1// SPDX-License-Identifier: GPL-2.0-only
2/* (C) 1999-2001 Paul `Rusty' Russell
3 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
4 */
5
6#include <linux/types.h>
7#include <linux/export.h>
8#include <linux/init.h>
9#include <linux/udp.h>
10#include <linux/tcp.h>
11#include <linux/icmp.h>
12#include <linux/icmpv6.h>
13
14#include <linux/dccp.h>
15#include <linux/sctp.h>
16#include <net/sctp/checksum.h>
17
18#include <linux/netfilter.h>
19#include <net/netfilter/nf_nat.h>
20
21#include <linux/ipv6.h>
22#include <linux/netfilter_ipv6.h>
23#include <net/checksum.h>
24#include <net/ip6_checksum.h>
25#include <net/ip6_route.h>
26#include <net/xfrm.h>
27#include <net/ipv6.h>
28
29#include <net/netfilter/nf_conntrack_core.h>
30#include <net/netfilter/nf_conntrack.h>
31#include <linux/netfilter/nfnetlink_conntrack.h>
32
33static void nf_csum_update(struct sk_buff *skb,
34 unsigned int iphdroff, __sum16 *check,
35 const struct nf_conntrack_tuple *t,
36 enum nf_nat_manip_type maniptype);
37
38static void
39__udp_manip_pkt(struct sk_buff *skb,
40 unsigned int iphdroff, struct udphdr *hdr,
41 const struct nf_conntrack_tuple *tuple,
42 enum nf_nat_manip_type maniptype, bool do_csum)
43{
44 __be16 *portptr, newport;
45
46 if (maniptype == NF_NAT_MANIP_SRC) {
47 /* Get rid of src port */
48 newport = tuple->src.u.udp.port;
49 portptr = &hdr->source;
50 } else {
51 /* Get rid of dst port */
52 newport = tuple->dst.u.udp.port;
53 portptr = &hdr->dest;
54 }
55 if (do_csum) {
56 nf_csum_update(skb, iphdroff, check: &hdr->check, t: tuple, maniptype);
57 inet_proto_csum_replace2(sum: &hdr->check, skb, from: *portptr, to: newport,
58 pseudohdr: false);
59 if (!hdr->check)
60 hdr->check = CSUM_MANGLED_0;
61 }
62 *portptr = newport;
63}
64
65static bool udp_manip_pkt(struct sk_buff *skb,
66 unsigned int iphdroff, unsigned int hdroff,
67 const struct nf_conntrack_tuple *tuple,
68 enum nf_nat_manip_type maniptype)
69{
70 struct udphdr *hdr;
71
72 if (skb_ensure_writable(skb, write_len: hdroff + sizeof(*hdr)))
73 return false;
74
75 hdr = (struct udphdr *)(skb->data + hdroff);
76 __udp_manip_pkt(skb, iphdroff, hdr, tuple, maniptype, do_csum: !!hdr->check);
77
78 return true;
79}
80
81static bool udplite_manip_pkt(struct sk_buff *skb,
82 unsigned int iphdroff, unsigned int hdroff,
83 const struct nf_conntrack_tuple *tuple,
84 enum nf_nat_manip_type maniptype)
85{
86#ifdef CONFIG_NF_CT_PROTO_UDPLITE
87 struct udphdr *hdr;
88
89 if (skb_ensure_writable(skb, hdroff + sizeof(*hdr)))
90 return false;
91
92 hdr = (struct udphdr *)(skb->data + hdroff);
93 __udp_manip_pkt(skb, iphdroff, hdr, tuple, maniptype, true);
94#endif
95 return true;
96}
97
98static bool
99sctp_manip_pkt(struct sk_buff *skb,
100 unsigned int iphdroff, unsigned int hdroff,
101 const struct nf_conntrack_tuple *tuple,
102 enum nf_nat_manip_type maniptype)
103{
104#ifdef CONFIG_NF_CT_PROTO_SCTP
105 struct sctphdr *hdr;
106 int hdrsize = 8;
107
108 /* This could be an inner header returned in imcp packet; in such
109 * cases we cannot update the checksum field since it is outside
110 * of the 8 bytes of transport layer headers we are guaranteed.
