1 /* ip_nat_helper.c - generic support functions for NAT helpers
3 * (C) 2000-2002 Harald Welte <laforge@netfilter.org>
4 * (C) 2003-2004 Netfilter Core Team <coreteam@netfilter.org>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
10 * 14 Jan 2002 Harald Welte <laforge@gnumonks.org>:
11 * - add support for SACK adjustment
12 * 14 Mar 2002 Harald Welte <laforge@gnumonks.org>:
13 * - merge SACK support into newnat API
14 * 16 Aug 2002 Brian J. Murrell <netfilter@interlinx.bc.ca>:
15 * - make ip_nat_resize_packet more generic (TCP and UDP)
16 * - add ip_nat_mangle_udp_packet
18 #include <linux/module.h>
19 #include <linux/kmod.h>
20 #include <linux/types.h>
21 #include <linux/timer.h>
22 #include <linux/skbuff.h>
23 #include <linux/netfilter_ipv4.h>
24 #include <net/checksum.h>
30 #define ASSERT_READ_LOCK(x)
31 #define ASSERT_WRITE_LOCK(x)
33 #include <linux/netfilter_ipv4/ip_conntrack.h>
34 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
35 #include <linux/netfilter_ipv4/ip_nat.h>
36 #include <linux/netfilter_ipv4/ip_nat_protocol.h>
37 #include <linux/netfilter_ipv4/ip_nat_core.h>
38 #include <linux/netfilter_ipv4/ip_nat_helper.h>
39 #include <linux/netfilter_ipv4/listhelp.h>
43 #define DUMP_OFFSET(x) printk("offset_before=%d, offset_after=%d, correction_pos=%u\n", x->offset_before, x->offset_after, x->correction_pos);
45 #define DEBUGP(format, args...)
46 #define DUMP_OFFSET(x)
49 static DEFINE_SPINLOCK(ip_nat_seqofs_lock
);
51 /* Setup TCP sequence correction given this change at this sequence */
53 adjust_tcp_sequence(u32 seq
,
55 struct ip_conntrack
*ct
,
56 enum ip_conntrack_info ctinfo
)
59 struct ip_nat_seq
*this_way
, *other_way
;
61 DEBUGP("ip_nat_resize_packet: old_size = %u, new_size = %u\n",
62 (*skb
)->len
, new_size
);
64 dir
= CTINFO2DIR(ctinfo
);
66 this_way
= &ct
->nat
.info
.seq
[dir
];
67 other_way
= &ct
->nat
.info
.seq
[!dir
];
69 DEBUGP("ip_nat_resize_packet: Seq_offset before: ");
70 DUMP_OFFSET(this_way
);
72 spin_lock_bh(&ip_nat_seqofs_lock
);
74 /* SYN adjust. If it's uninitialized, or this is after last
75 * correction, record it: we don't handle more than one
76 * adjustment in the window, but do deal with common case of a
78 if (this_way
->offset_before
== this_way
->offset_after
79 || before(this_way
->correction_pos
, seq
)) {
80 this_way
->correction_pos
= seq
;
81 this_way
->offset_before
= this_way
->offset_after
;
82 this_way
->offset_after
+= sizediff
;
84 spin_unlock_bh(&ip_nat_seqofs_lock
);
86 DEBUGP("ip_nat_resize_packet: Seq_offset after: ");
87 DUMP_OFFSET(this_way
);
90 /* Frobs data inside this packet, which is linear. */
91 static void mangle_contents(struct sk_buff
*skb
,
93 unsigned int match_offset
,
94 unsigned int match_len
,
95 const char *rep_buffer
,
100 BUG_ON(skb_is_nonlinear(skb
));
101 data
= (unsigned char *)skb
->nh
.iph
+ dataoff
;
