net/ipv4/netfilter/ip_nat_proto_gre.c

   1 /*
   2  * ip_nat_proto_gre.c - Version 2.0
   3  *
   4  * NAT protocol helper module for GRE.
   5  *
   6  * GRE is a generic encapsulation protocol, which is generally not very
   7  * suited for NAT, as it has no protocol-specific part as port numbers.
   8  *
   9  * It has an optional key field, which may help us distinguishing two
  10  * connections between the same two hosts.
  11  *
  12  * GRE is defined in RFC 1701 and RFC 1702, as well as RFC 2784
  13  *
  14  * PPTP is built on top of a modified version of GRE, and has a mandatory
  15  * field called "CallID", which serves us for the same purpose as the key
  16  * field in plain GRE.
  17  *
  18  * Documentation about PPTP can be found in RFC 2637
  19  *
  20  * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org>
  21  *
  22  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  23  *
  24  */
  25
  26 #include <linux/config.h>
  27 #include <linux/module.h>
  28 #include <linux/ip.h>
  29 #include <linux/netfilter_ipv4/ip_nat.h>
  30 #include <linux/netfilter_ipv4/ip_nat_rule.h>
  31 #include <linux/netfilter_ipv4/ip_nat_protocol.h>
  32 #include <linux/netfilter_ipv4/ip_conntrack_proto_gre.h>
  33
  34 MODULE_LICENSE("GPL");
  35 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
  36 MODULE_DESCRIPTION("Netfilter NAT protocol helper module for GRE");
  37
  38 #if 0
  39 #define DEBUGP(format, args...) printk(KERN_DEBUG "%s:%s: " format, __FILE__, \
  40                                        __FUNCTION__, ## args)
  41 #else
  42 #define DEBUGP(x, args...)
  43 #endif
  44
  45 /* is key in given range between min and max */
  46 static int
  47 gre_in_range(const struct ip_conntrack_tuple *tuple,
  48              enum ip_nat_manip_type maniptype,
  49              const union ip_conntrack_manip_proto *min,
  50              const union ip_conntrack_manip_proto *max)
  51 {
  52         u_int32_t key;
  53
  54         if (maniptype == IP_NAT_MANIP_SRC)
  55                 key = tuple->src.u.gre.key;
  56         else
  57                 key = tuple->dst.u.gre.key;
  58
  59         return ntohl(key) >= ntohl(min->gre.key)
  60                 && ntohl(key) <= ntohl(max->gre.key);
  61 }
  62
  63 /* generate unique tuple ... */
  64 static int
  65 gre_unique_tuple(struct ip_conntrack_tuple *tuple,
  66                  const struct ip_nat_range *range,
  67                  enum ip_nat_manip_type maniptype,
  68                  const struct ip_conntrack *conntrack)
  69 {
  70         static u_int16_t key;
  71         u_int16_t *keyptr;
  72         unsigned int min, i, range_size;
  73
  74         if (maniptype == IP_NAT_MANIP_SRC)
  75                 keyptr = &tuple->src.u.gre.key;
  76         else
  77                 keyptr = &tuple->dst.u.gre.key;
  78
  79         if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) {
  80                 DEBUGP("%p: NATing GRE PPTP\n", conntrack);
  81                 min = 1;
  82                 range_size = 0xffff;
  83         } else {
  84                 min = ntohl(range->min.gre.key);
  85                 range_size = ntohl(range->max.gre.key) - min + 1;
  86         }
  87
  88         DEBUGP("min = %u, range_size = %u\n", min, range_size);
  89
  90         for (i = 0; i < range_size; i++, key++) {
  91                 *keyptr = htonl(min + key % range_size);
  92                 if (!ip_nat_used_tuple(tuple, conntrack))
  93                         return 1;
  94         }
  95
  96         DEBUGP("%p: no NAT mapping\n", conntrack);
  97
  98         return 0;
  99 }
 100
 101 /* manipulate a GRE packet according to maniptype */
 102 static int
 103 gre_manip_pkt(struct sk_buff **pskb,
 104               unsigned int iphdroff,
 105               const struct ip_conntrack_tuple *tuple,
 106               enum ip_nat_manip_type maniptype)
 107 {
 108         struct gre_hdr *greh;
 109         struct gre_hdr_pptp *pgreh;
 110         struct iphdr *iph = (struct iphdr *)((*pskb)->data + iphdroff);
 111         unsigned int hdroff = iphdroff + iph->ihl*4;
 112
 113         /* pgreh includes two optional 32bit fields which are not required