111 */
112 if (skb->len >= hdroff + sizeof(*hdr))
113 hdrsize = sizeof(*hdr);
114
115 if (skb_ensure_writable(skb, hdroff + hdrsize))
116 return false;
117
118 hdr = (struct sctphdr *)(skb->data + hdroff);
119
120 if (maniptype == NF_NAT_MANIP_SRC) {
121 /* Get rid of src port */
122 hdr->source = tuple->src.u.sctp.port;
123 } else {
124 /* Get rid of dst port */
125 hdr->dest = tuple->dst.u.sctp.port;
126 }
127
128 if (hdrsize < sizeof(*hdr))
129 return true;
130
131 if (skb->ip_summed != CHECKSUM_PARTIAL) {
132 hdr->checksum = sctp_compute_cksum(skb, hdroff);
133 skb->ip_summed = CHECKSUM_NONE;
134 }
135
136#endif
137 return true;
138}
139
140static bool
141tcp_manip_pkt(struct sk_buff *skb,
142 unsigned int iphdroff, unsigned int hdroff,
143 const struct nf_conntrack_tuple *tuple,
144 enum nf_nat_manip_type maniptype)
145{
146 struct tcphdr *hdr;
147 __be16 *portptr, newport, oldport;
148 int hdrsize = 8; /* TCP connection tracking guarantees this much */
149
150 /* this could be a inner header returned in icmp packet; in such
151 cases we cannot update the checksum field since it is outside of
152 the 8 bytes of transport layer headers we are guaranteed */
153 if (skb->len >= hdroff + sizeof(struct tcphdr))
154 hdrsize = sizeof(struct tcphdr);
155
156 if (skb_ensure_writable(skb, write_len: hdroff + hdrsize))
157 return false;
158
159 hdr = (struct tcphdr *)(skb->data + hdroff);
160
161 if (maniptype == NF_NAT_MANIP_SRC) {
162 /* Get rid of src port */
163 newport = tuple->src.u.tcp.port;
164 portptr = &hdr->source;
165 } else {
166 /* Get rid of dst port */
167 newport = tuple->dst.u.tcp.port;
168 portptr = &hdr->dest;
169 }
170
171 oldport = *portptr;
172 *portptr = newport;
173
174 if (hdrsize < sizeof(*hdr))
175 return true;
176
177 nf_csum_update(skb, iphdroff, check: &hdr->check, t: tuple, maniptype);
178 inet_proto_csum_replace2(sum: &hdr->check, skb, from: oldport, to: newport, pseudohdr: false);
179 return true;
180}
181
182static bool
183icmp_manip_pkt(struct sk_buff *skb,
184 unsigned int iphdroff, unsigned int hdroff,
185 const struct nf_conntrack_tuple *tuple,
186 enum nf_nat_manip_type maniptype)
187{
188 struct icmphdr *hdr;
189
190 if (skb_ensure_writable(skb, write_len: hdroff + sizeof(*hdr)))
191 return false;
192
193 hdr = (struct icmphdr *)(skb->data + hdroff);
194 switch (hdr->type) {
195 case ICMP_ECHO:
196 case ICMP_ECHOREPLY:
197 case ICMP_TIMESTAMP:
198 case ICMP_TIMESTAMPREPLY:
199 case ICMP_INFO_REQUEST:
200 case ICMP_INFO_REPLY:
201 case ICMP_ADDRESS:
202 case ICMP_ADDRESSREPLY:
203 break;
204 default:
205 return true;
206 }
207 inet_proto_csum_replace2(sum: &hdr->checksum, skb,
208 from: hdr->un.echo.id, to: tuple->src.u.icmp.id, pseudohdr: false);
209 hdr->un.echo.id = tuple->src.u.icmp.id;
210 return true;
211}
212
213static bool
