1 /* ip_nat_helper.c - generic support functions for NAT helpers
3 * (C) 2000-2002 Harald Welte <laforge@netfilter.org>
4 * (C) 2003-2004 Netfilter Core Team <coreteam@netfilter.org>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
10 * 14 Jan 2002 Harald Welte <laforge@gnumonks.org>:
11 * - add support for SACK adjustment
12 * 14 Mar 2002 Harald Welte <laforge@gnumonks.org>:
13 * - merge SACK support into newnat API
14 * 16 Aug 2002 Brian J. Murrell <netfilter@interlinx.bc.ca>:
15 * - make ip_nat_resize_packet more generic (TCP and UDP)
16 * - add ip_nat_mangle_udp_packet
18 #include <linux/config.h>
19 #include <linux/module.h>
20 #include <linux/kmod.h>
21 #include <linux/types.h>
22 #include <linux/timer.h>
23 #include <linux/skbuff.h>
24 #include <linux/netfilter_ipv4.h>
25 #include <net/checksum.h>
31 #define ASSERT_READ_LOCK(x)
32 #define ASSERT_WRITE_LOCK(x)
34 #include <linux/netfilter_ipv4/ip_conntrack.h>
35 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
36 #include <linux/netfilter_ipv4/ip_nat.h>
37 #include <linux/netfilter_ipv4/ip_nat_protocol.h>
38 #include <linux/netfilter_ipv4/ip_nat_core.h>
39 #include <linux/netfilter_ipv4/ip_nat_helper.h>
40 #include <linux/netfilter_ipv4/listhelp.h>
44 #define DUMP_OFFSET(x) printk("offset_before=%d, offset_after=%d, correction_pos=%u\n", x->offset_before, x->offset_after, x->correction_pos);
46 #define DEBUGP(format, args...)
47 #define DUMP_OFFSET(x)
50 static DEFINE_SPINLOCK(ip_nat_seqofs_lock
);
52 /* Setup TCP sequence correction given this change at this sequence */
54 adjust_tcp_sequence(u32 seq
,
56 struct ip_conntrack
*ct
,
57 enum ip_conntrack_info ctinfo
)
60 struct ip_nat_seq
*this_way
, *other_way
;
62 DEBUGP("ip_nat_resize_packet: old_size = %u, new_size = %u\n",
63 (*skb
)->len
, new_size
);
65 dir
= CTINFO2DIR(ctinfo
);
67 this_way
= &ct
->nat
.info
.seq
[dir
];
68 other_way
= &ct
->nat
.info
.seq
[!dir
];
70 DEBUGP("ip_nat_resize_packet: Seq_offset before: ");
71 DUMP_OFFSET(this_way
);
73 spin_lock_bh(&ip_nat_seqofs_lock
);
75 /* SYN adjust. If it's uninitialized, or this is after last
76 * correction, record it: we don't handle more than one
77 * adjustment in the window, but do deal with common case of a
79 if (this_way
->offset_before
== this_way
->offset_after
80 || before(this_way
->correction_pos
, seq
)) {
81 this_way
->correction_pos
= seq
;
82 this_way
->offset_before
= this_way
->offset_after
;
83 this_way
->offset_after
+= sizediff
;
85 spin_unlock_bh(&ip_nat_seqofs_lock
);
87 DEBUGP("ip_nat_resize_packet: Seq_offset after: ");
88 DUMP_OFFSET(this_way
);
91 /* Frobs data inside this packet, which is linear. */
92 static void mangle_contents(struct sk_buff
*skb
,
94 unsigned int match_offset
,
95 unsigned int match_len
,
96 const char *rep_buffer
,
101 BUG_ON(skb_is_nonlinear(skb
));
102 data
= (unsigned char *)skb
->nh
.iph
