;

	if (!pskb_may_pull(skb, sizeof(*iph)))
		goto drop;

	iph = ip_hdr(skb);

	if (egress)
		addr = iph->saddr;
	else
		addr = iph->daddr;

	if (!((old_addr ^ addr) & mask)) {
		if (skb_cloned(skb) &&
		    !skb_clone_writable(skb, sizeof(*iph)) &&
		    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
			goto drop;

		new_addr &= mask;
		new_addr |= addr & ~mask;

		/* Rewrite IP header */
		iph = ip_hdr(skb);
		if (egress)
			iph->saddr = new_addr;
		else
			iph->daddr = new_addr;

		csum_replace4(&iph->check, addr, new_addr);
	} else if ((iph->frag_off & htons(IP_OFFSET)) ||
		   iph->protocol != IPPROTO_ICMP) {
		goto out;
	}

	ihl = iph->ihl * 4;

	/* It would be nice to share code with stateful NAT. */
	switch (iph->frag_off & htons(IP_OFFSET) ? 0 : iph->protocol) {
	case IPPROTO_TCP:
	{
		struct tcphdr *tcph;

		if (!pskb_may_pull(skb, ihl + sizeof(*tcph)) ||
		    (skb_cloned(skb) &&
		     !skb_clone_writable(skb, ihl + sizeof(*tcph)) &&
		     pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
			goto drop;

		tcph = (void *)(skb_network_header(skb) + ihl);
		inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, 1);
		break;
	}
	case IPPROTO_UDP:
	{
		struct udphdr *udph;

		if (!pskb_may_pull(skb, ihl + sizeof(*udph)) ||
		    (skb_cloned(skb) &&
		     !skb_clone_writable(skb, ihl + sizeof(*udph)) &&
		     pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
			goto drop;

		udph = (void *)(skb_network_header(skb) + ihl);
		if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
			inet_proto_csum_replace4(&udph->check, skb, addr,
						 new_addr, 1);
			if (!udph->check)
				udph->check = CSUM_MANGLED_0;
		}
		break;
	}
	case IPPROTO_ICMP:
	{
		struct icmphdr *icmph;

		if (!pskb_may_pull(skb, ihl + sizeof(*icmph)))
			goto drop;

		icmph = (void *)(skb_network_header(skb) + ihl);

		if ((icmph->type != ICMP_DEST_UNREACH) &&
		    (icmph->type != ICMP_TIME_EXCEEDED) &&
		    (icmph->type != ICMP_PARAMETERPROB))
			break;

		if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
			goto drop;

		icmph = (void *)(skb_network_header(skb) + ihl);
		iph = (void *)(icmph + 1);
		if (egress)
			addr = iph->daddr;
		else
			addr = iph->saddr;

		if ((old_addr ^ addr) & mask)
			break;

		if (skb_cloned(skb) &&
		    !skb_clone_writable(skb,
					ihl + sizeof(*icmph) + sizeof(*iph)) &&
		    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
			goto drop;

		icmph = (void *)(skb_network_header(skb) + ihl);
		iph = (void *)(icmph + 1);

		new_addr &= mask;
		new_addr |= addr & ~mask;

		/* XXX Fix up the inner checksums. */
		if (egress)
			iph->daddr = new_addr;
		else
			iph->saddr = new_addr;

		inet_proto_csum_replace4(&icmph->checksum, skb, addr, new_addr,
					 0);
		break;
	}
	default:
		break;
	}

out:
	return action;

drop:
	spin_lock(&p->tcf_lock);
	p->tcf_qstats.drops++;
	spin_unlock(&p->tcf_lock);
	return TC_ACT_SHOT;
}

static int tcf_nat_dump(struct sk_buff *skb, struct tc_action *a,
			int bind, int ref)
{
	unsigned char *b = skb_tail_pointer(skb);
	struct tcf_nat *p = a->priv;
	struct tc_nat opt;
	struct tcf_t t;

	opt.old_addr = p->old_addr;
	opt.new_addr = p->new_addr;
	opt.mask = p->mask;
	opt.flags = p->flags;

	opt.index = p->tcf_index;
	opt.action = p->tcf_action;
	opt.refcnt = p->tcf_refcnt - ref;
	opt.bindcnt = p->tcf_bindcnt - bind;

