1 // SPDX-License-Identifier: GPL-2.0-only 2 /* (C) 1999-2001 Paul `Rusty' Russell 3 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 4 */ 5 6 #include <linux/types.h> 7 #include <linux/export.h> 8 #include <linux/init.h> 9 #include <linux/udp.h> 10 #include <linux/tcp.h> 11 #include <linux/icmp.h> 12 #include <linux/icmpv6.h> 13 14 #include <linux/dccp.h> 15 #include <linux/sctp.h> 16 #include <net/sctp/checksum.h> 17 18 #include <linux/netfilter.h> 19 #include <net/netfilter/nf_nat.h> 20 21 #include <linux/ipv6.h> 22 #include <linux/netfilter_ipv6.h> 23 #include <net/checksum.h> 24 #include <net/ip6_checksum.h> 25 #include <net/ip6_route.h> 26 #include <net/xfrm.h> 27 #include <net/ipv6.h> 28 29 #include <net/netfilter/nf_conntrack_core.h> 30 #include <net/netfilter/nf_conntrack.h> 31 #include <linux/netfilter/nfnetlink_conntrack.h> 32 33 static void nf_csum_update(struct sk_buff *skb, 34 unsigned int iphdroff, __sum16 *check, 35 const struct nf_conntrack_tuple *t, 36 enum nf_nat_manip_type maniptype); 37 38 static void 39 __udp_manip_pkt(struct sk_buff *skb, 40 unsigned int iphdroff, struct udphdr *hdr, 41 const struct nf_conntrack_tuple *tuple, 42 enum nf_nat_manip_type maniptype, bool do_csum) 43 { 44 __be16 *portptr, newport; 45 46 if (maniptype == NF_NAT_MANIP_SRC) { 47 /* Get rid of src port */ 48 newport = tuple->src.u.udp.port; 49 portptr = &hdr->source; 50 } else { 51 /* Get rid of dst port */ 52 newport = tuple->dst.u.udp.port; 53 portptr = &hdr->dest; 54 } 55 if (do_csum) { 56 nf_csum_update(skb, iphdroff, &hdr->check, tuple, maniptype); 57 inet_proto_csum_replace2(&hdr->check, skb, *portptr, newport, 58 false); 59 if (!hdr->check) 60 hdr->check = CSUM_MANGLED_0; 61 } 62 *portptr = newport; 63 } 64 65 static bool udp_manip_pkt(struct sk_buff *skb, 66 unsigned int iphdroff, unsigned int hdroff, 67 const struct nf_conntrack_tuple *tuple, 68 enum nf_nat_manip_type maniptype) 69 { 70 struct udphdr *hdr; 71 72 if (skb_ensure_writable(skb, hdroff + sizeof(*hdr))) 73 return false; 74 75 hdr = (struct udphdr *)(skb->data + hdroff); 76 __udp_manip_pkt(skb, iphdroff, hdr, tuple, maniptype, !!hdr->check); 77 78 return true; 79 } 80 81 static bool udplite_manip_pkt(struct sk_buff *skb, 82 unsigned int iphdroff, unsigned int hdroff, 83 const struct nf_conntrack_tuple *tuple, 84 enum nf_nat_manip_type maniptype) 85 { 86 #ifdef CONFIG_NF_CT_PROTO_UDPLITE 87 struct udphdr *hdr; 88 89 if (skb_ensure_writable(skb, hdroff + sizeof(*hdr))) 90 return false; 91 92 hdr = (struct udphdr *)(skb->data + hdroff); 93 __udp_manip_pkt(skb, iphdroff, hdr, tuple, maniptype, true); 94 #endif 95 return true; 96 } 97 98 static bool 99 sctp_manip_pkt(struct sk_buff *skb, 100 unsigned int iphdroff, unsigned int hdroff, 101 const struct nf_conntrack_tuple *tuple, 102 enum nf_nat_manip_type maniptype) 103 { 104 #ifdef CONFIG_NF_CT_PROTO_SCTP 105 struct sctphdr *hdr; 106 int hdrsize = 8; 107 108 /* This could be an inner header returned in imcp packet; in such 109 * cases we cannot update the checksum field since it is outside 110 * of the 8 bytes of transport layer headers we are guaranteed. 111 */ 112 if (skb->len >= hdroff + sizeof(*hdr)) 113 hdrsize = sizeof(*hdr); 114 115 if (skb_ensure_writable(skb, hdroff + hdrsize)) 116 return false; 117 118 hdr = (struct sctphdr *)(skb->data + hdroff); 119 120 if (maniptype == NF_NAT_MANIP_SRC) { 121 /* Get rid of src port */ 122 hdr->source = tuple->src.u.sctp.port; 123 } else { 124 /* Get rid of dst port */ 125 hdr->dest = tuple->dst.u.sctp.port; 126 } 127 128 if (hdrsize < sizeof(*hdr)) 129 return true; 130 131 if (skb->ip_summed != CHECKSUM_PARTIAL) { 132 hdr->checksum = sctp_compute_cksum(skb, hdroff); 133 skb->ip_summed = CHECKSUM_NONE; 134 } 135 136 #endif 137 return