103 /* move post-replacement */
104 memmove(data
+ match_offset
+ rep_len
,
105 data
+ match_offset
+ match_len
,
106 skb
->tail
- (data
+ match_offset
+ match_len
));
108 /* insert data from buffer */
109 memcpy(data
+ match_offset
, rep_buffer
, rep_len
);
111 /* update skb info */
112 if (rep_len
> match_len
) {
113 DEBUGP("ip_nat_mangle_packet: Extending packet by "
114 "%u from %u bytes\n", rep_len
- match_len
,
116 skb_put(skb
, rep_len
- match_len
);
118 DEBUGP("ip_nat_mangle_packet: Shrinking packet from "
119 "%u from %u bytes\n", match_len
- rep_len
,
121 __skb_trim(skb
, skb
->len
+ rep_len
- match_len
);
124 /* fix IP hdr checksum information */
125 skb
->nh
.iph
->tot_len
= htons(skb
->len
);
126 ip_send_check(skb
->nh
.iph
);
129 /* Unusual, but possible case. */
130 static int enlarge_skb(struct sk_buff
**pskb
, unsigned int extra
)
132 struct sk_buff
*nskb
;
134 if ((*pskb
)->len
+ extra
> 65535)
137 nskb
= skb_copy_expand(*pskb
, skb_headroom(*pskb
), extra
, GFP_ATOMIC
);
141 /* Transfer socket to new skb. */
143 skb_set_owner_w(nskb
, (*pskb
)->sk
);
149 /* Generic function for mangling variable-length address changes inside
150 * NATed TCP connections (like the PORT XXX,XXX,XXX,XXX,XXX,XXX
153 * Takes care about all the nasty sequence number changes, checksumming,
154 * skb enlargement, ...
158 ip_nat_mangle_tcp_packet(struct sk_buff
**pskb
,
159 struct ip_conntrack
*ct
,
160 enum ip_conntrack_info ctinfo
,
161 unsigned int match_offset
,
162 unsigned int match_len
,
163 const char *rep_buffer
,
164 unsigned int rep_len
)
170 if (!skb_make_writable(pskb
, (*pskb
)->len
))
173 if (rep_len
> match_len
174 && rep_len
- match_len
> skb_tailroom(*pskb
)
175 && !enlarge_skb(pskb
, rep_len
- match_len
))
178 SKB_LINEAR_ASSERT(*pskb
);
180 iph
= (*pskb
)->nh
.iph
;
181 tcph
= (void *)iph
+ iph
->ihl
*4;
183 mangle_contents(*pskb
, iph
->ihl
*4 + tcph
->doff
*4,
184 match_offset
, match_len
, rep_buffer
, rep_len
);
186 datalen
= (*pskb
)->len
- iph
->ihl
*4;
188 tcph
->check
= tcp_v4_check(tcph
, datalen
, iph
->saddr
, iph
->daddr
,
189 csum_partial((char *)tcph
, datalen
, 0));
191 if (rep_len
!= match_len
) {
192 set_bit(IPS_SEQ_ADJUST_BIT
, &ct
->status
);
193 adjust_tcp_sequence(ntohl(tcph
->seq
),
194 (int)rep_len
- (int)match_len
,
196 /* Tell TCP window tracking about seq change */
197 ip_conntrack_tcp_update(*pskb
, ct
, CTINFO2DIR(ctinfo
));
201 EXPORT_SYMBOL(ip_nat_mangle_tcp_packet
);
203 /* Generic function for mangling variable-length address changes inside
204 * NATed UDP connections (like the CONNECT DATA XXXXX MESG XXXXX INDEX XXXXX
205 * command in the Amanda protocol)
207 * Takes care about all the nasty sequence number changes, checksumming,
208 * skb enlargement, ...
210 * XXX - This function could be merged with ip_nat_mangle_tcp_packet which
211 * should be fairly easy to do.
