[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / ipv4 / netfilter / nf_nat_standalone.c

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/types.h>
#include <linux/icmp.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/proc_fs.h>
#include <net/ip.h>
#include <net/checksum.h>
#include <linux/spinlock.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_nat_rule.h>
#include <net/netfilter/nf_nat_protocol.h>
#include <net/netfilter/nf_nat_core.h>
#include <net/netfilter/nf_nat_helper.h>
#include <linux/netfilter_ipv4/ip_tables.h>

#if 0
#define DEBUGP printk
#else
#define DEBUGP(format, args...)
#endif

#ifdef CONFIG_XFRM
static void nat_decode_session(struct sk_buff *skb, struct flowi *fl)
{
	struct nf_conn *ct;
	struct nf_conntrack_tuple *t;
	enum ip_conntrack_info ctinfo;
	enum ip_conntrack_dir dir;
	unsigned long statusbit;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return;
	dir = CTINFO2DIR(ctinfo);
	t = &ct->tuplehash[dir].tuple;

	if (dir == IP_CT_DIR_ORIGINAL)
		statusbit = IPS_DST_NAT;
	else
		statusbit = IPS_SRC_NAT;

	if (ct->status & statusbit) {
		fl->fl4_dst = t->dst.u3.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP)
			fl->fl_ip_dport = t->dst.u.tcp.port;
	}

	statusbit ^= IPS_NAT_MASK;

	if (ct->status & statusbit) {
		fl->fl4_src = t->src.u3.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP)
			fl->fl_ip_sport = t->src.u.tcp.port;
	}
}
#endif

static unsigned int
nf_nat_fn(unsigned int hooknum,
	  struct sk_buff **pskb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	struct nf_conn_nat *nat;
	struct nf_nat_info *info;
	/* maniptype == SRC for postrouting. */
	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);

	/* We never see fragments: conntrack defrags on pre-routing
	   and local-out, and nf_nat_out protects post-routing. */
	NF_CT_ASSERT(!((*pskb)->nh.iph->frag_off
		       & htons(IP_MF|IP_OFFSET)));

	ct = nf_ct_get(*pskb, &ctinfo);
	/* Can't track?  It's not due to stress, or conntrack would
	   have dropped it.  Hence it's the user's responsibilty to
	   packet filter it out, or implement conntrack/NAT for that
	   protocol. 8) --RR */
	if (!ct) {
		/* Exception: ICMP redirect to new connection (not in
		   hash table yet).  We must not let this through, in
		   case we're doing NAT to the same network. */
		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
			struct icmphdr _hdr, *hp;

			hp = skb_header_pointer(*pskb,
						(*pskb)->nh.iph->ihl*4,
						sizeof(_hdr), &_hdr);
			if (hp != NULL &&
			    hp->type == ICMP_REDIRECT)
				return NF_DROP;
		}
		return NF_ACCEPT;
	}

	/* Don't try to NAT if this packet is not conntracked */
	if (ct == &nf_conntrack_untracked)
		return NF_ACCEPT;

	nat = nfct_nat(ct);
	if (!nat)
		return NF_ACCEPT;

	switch (ctinfo) {
	case IP_CT_RELATED:
	case IP_CT_RELATED+IP_CT_IS_REPLY:
		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
			if (!nf_nat_icmp_reply_translation(ct, ctinfo,
							   hooknum, pskb))
				return NF_DROP;
			else
				return NF_ACCEPT;
		}
		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	case IP_CT_NEW:
		info = &nat->info;

		/* Seen it before?  This can happen for loopback, retrans,
		   or local packets.. */
		if (!nf_nat_initialized(ct, maniptype)) {
			unsigned int ret;

			if (unlikely(nf_ct_is_confirmed(ct)))
				/* NAT module was loaded late */
				ret = alloc_null_binding_confirmed(ct, info,
								   hooknum);
			else if (hooknum == NF_IP_LOCAL_IN)
				/* LOCAL_IN hook doesn't have a chain!  */
				ret = alloc_null_binding(ct, info, hooknum);
			else
				ret = nf_nat_rule_find(pskb, hooknum, in, out,
						       ct, info);

			if (ret != NF_ACCEPT) {
				return ret;
			}
		} else
			DEBUGP("Already setup manip %s for ct %p\n",
			       maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
			       ct);
		break;

	default:
		/* ESTABLISHED */
		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
			     ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
		info = &nat->info;
	}