+ dataoff
;
104 /* move post-replacement */
105 memmove(data
+ match_offset
+ rep_len
,
106 data
+ match_offset
+ match_len
,
107 skb
->tail
- (data
+ match_offset
+ match_len
));
109 /* insert data from buffer */
110 memcpy(data
+ match_offset
, rep_buffer
, rep_len
);
112 /* update skb info */
113 if (rep_len
> match_len
) {
114 DEBUGP("ip_nat_mangle_packet: Extending packet by "
115 "%u from %u bytes\n", rep_len
- match_len
,
117 skb_put(skb
, rep_len
- match_len
);
119 DEBUGP("ip_nat_mangle_packet: Shrinking packet from "
120 "%u from %u bytes\n", match_len
- rep_len
,
122 __skb_trim(skb
, skb
->len
+ rep_len
- match_len
);
125 /* fix IP hdr checksum information */
126 skb
->nh
.iph
->tot_len
= htons(skb
->len
);
127 ip_send_check(skb
->nh
.iph
);
130 /* Unusual, but possible case. */
131 static int enlarge_skb(struct sk_buff
**pskb
, unsigned int extra
)
133 struct sk_buff
*nskb
;
135 if ((*pskb
)->len
+ extra
> 65535)
138 nskb
= skb_copy_expand(*pskb
, skb_headroom(*pskb
), extra
, GFP_ATOMIC
);
142 /* Transfer socket to new skb. */
144 skb_set_owner_w(nskb
, (*pskb
)->sk
);
150 /* Generic function for mangling variable-length address changes inside
151 * NATed TCP connections (like the PORT XXX,XXX,XXX,XXX,XXX,XXX
154 * Takes care about all the nasty sequence number changes, checksumming,
155 * skb enlargement, ...
159 ip_nat_mangle_tcp_packet(struct sk_buff
**pskb
,
160 struct ip_conntrack
*ct
,
161 enum ip_conntrack_info ctinfo
,
162 unsigned int match_offset
,
163 unsigned int match_len
,
164 const char *rep_buffer
,
165 unsigned int rep_len
)
171 if (!skb_make_writable(pskb
, (*pskb
)->len
))
174 if (rep_len
> match_len
175 && rep_len
- match_len
> skb_tailroom(*pskb
)
176 && !enlarge_skb(pskb
, rep_len
- match_len
))
179 SKB_LINEAR_ASSERT(*pskb
);
181 iph
= (*pskb
)->nh
.iph
;
182 tcph
= (void *)iph
+ iph
->ihl
*4;
184 mangle_contents(*pskb
, iph
->ihl
*4 + tcph
->doff
*4,
185 match_offset
, match_len
, rep_buffer
, rep_len
);
187 datalen
= (*pskb
)->len
- iph
->ihl
*4;
189 tcph
->check
= tcp_v4_check(tcph
, datalen
, iph
->saddr
, iph
->daddr
,
190 csum_partial((char *)tcph
, datalen
, 0));
192 if (rep_len
!= match_len
) {
193 set_bit(IPS_SEQ_ADJUST_BIT
, &ct
->status
);
194 adjust_tcp_sequence(ntohl(tcph
->seq
),
195 (int)rep_len
- (int)match_len
,
197 /* Tell TCP window tracking about seq change */
198 ip_conntrack_tcp_update(*pskb
, ct
, CTINFO2DIR(ctinfo
));
202 EXPORT_SYMBOL(ip_nat_mangle_tcp_packet
);
204 /* Generic function for mangling variable-length address changes inside
205 * NATed UDP connections (like the CONNECT DATA XXXXX MESG XXXXX INDEX XXXXX
206 * command in the Amanda protocol)
208 * Takes care about all the nasty sequence number changes, checksumming,
209 * skb enlargement, ...
211 * XXX - This function could be merged with ip_nat_mangle_tcp_packet which
212 * should be fairly easy to do.