true; 138 } 139 140 static bool 141 tcp_manip_pkt(struct sk_buff *skb, 142 unsigned int iphdroff, unsigned int hdroff, 143 const struct nf_conntrack_tuple *tuple, 144 enum nf_nat_manip_type maniptype) 145 { 146 struct tcphdr *hdr; 147 __be16 *portptr, newport, oldport; 148 int hdrsize = 8; /* TCP connection tracking guarantees this much */ 149 150 /* this could be a inner header returned in icmp packet; in such 151 cases we cannot update the checksum field since it is outside of 152 the 8 bytes of transport layer headers we are guaranteed */ 153 if (skb->len >= hdroff + sizeof(struct tcphdr)) 154 hdrsize = sizeof(struct tcphdr); 155 156 if (skb_ensure_writable(skb, hdroff + hdrsize)) 157 return false; 158 159 hdr = (struct tcphdr *)(skb->data + hdroff); 160 161 if (maniptype == NF_NAT_MANIP_SRC) { 162 /* Get rid of src port */ 163 newport = tuple->src.u.tcp.port; 164 portptr = &hdr->source; 165 } else { 166 /* Get rid of dst port */ 167 newport = tuple->dst.u.tcp.port; 168 portptr = &hdr->dest; 169 } 170 171 oldport = *portptr; 172 *portptr = newport; 173 174 if (hdrsize < sizeof(*hdr)) 175 return true; 176 177 nf_csum_update(skb, iphdroff, &hdr->check, tuple, maniptype); 178 inet_proto_csum_replace2(&hdr->check, skb, oldport, newport, false); 179 return true; 180 } 181 182 static bool 183 dccp_manip_pkt(struct sk_buff *skb, 184 unsigned int iphdroff, unsigned int hdroff, 185 const struct nf_conntrack_tuple *tuple, 186 enum nf_nat_manip_type maniptype) 187 { 188 #ifdef CONFIG_NF_CT_PROTO_DCCP 189 struct dccp_hdr *hdr; 190 __be16 *portptr, oldport, newport; 191 int hdrsize = 8; /* DCCP connection tracking guarantees this much */ 192 193 if (skb->len >= hdroff + sizeof(struct dccp_hdr)) 194 hdrsize = sizeof(struct dccp_hdr); 195 196 if (skb_ensure_writable(skb, hdroff + hdrsize)) 197 return false; 198 199 hdr = (struct dccp_hdr *)(skb->data + hdroff); 200 201 if (maniptype == NF_NAT_MANIP_SRC) { 202 newport = tuple->src.u.dccp.port; 203 portptr = &hdr->dccph_sport; 204 } else { 205 newport = tuple->dst.u.dccp.port; 206 portptr = &hdr->dccph_dport; 207 } 208 209 oldport = *portptr; 210 *portptr = newport; 211 212 if (hdrsize < sizeof(*hdr)) 213 return true; 214 215 nf_csum_update(skb, iphdroff, &hdr->dccph_checksum, tuple, maniptype); 216 inet_proto_csum_replace2(&hdr->dccph_checksum, skb, oldport, newport, 217 false); 218 #endif 219 return true; 220 } 221 222 static bool 223 icmp_manip_pkt(struct sk_buff *skb, 224 unsigned int iphdroff, unsigned int hdroff, 225 const struct nf_conntrack_tuple *tuple, 226 enum nf_nat_manip_type maniptype) 227 { 228 struct icmphdr *hdr; 229 230 if (skb_ensure_writable(skb, hdroff + sizeof(*hdr))) 231 return false; 232 233 hdr = (struct icmphdr *)(skb->data + hdroff); 234 switch (hdr->type) { 235 case ICMP_ECHO: 236 case ICMP_ECHOREPLY: 237 case ICMP_TIMESTAMP: 238 case ICMP_TIMESTAMPREPLY: 239 case ICMP_INFO_REQUEST: 240 case ICMP_INFO_REPLY: 241 case ICMP_ADDRESS: 242 case ICMP_ADDRESSREPLY: 243 break; 244 default: 245 return true; 246 } 247 inet_proto_csum_replace2(&hdr->checksum, skb, 248 hdr->un.echo.id, tuple->src.u.icmp.id, false); 249 hdr->un.echo.id = tuple->src.u.icmp.id; 250 return true; 251 } 252 253 static bool 254 icmpv6_manip_pkt(struct sk_buff *skb, 255 unsigned int iphdroff, unsigned int hdroff, 256 const struct nf_conntrack_tuple *tuple, 257 enum nf_nat_manip_type maniptype) 258 { 259 struct icmp6hdr *hdr; 260 261 if (skb_ensure_writable(skb, hdroff + sizeof(*hdr))) 262 return false; 263 264 hdr = (struct icmp6hdr *)(skb->data + hdroff); 265 nf_csum_update(skb, iphdroff, &hdr->icmp6_cksum, tuple, maniptype); 266 if (hdr->icmp6_type == ICMPV6_ECHO_REQUEST || 267 hdr->icmp6_type == ICMPV6_ECHO_REPLY) { 268 inet_proto_csum_replace2(&hdr->icmp6_cksum, skb, 