	NF_CT_ASSERT(info);
	return nf_nat_packet(ct, ctinfo, hooknum, pskb);
}

static unsigned int
nf_nat_in(unsigned int hooknum,
	  struct sk_buff **pskb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	unsigned int ret;
	__be32 daddr = (*pskb)->nh.iph->daddr;

	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    daddr != (*pskb)->nh.iph->daddr) {
		dst_release((*pskb)->dst);
		(*pskb)->dst = NULL;
	}
	return ret;
}

static unsigned int
nf_nat_out(unsigned int hooknum,
	   struct sk_buff **pskb,
	   const struct net_device *in,
	   const struct net_device *out,
	   int (*okfn)(struct sk_buff *))
{
#ifdef CONFIG_XFRM
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
#endif
	unsigned int ret;

	/* root is playing with raw sockets. */
	if ((*pskb)->len < sizeof(struct iphdr) ||
	    (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
#ifdef CONFIG_XFRM
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    (ct = nf_ct_get(*pskb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if (ct->tuplehash[dir].tuple.src.u3.ip !=
		    ct->tuplehash[!dir].tuple.dst.u3.ip
		    || ct->tuplehash[dir].tuple.src.u.all !=
		       ct->tuplehash[!dir].tuple.dst.u.all
		    )
			return ip_xfrm_me_harder(pskb) == 0 ? ret : NF_DROP;
	}
#endif
	return ret;
}

static unsigned int
nf_nat_local_fn(unsigned int hooknum,
		struct sk_buff **pskb,
		const struct net_device *in,
		const struct net_device *out,
		int (*okfn)(struct sk_buff *))
{
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	unsigned int ret;

	/* root is playing with raw sockets. */
	if ((*pskb)->len < sizeof(struct iphdr) ||
	    (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    (ct = nf_ct_get(*pskb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if (ct->tuplehash[dir].tuple.dst.u3.ip !=
		    ct->tuplehash[!dir].tuple.src.u3.ip
#ifdef CONFIG_XFRM
		    || ct->tuplehash[dir].tuple.dst.u.all !=
		       ct->tuplehash[!dir].tuple.src.u.all
#endif
		    )
			if (ip_route_me_harder(pskb, RTN_UNSPEC))
				ret = NF_DROP;
	}
	return ret;
}

static unsigned int
nf_nat_adjust(unsigned int hooknum,
	      struct sk_buff **pskb,
	      const struct net_device *in,
	      const struct net_device *out,
	      int (*okfn)(struct sk_buff *))
{
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;

	ct = nf_ct_get(*pskb, &ctinfo);
	if (ct && test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
		DEBUGP("nf_nat_standalone: adjusting sequence number\n");
		if (!nf_nat_seq_adjust(pskb, ct, ctinfo))
			return NF_DROP;
	}
	return NF_ACCEPT;
}

/* We must be after connection tracking and before packet filtering. */

static struct nf_hook_ops nf_nat_ops[] = {
	/* Before packet filtering, change destination */
	{
		.hook		= nf_nat_in,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_PRE_ROUTING,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= nf_nat_out,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_POST_ROUTING,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
	/* After conntrack, adjust sequence number */
	{
		.hook		= nf_nat_adjust,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_POST_ROUTING,
		.priority	= NF_IP_PRI_NAT_SEQ_ADJUST,
	},
	/* Before packet filtering, change destination */
	{
		.hook		= nf_nat_local_fn,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_LOCAL_OUT,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= nf_nat_fn,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_LOCAL_IN,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
	/* After conntrack, adjust sequence number */
	{
		.hook		= nf_nat_adjust,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_LOCAL_IN,
		.priority	= NF_IP_PRI_NAT_SEQ_ADJUST,
	},
};

static int __init nf_nat_standalone_init(void)
{
	int size, ret = 0;

	need_conntrack();

	size = ALIGN(sizeof(struct nf_conn), __alignof__(struct nf_conn_nat)) +
	       sizeof(struct nf_conn_nat);
	ret = nf_conntrack_register_cache(NF_CT_F_NAT, "nf_nat:base", size);
	if (ret < 0) {
		printk(KERN_ERR "nf_nat_init: Unable to create slab cache\n");
		return ret;
	}