215 ip_nat_mangle_udp_packet(struct sk_buff
**pskb
,
216 struct ip_conntrack
*ct
,
217 enum ip_conntrack_info ctinfo
,
218 unsigned int match_offset
,
219 unsigned int match_len
,
220 const char *rep_buffer
,
221 unsigned int rep_len
)
226 /* UDP helpers might accidentally mangle the wrong packet */
227 iph
= (*pskb
)->nh
.iph
;
228 if ((*pskb
)->len
< iph
->ihl
*4 + sizeof(*udph
) +
229 match_offset
+ match_len
)
232 if (!skb_make_writable(pskb
, (*pskb
)->len
))
235 if (rep_len
> match_len
236 && rep_len
- match_len
> skb_tailroom(*pskb
)
237 && !enlarge_skb(pskb
, rep_len
- match_len
))
240 iph
= (*pskb
)->nh
.iph
;
241 udph
= (void *)iph
+ iph
->ihl
*4;
242 mangle_contents(*pskb
, iph
->ihl
*4 + sizeof(*udph
),
243 match_offset
, match_len
, rep_buffer
, rep_len
);
245 /* update the length of the UDP packet */
246 udph
->len
= htons((*pskb
)->len
- iph
->ihl
*4);
248 /* fix udp checksum if udp checksum was previously calculated */
250 int datalen
= (*pskb
)->len
- iph
->ihl
* 4;
252 udph
->check
= csum_tcpudp_magic(iph
->saddr
, iph
->daddr
,
253 datalen
, IPPROTO_UDP
,
254 csum_partial((char *)udph
,
260 EXPORT_SYMBOL(ip_nat_mangle_udp_packet
);
262 /* Adjust one found SACK option including checksum correction */
264 sack_adjust(struct sk_buff
*skb
,
266 unsigned int sackoff
,
267 unsigned int sackend
,
268 struct ip_nat_seq
*natseq
)
270 while (sackoff
< sackend
) {
271 struct tcp_sack_block
*sack
;
272 u_int32_t new_start_seq
, new_end_seq
;
274 sack
= (void *)skb
->data
+ sackoff
;
275 if (after(ntohl(sack
->start_seq
) - natseq
->offset_before
,
276 natseq
->correction_pos
))
277 new_start_seq
= ntohl(sack
->start_seq
)
278 - natseq
->offset_after
;
280 new_start_seq
= ntohl(sack
->start_seq
)
281 - natseq
->offset_before
;
282 new_start_seq
= htonl(new_start_seq
);
284 if (after(ntohl(sack
->end_seq
) - natseq
->offset_before
,
285 natseq
->correction_pos
))
286 new_end_seq
= ntohl(sack
->end_seq
)
287 - natseq
->offset_after
;
289 new_end_seq
= ntohl(sack
->end_seq
)
290 - natseq
->offset_before
;
291 new_end_seq
= htonl(new_end_seq
);
293 DEBUGP("sack_adjust: start_seq: %d->%d, end_seq: %d->%d\n",
294 ntohl(sack
->start_seq
), new_start_seq
,
295 ntohl(sack
->end_seq
), new_end_seq
);
298 ip_nat_cheat_check(~sack
->start_seq
, new_start_seq
,
299 ip_nat_cheat_check(~sack
->end_seq
,
302 sack
->start_seq
= new_start_seq
;
303 sack
->end_seq
= new_end_seq
;
304 sackoff
+= sizeof(*sack
);
308 /* TCP SACK sequence number adjustment */
309 static inline unsigned int
310 ip_nat_sack_adjust(struct sk_buff
**pskb
,
312 struct ip_conntrack
*ct
,
313 enum ip_conntrack_info ctinfo
)
315 unsigned int dir
, optoff
, optend
;
317 optoff
= (*pskb
)->nh
.iph
->ihl
*4 + sizeof(struct tcphdr
);
318 optend
= (*pskb
)->nh
.iph
->ihl
*4 + tcph
->doff
*4;
320 if (!skb_make_writable(pskb
, optend
))
323 dir
= CTINFO2DIR(ctinfo
);
325 while (optoff
< optend