214icmpv6_manip_pkt(struct sk_buff *skb,
215 unsigned int iphdroff, unsigned int hdroff,
216 const struct nf_conntrack_tuple *tuple,
217 enum nf_nat_manip_type maniptype)
218{
219 struct icmp6hdr *hdr;
220
221 if (skb_ensure_writable(skb, write_len: hdroff + sizeof(*hdr)))
222 return false;
223
224 hdr = (struct icmp6hdr *)(skb->data + hdroff);
225 nf_csum_update(skb, iphdroff, check: &hdr->icmp6_cksum, t: tuple, maniptype);
226 if (hdr->icmp6_type == ICMPV6_ECHO_REQUEST ||
227 hdr->icmp6_type == ICMPV6_ECHO_REPLY) {
228 inet_proto_csum_replace2(sum: &hdr->icmp6_cksum, skb,
229 from: hdr->icmp6_identifier,
230 to: tuple->src.u.icmp.id, pseudohdr: false);
231 hdr->icmp6_identifier = tuple->src.u.icmp.id;
232 }
233 return true;
234}
235
236/* manipulate a GRE packet according to maniptype */
237static bool
238gre_manip_pkt(struct sk_buff *skb,
239 unsigned int iphdroff, unsigned int hdroff,
240 const struct nf_conntrack_tuple *tuple,
241 enum nf_nat_manip_type maniptype)
242{
243#if IS_ENABLED(CONFIG_NF_CT_PROTO_GRE)
244 const struct gre_base_hdr *greh;
245 struct pptp_gre_header *pgreh;
246
247 /* pgreh includes two optional 32bit fields which are not required
248 * to be there. That's where the magic '8' comes from */
249 if (skb_ensure_writable(skb, hdroff + sizeof(*pgreh) - 8))
250 return false;
251
252 greh = (void *)skb->data + hdroff;
253 pgreh = (struct pptp_gre_header *)greh;
254
255 /* we only have destination manip of a packet, since 'source key'
256 * is not present in the packet itself */
257 if (maniptype != NF_NAT_MANIP_DST)
258 return true;
259
260 switch (greh->flags & GRE_VERSION) {
261 case GRE_VERSION_0:
262 /* We do not currently NAT any GREv0 packets.
263 * Try to behave like "nf_nat_proto_unknown" */
264 break;
265 case GRE_VERSION_1:
266 pr_debug("call_id -> 0x%04x\n", ntohs(tuple->dst.u.gre.key));
267 pgreh->call_id = tuple->dst.u.gre.key;
268 break;
269 default:
270 pr_debug("can't nat unknown GRE version\n");
271 return false;
272 }
273#endif
274 return true;
275}
276
277static bool l4proto_manip_pkt(struct sk_buff *skb,
278 unsigned int iphdroff, unsigned int hdroff,
279 const struct nf_conntrack_tuple *tuple,
280 enum nf_nat_manip_type maniptype)
281{
282 switch (tuple->dst.protonum) {
283 case IPPROTO_TCP:
284 return tcp_manip_pkt(skb, iphdroff, hdroff,
285 tuple, maniptype);
286 case IPPROTO_UDP:
287 return udp_manip_pkt(skb, iphdroff, hdroff,
288 tuple, maniptype);
289 case IPPROTO_UDPLITE:
290 return udplite_manip_pkt(skb, iphdroff, hdroff,
291 tuple, maniptype);
292 case IPPROTO_SCTP:
293 return sctp_manip_pkt(skb, iphdroff, hdroff,
294 tuple, maniptype);
295 case IPPROTO_ICMP:
296 return icmp_manip_pkt(skb, iphdroff, hdroff,
297 tuple, maniptype);
298 case IPPROTO_ICMPV6:
299 return icmpv6_manip_pkt(skb, iphdroff, hdroff,
300 tuple, maniptype);
301 case IPPROTO_GRE:
302 return gre_manip_pkt(skb, iphdroff, hdroff,
303 tuple, maniptype);
304 }
305
306 /* If we don't know protocol -- no error, pass it unmodified. */
307 return true;
308}
309
310static bool nf_nat_ipv4_manip_pkt(struct sk_buff *skb,
311 unsigned int iphdroff,
312 const struct nf_conntrack_tuple *target,
313 enum nf_nat_manip_type maniptype)
314{
315 struct iphdr *iph;
316 unsigned int hdroff;
317
318 if (skb_ensure_writable(skb, write_len: iphdroff + sizeof(*iph)))
319 return false;
320
321 iph = (void *)skb->data + iphdroff;
322 hdroff = iphdroff + iph->ihl * 4;
323
324 if (!l4proto_manip_pkt(skb, iphdroff, hdroff, tuple: target, maniptype))
325 return false;
326 iph = (void *)skb->data + iphdroff;
327
328 if (maniptype == NF_NAT_MANIP_SRC) {
329 csum_replace4(sum: &iph->check, from: iph->saddr, to: target->src.u3.ip);
330 iph->saddr = target->src.u3.ip;
331 } else {
332 csum_replace4(sum: &iph->check, from: iph->daddr, to: target->dst.u3.ip);
333 iph->daddr = target->dst.u3.ip;
334 }
335 return true;
336}
337
338static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb,
339 unsigned int iphdroff,
340 const struct nf_conntrack_tuple *target,
341 enum nf_nat_manip_type maniptype)
342{
343#if IS_ENABLED(CONFIG_IPV6)
344 struct ipv6hdr *ipv6h;
345 __be16 frag_off;
346 int hdroff;
347 u8 nexthdr;
348
349 if (skb_ensure_writable(skb, write_len: iphdroff + sizeof(*ipv6h)))
350 return false;
351
352 ipv6h = (void *)skb->data + iphdroff;
353 nexthdr = ipv6h->nexthdr;
354 hdroff = ipv6_skip_exthdr(skb, start: iphdroff + sizeof(*ipv6h),
355 nexthdrp: &nexthdr, frag_offp: &frag_off);
356 if (hdroff < 0)
357 goto manip_addr;
358
359 if ((frag_off & htons(~0x7)) == 0 &&
360 !l4proto_manip_pkt(skb, iphdroff, hdroff, tuple: target, maniptype))
361 return false;
362
363 /* must reload, offset might have changed */
364 ipv6h = (void *)skb->data + iphdroff;
365
366manip_addr:
367 if (maniptype == NF_NAT_MANIP_SRC)
368 ipv6h->saddr = target->src.u3.in6;
369 else
370 ipv6h->daddr = target->dst.u3.in6;
371
372#endif
373 return true;
374}
375
376unsigned int nf_nat_manip_pkt(struct sk_buff *skb, struct nf_conn *ct,
377 enum nf_nat_manip_type mtype,
378 enum ip_conntrack_dir dir)
379{
380 struct nf_conntrack_tuple target;
381
382 /* We are aiming to look like inverse of other direction. */
383 nf_ct_invert_tuple(inverse: &target, orig: &ct->tuplehash[!dir].tuple);
384
385 switch (target.src.l3num) {
386 case NFPROTO_IPV6:
387 if (nf_nat_ipv6_manip_pkt(skb, iphdroff: 0, target: &target, maniptype: mtype))
388 return NF_ACCEPT;
389 break;
390 case NFPROTO_IPV4:
391 if (nf_nat_ipv4_manip_pkt(skb, iphdroff: 0, target: &target, maniptype: mtype))
392 return NF_ACCEPT;
393 break;
394 default:
395 WARN_ON_ONCE(1);
396 break;
397 }
398
399 return NF_DROP;
400}
401
402static void nf_nat_ipv4_csum_update(struct sk_buff *skb,