	size = ALIGN(size, __alignof__(struct nf_conn_help)) +
	       sizeof(struct nf_conn_help);
	ret = nf_conntrack_register_cache(NF_CT_F_NAT|NF_CT_F_HELP,
					  "nf_nat:help", size);
	if (ret < 0) {
		printk(KERN_ERR "nf_nat_init: Unable to create slab cache\n");
		goto cleanup_register_cache;
	}
#ifdef CONFIG_XFRM
	BUG_ON(ip_nat_decode_session != NULL);
	ip_nat_decode_session = nat_decode_session;
#endif
	ret = nf_nat_rule_init();
	if (ret < 0) {
		printk("nf_nat_init: can't setup rules.\n");
		goto cleanup_decode_session;
	}
	ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	if (ret < 0) {
		printk("nf_nat_init: can't register hooks.\n");
		goto cleanup_rule_init;
	}
	nf_nat_module_is_loaded = 1;
	return ret;

 cleanup_rule_init:
	nf_nat_rule_cleanup();
 cleanup_decode_session:
#ifdef CONFIG_XFRM
	ip_nat_decode_session = NULL;
	synchronize_net();
#endif
	nf_conntrack_unregister_cache(NF_CT_F_NAT|NF_CT_F_HELP);
 cleanup_register_cache:
	nf_conntrack_unregister_cache(NF_CT_F_NAT);
	return ret;
}

static void __exit nf_nat_standalone_fini(void)
{
	nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	nf_nat_rule_cleanup();
	nf_nat_module_is_loaded = 0;
#ifdef CONFIG_XFRM
	ip_nat_decode_session = NULL;
	synchronize_net();
#endif
	/* Conntrack caches are unregistered in nf_conntrack_cleanup */
}

module_init(nf_nat_standalone_init);
module_exit(nf_nat_standalone_fini);