) {
326 /* Usually: option, length. */
327 unsigned char *op
= (*pskb
)->data
+ optoff
;
336 /* no partial options */
337 if (optoff
+ 1 == optend
338 || optoff
+ op
[1] > optend
341 if (op
[0] == TCPOPT_SACK
342 && op
[1] >= 2+TCPOLEN_SACK_PERBLOCK
343 && ((op
[1] - 2) % TCPOLEN_SACK_PERBLOCK
) == 0)
344 sack_adjust(*pskb
, tcph
, optoff
+2,
346 &ct
->nat
.info
.seq
[!dir
]);
353 /* TCP sequence number adjustment. Returns 1 on success, 0 on failure */
355 ip_nat_seq_adjust(struct sk_buff
**pskb
,
356 struct ip_conntrack
*ct
,
357 enum ip_conntrack_info ctinfo
)
360 int dir
, newseq
, newack
;
361 struct ip_nat_seq
*this_way
, *other_way
;
363 dir
= CTINFO2DIR(ctinfo
);
365 this_way
= &ct
->nat
.info
.seq
[dir
];
366 other_way
= &ct
->nat
.info
.seq
[!dir
];
368 if (!skb_make_writable(pskb
, (*pskb
)->nh
.iph
->ihl
*4+sizeof(*tcph
)))
371 tcph
= (void *)(*pskb
)->data
+ (*pskb
)->nh
.iph
->ihl
*4;
372 if (after(ntohl(tcph
->seq
), this_way
->correction_pos
))
373 newseq
= ntohl(tcph
->seq
) + this_way
->offset_after
;
375 newseq
= ntohl(tcph
->seq
) + this_way
->offset_before
;
376 newseq
= htonl(newseq
);
378 if (after(ntohl(tcph
->ack_seq
) - other_way
->offset_before
,
379 other_way
->correction_pos
))
380 newack
= ntohl(tcph
->ack_seq
) - other_way
->offset_after
;
382 newack
= ntohl(tcph
->ack_seq
) - other_way
->offset_before
;
383 newack
= htonl(newack
);
385 tcph
->check
= ip_nat_cheat_check(~tcph
->seq
, newseq
,
386 ip_nat_cheat_check(~tcph
->ack_seq
,
390 DEBUGP("Adjusting sequence number from %u->%u, ack from %u->%u\n",
391 ntohl(tcph
->seq
), ntohl(newseq
), ntohl(tcph
->ack_seq
),
395 tcph
->ack_seq
= newack
;
397 if (!ip_nat_sack_adjust(pskb
, tcph
, ct
, ctinfo
))
400 ip_conntrack_tcp_update(*pskb
, ct
, dir
);
404 EXPORT_SYMBOL(ip_nat_seq_adjust
);
406 /* Setup NAT on this expected conntrack so it follows master. */
407 /* If we fail to get a free NAT slot, we'll get dropped on confirm */
408 void ip_nat_follow_master(struct ip_conntrack
*ct
,
409 struct ip_conntrack_expect
*exp
)
411 struct ip_nat_range range
;
413 /* This must be a fresh one. */
414 BUG_ON(ct
->status
& IPS_NAT_DONE_MASK
);
416 /* Change src to where master sends to */
417 range
.flags
= IP_NAT_RANGE_MAP_IPS
;
418 range
.min_ip
= range
.max_ip
419 = ct
->master
->tuplehash
[!exp
->dir
].tuple
.dst
.ip
;
420 /* hook doesn't matter, but it has to do source manip */
421 ip_nat_setup_info(ct
, &range
, NF_IP_POST_ROUTING
);
423 /* For DST manip, map port here to where it's expected. */
424 range
.flags
= (IP_NAT_RANGE_MAP_IPS
| IP_NAT_RANGE_PROTO_SPECIFIED
);
425 range
.min
= range
.max
= exp
->saved_proto
;
426 range
.min_ip
= range
.max_ip
427 = ct
->master
->tuplehash
[!exp
->dir
].tuple
.src
.ip
;
428 /* hook doesn't matter, but it has to do destination manip */
429 ip_nat_setup_info(ct
, &range
, NF_IP_PRE_ROUTING
);
431 EXPORT_SYMBOL(ip_nat_follow_master
);