269 hdr->icmp6_identifier, 270 tuple->src.u.icmp.id, false); 271 hdr->icmp6_identifier = tuple->src.u.icmp.id; 272 } 273 return true; 274 } 275 276 /* manipulate a GRE packet according to maniptype */ 277 static bool 278 gre_manip_pkt(struct sk_buff *skb, 279 unsigned int iphdroff, unsigned int hdroff, 280 const struct nf_conntrack_tuple *tuple, 281 enum nf_nat_manip_type maniptype) 282 { 283 #if IS_ENABLED(CONFIG_NF_CT_PROTO_GRE) 284 const struct gre_base_hdr *greh; 285 struct pptp_gre_header *pgreh; 286 287 /* pgreh includes two optional 32bit fields which are not required 288 * to be there. That's where the magic '8' comes from */ 289 if (skb_ensure_writable(skb, hdroff + sizeof(*pgreh) - 8)) 290 return false; 291 292 greh = (void *)skb->data + hdroff; 293 pgreh = (struct pptp_gre_header *)greh; 294 295 /* we only have destination manip of a packet, since 'source key' 296 * is not present in the packet itself */ 297 if (maniptype != NF_NAT_MANIP_DST) 298 return true; 299 300 switch (greh->flags & GRE_VERSION) { 301 case GRE_VERSION_0: 302 /* We do not currently NAT any GREv0 packets. 303 * Try to behave like "nf_nat_proto_unknown" */ 304 break; 305 case GRE_VERSION_1: 306 pr_debug("call_id -> 0x%04x\n", ntohs(tuple->dst.u.gre.key)); 307 pgreh->call_id = tuple->dst.u.gre.key; 308 break; 309 default: 310 pr_debug("can't nat unknown GRE version\n"); 311 return false; 312 } 313 #endif 314 return true; 315 } 316 317 static bool l4proto_manip_pkt(struct sk_buff *skb, 318 unsigned int iphdroff, unsigned int hdroff, 319 const struct nf_conntrack_tuple *tuple, 320 enum nf_nat_manip_type maniptype) 321 { 322 switch (tuple->dst.protonum) { 323 case IPPROTO_TCP: 324 return tcp_manip_pkt(skb, iphdroff, hdroff, 325 tuple, maniptype); 326 case IPPROTO_UDP: 327 return udp_manip_pkt(skb, iphdroff, hdroff, 328 tuple, maniptype); 329 case IPPROTO_UDPLITE: 330 return udplite_manip_pkt(skb, iphdroff, hdroff, 331 tuple, maniptype); 332 case IPPROTO_SCTP: 333 return sctp_manip_pkt(skb, iphdroff, hdroff, 334 tuple, maniptype); 335 case IPPROTO_ICMP: 336 return icmp_manip_pkt(skb, iphdroff, hdroff, 337 tuple, maniptype); 338 case IPPROTO_ICMPV6: 339 return icmpv6_manip_pkt(skb, iphdroff, hdroff, 340 tuple, maniptype); 341 case IPPROTO_DCCP: 342 return dccp_manip_pkt(skb, iphdroff, hdroff, 343 tuple, maniptype); 344 case IPPROTO_GRE: 345 return gre_manip_pkt(skb, iphdroff, hdroff, 346 tuple, maniptype); 347 } 348 349 /* If we don't know protocol -- no error, pass it unmodified. */ 350 return true; 351 } 352 353 static bool nf_nat_ipv4_manip_pkt(struct sk_buff *skb, 354 unsigned int iphdroff, 355 const struct nf_conntrack_tuple *target, 356 enum nf_nat_manip_type maniptype) 357 { 358 struct iphdr *iph; 359 unsigned int hdroff; 360 361 if (skb_ensure_writable(skb, iphdroff + sizeof(*iph))) 362 return false; 363 364 iph = (void *)skb->data + iphdroff; 365 hdroff = iphdroff + iph->ihl * 4; 366 367 if (!l4proto_manip_pkt(skb, iphdroff, hdroff, target, maniptype)) 368 return false; 369 iph = (void *)skb->data + iphdroff; 370 371 if (maniptype == NF_NAT_MANIP_SRC) { 372 csum_replace4(&iph->check, iph->saddr, target->src.u3.ip); 373 iph->saddr = target->src.u3.ip; 374 } else { 375 csum_replace4(&iph->check, iph->daddr, target->dst.u3.ip); 376 iph->daddr = target->dst.u3.ip; 377 } 378 return true; 379 } 380 381 static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb, 382 unsigned int iphdroff, 383 const struct nf_conntrack_tuple *target, 384 enum nf_nat_manip_type maniptype) 385 { 386 #if IS_ENABLED(CONFIG_IPV6) 387 struct ipv6hdr *ipv6h; 388 __be16 frag_off; 389 int hdroff; 390 u8 nexthdr; 391 392 if (skb_ensure_writable(skb, iphdroff + sizeof(*ipv6h))) 393 return false; 394 395 ipv6h = (void *)skb->data + iphdroff; 396 nexthdr = ipv6h->nexthdr; 397 hdroff = ipv6_skip_exthdr(skb, iphdroff + sizeof(*ipv6h), 398 &nexthdr, &frag_off); 399 if (hdroff < 0) 400 goto manip_addr; 401 402 if ((frag_off & htons(~0x7)) == 0 && 403 !l4proto_manip_pkt(skb, iphdroff, hdroff, target, maniptype)) 404 return false; 405 406 /* must reload, offset might have changed */ 407 ipv6h = (void *)skb->data + iphdroff; 408 409 manip_addr: 410 if (maniptype == NF_NAT_MANIP_SRC) 411 ipv6h->saddr = target->src.u3.in6; 412 else 413 ipv6h->daddr = target->dst.u3.in6; 414 415 #endif 416 return true; 417 } 418 419 unsigned int nf_nat_manip_pkt(struct sk_buff *skb, struct nf_conn *ct, 420 enum nf_nat_manip_type mtype, 421 enum ip_conntrack_dir dir) 422 { 423 struct nf_conntrack_tuple target; 424 425 /* We are aiming to look like inverse of other direction. */ 426 nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple); 427 428 switch (target.src.l3num) { 429 case NFPROTO_IPV6: 430 if (nf_nat_ipv6_manip_pkt(skb, 0, &target, mtype)) 431 return NF_ACCEPT; 432 break; 433 case NFPROTO_IPV4: 434 if (nf_nat_ipv4_manip_pkt(skb, 0, &target, mtype)) 435 return NF_ACCEPT; 436 break; 437 default: 438 WARN_ON_ONCE(1); 439 break; 440 } 441 442 return NF_DROP; 443 } 444 445 static void nf_nat_ipv4_csum_update(struct sk_buff *skb, 446 unsigned int iphdroff, __sum16 *check, 447 const struct nf_conntrack_tuple *t, 448 enum nf_nat_manip_type maniptype) 449 { 450 struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff); 451 __be32 oldip, newip; 452 453 if (maniptype == NF_NAT_MANIP_SRC) { 454 oldip = iph->saddr; 455 newip = t->src.u3.ip; 456 } else { 457 oldip = iph->daddr; 458 newip = t->dst.u3.ip; 459 } 460 inet_proto_csum_replace4(check, skb, oldip, newip, true); 461 } 462 463 static void nf_nat_ipv6_csum_update(struct sk_buff *skb, 464 unsigned int iphdroff, __sum16 *check, 465 const struct nf_conntrack_tuple *t, 466 enum nf_nat_manip_type maniptype) 467 { 468 #if IS_ENABLED(CONFIG_IPV6) 469 const struct ipv6hdr *ipv6h = (struct ipv6hdr *)(skb->data + iphdroff); 470 const struct in6_addr *oldip, *newip; 471 472 if (maniptype == NF_NAT_MANIP_SRC) { 473 oldip = &ipv6h->saddr; 474 newip = &t->src.u3.in6; 475 } else { 476 oldip = &ipv6h->daddr; 477 newip = &t->dst.u3.in6; 478 } 479 inet_proto_csum_replace16(check, skb, oldip->s6_addr32, 480 newip->s6_addr32, true); 481 #endif 482 } 483 484 static void nf_csum_update(struct sk_buff *skb, 485 unsigned int iphdroff, __sum16 *check, 486 const struct nf_conntrack_tuple *t, 487 enum nf_nat_manip_type maniptype) 488 { 489 switch (t->src.l3num) { 490 case NFPROTO_IPV4: 491 nf_nat_ipv4_csum_update(skb, iphdroff, check, t, maniptype); 492 return; 493 case NFPROTO_IPV6: 494 nf_nat_ipv6_csum_update(skb, iphdroff, check, t, maniptype); 495 return; 496 } 497 } 498 499 static void nf_nat_ipv4_csum_recalc(struct sk_buff *skb, 500 u8 proto, void *data, __sum16 *check, 501 int datalen, int oldlen) 502 { 503 if (skb->ip_summed != CHECKSUM_PARTIAL) { 504 const struct iphdr *iph = ip_hdr(skb); 505 506 skb->ip_summed = CHECKSUM_PARTIAL; 507 skb->csum_start = skb_headroom(skb) + skb_network_offset(skb) + 508 ip_hdrlen(skb); 509 skb->csum_offset = (void *)check - data; 510 *check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, datalen, 511 proto, 0); 512 } else { 513 inet_proto_csum_replace2(check, skb, 514 htons(oldlen), htons(datalen), true); 515 } 516 } 517 518 #if IS_ENABLED(CONFIG_IPV6) 519 static void nf_nat_ipv6_csum_recalc(struct sk_buff *skb, 520 u8 proto, void *data, __sum16 *check, 521 int datalen, int oldlen) 522 { 523 if (skb->ip_summed != CHECKSUM_PARTIAL) { 524 const struct ipv6hdr *ipv6h = ipv6_hdr(skb); 525 526 skb->ip_summed = CHECKSUM_PARTIAL; 527 skb->csum_start = skb_headroom(skb) + skb_network_offset(skb) + 