214 ip_nat_mangle_udp_packet(struct sk_buff
**pskb
,
215 struct ip_conntrack
*ct
,
216 enum ip_conntrack_info ctinfo
,
217 unsigned int match_offset
,
218 unsigned int match_len
,
219 const char *rep_buffer
,
220 unsigned int rep_len
)
225 /* UDP helpers might accidentally mangle the wrong packet */
226 iph
= (*pskb
)->nh
.iph
;
227 if ((*pskb
)->len
< iph
->ihl
*4 + sizeof(*udph
) +
228 match_offset
+ match_len
)
231 if (!skb_make_writable(pskb
, (*pskb
)->len
))
234 if (rep_len
> match_len
235 && rep_len
- match_len
> skb_tailroom(*pskb
)
236 && !enlarge_skb(pskb
, rep_len
- match_len
))
239 iph
= (*pskb
)->nh
.iph
;
240 udph
= (void *)iph
+ iph
->ihl
*4;
241 mangle_contents(*pskb
, iph
->ihl
*4 + sizeof(*udph
),
242 match_offset
, match_len
, rep_buffer
, rep_len
);
244 /* update the length of the UDP packet */
245 udph
->len
= htons((*pskb
)->len
- iph
->ihl
*4);
247 /* fix udp checksum if udp checksum was previously calculated */
249 int datalen
= (*pskb
)->len
- iph
->ihl
* 4;
251 udph
->check
= csum_tcpudp_magic(iph
->saddr
, iph
->daddr
,
252 datalen
, IPPROTO_UDP
,
253 csum_partial((char *)udph
,
259 EXPORT_SYMBOL(ip_nat_mangle_udp_packet
);
261 /* Adjust one found SACK option including checksum correction */
263 sack_adjust(struct sk_buff
*skb
,
265 unsigned int sackoff
,
266 unsigned int sackend
,
267 struct ip_nat_seq
*natseq
)
269 while (sackoff
< sackend
) {
270 struct tcp_sack_block
*sack
;
271 u_int32_t new_start_seq
, new_end_seq
;
273 sack
= (void *)skb
->data
+ sackoff
;
274 if (after(ntohl(sack
->start_seq
) - natseq
->offset_before
,
275 natseq
->correction_pos
))
276 new_start_seq
= ntohl(sack
->start_seq
)
277 - natseq
->offset_after
;
279 new_start_seq
= ntohl(sack
->start_seq
)
280 - natseq
->offset_before
;
281 new_start_seq
= htonl(new_start_seq
);
283 if (after(ntohl(sack
->end_seq
) - natseq
->offset_before
,
284 natseq
->correction_pos
))
285 new_end_seq
= ntohl(sack
->end_seq
)
286 - natseq
->offset_after
;
288 new_end_seq
= ntohl(sack
->end_seq
)
289 - natseq
->offset_before
;
290 new_end_seq
= htonl(new_end_seq
);
292 DEBUGP("sack_adjust: start_seq: %d->%d, end_seq: %d->%d\n",
293 ntohl(sack
->start_seq
), new_start_seq
,
294 ntohl(sack
->end_seq
), new_end_seq
);
297 ip_nat_cheat_check(~sack
->start_seq
, new_start_seq
,
298 ip_nat_cheat_check(~sack
->end_seq
,
301 sack
->start_seq
= new_start_seq
;
302 sack
->end_seq
= new_end_seq
;
303 sackoff
+= sizeof(*sack
);
307 /* TCP SACK sequence number adjustment */
308 static inline unsigned int
309 ip_nat_sack_adjust(struct sk_buff
**pskb
,
311 struct ip_conntrack
*ct
,
312 enum ip_conntrack_info ctinfo
)
314 unsigned int dir
, optoff
, optend
;
316 optoff
= (*pskb
)->nh
.iph
->ihl
*4 + sizeof(struct tcphdr
);
317 optend
= (*pskb
)->nh
.iph
->ihl
*4 + tcph
->doff
*4;
319 if (!skb_make_writable(pskb
, optend
))
322 dir
= CTINFO2DIR(ctinfo
);
324 while (optoff
< optend
