LXR linux/net/ipv4/netfilter/nf_nat_proto

   1/*
   2 * nf_nat_proto_gre.c
   3 *
   4 * NAT protocol helper module for GRE.
   5 *
   6 * GRE is a generic encapsulation protocol, which is generally not very
   7 * suited for NAT, as it has no protocol-specific part as port numbers.
   8 *
   9 * It has an optional key field, which may help us distinguishing two
  10 * connections between the same two hosts.
  11 *
  12 * GRE is defined in RFC 1701 and RFC 1702, as well as RFC 2784
  13 *
  14 * PPTP is built on top of a modified version of GRE, and has a mandatory
  15 * field called "CallID", which serves us for the same purpose as the key
  16 * field in plain GRE.
  17 *
  18 * Documentation about PPTP can be found in RFC 2637
  19 *
  20 * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org>
  21 *
  22 * Development of this code funded by Astaro AG (http://www.astaro.com/)
  23 *
  24 * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
  25 *
  26 */
  27
  28#include <linux/module.h>
  29#include <linux/skbuff.h>
  30#include <linux/ip.h>
  31
  32#include <net/netfilter/nf_nat.h>
  33#include <net/netfilter/nf_nat_l4proto.h>
  34#include <linux/netfilter/nf_conntrack_proto_gre.h>
  35
  36MODULE_LICENSE("GPL");
  37MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
  38MODULE_DESCRIPTION("Netfilter NAT protocol helper module for GRE");
  39
  40/* generate unique tuple ... */
  41static void
  42gre_unique_tuple(const struct nf_nat_l3proto *l3proto,
  43                 struct nf_conntrack_tuple *tuple,
  44                 const struct nf_nat_range *range,
  45                 enum nf_nat_manip_type maniptype,
  46                 const struct nf_conn *ct)
  47{
  48        static u_int16_t key;
  49        __be16 *keyptr;
  50        unsigned int min, i, range_size;
  51
  52        /* If there is no master conntrack we are not PPTP,
  53           do not change tuples */
  54        if (!ct->master)
  55                return;
  56
  57        if (maniptype == NF_NAT_MANIP_SRC)
  58                keyptr = &tuple->src.u.gre.key;
  59        else
  60                keyptr = &tuple->dst.u.gre.key;
  61
  62        if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED)) {
  63                pr_debug("%p: NATing GRE PPTP\n", ct);
  64                min = 1;
  65                range_size = 0xffff;
  66        } else {
  67                min = ntohs(range->min_proto.gre.key);
  68                range_size = ntohs(range->max_proto.gre.key) - min + 1;
  69        }
  70
  71        pr_debug("min = %u, range_size = %u\n", min, range_size);
  72
  73        for (i = 0; ; ++key) {
  74                *keyptr = htons(min + key % range_size);
  75                if (++i == range_size || !nf_nat_used_tuple(tuple, ct))
  76                        return;
  77        }
  78
  79        pr_debug("%p: no NAT mapping\n", ct);
  80        return;
  81}
  82
  83/* manipulate a GRE packet according to maniptype */
  84static bool
  85gre_manip_pkt(struct sk_buff *skb,
  86              const struct nf_nat_l3proto *l3proto,
  87              unsigned int iphdroff, unsigned int hdroff,
  88              const struct nf_conntrack_tuple *tuple,
  89              enum nf_nat_manip_type maniptype)
  90{
  91        const struct gre_base_hdr *greh;
  92        struct pptp_gre_header *pgreh;
  93
  94        /* pgreh includes two optional 32bit fields which are not required
  95         * to be there.  That's where the magic '8' comes from */
  96        if (!skb_make_writable(skb, hdroff + sizeof(*pgreh) - 8))
  97                return false;
  98
  99        greh = (void *)skb->data + hdroff;
 100        pgreh = (struct pptp_gre_header *)greh;
 101
 102        /* we only have destination manip of a packet, since 'source key'
 103         * is not present in the packet itself */
 104        if (maniptype != NF_NAT_MANIP_DST)
 105                return true;
 106
 107        switch (greh->flags & GRE_VERSION) {
 108        case GRE_VERSION_0:
 109                /* We do not currently NAT any GREv0 packets.
 110                 * Try to behave like "nf_nat_proto_unknown" */
 111                break;
 112        case GRE_VERSION_1:
 113                pr_debug("call_id -> 0x%04x\n", ntohs(tuple->dst.u.gre.key));
 114                pgreh->call_id = tuple->dst.u.gre.key;
 115                break;
 116        default:
 117                pr_debug("can't nat unknown GRE version\n");
 118                return false;
 119        }
 120        return true;
 121}
 122
 123static const struct nf_nat_l4proto gre = {
 124        .l4proto                = IPPROTO_GRE,
 125        .manip_pkt              = gre_manip_pkt,
 126        .in_range               = nf_nat_l4proto_in_range,
 127        .unique_tuple           = gre_unique_tuple,
 128#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
 129        .nlattr_to_range        = nf_nat_l4proto_nlattr_to_range,
 130#endif
 131};
 132
 133static int __init nf_nat_proto_gre_init(void)
 134{
 135        return nf_nat_l4proto_register(NFPROTO_IPV4, &gre);
 136}
 137
 138static void __exit nf_nat_proto_gre_fini(void)
 139{
 140        nf_nat_l4proto_unregister(NFPROTO_IPV4, &gre);
 141}
 142
 143module_init(nf_nat_proto_gre_init);
 144module_exit(nf_nat_proto_gre_fini);
 145
 146void nf_nat_need_gre(void)
 147{
 148        return;
 149}
 150EXPORT_SYMBOL_GPL(nf_nat_need_gre);
 151