1 /* 2 * Stateless NAT actions 3 * 4 * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> 5 * 6 * This program is free software; you can redistribute it and/or modify it 7 * under the terms of the GNU General Public License as published by the Free 8 * Software Foundation; either version 2 of the License, or (at your option) 9 * any later version. 10 */ 11 12 #include <linux/errno.h> 13 #include <linux/init.h> 14 #include <linux/kernel.h> 15 #include <linux/module.h> 16 #include <linux/netfilter.h> 17 #include <linux/rtnetlink.h> 18 #include <linux/skbuff.h> 19 #include <linux/slab.h> 20 #include <linux/spinlock.h> 21 #include <linux/string.h> 22 #include <linux/tc_act/tc_nat.h> 23 #include <net/act_api.h> 24 #include <net/icmp.h> 25 #include <net/ip.h> 26 #include <net/netlink.h> 27 #include <net/tc_act/tc_nat.h> 28 #include <net/tcp.h> 29 #include <net/udp.h> 30 31 32 #define NAT_TAB_MASK 15 33 34 static unsigned int nat_net_id; 35 static struct tc_action_ops act_nat_ops; 36 37 static const struct nla_policy nat_policy[TCA_NAT_MAX + 1] = { 38 [TCA_NAT_PARMS] = { .len = sizeof(struct tc_nat) }, 39 }; 40 41 static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est, 42 struct tc_action **a, int ovr, int bind) 43 { 44 struct tc_action_net *tn = net_generic(net, nat_net_id); 45 struct nlattr *tb[TCA_NAT_MAX + 1]; 46 struct tc_nat *parm; 47 int ret = 0, err; 48 struct tcf_nat *p; 49 50 if (nla == NULL) 51 return -EINVAL; 52 53 err = nla_parse_nested(tb, TCA_NAT_MAX, nla, nat_policy, NULL); 54 if (err < 0) 55 return err; 56 57 if (tb[TCA_NAT_PARMS] == NULL) 58 return -EINVAL; 59 parm = nla_data(tb[TCA_NAT_PARMS]); 60 61 if (!tcf_hash_check(tn, parm->index, a, bind)) { 62 ret = tcf_hash_create(tn, parm->index, est, a, 63 &act_nat_ops, bind, false); 64 if (ret) 65 return ret; 66 ret = ACT_P_CREATED; 67 } else { 68 if (bind) 69 return 0; 70 tcf_hash_release(*a, bind); 71 if (!ovr) 72 return -EEXIST; 73 } 74 p = to_tcf_nat(*a); 75 76 spin_lock_bh(&p->tcf_lock); 77 p->old_addr = parm->old_addr; 78 p->new_addr = parm->new_addr; 79 p->mask = parm->mask; 80 p->flags = parm->flags; 81 82 p->tcf_action = parm->action; 83 spin_unlock_bh(&p->tcf_lock); 84 85 if (ret == ACT_P_CREATED) 86 tcf_hash_insert(tn, *a); 87 88 return ret; 89 } 90 91 static int tcf_nat(struct sk_buff *skb, const struct tc_action *a, 92 struct tcf_result *res) 93 { 94 struct tcf_nat *p = to_tcf_nat(a); 95 struct iphdr *iph; 96 __be32 old_addr; 97 __be32 new_addr; 98 __be32 mask; 99 __be32 addr; 100 int egress; 101 int action; 102 int ihl; 103 int noff; 104 105 spin_lock(&p->tcf_lock); 106 107 tcf_lastuse_update(&p->tcf_tm); 108 old_addr = p->old_addr; 109 new_addr = p->new_addr; 110 mask = p->mask; 111 egress = p->flags & TCA_NAT_FLAG_EGRESS; 112 action = p->tcf_action; 113 114 bstats_update(&p->tcf_bstats, skb); 115 116 spin_unlock(&p->tcf_lock); 117 118 if (unlikely(action == TC_ACT_SHOT)) 119 goto drop; 120 121 noff = skb_network_offset(skb); 122 if (!pskb_may_pull(skb, sizeof(*iph) + noff)) 123 goto drop; 124 125 iph = ip_hdr(skb); 126 127 if (egress) 128 addr = iph->saddr; 129 else 130 addr = iph->daddr; 131 132 if (!((old_addr ^ addr) & mask)) { 133 if (skb_try_make_writable(skb, sizeof(*iph) + noff)) 134 goto drop; 135 136 new_addr &= mask; 137 new_addr |= addr & ~mask; 138 139 /* Rewrite IP header */ 140 iph = ip_hdr(skb); 141 if (egress) 142 iph->saddr = new_addr; 143 else 144 iph->daddr = new_addr; 145 146 csum_replace4(&iph->check, addr, new_addr); 147 } else if ((iph->frag_off & htons(IP_OFFSET)) || 148 iph->protocol != IPPROTO_ICMP) { 149 goto out; 150 } 151 152 ihl = iph->ihl * 4; 153 154 /* It would be nice to share code with stateful NAT. */ 155 switch (iph->frag_off & htons(IP_OFFSET) ? 