MODULE_LICENSE("GPL");
MODULE_ALIAS("ip_nat");
Commit	Line	Data
5b1158e9 JK	1	/* (C) 1999-2001 Paul `Rusty' Russell
	2	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8	#include <linux/types.h>
	9	#include <linux/icmp.h>
	10	#include <linux/ip.h>
	11	#include <linux/netfilter.h>
	12	#include <linux/netfilter_ipv4.h>
	13	#include <linux/module.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/proc_fs.h>
	16	#include <net/ip.h>
	17	#include <net/checksum.h>
	18	#include <linux/spinlock.h>
	19
	20	#include <net/netfilter/nf_conntrack.h>
	21	#include <net/netfilter/nf_conntrack_core.h>
	22	#include <net/netfilter/nf_nat.h>
	23	#include <net/netfilter/nf_nat_rule.h>
	24	#include <net/netfilter/nf_nat_protocol.h>
	25	#include <net/netfilter/nf_nat_core.h>
	26	#include <net/netfilter/nf_nat_helper.h>
	27	#include <linux/netfilter_ipv4/ip_tables.h>
	28
	29	#if 0
	30	#define DEBUGP printk
	31	#else
	32	#define DEBUGP(format, args...)
	33	#endif
	34
5b1158e9 JK	35	#ifdef CONFIG_XFRM
	36	static void nat_decode_session(struct sk_buff skb, struct flowi fl)
	37	{
	38	struct nf_conn *ct;
	39	struct nf_conntrack_tuple *t;
	40	enum ip_conntrack_info ctinfo;
	41	enum ip_conntrack_dir dir;
	42	unsigned long statusbit;
	43
	44	ct = nf_ct_get(skb, &ctinfo);
	45	if (ct == NULL)
	46	return;
	47	dir = CTINFO2DIR(ctinfo);
	48	t = &ct->tuplehash[dir].tuple;
	49
	50	if (dir == IP_CT_DIR_ORIGINAL)
	51	statusbit = IPS_DST_NAT;
	52	else
	53	statusbit = IPS_SRC_NAT;
	54
	55	if (ct->status & statusbit) {
	56	fl->fl4_dst = t->dst.u3.ip;
	57	if (t->dst.protonum == IPPROTO_TCP \|\|
	58	t->dst.protonum == IPPROTO_UDP)
	59	fl->fl_ip_dport = t->dst.u.tcp.port;
	60	}
	61
	62	statusbit ^= IPS_NAT_MASK;
	63
	64	if (ct->status & statusbit) {
	65	fl->fl4_src = t->src.u3.ip;
	66	if (t->dst.protonum == IPPROTO_TCP \|\|
	67	t->dst.protonum == IPPROTO_UDP)
	68	fl->fl_ip_sport = t->src.u.tcp.port;
	69	}
	70	}
	71	#endif
	72
	73	static unsigned int
	74	nf_nat_fn(unsigned int hooknum,
	75	struct sk_buff **pskb,
	76	const struct net_device *in,
	77	const struct net_device *out,
	78	int (okfn)(struct sk_buff ))
	79	{
	80	struct nf_conn *ct;
	81	enum ip_conntrack_info ctinfo;
	82	struct nf_conn_nat *nat;
	83	struct nf_nat_info *info;
	84	/* maniptype == SRC for postrouting. */
	85	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
	86
	87	/* We never see fragments: conntrack defrags on pre-routing
	88	and local-out, and nf_nat_out protects post-routing. */
	89	NF_CT_ASSERT(!((*pskb)->nh.iph->frag_off
	90	& htons(IP_MF\|IP_OFFSET)));
	91
	92	ct = nf_ct_get(*pskb, &ctinfo);
	93	/* Can't track? It's not due to stress, or conntrack would
	94	have dropped it. Hence it's the user's responsibilty to
	95	packet filter it out, or implement conntrack/NAT for that
	96	protocol. 8) --RR */
	97	if (!ct) {
	98	/* Exception: ICMP redirect to new connection (not in
e905a9ed YH	99	hash table yet). We must not let this through, in
e905a9ed YH	100	case we're doing NAT to the same network. */
5b1158e9 JK	101	if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
	102	struct icmphdr _hdr, *hp;
	103
	104	hp = skb_header_pointer(*pskb,
	105	(pskb)->nh.iph->ihl4,
	106	sizeof(_hdr), &_hdr);
	107	if (hp != NULL &&
	108	hp->type == ICMP_REDIRECT)
	109	return NF_DROP;
	110	}
	111	return NF_ACCEPT;
	112	}
	113
	114	/* Don't try to NAT if this packet is not conntracked */
	115	if (ct == &nf_conntrack_untracked)
	116	return NF_ACCEPT;
	117
	118	nat = nfct_nat(ct);
	119	if (!nat)
ffed53d2	120	return NF_ACCEPT;
5b1158e9 JK	121
	122	switch (ctinfo) {
	123	case IP_CT_RELATED:
	124	case IP_CT_RELATED+IP_CT_IS_REPLY:
	125	if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
	126	if (!nf_nat_icmp_reply_translation(ct, ctinfo,
	127	hooknum, pskb))
	128	return NF_DROP;
	129	else
	130	return NF_ACCEPT;
	131	}