528 (data - (void *)skb->data); 529 skb->csum_offset = (void *)check - data; 530 *check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, 531 datalen, proto, 0); 532 } else { 533 inet_proto_csum_replace2(check, skb, 534 htons(oldlen), htons(datalen), true); 535 } 536 } 537 #endif 538 539 void nf_nat_csum_recalc(struct sk_buff *skb, 540 u8 nfproto, u8 proto, void *data, __sum16 *check, 541 int datalen, int oldlen) 542 { 543 switch (nfproto) { 544 case NFPROTO_IPV4: 545 nf_nat_ipv4_csum_recalc(skb, proto, data, check, 546 datalen, oldlen); 547 return; 548 #if IS_ENABLED(CONFIG_IPV6) 549 case NFPROTO_IPV6: 550 nf_nat_ipv6_csum_recalc(skb, proto, data, check, 551 datalen, oldlen); 552 return; 553 #endif 554 } 555 556 WARN_ON_ONCE(1); 557 } 558 559 int nf_nat_icmp_reply_translation(struct sk_buff *skb, 560 struct nf_conn *ct, 561 enum ip_conntrack_info ctinfo, 562 unsigned int hooknum) 563 { 564 struct { 565 struct icmphdr icmp; 566 struct iphdr ip; 567 } *inside; 568 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 569 enum nf_nat_manip_type manip = HOOK2MANIP(hooknum); 570 unsigned int hdrlen = ip_hdrlen(skb); 571 struct nf_conntrack_tuple target; 572 unsigned long statusbit; 573 574 WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY); 575 576 if (skb_ensure_writable(skb, hdrlen + sizeof(*inside))) 577 return 0; 578 if (nf_ip_checksum(skb, hooknum, hdrlen, IPPROTO_ICMP)) 579 return 0; 580 581 inside = (void *)skb->data + hdrlen; 582 if (inside->icmp.type == ICMP_REDIRECT) { 583 if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK) 584 return 0; 585 if (ct->status & IPS_NAT_MASK) 586 return 0; 587 } 588 589 if (manip == NF_NAT_MANIP_SRC) 590 statusbit = IPS_SRC_NAT; 591 else 592 statusbit = IPS_DST_NAT; 593 594 /* Invert if this is reply direction */ 595 if (dir == IP_CT_DIR_REPLY) 596 statusbit ^= IPS_NAT_MASK; 597 598 if (!(ct->status & statusbit)) 599 return 1; 600 601 if (!nf_nat_ipv4_manip_pkt(skb, hdrlen + sizeof(inside->icmp), 602 &ct->tuplehash[!dir].tuple, !manip)) 603 return 0; 604 605 if (skb->ip_summed != CHECKSUM_PARTIAL) { 606 /* Reloading "inside" here since manip_pkt may reallocate */ 607 inside = (void *)skb->data + hdrlen; 608 inside->icmp.checksum = 0; 609 inside->icmp.checksum = 610 csum_fold(skb_checksum(skb, hdrlen, 611 skb->len - hdrlen, 0)); 612 } 613 614 /* Change outer to look like the reply to an incoming packet */ 615 nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple); 616 target.dst.protonum = IPPROTO_ICMP; 617 if (!nf_nat_ipv4_manip_pkt(skb, 0, &target, manip)) 618 return 0; 619 620 return 1; 621 } 622 EXPORT_SYMBOL_GPL(nf_nat_icmp_reply_translation); 623 624 static unsigned int 625 nf_nat_ipv4_fn(void *priv, struct sk_buff *skb, 626 const struct nf_hook_state *state) 627 { 628 struct nf_conn *ct; 629 enum ip_conntrack_info ctinfo; 630 631 ct = nf_ct_get(skb, &ctinfo); 632 if (!ct) 633 return NF_ACCEPT; 634 635 if (ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY) { 636 if (ip_hdr(skb)->protocol == IPPROTO_ICMP) { 637 if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo, 638 state->hook)) 639 return NF_DROP; 640 else 641 return NF_ACCEPT; 642 } 643 } 644 645 return nf_nat_inet_fn(priv, skb, state); 646 } 647 648 static unsigned int 649 nf_nat_ipv4_pre_routing(void *priv, struct sk_buff *skb, 650 const struct nf_hook_state *state) 651 { 652 unsigned int ret; 653 __be32 daddr = ip_hdr(skb)->daddr; 654 655 ret = nf_nat_ipv4_fn(priv, skb, state); 656 if (ret == NF_ACCEPT && daddr != ip_hdr(skb)->daddr) 657 skb_dst_drop(skb); 658 659 return ret; 660 } 661 662 static unsigned int 663 nf_nat_ipv4_local_in(void *priv, struct sk_buff *skb, 664 const struct nf_hook_state *state) 665 { 666 __be32 saddr = ip_hdr(skb)->saddr; 667 