0 : iph->protocol) { 156 case IPPROTO_TCP: 157 { 158 struct tcphdr *tcph; 159 160 if (!pskb_may_pull(skb, ihl + sizeof(*tcph) + noff) || 161 skb_try_make_writable(skb, ihl + sizeof(*tcph) + noff)) 162 goto drop; 163 164 tcph = (void *)(skb_network_header(skb) + ihl); 165 inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, 166 true); 167 break; 168 } 169 case IPPROTO_UDP: 170 { 171 struct udphdr *udph; 172 173 if (!pskb_may_pull(skb, ihl + sizeof(*udph) + noff) || 174 skb_try_make_writable(skb, ihl + sizeof(*udph) + noff)) 175 goto drop; 176 177 udph = (void *)(skb_network_header(skb) + ihl); 178 if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { 179 inet_proto_csum_replace4(&udph->check, skb, addr, 180 new_addr, true); 181 if (!udph->check) 182 udph->check = CSUM_MANGLED_0; 183 } 184 break; 185 } 186 case IPPROTO_ICMP: 187 { 188 struct icmphdr *icmph; 189 190 if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + noff)) 191 goto drop; 192 193 icmph = (void *)(skb_network_header(skb) + ihl); 194 195 if ((icmph->type != ICMP_DEST_UNREACH) && 196 (icmph->type != ICMP_TIME_EXCEEDED) && 197 (icmph->type != ICMP_PARAMETERPROB)) 198 break; 199 200 if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph) + 201 noff)) 202 goto drop; 203 204 icmph = (void *)(skb_network_header(skb) + ihl); 205 iph = (void *)(icmph + 1); 206 if (egress) 207 addr = iph->daddr; 208 else 209 addr = iph->saddr; 210 211 if ((old_addr ^ addr) & mask) 212 break; 213 214 if (skb_try_make_writable(skb, ihl + sizeof(*icmph) + 215 sizeof(*iph) + noff)) 216 goto drop; 217 218 icmph = (void *)(skb_network_header(skb) + ihl); 219 iph = (void *)(icmph + 1); 220 221 new_addr &= mask; 222 new_addr |= addr & ~mask; 223 224 /* XXX Fix up the inner checksums. */ 225 if (egress) 226 iph->daddr = new_addr; 227 else 228 iph->saddr = new_addr; 229 230 inet_proto_csum_replace4(&icmph->checksum, skb, addr, new_addr, 231 false); 232 break; 233 } 234 default: 235 break; 236 } 237 238 out: 239 return action; 240 241 drop: 242 spin_lock(&p->tcf_lock); 243 p->tcf_qstats.drops++; 244 spin_unlock(&p->tcf_lock); 245 return TC_ACT_SHOT; 246 } 247 248 static int tcf_nat_dump(struct sk_buff *skb, struct tc_action *a, 249 int bind, int ref) 250 { 251 unsigned char *b = skb_tail_pointer(skb); 252 struct tcf_nat *p = to_tcf_nat(a); 253 struct tc_nat opt = { 254 .old_addr = p->old_addr, 255 .new_addr = p->new_addr, 256 .mask = p->mask, 257 .flags = p->flags, 258 259 .index = p->tcf_index, 260 .action = p->tcf_action, 261 .refcnt = p->tcf_refcnt - ref, 262 .bindcnt = p->tcf_bindcnt - bind, 263 }; 264 struct tcf_t t; 265 266 if (nla_put(skb, TCA_NAT_PARMS, sizeof(opt), &opt)) 267 goto nla_put_failure; 268 269 tcf_tm_dump(&t, &p->tcf_tm); 270 if (nla_put_64bit(skb, TCA_NAT_TM, sizeof(t), &t, TCA_NAT_PAD)) 271 goto nla_put_failure; 272 273 return skb->len; 274 275 nla_put_failure: 276 nlmsg_trim(skb, b); 277 return -1; 278 } 279 280 static int tcf_nat_walker(struct net *net, struct sk_buff *skb, 281 struct netlink_callback *cb, int type, 282 const struct tc_action_ops *ops) 283 { 284 struct tc_action_net *tn = net_generic(net, nat_net_id); 285 286 return tcf_generic_walker(tn, skb, cb, type, ops); 287 } 288 289 static int tcf_nat_search(struct net *net, struct tc_action **a, u32 index) 290 { 291 struct tc_action_net *tn = net_generic(net, nat_net_id); 292 293 return tcf_hash_search(tn, a, index); 294 } 295 296 static struct tc_action_ops act_nat_ops = { 297 .kind = "nat", 298 .type = TCA_ACT_NAT, 299 .owner = THIS_MODULE, 300 .act = tcf_nat, 301 .dump = tcf_nat_dump, 302 .init = tcf_nat_init, 303 .walk = tcf_nat_walker, 304 .lookup = tcf_nat_search, 305 .size = sizeof(struct tcf_nat), 306 }; 307 308 static __net_init int nat_init_net(struct net *net) 309 { 310 struct tc_action_net *tn = net_generic(net, nat_net_id); 311 312 return tc_action_net_init(tn, &act_nat_ops, NAT_TAB_MASK); 313 } 314 315 static void __net_exit nat_exit_net(struct net *net) 316 { 317 struct tc_action_net *tn = net_generic(net, nat_net_id); 318 319 tc_action_net_exit(tn); 320 } 321 322 static struct pernet_operations nat_net_ops = { 323 .init = nat_init_net, 324 .exit = nat_exit_net, 325 .id = &nat_net_id, 326 .size = sizeof(struct tc_action_net), 327 }; 328 329 MODULE_DESCRIPTION("Stateless NAT actions"); 330 MODULE_LICENSE("GPL"); 331 332 static int __init nat_init_module(void) 333 { 334 return tcf_register_action(&act_nat_ops, &nat_net_ops); 335 } 336 337 static void __exit nat_cleanup_module(void) 338 { 339 tcf_unregister_action(&act_nat_ops, &nat_net_ops); 340 } 341 342 module_init(nat_init_module); 343 module_exit(nat_cleanup_module); 344