1 /* ip_nat_helper.c - generic support functions for NAT helpers
3 * (C) 2000-2002 Harald Welte <laforge@netfilter.org>
4 * (C) 2003-2004 Netfilter Core Team <coreteam@netfilter.org>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
10 * 14 Jan 2002 Harald Welte <laforge@gnumonks.org>:
11 * - add support for SACK adjustment
12 * 14 Mar 2002 Harald Welte <laforge@gnumonks.org>:
13 * - merge SACK support into newnat API
14 * 16 Aug 2002 Brian J. Murrell <netfilter@interlinx.bc.ca>:
15 * - make ip_nat_resize_packet more generic (TCP and UDP)
16 * - add ip_nat_mangle_udp_packet
18 #include <linux/config.h>
19 #include <linux/module.h>
20 #include <linux/kmod.h>
21 #include <linux/types.h>
22 #include <linux/timer.h>
23 #include <linux/skbuff.h>
24 #include <linux/netfilter_ipv4.h>
25 #include <net/checksum.h>
31 #define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_nat_lock)
32 #define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_nat_lock)
34 #include <linux/netfilter_ipv4/ip_conntrack.h>
35 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
36 #include <linux/netfilter_ipv4/ip_nat.h>
37 #include <linux/netfilter_ipv4/ip_nat_protocol.h>
38 #include <linux/netfilter_ipv4/ip_nat_core.h>
39 #include <linux/netfilter_ipv4/ip_nat_helper.h>
40 #include <linux/netfilter_ipv4/listhelp.h>
44 #define DUMP_OFFSET(x) printk("offset_before=%d, offset_after=%d, correction_pos=%u\n", x->offset_before, x->offset_after, x->correction_pos);
46 #define DEBUGP(format, args...)
47 #define DUMP_OFFSET(x)
50 static DECLARE_LOCK(ip_nat_seqofs_lock
);
52 /* Setup TCP sequence correction given this change at this sequence */
54 adjust_tcp_sequence(u32 seq
,
56 struct ip_conntrack
*ct
,
57 enum ip_conntrack_info ctinfo
)
60 struct ip_nat_seq
*this_way
, *other_way
;
62 DEBUGP("ip_nat_resize_packet: old_size = %u, new_size = %u\n",
63 (*skb
)->len
, new_size
);
65 dir
= CTINFO2DIR(ctinfo
);
67 this_way
= &ct
->nat
.info
.seq
[dir
];
68 other_way
= &ct
->nat
.info
.seq
[!dir
];
70 DEBUGP("ip_nat_resize_packet: Seq_offset before: ");
71 DUMP_OFFSET(this_way
);
73 LOCK_BH(&ip_nat_seqofs_lock
);
75 /* SYN adjust. If it's uninitialized, or this is after last
76 * correction, record it: we don't handle more than one
77 * adjustment in the window, but do deal with common case of a
79 if (this_way
->offset_before
== this_way
->offset_after
80 || before(this_way
->correction_pos
, seq
)) {
81 this_way
->correction_pos
= seq
;
82 this_way
->offset_before
= this_way
->offset_after
;
83 this_way
->offset_after
+= sizediff
;
85 UNLOCK_BH(&ip_nat_seqofs_lock
);
87 DEBUGP("ip_nat_resize_packet: Seq_offset after: ");
88 DUMP_OFFSET(this_way
);
91 /* Frobs data inside this packet, which is linear. */
92 static void mangle_contents(struct sk_buff
*skb
,
94 unsigned int match_offset
,
95 unsigned int match_len
,
96 const char *rep_buffer
,
101 BUG_ON(skb_is_nonlinear(skb
));
102 data
= (unsigned char *)skb
