net/ipv4/netfilter/nf_nat_l3proto_ipv4.c

   1 /*
   2  * (C) 1999-2001 Paul `Rusty' Russell
   3  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
   4  * (C) 2011 Patrick McHardy <kaber@trash.net>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 #include <linux/types.h>
  12 #include <linux/module.h>
  13 #include <linux/skbuff.h>
  14 #include <linux/ip.h>
  15 #include <linux/icmp.h>
  16 #include <linux/netfilter.h>
  17 #include <linux/netfilter_ipv4.h>
  18 #include <net/secure_seq.h>
  19 #include <net/checksum.h>
  20 #include <net/route.h>
  21 #include <net/ip.h>
  22
  23 #include <net/netfilter/nf_conntrack_core.h>
  24 #include <net/netfilter/nf_conntrack.h>
  25 #include <net/netfilter/nf_nat_core.h>
  26 #include <net/netfilter/nf_nat_l3proto.h>
  27 #include <net/netfilter/nf_nat_l4proto.h>
  28
  29 static const struct nf_nat_l3proto nf_nat_l3proto_ipv4;
  30
  31 #ifdef CONFIG_XFRM
  32 static void nf_nat_ipv4_decode_session(struct sk_buff *skb,
  33                                        const struct nf_conn *ct,
  34                                        enum ip_conntrack_dir dir,
  35                                        unsigned long statusbit,
  36                                        struct flowi *fl)
  37 {
  38         const struct nf_conntrack_tuple *t = &ct->tuplehash[dir].tuple;
  39         struct flowi4 *fl4 = &fl->u.ip4;
  40
  41         if (ct->status & statusbit) {
  42                 fl4->daddr = t->dst.u3.ip;
  43                 if (t->dst.protonum == IPPROTO_TCP ||
  44                     t->dst.protonum == IPPROTO_UDP ||
  45                     t->dst.protonum == IPPROTO_UDPLITE ||
  46                     t->dst.protonum == IPPROTO_DCCP ||
  47                     t->dst.protonum == IPPROTO_SCTP)
  48                         fl4->fl4_dport = t->dst.u.all;
  49         }
  50
  51         statusbit ^= IPS_NAT_MASK;
  52
  53         if (ct->status & statusbit) {
  54                 fl4->saddr = t->src.u3.ip;
  55                 if (t->dst.protonum == IPPROTO_TCP ||
  56                     t->dst.protonum == IPPROTO_UDP ||
  57                     t->dst.protonum == IPPROTO_UDPLITE ||
  58                     t->dst.protonum == IPPROTO_DCCP ||
  59                     t->dst.protonum == IPPROTO_SCTP)
  60                         fl4->fl4_sport = t->src.u.all;
  61         }
  62 }
  63 #endif /* CONFIG_XFRM */
  64
  65 static bool nf_nat_ipv4_in_range(const struct nf_conntrack_tuple *t,
  66                                  const struct nf_nat_range2 *range)
  67 {
  68         return ntohl(t->src.u3.ip) >= ntohl(range->min_addr.ip) &&
  69                ntohl(t->src.u3.ip) <= ntohl(range->max_addr.ip);
  70 }
  71
  72 static u32 nf_nat_ipv4_secure_port(const struct nf_conntrack_tuple *t,
  73                                    __be16 dport)
  74 {
  75         return secure_ipv4_port_ephemeral(t->src.u3.ip, t->dst.u3.ip, dport);
  76 }
  77
  78 static bool nf_nat_ipv4_manip_pkt(struct sk_buff *skb,
  79                                   unsigned int iphdroff,
  80                                   const struct nf_nat_l4proto *l4proto,
  81                                   const struct nf_conntrack_tuple *target,
  82                                   enum nf_nat_manip_type maniptype)
  83 {
  84         struct iphdr *iph;
  85         unsigned int hdroff;
  86
  87         if (!skb_make_writable(skb, iphdroff + sizeof(*iph)))
  88                 return false;
  89
  90         iph = (void *)skb->data + iphdroff;
  91         hdroff = iphdroff + iph->ihl * 4;
  92
  93         if (!l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv4, iphdroff, hdroff,
  94                                 target, maniptype))
  95                 return false;
  96         iph = (void *)skb->data + iphdroff;
  97
  98         if (maniptype == NF_NAT_MANIP_SRC) {
  99                 csum_replace4(&iph->check, iph->saddr, target->src.u3.ip);
 100                 iph->saddr = target->src.u3.ip;
 101         } else {
 102                 csum_replace4(&iph->check, iph->daddr, target->dst.u3.ip);
 103                 iph->daddr = target->dst.u3.ip;
 104         }
 105         return true;
 106 }
 107
