projects / GitHub / exynos8895 / android_kernel_samsung_universal8895.git / blob
? search:


1172267
[GitHub/exynos8895/android_kernel_samsung_universal8895.git] /
1 /* (C) 1999-2001 Paul `Rusty' Russell
2 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 */
8
9 /* Everything about the rules for NAT. */
10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11 #include <linux/types.h>
12 #include <linux/ip.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter_ipv4.h>
15 #include <linux/module.h>
16 #include <linux/kmod.h>
17 #include <linux/skbuff.h>
18 #include <linux/proc_fs.h>
19 #include <net/checksum.h>
20 #include <net/route.h>
21 #include <linux/bitops.h>
22
23 #include <linux/netfilter_ipv4/ip_tables.h>
24 #include <net/netfilter/nf_nat.h>
25 #include <net/netfilter/nf_nat_core.h>
26 #include <net/netfilter/nf_nat_rule.h>
27
28 #define NAT_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
29 (1 << NF_INET_POST_ROUTING) | \
30 (1 << NF_INET_LOCAL_OUT))
31
32 static const struct xt_table nat_table = {
33 .name = "nat",
34 .valid_hooks = NAT_VALID_HOOKS,
35 .me = THIS_MODULE,
36 .af = NFPROTO_IPV4,
37 };
38
39 /* Source NAT */
40 static unsigned int
41 ipt_snat_target(struct sk_buff *skb, const struct xt_target_param *par)
42 {
43 struct nf_conn *ct;
44 enum ip_conntrack_info ctinfo;
45 const struct nf_nat_multi_range_compat *mr = par->targinfo;
46
47 NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING);
48
49 ct = nf_ct_get(skb, &ctinfo);
50
51 /* Connection must be valid and new. */
52 NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
53 ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
54 NF_CT_ASSERT(par->out != NULL);
55
56 return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_SRC);
57 }
58
59 static unsigned int
60 ipt_dnat_target(struct sk_buff *skb, const struct xt_target_param *par)
61 {
62 struct nf_conn *ct;
63 enum ip_conntrack_info ctinfo;
64 const struct nf_nat_multi_range_compat *mr = par->targinfo;
65
66 NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
67 par->hooknum == NF_INET_LOCAL_OUT);
68
69 ct = nf_ct_get(skb, &ctinfo);
70
71 /* Connection must be valid and new. */
72 NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
73
74 return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_DST);
75 }
76
77 static int ipt_snat_checkentry(const struct xt_tgchk_param *par)
78 {
79 const struct nf_nat_multi_range_compat *mr = par->targinfo;
80
81 /* Must be a valid range */
82 if (mr->rangesize != 1) {
83 pr_info("SNAT: multiple ranges no longer supported\n");
84 return false;
85 }
86 return true;
87 }
88
89 static int ipt_dnat_checkentry(const struct xt_tgchk_param *par)
90 {
91 const struct nf_nat_multi_range_compat *mr = par->targinfo;
92
93 /* Must be a valid range */
94 if (mr->rangesize != 1) {
95 pr_info("DNAT: multiple ranges no longer supported\n");
96 return false;
97 }
98 return true;
99 }
100
101 unsigned int
102 alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
103 {
104 /* Force range to this IP; let proto decide mapping for
105 per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
106 Use reply in case it's already been mangled (eg local packet).
107 */
108 __be32 ip
109 = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
110 ? ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip
111 : ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);
112 struct nf_nat_range range
113 = { IP_NAT_RANGE_MAP_IPS, ip, ip, { 0 }, { 0 } };
114
115 pr_debug("Allocating NULL binding for %p (%pI4)\n", ct, &ip);
116 return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
117 }
118
119 int nf_nat_rule_find(struct sk_buff *skb,
120 unsigned int hooknum,
121 const struct net_device *in,
122 const struct net_device *out,
123 struct nf_conn *ct)
124 {
125 struct net *net = nf_ct_net(ct);
126 int ret;
127
128 ret = ipt_do_table(skb, hooknum, in, out, net->ipv4.nat_table);
129
130 if (ret == NF_ACCEPT) {
131 if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
132 /* NUL mapping */
133 ret = alloc_null_binding(ct, hooknum);
134 }
135 return ret;
136 }
137
138 static struct xt_target ipt_snat_reg __read_mostly = {
139 .name = "SNAT",
140 .target = ipt_snat_target,
141 .targetsize = sizeof(struct nf_nat_multi_range_compat),
142 .table = "nat",
143 .hooks = 1 << NF_INET_POST_ROUTING,
144 .checkentry = ipt_snat_checkentry,
145 .family = AF_INET,
146 };
147
148 static struct xt_target ipt_dnat_reg __read_mostly = {
149 .name = "DNAT",
150 .target = ipt_dnat_target,
151 .targetsize = sizeof(struct nf_nat_multi_range_compat),
152 .table = "nat",
153 .hooks = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT),
154 .checkentry = ipt_dnat_checkentry,
155 .family = AF_INET,
156 };
157
158 static int __net_init nf_nat_rule_net_init(struct net *net)
159 {
160 struct ipt_replace *repl;
161
162 repl = ipt_alloc_initial_table(&nat_table);
163 if (repl == NULL)
164 return -ENOMEM;
165 net->ipv4.nat_table = ipt_register_table(net, &nat_table, repl);
166 kfree(repl);
167 if (IS_ERR(net->ipv4.nat_table))
168 return PTR_ERR(net->ipv4.nat_table);
169 return 0;
170 }
171
172 static void __net_exit nf_nat_rule_net_exit(struct net *net)
173 {
174 ipt_unregister_table(net, net->ipv4.nat_table);
175 }
176
177 static struct pernet_operations nf_nat_rule_net_ops = {
178 .init = nf_nat_rule_net_init,
179 .exit = nf_nat_rule_net_exit,
180 };
181
182 int __init nf_nat_rule_init(void)
183 {
184 int ret;
185
186 ret = register_pernet_subsys(&nf_nat_rule_net_ops);
187 if (ret != 0)
188 goto out;
189 ret = xt_register_target(&ipt_snat_reg);
190 if (ret != 0)
191 goto unregister_table;
192
193 ret = xt_register_target(&ipt_dnat_reg);
194 if (ret != 0)
195 goto unregister_snat;
196
197 return ret;
198
199 unregister_snat:
200 xt_unregister_target(&ipt_snat_reg);
201 unregister_table:
202 unregister_pernet_subsys(&nf_nat_rule_net_ops);
203 out:
204 return ret;
205 }
206
207 void nf_nat_rule_cleanup(void)
208 {
209 xt_unregister_target(&ipt_dnat_reg);
210 xt_unregister_target(&ipt_snat_reg);
211 unregister_pernet_subsys(&nf_nat_rule_net_ops);
212 }