->nh
.iph
+ dataoff
;
104 /* move post-replacement */
105 memmove(data
+ match_offset
+ rep_len
,
106 data
+ match_offset
+ match_len
,
107 skb
->tail
- (data
+ match_offset
+ match_len
));
109 /* insert data from buffer */
110 memcpy(data
+ match_offset
, rep_buffer
, rep_len
);
112 /* update skb info */
113 if (rep_len
> match_len
) {
114 DEBUGP("ip_nat_mangle_packet: Extending packet by "
115 "%u from %u bytes\n", rep_len
- match_len
,
117 skb_put(skb
, rep_len
- match_len
);
119 DEBUGP("ip_nat_mangle_packet: Shrinking packet from "
120 "%u from %u bytes\n", match_len
- rep_len
,
122 __skb_trim(skb
, skb
->len
+ rep_len
- match_len
);
125 /* fix IP hdr checksum information */
126 skb
->nh
.iph
->tot_len
= htons(skb
->len
);
127 ip_send_check(skb
->nh
.iph
);
130 /* Unusual, but possible case. */
131 static int enlarge_skb(struct sk_buff
**pskb
, unsigned int extra
)
133 struct sk_buff
*nskb
;
135 if ((*pskb
)->len
+ extra
> 65535)
138 nskb
= skb_copy_expand(*pskb
, skb_headroom(*pskb
), extra
, GFP_ATOMIC
);
142 /* Transfer socket to new skb. */
144 skb_set_owner_w(nskb
, (*pskb
)->sk
);
145 #ifdef CONFIG_NETFILTER_DEBUG
146 nskb
->nf_debug
= (*pskb
)->nf_debug
;
153 /* Generic function for mangling variable-length address changes inside
154 * NATed TCP connections (like the PORT XXX,XXX,XXX,XXX,XXX,XXX
157 * Takes care about all the nasty sequence number changes, checksumming,
158 * skb enlargement, ...
162 ip_nat_mangle_tcp_packet(struct sk_buff
**pskb
,
163 struct ip_conntrack
*ct
,
164 enum ip_conntrack_info ctinfo
,
165 unsigned int match_offset
,
166 unsigned int match_len
,
167 const char *rep_buffer
,
168 unsigned int rep_len
)
174 if (!skb_ip_make_writable(pskb
, (*pskb
)->len
))
177 if (rep_len
> match_len
178 && rep_len
- match_len
> skb_tailroom(*pskb
)
179 && !enlarge_skb(pskb
, rep_len
- match_len
))
182 SKB_LINEAR_ASSERT(*pskb
);
184 iph
= (*pskb
)->nh
.iph
;
185 tcph
= (void *)iph
+ iph
->ihl
*4;
187 mangle_contents(*pskb
, iph
->ihl
*4 + tcph
->doff
*4,
188 match_offset
, match_len
, rep_buffer
, rep_len
);
190 datalen
= (*pskb
)->len
- iph
->ihl
*4;
192 tcph
->check
= tcp_v4_check(tcph
, datalen
, iph
->saddr
, iph
->daddr
,
193 csum_partial((char *)tcph
, datalen
, 0));
195 if (rep_len
!= match_len
) {
196 set_bit(IPS_SEQ_ADJUST_BIT
, &ct
->status
);
197 adjust_tcp_sequence(ntohl(tcph
->seq
),
198 (int)rep_len
- (int)match_len
,
200 /* Tell TCP window tracking about seq change */
201 ip_conntrack_tcp_update(*pskb
, ct
, CTINFO2DIR(ctinfo
));
206 /* Generic function for mangling variable-length address changes inside
207 * NATed UDP connections (like the CONNECT DATA XXXXX MESG XXXXX INDEX XXXXX
208 * command in the Amanda protocol)
210 * Takes care about all the nasty sequence number changes, checksumming,
211 * skb enlargement, ...
213 * XXX - This function could be merged with ip_nat_mangle_tcp_packet which
214 * should be fairly easy to do.