 108 static void nf_nat_ipv4_csum_update(struct sk_buff *skb,
 109                                     unsigned int iphdroff, __sum16 *check,
 110                                     const struct nf_conntrack_tuple *t,
 111                                     enum nf_nat_manip_type maniptype)
 112 {
 113         struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
 114         __be32 oldip, newip;
 115
 116         if (maniptype == NF_NAT_MANIP_SRC) {
 117                 oldip = iph->saddr;
 118                 newip = t->src.u3.ip;
 119         } else {
 120                 oldip = iph->daddr;
 121                 newip = t->dst.u3.ip;
 122         }
 123         inet_proto_csum_replace4(check, skb, oldip, newip, true);
 124 }
 125
 126 static void nf_nat_ipv4_csum_recalc(struct sk_buff *skb,
 127                                     u8 proto, void *data, __sum16 *check,
 128                                     int datalen, int oldlen)
 129 {
 130         if (skb->ip_summed != CHECKSUM_PARTIAL) {
 131                 const struct iphdr *iph = ip_hdr(skb);
 132
 133                 skb->ip_summed = CHECKSUM_PARTIAL;
 134                 skb->csum_start = skb_headroom(skb) + skb_network_offset(skb) +
 135                         ip_hdrlen(skb);
 136                 skb->csum_offset = (void *)check - data;
 137                 *check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, datalen,
 138                                             proto, 0);
 139         } else
 140                 inet_proto_csum_replace2(check, skb,
 141                                          htons(oldlen), htons(datalen), true);
 142 }
 143
 144 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
 145 static int nf_nat_ipv4_nlattr_to_range(struct nlattr *tb[],
 146                                        struct nf_nat_range2 *range)
 147 {
 148         if (tb[CTA_NAT_V4_MINIP]) {
 149                 range->min_addr.ip = nla_get_be32(tb[CTA_NAT_V4_MINIP]);
 150                 range->flags |= NF_NAT_RANGE_MAP_IPS;
 151         }
 152
 153         if (tb[CTA_NAT_V4_MAXIP])
 154                 range->max_addr.ip = nla_get_be32(tb[CTA_NAT_V4_MAXIP]);
 155         else
 156                 range->max_addr.ip = range->min_addr.ip;
 157
 158         return 0;
 159 }
 160 #endif
 161
 162 static const struct nf_nat_l3proto nf_nat_l3proto_ipv4 = {
 163         .l3proto                = NFPROTO_IPV4,
 164         .in_range               = nf_nat_ipv4_in_range,
 165         .secure_port            = nf_nat_ipv4_secure_port,
 166         .manip_pkt              = nf_nat_ipv4_manip_pkt,
 167         .csum_update            = nf_nat_ipv4_csum_update,
 168         .csum_recalc            = nf_nat_ipv4_csum_recalc,
 169 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
 170         .nlattr_to_range        = nf_nat_ipv4_nlattr_to_range,
 171 #endif
 172 #ifdef CONFIG_XFRM
 173         .decode_session         = nf_nat_ipv4_decode_session,
 174 #endif
 175 };
 176
 177 int nf_nat_icmp_reply_translation(struct sk_buff *skb,
 178                                   struct nf_conn *ct,
 179                                   enum ip_conntrack_info ctinfo,
 180                                   unsigned int hooknum)
 181 {
 182         struct {
 183                 struct icmphdr  icmp;
 184                 struct iphdr    ip;
 185         } *inside;
 186         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 187         enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
 188         unsigned int hdrlen = ip_hdrlen(skb);
 189         const struct nf_nat_l4proto *l4proto;
 190         struct nf_conntrack_tuple target;
 191         unsigned long statusbit;
 192
 193         WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY);
 194
 195         if (!skb_make_writable(skb, hdrlen + sizeof(*inside)))
 196                 return 0;
 197         if (nf_ip_checksum(skb, hooknum, hdrlen, 0))
 198                 return 0;
 199
 200         inside = (void *)skb->data + hdrlen;
 201         if (inside->icmp.type == ICMP_REDIRECT) {
 202                 if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
 203                         return 0;
 204                 if (ct->status & IPS_NAT_MASK)