struct sock *sk = skb->sk; 668 unsigned int ret; 669 670 ret = nf_nat_ipv4_fn(priv, skb, state); 671 672 if (ret == NF_ACCEPT && sk && saddr != ip_hdr(skb)->saddr && 673 !inet_sk_transparent(sk)) 674 skb_orphan(skb); /* TCP edemux obtained wrong socket */ 675 676 return ret; 677 } 678 679 static unsigned int 680 nf_nat_ipv4_out(void *priv, struct sk_buff *skb, 681 const struct nf_hook_state *state) 682 { 683 #ifdef CONFIG_XFRM 684 const struct nf_conn *ct; 685 enum ip_conntrack_info ctinfo; 686 int err; 687 #endif 688 unsigned int ret; 689 690 ret = nf_nat_ipv4_fn(priv, skb, state); 691 #ifdef CONFIG_XFRM 692 if (ret != NF_ACCEPT) 693 return ret; 694 695 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) 696 return ret; 697 698 ct = nf_ct_get(skb, &ctinfo); 699 if (ct) { 700 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 701 702 if (ct->tuplehash[dir].tuple.src.u3.ip != 703 ct->tuplehash[!dir].tuple.dst.u3.ip || 704 (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP && 705 ct->tuplehash[dir].tuple.src.u.all != 706 ct->tuplehash[!dir].tuple.dst.u.all)) { 707 err = nf_xfrm_me_harder(state->net, skb, AF_INET); 708 if (err < 0) 709 ret = NF_DROP_ERR(err); 710 } 711 } 712 #endif 713 return ret; 714 } 715 716 static unsigned int 717 nf_nat_ipv4_local_fn(void *priv, struct sk_buff *skb, 718 const struct nf_hook_state *state) 719 { 720 const struct nf_conn *ct; 721 enum ip_conntrack_info ctinfo; 722 unsigned int ret; 723 int err; 724 725 ret = nf_nat_ipv4_fn(priv, skb, state); 726 if (ret != NF_ACCEPT) 727 return ret; 728 729 ct = nf_ct_get(skb, &ctinfo); 730 if (ct) { 731 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 732 733 if (ct->tuplehash[dir].tuple.dst.u3.ip != 734 ct->tuplehash[!dir].tuple.src.u3.ip) { 735 err = ip_route_me_harder(state->net, state->sk, skb, RTN_UNSPEC); 736 if (err < 0) 737 ret = NF_DROP_ERR(err); 738 } 739 #ifdef CONFIG_XFRM 740 else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && 741 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP && 742 ct->tuplehash[dir].tuple.dst.u.all != 743 ct->tuplehash[!dir].tuple.src.u.all) { 744 err = nf_xfrm_me_harder(state->net, skb, AF_INET); 745 if (err < 0) 746 ret = NF_DROP_ERR(err); 747 } 748 #endif 749 } 750 return ret; 751 } 752 753 static const struct nf_hook_ops nf_nat_ipv4_ops[] = { 754 /* Before packet filtering, change destination */ 755 { 756 .hook = nf_nat_ipv4_pre_routing, 757 .pf = NFPROTO_IPV4, 758 .hooknum = NF_INET_PRE_ROUTING, 759 .priority = NF_IP_PRI_NAT_DST, 760 }, 761 /* After packet filtering, change source */ 762 { 763 .hook = nf_nat_ipv4_out, 764 .pf = NFPROTO_IPV4, 765 .hooknum = NF_INET_POST_ROUTING, 766 .priority = NF_IP_PRI_NAT_SRC, 767 }, 768 /* Before packet filtering, change destination */ 769 { 770 .hook = nf_nat_ipv4_local_fn, 771 .pf = NFPROTO_IPV4, 772 .hooknum = NF_INET_LOCAL_OUT, 773 .priority = NF_IP_PRI_NAT_DST, 774 }, 775 /* After packet filtering, change source */ 776 { 777 .hook = nf_nat_ipv4_local_in, 778 .pf = NFPROTO_IPV4, 779 .hooknum = NF_INET_LOCAL_IN, 780 .priority = NF_IP_PRI_NAT_SRC, 781 }, 782 }; 783 784 int nf_nat_ipv4_register_fn(struct net *net, const struct nf_hook_ops *ops) 785 { 786 return nf_nat_register_fn(net, ops->pf, ops, nf_nat_ipv4_ops, 787 ARRAY_SIZE(nf_nat_ipv4_ops)); 788 } 789 EXPORT_SYMBOL_GPL(nf_nat_ipv4_register_fn); 790 791 void nf_nat_ipv4_unregister_fn(struct net *net, const struct nf_hook_ops *ops) 792 { 793 nf_nat_unregister_fn(net, ops->pf, ops, ARRAY_SIZE(nf_nat_ipv4_ops)); 794 } 795 EXPORT_SYMBOL_GPL(nf_nat_ipv4_unregister_fn); 796 797 #if IS_ENABLED(CONFIG_IPV6) 798 int nf_nat_icmpv6_reply_translation(struct sk_buff *skb, 799 struct nf_conn *ct, 800 enum ip_conntrack_info ctinfo, 801 unsigned int hooknum, 802 unsigned int hdrlen) 