 114          * to be there.  That's where the magic '8' comes from */
 115         if (!skb_make_writable(pskb, hdroff + sizeof(*pgreh)-8))
 116                 return 0;
 117
 118         greh = (void *)(*pskb)->data + hdroff;
 119         pgreh = (struct gre_hdr_pptp *) greh;
 120
 121         /* we only have destination manip of a packet, since 'source key'
 122          * is not present in the packet itself */
 123         if (maniptype == IP_NAT_MANIP_DST) {
 124                 /* key manipulation is always dest */
 125                 switch (greh->version) {
 126                 case 0:
 127                         if (!greh->key) {
 128                                 DEBUGP("can't nat GRE w/o key\n");
 129                                 break;
 130                         }
 131                         if (greh->csum) {
 132                                 /* FIXME: Never tested this code... */
 133                                 *(gre_csum(greh)) =
 134                                         ip_nat_cheat_check(~*(gre_key(greh)),
 135                                                         tuple->dst.u.gre.key,
 136                                                         *(gre_csum(greh)));
 137                         }
 138                         *(gre_key(greh)) = tuple->dst.u.gre.key;
 139                         break;
 140                 case GRE_VERSION_PPTP:
 141                         DEBUGP("call_id -> 0x%04x\n",
 142                                 ntohs(tuple->dst.u.gre.key));
 143                         pgreh->call_id = tuple->dst.u.gre.key;
 144                         break;
 145                 default:
 146                         DEBUGP("can't nat unknown GRE version\n");
 147                         return 0;
 148                         break;
 149                 }
 150         }
 151         return 1;
 152 }
 153
 154 /* print out a nat tuple */
 155 static unsigned int
 156 gre_print(char *buffer,
 157           const struct ip_conntrack_tuple *match,
 158           const struct ip_conntrack_tuple *mask)
 159 {
 160         unsigned int len = 0;
 161
 162         if (mask->src.u.gre.key)
 163                 len += sprintf(buffer + len, "srckey=0x%x ",
 164                                 ntohl(match->src.u.gre.key));
 165
 166         if (mask->dst.u.gre.key)
 167                 len += sprintf(buffer + len, "dstkey=0x%x ",
 168                                 ntohl(match->src.u.gre.key));
 169
 170         return len;
 171 }
 172
 173 /* print a range of keys */
 174 static unsigned int
 175 gre_print_range(char *buffer, const struct ip_nat_range *range)
 176 {
 177         if (range->min.gre.key != 0
 178             || range->max.gre.key != 0xFFFF) {
 179                 if (range->min.gre.key == range->max.gre.key)
 180                         return sprintf(buffer, "key 0x%x ",
 181                                         ntohl(range->min.gre.key));
 182                 else
 183                         return sprintf(buffer, "keys 0x%u-0x%u ",
 184                                         ntohl(range->min.gre.key),
 185                                         ntohl(range->max.gre.key));
 186         } else
 187                 return 0;
 188 }
 189
 190 /* nat helper struct */
 191 static struct ip_nat_protocol gre = {
 192         .name           = "GRE",
 193         .protonum       = IPPROTO_GRE,
 194         .manip_pkt      = gre_manip_pkt,
 195         .in_range       = gre_in_range,
 196         .unique_tuple   = gre_unique_tuple,
 197         .print          = gre_print,
 198         .print_range    = gre_print_range,
 199 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
 200     defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
 201         .range_to_nfattr        = ip_nat_port_range_to_nfattr,
 202         .nfattr_to_range        = ip_nat_port_nfattr_to_range,
 203 #endif
 204 };
 205
 206 int __init ip_nat_proto_gre_init(void)
 207 {
 208         return ip_nat_protocol_register(&gre);
 209 }
 210
 211 void __exit ip_nat_proto_gre_fini(void)
 212 {
 213         ip_nat_protocol_unregister(&gre);
 214 }