217 ip_nat_mangle_udp_packet(struct sk_buff
**pskb
,
218 struct ip_conntrack
*ct
,
219 enum ip_conntrack_info ctinfo
,
220 unsigned int match_offset
,
221 unsigned int match_len
,
222 const char *rep_buffer
,
223 unsigned int rep_len
)
228 /* UDP helpers might accidentally mangle the wrong packet */
229 iph
= (*pskb
)->nh
.iph
;
230 if ((*pskb
)->len
< iph
->ihl
*4 + sizeof(*udph
) +
231 match_offset
+ match_len
)
234 if (!skb_ip_make_writable(pskb
, (*pskb
)->len
))
237 if (rep_len
> match_len
238 && rep_len
- match_len
> skb_tailroom(*pskb
)
239 && !enlarge_skb(pskb
, rep_len
- match_len
))
242 iph
= (*pskb
)->nh
.iph
;
243 udph
= (void *)iph
+ iph
->ihl
*4;
244 mangle_contents(*pskb
, iph
->ihl
*4 + sizeof(*udph
),
245 match_offset
, match_len
, rep_buffer
, rep_len
);
247 /* update the length of the UDP packet */
248 udph
->len
= htons((*pskb
)->len
- iph
->ihl
*4);
250 /* fix udp checksum if udp checksum was previously calculated */
252 int datalen
= (*pskb
)->len
- iph
->ihl
* 4;
254 udph
->check
= csum_tcpudp_magic(iph
->saddr
, iph
->daddr
,
255 datalen
, IPPROTO_UDP
,
256 csum_partial((char *)udph
,
263 /* Adjust one found SACK option including checksum correction */
265 sack_adjust(struct sk_buff
*skb
,
267 unsigned int sackoff
,
268 unsigned int sackend
,
269 struct ip_nat_seq
*natseq
)
271 while (sackoff
< sackend
) {
272 struct tcp_sack_block
*sack
;
273 u_int32_t new_start_seq
, new_end_seq
;
275 sack
= (void *)skb
->data
+ sackoff
;
276 if (after(ntohl(sack
->start_seq
) - natseq
->offset_before
,
277 natseq
->correction_pos
))
278 new_start_seq
= ntohl(sack
->start_seq
)
279 - natseq
->offset_after
;
281 new_start_seq
= ntohl(sack
->start_seq
)
282 - natseq
->offset_before
;
283 new_start_seq
= htonl(new_start_seq
);
285 if (after(ntohl(sack
->end_seq
) - natseq
->offset_before
,
286 natseq
->correction_pos
))
287 new_end_seq
= ntohl(sack
->end_seq
)
288 - natseq
->offset_after
;
290 new_end_seq
= ntohl(sack
->end_seq
)
291 - natseq
->offset_before
;
292 new_end_seq
= htonl(new_end_seq
);
294 DEBUGP("sack_adjust: start_seq: %d->%d, end_seq: %d->%d\n",
295 ntohl(sack
->start_seq
), new_start_seq
,
296 ntohl(sack
->end_seq
), new_end_seq
);
299 ip_nat_cheat_check(~sack
->start_seq
, new_start_seq
,
300 ip_nat_cheat_check(~sack
->end_seq
,
303 sack
->start_seq
= new_start_seq
;
304 sack
->end_seq
= new_end_seq
;
305 sackoff
+= sizeof(*sack
);
309 /* TCP SACK sequence number adjustment */
310 static inline unsigned int
311 ip_nat_sack_adjust(struct sk_buff
**pskb
,
313 struct ip_conntrack
*ct
,
314 enum ip_conntrack_info ctinfo
)
316 unsigned int dir
, optoff
, optend
;
318 optoff
= (*pskb
)->nh
.iph
->ihl
*4 + sizeof(struct tcphdr
);
319 optend
= (*pskb
)->nh
.iph
->ihl
*4 + tcph
->doff
*4;
321 if (!skb_ip_make_writable(pskb
, optend
))
324 dir
= CTINFO2DIR(ctinfo
);