	NLA_PUT(skb, TCA_NAT_PARMS, sizeof(opt), &opt);
	t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
	t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);
	t.expires = jiffies_to_clock_t(p->tcf_tm.expires);
	NLA_PUT(skb, TCA_NAT_TM, sizeof(t), &t);

	return skb->len;

nla_put_failure:
	nlmsg_trim(skb, b);
	return -1;
}

static struct tc_action_ops act_nat_ops = {
	.kind		=	"nat",
	.hinfo		=	&nat_hash_info,
	.type		=	TCA_ACT_NAT,
	.capab		=	TCA_CAP_NONE,
	.owner		=	THIS_MODULE,
	.act		=	tcf_nat,
	.dump		=	tcf_nat_dump,
	.cleanup	=	tcf_nat_cleanup,
	.lookup		=	tcf_hash_search,
	.init		=	tcf_nat_init,
	.walk		=	tcf_generic_walker
};

MODULE_DESCRIPTION("Stateless NAT actions");
MODULE_LICENSE("GPL");

static int __init nat_init_module(void)
{
	return tcf_register_action(&act_nat_ops);
}

static void __exit nat_cleanup_module(void)
{
	tcf_unregister_action(&act_nat_ops);
}

module_init(nat_init_module);
module_exit(nat_cleanup_module);
Commit	Line	Data
b4219952 HX	1	/*
	2	* Stateless NAT actions
	3	*
	4	* Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>
	5	*
	6	* This program is free software; you can redistribute it and/or modify it
	7	* under the terms of the GNU General Public License as published by the Free
	8	* Software Foundation; either version 2 of the License, or (at your option)
	9	* any later version.
	10	*/
	11
	12	#include <linux/errno.h>
	13	#include <linux/init.h>
	14	#include <linux/kernel.h>
	15	#include <linux/module.h>
	16	#include <linux/netfilter.h>
	17	#include <linux/rtnetlink.h>
	18	#include <linux/skbuff.h>
	19	#include <linux/slab.h>
	20	#include <linux/spinlock.h>
	21	#include <linux/string.h>
	22	#include <linux/tc_act/tc_nat.h>
	23	#include <net/act_api.h>
	24	#include <net/icmp.h>
	25	#include <net/ip.h>
	26	#include <net/netlink.h>
	27	#include <net/tc_act/tc_nat.h>
	28	#include <net/tcp.h>
	29	#include <net/udp.h>
	30
	31
	32	#define NAT_TAB_MASK 15
	33	static struct tcf_common *tcf_nat_ht[NAT_TAB_MASK + 1];
	34	static u32 nat_idx_gen;
	35	static DEFINE_RWLOCK(nat_lock);
	36
	37	static struct tcf_hashinfo nat_hash_info = {
	38	.htab = tcf_nat_ht,
	39	.hmask = NAT_TAB_MASK,
	40	.lock = &nat_lock,
	41	};
	42
53b2bf3f PM	43	static const struct nla_policy nat_policy[TCA_NAT_MAX + 1] = {
	44	[TCA_NAT_PARMS] = { .len = sizeof(struct tc_nat) },
	45	};
	46
7ba699c6	47	static int tcf_nat_init(struct nlattr nla, struct nlattr est,
b4219952 HX	48	struct tc_action *a, int ovr, int bind)
b4219952 HX	49	{
7ba699c6	50	struct nlattr *tb[TCA_NAT_MAX + 1];
b4219952	51	struct tc_nat *parm;
cee63723	52	int ret = 0, err;
b4219952 HX	53	struct tcf_nat *p;
	54	struct tcf_common *pc;
	55
cee63723	56	if (nla == NULL)
b4219952 HX	57	return -EINVAL;
b4219952 HX	58
53b2bf3f	59	err = nla_parse_nested(tb, TCA_NAT_MAX, nla, nat_policy);
cee63723 PM	60	if (err < 0)
	61	return err;
	62
53b2bf3f	63	if (tb[TCA_NAT_PARMS] == NULL)
b4219952	64	return -EINVAL;
7ba699c6	65	parm = nla_data(tb[TCA_NAT_PARMS]);
b4219952 HX	66
	67	pc = tcf_hash_check(parm->index, a, bind, &nat_hash_info);
	68	if (!pc) {
	69	pc = tcf_hash_create(parm->index, est, a, sizeof(*p), bind,
	70	&nat_idx_gen, &nat_hash_info);
0e991ec6 SH	71	if (IS_ERR(pc))
0e991ec6 SH	72	return PTR_ERR(pc);
b4219952 HX	73	p = to_tcf_nat(pc);
	74	ret = ACT_P_CREATED;
	75	} else {