	132	/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	133	case IP_CT_NEW:
	134	info = &nat->info;
	135
	136	/* Seen it before? This can happen for loopback, retrans,
	137	or local packets.. */
	138	if (!nf_nat_initialized(ct, maniptype)) {
	139	unsigned int ret;
	140
	141	if (unlikely(nf_ct_is_confirmed(ct)))
	142	/* NAT module was loaded late */
	143	ret = alloc_null_binding_confirmed(ct, info,
e905a9ed	144	hooknum);
5b1158e9 JK	145	else if (hooknum == NF_IP_LOCAL_IN)
	146	/* LOCAL_IN hook doesn't have a chain! */
	147	ret = alloc_null_binding(ct, info, hooknum);
	148	else
	149	ret = nf_nat_rule_find(pskb, hooknum, in, out,
	150	ct, info);
	151
	152	if (ret != NF_ACCEPT) {
	153	return ret;
	154	}
	155	} else
	156	DEBUGP("Already setup manip %s for ct %p\n",
	157	maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
	158	ct);
	159	break;
	160
	161	default:
	162	/* ESTABLISHED */
	163	NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED \|\|
	164	ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
	165	info = &nat->info;
	166	}
	167
	168	NF_CT_ASSERT(info);
	169	return nf_nat_packet(ct, ctinfo, hooknum, pskb);
	170	}
	171
	172	static unsigned int
	173	nf_nat_in(unsigned int hooknum,
e905a9ed YH	174	struct sk_buff **pskb,
	175	const struct net_device *in,
	176	const struct net_device *out,
	177	int (okfn)(struct sk_buff ))
5b1158e9 JK	178	{
	179	unsigned int ret;
	180	__be32 daddr = (*pskb)->nh.iph->daddr;
	181
	182	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
	183	if (ret != NF_DROP && ret != NF_STOLEN &&
	184	daddr != (*pskb)->nh.iph->daddr) {
	185	dst_release((*pskb)->dst);
	186	(*pskb)->dst = NULL;
	187	}
	188	return ret;
	189	}
	190
	191	static unsigned int
	192	nf_nat_out(unsigned int hooknum,
	193	struct sk_buff **pskb,
	194	const struct net_device *in,
	195	const struct net_device *out,
	196	int (okfn)(struct sk_buff ))
	197	{
	198	#ifdef CONFIG_XFRM
	199	struct nf_conn *ct;
	200	enum ip_conntrack_info ctinfo;
	201	#endif
	202	unsigned int ret;
	203
	204	/* root is playing with raw sockets. */
	205	if ((*pskb)->len < sizeof(struct iphdr) \|\|
	206	(pskb)->nh.iph->ihl 4 < sizeof(struct iphdr))
	207	return NF_ACCEPT;
	208
	209	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
	210	#ifdef CONFIG_XFRM
	211	if (ret != NF_DROP && ret != NF_STOLEN &&
	212	(ct = nf_ct_get(*pskb, &ctinfo)) != NULL) {
	213	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	214
	215	if (ct->tuplehash[dir].tuple.src.u3.ip !=
	216	ct->tuplehash[!dir].tuple.dst.u3.ip
	217	\|\| ct->tuplehash[dir].tuple.src.u.all !=
	218	ct->tuplehash[!dir].tuple.dst.u.all
	219	)
	220	return ip_xfrm_me_harder(pskb) == 0 ? ret : NF_DROP;
	221	}
	222	#endif
	223	return ret;
	224	}
	225
	226	static unsigned int
	227	nf_nat_local_fn(unsigned int hooknum,
	228	struct sk_buff **pskb,
	229	const struct net_device *in,
	230	const struct net_device *out,
	231	int (okfn)(struct sk_buff ))
	232	{
	233	struct nf_conn *ct;
	234	enum ip_conntrack_info ctinfo;
	235	unsigned int ret;
	236
	237	/* root is playing with raw sockets. */
	238	if ((*pskb)->len < sizeof(struct iphdr) \|\|
	239	(pskb)->nh.iph->ihl 4 < sizeof(struct iphdr))
	240	return NF_ACCEPT;
	241
242	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
243	if (ret != NF_DROP && ret != NF_STOLEN &&
244	(ct = nf_ct_get(*pskb, &ctinfo)) != NULL) {
245	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
246
247	if (ct->tuplehash[dir].tuple.dst.u3.ip !=
248	ct->tuplehash[!dir].tuple.src.u3.ip
249	#ifdef CONFIG_XFRM
250	\|\| ct->tuplehash[dir].tuple.dst.u.all !=
251	ct->tuplehash[!dir].tuple.src.u.all
252	#endif
253	)
254	if (ip_route_me_harder(pskb, RTN_UNSPEC))
255	ret = NF_DROP;
256	}
257	return ret;
258	}
259
260	static unsigned int
261	nf_nat_adjust(unsigned int hooknum,
262	struct sk_buff **pskb,
263	const struct net_device *in,
264	const struct net_device *out,