803 { 804 struct { 805 struct icmp6hdr icmp6; 806 struct ipv6hdr ip6; 807 } *inside; 808 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 809 enum nf_nat_manip_type manip = HOOK2MANIP(hooknum); 810 struct nf_conntrack_tuple target; 811 unsigned long statusbit; 812 813 WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY); 814 815 if (skb_ensure_writable(skb, hdrlen + sizeof(*inside))) 816 return 0; 817 if (nf_ip6_checksum(skb, hooknum, hdrlen, IPPROTO_ICMPV6)) 818 return 0; 819 820 inside = (void *)skb->data + hdrlen; 821 if (inside->icmp6.icmp6_type == NDISC_REDIRECT) { 822 if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK) 823 return 0; 824 if (ct->status & IPS_NAT_MASK) 825 return 0; 826 } 827 828 if (manip == NF_NAT_MANIP_SRC) 829 statusbit = IPS_SRC_NAT; 830 else 831 statusbit = IPS_DST_NAT; 832 833 /* Invert if this is reply direction */ 834 if (dir == IP_CT_DIR_REPLY) 835 statusbit ^= IPS_NAT_MASK; 836 837 if (!(ct->status & statusbit)) 838 return 1; 839 840 if (!nf_nat_ipv6_manip_pkt(skb, hdrlen + sizeof(inside->icmp6), 841 &ct->tuplehash[!dir].tuple, !manip)) 842 return 0; 843 844 if (skb->ip_summed != CHECKSUM_PARTIAL) { 845 struct ipv6hdr *ipv6h = ipv6_hdr(skb); 846 847 inside = (void *)skb->data + hdrlen; 848 inside->icmp6.icmp6_cksum = 0; 849 inside->icmp6.icmp6_cksum = 850 csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, 851 skb->len - hdrlen, IPPROTO_ICMPV6, 852 skb_checksum(skb, hdrlen, 853 skb->len - hdrlen, 0)); 854 } 855 856 nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple); 857 target.dst.protonum = IPPROTO_ICMPV6; 858 if (!nf_nat_ipv6_manip_pkt(skb, 0, &target, manip)) 859 return 0; 860 861 return 1; 862 } 863 EXPORT_SYMBOL_GPL(nf_nat_icmpv6_reply_translation); 864 865 static unsigned int 866 nf_nat_ipv6_fn(void *priv, struct sk_buff *skb, 867 const struct nf_hook_state *state) 868 { 869 struct nf_conn *ct; 870 enum ip_conntrack_info ctinfo; 871 __be16 frag_off; 872 int hdrlen; 873 u8 nexthdr; 874 875 ct = nf_ct_get(skb, &ctinfo); 876 /* Can't track? It's not due to stress, or conntrack would 877 * have dropped it. Hence it's the user's responsibilty to 878 * packet filter it out, or implement conntrack/NAT for that 879 * protocol. 8) --RR 880 */ 881 if (!ct) 882 return NF_ACCEPT; 883 884 if (ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY) { 885 nexthdr = ipv6_hdr(skb)->nexthdr; 886 hdrlen = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), 887 &nexthdr, &frag_off); 888 889 if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) { 890 if (!nf_nat_icmpv6_reply_translation(skb, ct, ctinfo, 891 state->hook, 892 hdrlen)) 893 return NF_DROP; 894 else 895 return NF_ACCEPT; 896 } 897 } 898 899 return nf_nat_inet_fn(priv, skb, state); 900 } 901 902 static unsigned int 903 nf_nat_ipv6_in(void *priv, struct sk_buff *skb, 904 const struct nf_hook_state *state) 905 { 906 unsigned int ret; 907 struct in6_addr daddr = ipv6_hdr(skb)->daddr; 908 909 ret = nf_nat_ipv6_fn(priv, skb, state); 910 if (ret != NF_DROP && ret != NF_STOLEN && 911 ipv6_addr_cmp(&daddr, &ipv6_hdr(skb)->daddr)) 912 skb_dst_drop(skb); 913 914 return ret; 915 } 916 917 static unsigned int 918 nf_nat_ipv6_out(void *priv, struct sk_buff *skb, 919 const struct nf_hook_state *state) 920 { 921 #ifdef CONFIG_XFRM 922 const struct nf_conn *ct; 923 enum ip_conntrack_info ctinfo; 924 int err; 925 #endif 926 unsigned int ret; 927 928 ret = nf_nat_ipv6_fn(priv, skb, state); 929 #ifdef CONFIG_XFRM 930 if (ret != NF_ACCEPT) 931 return ret; 932 933 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) 934 return ret; 935 ct = nf_ct_get(skb, &ctinfo); 936 if (ct) { 937 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 938 939 if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3, 