	76	p = to_tcf_nat(pc);
	77	if (!ovr) {
	78	tcf_hash_release(pc, bind, &nat_hash_info);
	79	return -EEXIST;
	80	}
	81	}
	82
	83	spin_lock_bh(&p->tcf_lock);
	84	p->old_addr = parm->old_addr;
	85	p->new_addr = parm->new_addr;
	86	p->mask = parm->mask;
	87	p->flags = parm->flags;
	88
	89	p->tcf_action = parm->action;
	90	spin_unlock_bh(&p->tcf_lock);
	91
	92	if (ret == ACT_P_CREATED)
	93	tcf_hash_insert(pc, &nat_hash_info);
	94
	95	return ret;
	96	}
	97
	98	static int tcf_nat_cleanup(struct tc_action *a, int bind)
	99	{
	100	struct tcf_nat *p = a->priv;
	101
	102	return tcf_hash_release(&p->common, bind, &nat_hash_info);
	103	}
	104
	105	static int tcf_nat(struct sk_buff skb, struct tc_action a,
	106	struct tcf_result *res)
	107	{
	108	struct tcf_nat *p = a->priv;
	109	struct iphdr *iph;
	110	__be32 old_addr;
	111	__be32 new_addr;
	112	__be32 mask;
	113	__be32 addr;
	114	int egress;
	115	int action;
	116	int ihl;
	117
	118	spin_lock(&p->tcf_lock);
	119
	120	p->tcf_tm.lastuse = jiffies;
	121	old_addr = p->old_addr;
	122	new_addr = p->new_addr;
	123	mask = p->mask;
	124	egress = p->flags & TCA_NAT_FLAG_EGRESS;
	125	action = p->tcf_action;
	126
0abf77e5	127	p->tcf_bstats.bytes += qdisc_pkt_len(skb);
b4219952 HX	128	p->tcf_bstats.packets++;
	129
	130	spin_unlock(&p->tcf_lock);
	131
	132	if (unlikely(action == TC_ACT_SHOT))
	133	goto drop;
	134
	135	if (!pskb_may_pull(skb, sizeof(*iph)))
	136	goto drop;
	137
	138	iph = ip_hdr(skb);
	139
	140	if (egress)
	141	addr = iph->saddr;
	142	else
	143	addr = iph->daddr;
	144
	145	if (!((old_addr ^ addr) & mask)) {
	146	if (skb_cloned(skb) &&
	147	!skb_clone_writable(skb, sizeof(*iph)) &&
	148	pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
	149	goto drop;
	150
	151	new_addr &= mask;
	152	new_addr \|= addr & ~mask;
	153
	154	/* Rewrite IP header */
	155	iph = ip_hdr(skb);
	156	if (egress)
	157	iph->saddr = new_addr;
	158	else
	159	iph->daddr = new_addr;
	160
be0ea7d5	161	csum_replace4(&iph->check, addr, new_addr);
33c29dde CG	162	} else if ((iph->frag_off & htons(IP_OFFSET)) \|\|
	163	iph->protocol != IPPROTO_ICMP) {
	164	goto out;
b4219952 HX	165	}
	166
	167	ihl = iph->ihl * 4;
	168
	169	/* It would be nice to share code with stateful NAT. */
	170	switch (iph->frag_off & htons(IP_OFFSET) ? 0 : iph->protocol) {
	171	case IPPROTO_TCP:
	172	{
	173	struct tcphdr *tcph;
	174
	175	if (!pskb_may_pull(skb, ihl + sizeof(*tcph)) \|\|
	176	(skb_cloned(skb) &&
	177	!skb_clone_writable(skb, ihl + sizeof(*tcph)) &&
	178	pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
	179	goto drop;
	180
	181	tcph = (void *)(skb_network_header(skb) + ihl);
be0ea7d5	182	inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, 1);
b4219952 HX	183	break;
	184	}
	185	case IPPROTO_UDP:
	186	{
	187	struct udphdr *udph;
	188
	189	if (!pskb_may_pull(skb, ihl + sizeof(*udph)) \|\|
	190	(skb_cloned(skb) &&
	191	!skb_clone_writable(skb, ihl + sizeof(*udph)) &&
	192	pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
	193	goto drop;
	194
	195	udph = (void *)(skb_network_header(skb) + ihl);
	196	if (udph->check \|\| skb->ip_summed == CHECKSUM_PARTIAL) {
be0ea7d5 PM	197	inet_proto_csum_replace4(&udph->check, skb, addr,
be0ea7d5 PM	198	new_addr, 1);
b4219952 HX	199	if (!udph->check)
	200	udph->check = CSUM_MANGLED_0;
	201	}
	202	break;