) {
325 /* Usually: option, length. */
326 unsigned char *op
= (*pskb
)->data
+ optoff
;
335 /* no partial options */
336 if (optoff
+ 1 == optend
337 || optoff
+ op
[1] > optend
340 if (op
[0] == TCPOPT_SACK
341 && op
[1] >= 2+TCPOLEN_SACK_PERBLOCK
342 && ((op
[1] - 2) % TCPOLEN_SACK_PERBLOCK
) == 0)
343 sack_adjust(*pskb
, tcph
, optoff
+2,
345 &ct
->nat
.info
.seq
[!dir
]);
352 /* TCP sequence number adjustment. Returns 1 on success, 0 on failure */
354 ip_nat_seq_adjust(struct sk_buff
**pskb
,
355 struct ip_conntrack
*ct
,
356 enum ip_conntrack_info ctinfo
)
359 int dir
, newseq
, newack
;
360 struct ip_nat_seq
*this_way
, *other_way
;
362 dir
= CTINFO2DIR(ctinfo
);
364 this_way
= &ct
->nat
.info
.seq
[dir
];
365 other_way
= &ct
->nat
.info
.seq
[!dir
];
367 if (!skb_make_writable(pskb
, (*pskb
)->nh
.iph
->ihl
*4+sizeof(*tcph
)))
370 tcph
= (void *)(*pskb
)->data
+ (*pskb
)->nh
.iph
->ihl
*4;
371 if (after(ntohl(tcph
->seq
), this_way
->correction_pos
))
372 newseq
= ntohl(tcph
->seq
) + this_way
->offset_after
;
374 newseq
= ntohl(tcph
->seq
) + this_way
->offset_before
;
375 newseq
= htonl(newseq
);
377 if (after(ntohl(tcph
->ack_seq
) - other_way
->offset_before
,
378 other_way
->correction_pos
))
379 newack
= ntohl(tcph
->ack_seq
) - other_way
->offset_after
;
381 newack
= ntohl(tcph
->ack_seq
) - other_way
->offset_before
;
382 newack
= htonl(newack
);
384 tcph
->check
= ip_nat_cheat_check(~tcph
->seq
, newseq
,
385 ip_nat_cheat_check(~tcph
->ack_seq
,
389 DEBUGP("Adjusting sequence number from %u->%u, ack from %u->%u\n",
390 ntohl(tcph
->seq
), ntohl(newseq
), ntohl(tcph
->ack_seq
),
394 tcph
->ack_seq
= newack
;
396 if (!ip_nat_sack_adjust(pskb
, tcph
, ct
, ctinfo
))
399 ip_conntrack_tcp_update(*pskb
, ct
, dir
);
403 EXPORT_SYMBOL(ip_nat_seq_adjust
);
405 /* Setup NAT on this expected conntrack so it follows master. */
406 /* If we fail to get a free NAT slot, we'll get dropped on confirm */
407 void ip_nat_follow_master(struct ip_conntrack
*ct
,
408 struct ip_conntrack_expect
*exp
)
410 struct ip_nat_range range
;
412 /* This must be a fresh one. */
413 BUG_ON(ct
->status
& IPS_NAT_DONE_MASK
);
415 /* Change src to where master sends to */
416 range
.flags
= IP_NAT_RANGE_MAP_IPS
;
417 range
.min_ip
= range
.max_ip
418 = ct
->master
->tuplehash
[!exp
->dir
].tuple
.dst
.ip
;
419 /* hook doesn't matter, but it has to do source manip */
420 ip_nat_setup_info(ct
, &range
, NF_IP_POST_ROUTING
);
422 /* For DST manip, map port here to where it's expected. */
423 range
.flags
= (IP_NAT_RANGE_MAP_IPS
| IP_NAT_RANGE_PROTO_SPECIFIED
);
424 range
.min
= range
.max
= exp
->saved_proto
;
425 range
.min_ip
= range
.max_ip
426 = ct
->master
->tuplehash
[!exp
->dir
].tuple
.src
.ip
;
427 /* hook doesn't matter, but it has to do destination manip */
428 ip_nat_setup_info(ct
, &range
, NF_IP_PRE_ROUTING
);
430 EXPORT_SYMBOL(ip_nat_follow_master
);