265	int (okfn)(struct sk_buff ))
266	{
267	struct nf_conn *ct;
268	enum ip_conntrack_info ctinfo;
269
270	ct = nf_ct_get(*pskb, &ctinfo);
271	if (ct && test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
e905a9ed YH	272	DEBUGP("nf_nat_standalone: adjusting sequence number\n");
	273	if (!nf_nat_seq_adjust(pskb, ct, ctinfo))
	274	return NF_DROP;
5b1158e9 JK	275	}
	276	return NF_ACCEPT;
	277	}
	278
	279	/* We must be after connection tracking and before packet filtering. */
	280
	281	static struct nf_hook_ops nf_nat_ops[] = {
	282	/* Before packet filtering, change destination */
	283	{
	284	.hook = nf_nat_in,
	285	.owner = THIS_MODULE,
	286	.pf = PF_INET,
	287	.hooknum = NF_IP_PRE_ROUTING,
	288	.priority = NF_IP_PRI_NAT_DST,
	289	},
	290	/* After packet filtering, change source */
	291	{
	292	.hook = nf_nat_out,
	293	.owner = THIS_MODULE,
	294	.pf = PF_INET,
	295	.hooknum = NF_IP_POST_ROUTING,
	296	.priority = NF_IP_PRI_NAT_SRC,
	297	},
	298	/* After conntrack, adjust sequence number */
	299	{
	300	.hook = nf_nat_adjust,
	301	.owner = THIS_MODULE,
	302	.pf = PF_INET,
	303	.hooknum = NF_IP_POST_ROUTING,
	304	.priority = NF_IP_PRI_NAT_SEQ_ADJUST,
	305	},
	306	/* Before packet filtering, change destination */
	307	{
	308	.hook = nf_nat_local_fn,
	309	.owner = THIS_MODULE,
	310	.pf = PF_INET,
	311	.hooknum = NF_IP_LOCAL_OUT,
	312	.priority = NF_IP_PRI_NAT_DST,
	313	},
	314	/* After packet filtering, change source */
	315	{
	316	.hook = nf_nat_fn,
	317	.owner = THIS_MODULE,
	318	.pf = PF_INET,
	319	.hooknum = NF_IP_LOCAL_IN,
	320	.priority = NF_IP_PRI_NAT_SRC,
	321	},
	322	/* After conntrack, adjust sequence number */
	323	{
	324	.hook = nf_nat_adjust,
	325	.owner = THIS_MODULE,
	326	.pf = PF_INET,
	327	.hooknum = NF_IP_LOCAL_IN,
	328	.priority = NF_IP_PRI_NAT_SEQ_ADJUST,
	329	},
	330	};
	331
	332	static int __init nf_nat_standalone_init(void)
	333	{
	334	int size, ret = 0;
	335
	336	need_conntrack();
	337
	338	size = ALIGN(sizeof(struct nf_conn), __alignof__(struct nf_conn_nat)) +
339	sizeof(struct nf_conn_nat);
340	ret = nf_conntrack_register_cache(NF_CT_F_NAT, "nf_nat:base", size);
341	if (ret < 0) {
342	printk(KERN_ERR "nf_nat_init: Unable to create slab cache\n");
343	return ret;
344	}
345
346	size = ALIGN(size, __alignof__(struct nf_conn_help)) +
347	sizeof(struct nf_conn_help);
348	ret = nf_conntrack_register_cache(NF_CT_F_NAT\|NF_CT_F_HELP,
349	"nf_nat:help", size);
350	if (ret < 0) {
351	printk(KERN_ERR "nf_nat_init: Unable to create slab cache\n");
352	goto cleanup_register_cache;
353	}
354	#ifdef CONFIG_XFRM
355	BUG_ON(ip_nat_decode_session != NULL);
356	ip_nat_decode_session = nat_decode_session;
357	#endif
358	ret = nf_nat_rule_init();
359	if (ret < 0) {
360	printk("nf_nat_init: can't setup rules.\n");
361	goto cleanup_decode_session;
362	}
363	ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
364	if (ret < 0) {
365	printk("nf_nat_init: can't register hooks.\n");
366	goto cleanup_rule_init;
367	}
368	nf_nat_module_is_loaded = 1;
369	return ret;
370
371	cleanup_rule_init:
372	nf_nat_rule_cleanup();
373	cleanup_decode_session:
374	#ifdef CONFIG_XFRM
375	ip_nat_decode_session = NULL;
376	synchronize_net();
377	#endif
378	nf_conntrack_unregister_cache(NF_CT_F_NAT\|NF_CT_F_HELP);
379	cleanup_register_cache:
380	nf_conntrack_unregister_cache(NF_CT_F_NAT);
381	return ret;
382	}
383
384	static void __exit nf_nat_standalone_fini(void)
385	{
386	nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
387	nf_nat_rule_cleanup();
388	nf_nat_module_is_loaded = 0;
389	#ifdef CONFIG_XFRM
390	ip_nat_decode_session = NULL;
391	synchronize_net();
392	#endif
393	/* Conntrack caches are unregistered in nf_conntrack_cleanup */
394	}
395
396	module_init(nf_nat_standalone_init);
397	module_exit(nf_nat_standalone_fini);
398
399	MODULE_LICENSE("GPL");
400	MODULE_ALIAS("ip_nat");