326 while (optoff
< optend
) {
327 /* Usually: option, length. */
328 unsigned char *op
= (*pskb
)->data
+ optoff
;
337 /* no partial options */
338 if (optoff
+ 1 == optend
339 || optoff
+ op
[1] > optend
342 if (op
[0] == TCPOPT_SACK
343 && op
[1] >= 2+TCPOLEN_SACK_PERBLOCK
344 && ((op
[1] - 2) % TCPOLEN_SACK_PERBLOCK
) == 0)
345 sack_adjust(*pskb
, tcph
, optoff
+2,
347 &ct
->nat
.info
.seq
[!dir
]);
354 /* TCP sequence number adjustment. Returns 1 on success, 0 on failure */
356 ip_nat_seq_adjust(struct sk_buff
**pskb
,
357 struct ip_conntrack
*ct
,
358 enum ip_conntrack_info ctinfo
)
361 int dir
, newseq
, newack
;
362 struct ip_nat_seq
*this_way
, *other_way
;
364 dir
= CTINFO2DIR(ctinfo
);
366 this_way
= &ct
->nat
.info
.seq
[dir
];
367 other_way
= &ct
->nat
.info
.seq
[!dir
];
369 if (!skb_ip_make_writable(pskb
, (*pskb
)->nh
.iph
->ihl
*4+sizeof(*tcph
)))
372 tcph
= (void *)(*pskb
)->data
+ (*pskb
)->nh
.iph
->ihl
*4;
373 if (after(ntohl(tcph
->seq
), this_way
->correction_pos
))
374 newseq
= ntohl(tcph
->seq
) + this_way
->offset_after
;
376 newseq
= ntohl(tcph
->seq
) + this_way
->offset_before
;
377 newseq
= htonl(newseq
);
379 if (after(ntohl(tcph
->ack_seq
) - other_way
->offset_before
,
380 other_way
->correction_pos
))
381 newack
= ntohl(tcph
->ack_seq
) - other_way
->offset_after
;
383 newack
= ntohl(tcph
->ack_seq
) - other_way
->offset_before
;
384 newack
= htonl(newack
);
386 tcph
->check
= ip_nat_cheat_check(~tcph
->seq
, newseq
,
387 ip_nat_cheat_check(~tcph
->ack_seq
,
391 DEBUGP("Adjusting sequence number from %u->%u, ack from %u->%u\n",
392 ntohl(tcph
->seq
), ntohl(newseq
), ntohl(tcph
->ack_seq
),
396 tcph
->ack_seq
= newack
;
398 if (!ip_nat_sack_adjust(pskb
, tcph
, ct
, ctinfo
))
401 ip_conntrack_tcp_update(*pskb
, ct
, dir
);
406 /* Setup NAT on this expected conntrack so it follows master. */
407 /* If we fail to get a free NAT slot, we'll get dropped on confirm */
408 void ip_nat_follow_master(struct ip_conntrack
*ct
,
409 struct ip_conntrack_expect
*exp
)
411 struct ip_nat_range range
;
413 /* This must be a fresh one. */
414 BUG_ON(ct
->status
& IPS_NAT_DONE_MASK
);
416 /* Change src to where master sends to */
417 range
.flags
= IP_NAT_RANGE_MAP_IPS
;
418 range
.min_ip
= range
.max_ip
419 = ct
->master
->tuplehash
[!exp
->dir
].tuple
.dst
.ip
;
420 /* hook doesn't matter, but it has to do source manip */
421 ip_nat_setup_info(ct
, &range
, NF_IP_POST_ROUTING
);
423 /* For DST manip, map port here to where it's expected. */
424 range
.flags
= (IP_NAT_RANGE_MAP_IPS
| IP_NAT_RANGE_PROTO_SPECIFIED
);
425 range
.min
= range
.max
= exp
->saved_proto
;
426 range
.min_ip
= range
.max_ip
427 = ct
->master
->tuplehash
[!exp
->dir
].tuple
.src
.ip
;
428 /* hook doesn't matter, but it has to do destination manip */
429 ip_nat_setup_info(ct
, &range
, NF_IP_PRE_ROUTING
);