	203	}
	204	case IPPROTO_ICMP:
	205	{
	206	struct icmphdr *icmph;
	207
70c2efa5	208	if (!pskb_may_pull(skb, ihl + sizeof(*icmph)))
b4219952 HX	209	goto drop;
	210
	211	icmph = (void *)(skb_network_header(skb) + ihl);
	212
	213	if ((icmph->type != ICMP_DEST_UNREACH) &&
	214	(icmph->type != ICMP_TIME_EXCEEDED) &&
	215	(icmph->type != ICMP_PARAMETERPROB))
	216	break;
	217
70c2efa5 CG	218	if (!pskb_may_pull(skb, ihl + sizeof(icmph) + sizeof(iph)))
	219	goto drop;
	220
072d79a3	221	icmph = (void *)(skb_network_header(skb) + ihl);
b4219952 HX	222	iph = (void *)(icmph + 1);
	223	if (egress)
	224	addr = iph->daddr;
	225	else
	226	addr = iph->saddr;
	227
	228	if ((old_addr ^ addr) & mask)
	229	break;
	230
	231	if (skb_cloned(skb) &&
	232	!skb_clone_writable(skb,
	233	ihl + sizeof(icmph) + sizeof(iph)) &&
	234	pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
	235	goto drop;
	236
	237	icmph = (void *)(skb_network_header(skb) + ihl);
	238	iph = (void *)(icmph + 1);
	239
	240	new_addr &= mask;
	241	new_addr \|= addr & ~mask;
	242
	243	/* XXX Fix up the inner checksums. */
	244	if (egress)
	245	iph->daddr = new_addr;
	246	else
	247	iph->saddr = new_addr;
	248
be0ea7d5	249	inet_proto_csum_replace4(&icmph->checksum, skb, addr, new_addr,
3a3dfb06	250	0);
b4219952 HX	251	break;
	252	}
	253	default:
	254	break;
	255	}
	256
33c29dde	257	out:
b4219952 HX	258	return action;
	259
	260	drop:
	261	spin_lock(&p->tcf_lock);
	262	p->tcf_qstats.drops++;
	263	spin_unlock(&p->tcf_lock);
	264	return TC_ACT_SHOT;
	265	}
	266
	267	static int tcf_nat_dump(struct sk_buff skb, struct tc_action a,
	268	int bind, int ref)
	269	{
	270	unsigned char *b = skb_tail_pointer(skb);
	271	struct tcf_nat *p = a->priv;
504f85c9	272	struct tc_nat opt;
b4219952	273	struct tcf_t t;
b4219952	274
504f85c9 CG	275	opt.old_addr = p->old_addr;
	276	opt.new_addr = p->new_addr;
	277	opt.mask = p->mask;
	278	opt.flags = p->flags;
b4219952	279
504f85c9 CG	280	opt.index = p->tcf_index;
	281	opt.action = p->tcf_action;
	282	opt.refcnt = p->tcf_refcnt - ref;
	283	opt.bindcnt = p->tcf_bindcnt - bind;
b4219952	284
504f85c9	285	NLA_PUT(skb, TCA_NAT_PARMS, sizeof(opt), &opt);
b4219952 HX	286	t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
	287	t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);
	288	t.expires = jiffies_to_clock_t(p->tcf_tm.expires);
7ba699c6	289	NLA_PUT(skb, TCA_NAT_TM, sizeof(t), &t);
b4219952	290
b4219952 HX	291	return skb->len;
b4219952 HX	292
7ba699c6	293	nla_put_failure:
b4219952	294	nlmsg_trim(skb, b);
b4219952 HX	295	return -1;
	296	}
	297
	298	static struct tc_action_ops act_nat_ops = {
	299	.kind = "nat",
	300	.hinfo = &nat_hash_info,
	301	.type = TCA_ACT_NAT,
	302	.capab = TCA_CAP_NONE,
	303	.owner = THIS_MODULE,
	304	.act = tcf_nat,
	305	.dump = tcf_nat_dump,
	306	.cleanup = tcf_nat_cleanup,
	307	.lookup = tcf_hash_search,
	308	.init = tcf_nat_init,
	309	.walk = tcf_generic_walker
	310	};
	311
	312	MODULE_DESCRIPTION("Stateless NAT actions");
	313	MODULE_LICENSE("GPL");
	314
	315	static int __init nat_init_module(void)
	316	{
	317	return tcf_register_action(&act_nat_ops);
	318	}
	319
	320	static void __exit nat_cleanup_module(void)
	321	{
	322	tcf_unregister_action(&act_nat_ops);
	323	}
	324
	325	module_init(nat_init_module);
	326	module_exit(nat_cleanup_module);