940 &ct->tuplehash[!dir].tuple.dst.u3) || 941 (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 && 942 ct->tuplehash[dir].tuple.src.u.all != 943 ct->tuplehash[!dir].tuple.dst.u.all)) { 944 err = nf_xfrm_me_harder(state->net, skb, AF_INET6); 945 if (err < 0) 946 ret = NF_DROP_ERR(err); 947 } 948 } 949 #endif 950 951 return ret; 952 } 953 954 static unsigned int 955 nf_nat_ipv6_local_fn(void *priv, struct sk_buff *skb, 956 const struct nf_hook_state *state) 957 { 958 const struct nf_conn *ct; 959 enum ip_conntrack_info ctinfo; 960 unsigned int ret; 961 int err; 962 963 ret = nf_nat_ipv6_fn(priv, skb, state); 964 if (ret != NF_ACCEPT) 965 return ret; 966 967 ct = nf_ct_get(skb, &ctinfo); 968 if (ct) { 969 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 970 971 if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3, 972 &ct->tuplehash[!dir].tuple.src.u3)) { 973 err = nf_ip6_route_me_harder(state->net, state->sk, skb); 974 if (err < 0) 975 ret = NF_DROP_ERR(err); 976 } 977 #ifdef CONFIG_XFRM 978 else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) && 979 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 && 980 ct->tuplehash[dir].tuple.dst.u.all != 981 ct->tuplehash[!dir].tuple.src.u.all) { 982 err = nf_xfrm_me_harder(state->net, skb, AF_INET6); 983 if (err < 0) 984 ret = NF_DROP_ERR(err); 985 } 986 #endif 987 } 988 989 return ret; 990 } 991 992 static const struct nf_hook_ops nf_nat_ipv6_ops[] = { 993 /* Before packet filtering, change destination */ 994 { 995 .hook = nf_nat_ipv6_in, 996 .pf = NFPROTO_IPV6, 997 .hooknum = NF_INET_PRE_ROUTING, 998 .priority = NF_IP6_PRI_NAT_DST, 999 }, 1000 /* After packet filtering, change source */ 1001 { 1002 .hook = nf_nat_ipv6_out, 1003 .pf = NFPROTO_IPV6, 1004 .hooknum = NF_INET_POST_ROUTING, 1005 .priority = NF_IP6_PRI_NAT_SRC, 1006 }, 1007 /* Before packet filtering, change destination */ 1008 { 1009 .hook = nf_nat_ipv6_local_fn, 1010 .pf = NFPROTO_IPV6, 1011 .hooknum = NF_INET_LOCAL_OUT, 1012 .priority = NF_IP6_PRI_NAT_DST, 1013 }, 1014 /* After packet filtering, change source */ 1015 { 1016 .hook = nf_nat_ipv6_fn, 1017 .pf = NFPROTO_IPV6, 1018 .hooknum = NF_INET_LOCAL_IN, 1019 .priority = NF_IP6_PRI_NAT_SRC, 1020 }, 1021 }; 1022 1023 int nf_nat_ipv6_register_fn(struct net *net, const struct nf_hook_ops *ops) 1024 { 1025 return nf_nat_register_fn(net, ops->pf, ops, nf_nat_ipv6_ops, 1026 ARRAY_SIZE(nf_nat_ipv6_ops)); 1027 } 1028 EXPORT_SYMBOL_GPL(nf_nat_ipv6_register_fn); 1029 1030 void nf_nat_ipv6_unregister_fn(struct net *net, const struct nf_hook_ops *ops) 1031 { 1032 nf_nat_unregister_fn(net, ops->pf, ops, ARRAY_SIZE(nf_nat_ipv6_ops)); 1033 } 1034 EXPORT_SYMBOL_GPL(nf_nat_ipv6_unregister_fn); 1035 #endif /* CONFIG_IPV6 */ 1036 1037 #if defined(CONFIG_NF_TABLES_INET) && IS_ENABLED(CONFIG_NFT_NAT) 1038 int nf_nat_inet_register_fn(struct net *net, const struct nf_hook_ops *ops) 1039 { 1040 int ret; 1041 1042 if (WARN_ON_ONCE(ops->pf != NFPROTO_INET)) 1043 return -EINVAL; 1044 1045 ret = nf_nat_register_fn(net, NFPROTO_IPV6, ops, nf_nat_ipv6_ops, 1046 ARRAY_SIZE(nf_nat_ipv6_ops)); 1047 if (ret) 1048 return ret; 1049 1050 ret = nf_nat_register_fn(net, NFPROTO_IPV4, ops, nf_nat_ipv4_ops, 1051 ARRAY_SIZE(nf_nat_ipv4_ops)); 1052 if (ret) 1053 nf_nat_unregister_fn(net, NFPROTO_IPV6, ops, 1054 ARRAY_SIZE(nf_nat_ipv6_ops)); 1055 return ret; 1056 } 1057 EXPORT_SYMBOL_GPL(nf_nat_inet_register_fn); 1058 1059 void nf_nat_inet_unregister_fn(struct net *net, const struct nf_hook_ops *ops) 1060 { 1061 nf_nat_unregister_fn(net, NFPROTO_IPV4, ops, ARRAY_SIZE(nf_nat_ipv4_ops)); 1062 nf_nat_unregister_fn(net, NFPROTO_IPV6, ops, ARRAY_SIZE(nf_nat_ipv6_ops)); 1063 } 1064 EXPORT_SYMBOL_GPL(nf_nat_inet_unregister_fn); 1065 #endif /* NFT INET NAT */ 1066