 205                         return 0;
 206         }
 207
 208         if (manip == NF_NAT_MANIP_SRC)
 209                 statusbit = IPS_SRC_NAT;
 210         else
 211                 statusbit = IPS_DST_NAT;
 212
 213         /* Invert if this is reply direction */
 214         if (dir == IP_CT_DIR_REPLY)
 215                 statusbit ^= IPS_NAT_MASK;
 216
 217         if (!(ct->status & statusbit))
 218                 return 1;
 219
 220         l4proto = __nf_nat_l4proto_find(NFPROTO_IPV4, inside->ip.protocol);
 221         if (!nf_nat_ipv4_manip_pkt(skb, hdrlen + sizeof(inside->icmp),
 222                                    l4proto, &ct->tuplehash[!dir].tuple, !manip))
 223                 return 0;
 224
 225         if (skb->ip_summed != CHECKSUM_PARTIAL) {
 226                 /* Reloading "inside" here since manip_pkt may reallocate */
 227                 inside = (void *)skb->data + hdrlen;
 228                 inside->icmp.checksum = 0;
 229                 inside->icmp.checksum =
 230                         csum_fold(skb_checksum(skb, hdrlen,
 231                                                skb->len - hdrlen, 0));
 232         }
 233
 234         /* Change outer to look like the reply to an incoming packet */
 235         nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
 236         l4proto = __nf_nat_l4proto_find(NFPROTO_IPV4, 0);
 237         if (!nf_nat_ipv4_manip_pkt(skb, 0, l4proto, &target, manip))
 238                 return 0;
 239
 240         return 1;
 241 }
 242 EXPORT_SYMBOL_GPL(nf_nat_icmp_reply_translation);
 243
 244 static unsigned int
 245 nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
 246                const struct nf_hook_state *state)
 247 {
 248         struct nf_conn *ct;
 249         enum ip_conntrack_info ctinfo;
 250
 251         ct = nf_ct_get(skb, &ctinfo);
 252         if (!ct)
 253                 return NF_ACCEPT;
 254
 255         if (ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY) {
 256                 if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
 257                         if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
 258                                                            state->hook))
 259                                 return NF_DROP;
 260                         else
 261                                 return NF_ACCEPT;
 262                 }
 263         }
 264
 265         return nf_nat_inet_fn(priv, skb, state);
 266 }
 267 EXPORT_SYMBOL_GPL(nf_nat_ipv4_fn);
 268
 269 static unsigned int
 270 nf_nat_ipv4_in(void *priv, struct sk_buff *skb,
 271                const struct nf_hook_state *state)
 272 {
 273         unsigned int ret;
 274         __be32 daddr = ip_hdr(skb)->daddr;
 275
 276         ret = nf_nat_ipv4_fn(priv, skb, state);
 277         if (ret != NF_DROP && ret != NF_STOLEN &&
 278             daddr != ip_hdr(skb)->daddr)
 279                 skb_dst_drop(skb);
 280
 281         return ret;
 282 }
 283
 284 static unsigned int
 285 nf_nat_ipv4_out(void *priv, struct sk_buff *skb,
 286                 const struct nf_hook_state *state)
 287 {
 288 #ifdef CONFIG_XFRM
 289         const struct nf_conn *ct;
 290         enum ip_conntrack_info ctinfo;
 291         int err;
 292 #endif
 293         unsigned int ret;
 294
 295         ret = nf_nat_ipv4_fn(priv, skb, state);
 296 #ifdef CONFIG_XFRM
 297         if (ret != NF_DROP && ret != NF_STOLEN &&
 298             !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
 299             (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
 300                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 301
 302                 if ((ct->tuplehash[dir].tuple.src.u3.ip !=
 303                      ct->tuplehash[!dir].tuple.dst.u3.ip) ||
 304                     (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
 305                      ct->tuplehash[dir].tuple.src.u.all !=
 306                      ct->tuplehash[!dir].tuple.dst.u.all)) {
 307                         err = nf_xfrm_me_harder(state->net, skb, AF_INET);
 308                         if (err < 0)
 309                                 ret = NF_DROP_ERR(err);
 310                 }
 311         }
 312 #endif
 313         return ret;
 314 }
 315
 316 static unsigned int
 317 nf_nat_ipv4_local_fn(void *priv, struct sk_buff *skb,
 318                      const struct nf_hook_state *state)
 319 {
 320         const struct nf_conn *ct;
 321         enum ip_conntrack_info ctinfo;
 322         unsigned int ret;
 323         int err;
 324
 325         ret = nf_nat_ipv4_fn(priv, skb, state);
 326         if (ret != NF_DROP && ret != NF_STOLEN &&
 327             (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
 328                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 329
 330                 if (ct->tuplehash[dir].tuple.dst.u3.ip !=
 331                     ct->tuplehash[!dir].tuple.src.u3.ip) {
 332                         err = ip_route_me_harder(state->net, state->sk, skb, RTN_UNSPEC);
 333                         if (err < 0)
 334                                 ret = NF_DROP_ERR(err);
 335                 }
 336 #ifdef CONFIG_XFRM
 337                 else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
 338                          ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
 339                          ct->tuplehash[dir].tuple.dst.u.all !=
 340                          ct->tuplehash[!dir].tuple.src.u.all) {
 341                         err = nf_xfrm_me_harder(state->net, skb, AF_INET);
 342                         if (err < 0)
 343                                 ret = NF_DROP_ERR(err);
 344                 }
 345 #endif
 346         }
 347         return ret;
 348 }
 349
 350 static const struct nf_hook_ops nf_nat_ipv4_ops[] = {
 351         /* Before packet filtering, change destination */
 352         {
 353                 .hook           = nf_nat_ipv4_in,
 354                 .pf             = NFPROTO_IPV4,
 355                 .hooknum        = NF_INET_PRE_ROUTING,
 356                 .priority       = NF_IP_PRI_NAT_DST,
 357         },
 358         /* After packet filtering, change source */
 359         {
 360                 .hook           = nf_nat_ipv4_out,
 361                 .pf             = NFPROTO_IPV4,
 362                 .hooknum        = NF_INET_POST_ROUTING,
 363                 .priority       = NF_IP_PRI_NAT_SRC,
 364         },
 365         /* Before packet filtering, change destination */
 366         {
 367                 .hook           = nf_nat_ipv4_local_fn,
 368                 .pf             = NFPROTO_IPV4,
 369                 .hooknum        = NF_INET_LOCAL_OUT,
 370                 .priority       = NF_IP_PRI_NAT_DST,
 371         },
 372         /* After packet filtering, change source */
 373         {
 374                 .hook           = nf_nat_ipv4_fn,
 375                 .pf             = NFPROTO_IPV4,
 376                 .hooknum        = NF_INET_LOCAL_IN,
 377                 .priority       = NF_IP_PRI_NAT_SRC,
 378         },
 379 };
 380
 381 int nf_nat_l3proto_ipv4_register_fn(struct net *net, const struct nf_hook_ops *ops)
 382 {
 383         return nf_nat_register_fn(net, ops, nf_nat_ipv4_ops, ARRAY_SIZE(nf_nat_ipv4_ops));
 384 }
 385 EXPORT_SYMBOL_GPL(nf_nat_l3proto_ipv4_register_fn);
 386
 387 void nf_nat_l3proto_ipv4_unregister_fn(struct net *net, const struct nf_hook_ops *ops)
 388 {
 389         nf_nat_unregister_fn(net, ops, ARRAY_SIZE(nf_nat_ipv4_ops));
 390 }
 391 EXPORT_SYMBOL_GPL(nf_nat_l3proto_ipv4_unregister_fn);
 392
 393 static int __init nf_nat_l3proto_ipv4_init(void)
 394 {
 395         int err;
 396
 397         err = nf_nat_l4proto_register(NFPROTO_IPV4, &nf_nat_l4proto_icmp);
 398         if (err < 0)
 399                 goto err1;
 400         err = nf_nat_l3proto_register(&nf_nat_l3proto_ipv4);
 401         if (err < 0)
 402                 goto err2;
 403         return err;
 404
 405 err2:
 406         nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_icmp);
 407 err1:
 408         return err;
 409 }
 410
 411 static void __exit nf_nat_l3proto_ipv4_exit(void)
 412 {
 413         nf_nat_l3proto_unregister(&nf_nat_l3proto_ipv4);
 414         nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_icmp);
 415 }
 416
 417 MODULE_LICENSE("GPL");
 418 MODULE_ALIAS("nf-nat-" __stringify(AF_INET));
 419
 420 module_init(nf_nat_l3proto_ipv4_init);
 421 module_exit(nf_nat_l3proto_ipv4_exit);