403 unsigned int iphdroff, __sum16 *check,
404 const struct nf_conntrack_tuple *t,
405 enum nf_nat_manip_type maniptype)
406{
407 struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
408 __be32 oldip, newip;
409
410 if (maniptype == NF_NAT_MANIP_SRC) {
411 oldip = iph->saddr;
412 newip = t->src.u3.ip;
413 } else {
414 oldip = iph->daddr;
415 newip = t->dst.u3.ip;
416 }
417 inet_proto_csum_replace4(sum: check, skb, from: oldip, to: newip, pseudohdr: true);
418}
419
420static void nf_nat_ipv6_csum_update(struct sk_buff *skb,
421 unsigned int iphdroff, __sum16 *check,
422 const struct nf_conntrack_tuple *t,
423 enum nf_nat_manip_type maniptype)
424{
425#if IS_ENABLED(CONFIG_IPV6)
426 const struct ipv6hdr *ipv6h = (struct ipv6hdr *)(skb->data + iphdroff);
427 const struct in6_addr *oldip, *newip;
428
429 if (maniptype == NF_NAT_MANIP_SRC) {
430 oldip = &ipv6h->saddr;
431 newip = &t->src.u3.in6;
432 } else {
433 oldip = &ipv6h->daddr;
434 newip = &t->dst.u3.in6;
435 }
436 inet_proto_csum_replace16(sum: check, skb, from: oldip->s6_addr32,
437 to: newip->s6_addr32, pseudohdr: true);
438#endif
439}
440
441static void nf_csum_update(struct sk_buff *skb,
442 unsigned int iphdroff, __sum16 *check,
443 const struct nf_conntrack_tuple *t,
444 enum nf_nat_manip_type maniptype)
445{
446 switch (t->src.l3num) {
447 case NFPROTO_IPV4:
448 nf_nat_ipv4_csum_update(skb, iphdroff, check, t, maniptype);
449 return;
450 case NFPROTO_IPV6:
451 nf_nat_ipv6_csum_update(skb, iphdroff, check, t, maniptype);
452 return;
453 }
454}
455
456static void nf_nat_ipv4_csum_recalc(struct sk_buff *skb,
457 u8 proto, void *data, __sum16 *check,
458 int datalen, int oldlen)
459{
460 if (skb->ip_summed != CHECKSUM_PARTIAL) {
461 const struct iphdr *iph = ip_hdr(skb);
462
463 skb->ip_summed = CHECKSUM_PARTIAL;
464 skb->csum_start = skb_headroom(skb) + skb_network_offset(skb) +
465 ip_hdrlen(skb);
466 skb->csum_offset = (void *)check - data;
467 *check = ~csum_tcpudp_magic(saddr: iph->saddr, daddr: iph->daddr, len: datalen,
468 proto, sum: 0);
469 } else {
470 inet_proto_csum_replace2(sum: check, skb,
471 htons(oldlen), htons(datalen), pseudohdr: true);
472 }
473}
474
475#if IS_ENABLED(CONFIG_IPV6)
476static void nf_nat_ipv6_csum_recalc(struct sk_buff *skb,
477 u8 proto, void *data, __sum16 *check,
478 int datalen, int oldlen)
479{
480 if (skb->ip_summed != CHECKSUM_PARTIAL) {
481 const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
482
483 skb->ip_summed = CHECKSUM_PARTIAL;
484 skb->csum_start = skb_headroom(skb) + skb_network_offset(skb) +
485 (data - (void *)skb->data);
486 skb->csum_offset = (void *)check - data;
487 *check = ~csum_ipv6_magic(saddr: &ipv6h->saddr, daddr: &ipv6h->daddr,
488 len: datalen, proto, sum: 0);
489 } else {
490 inet_proto_csum_replace2(sum: check, skb,
491 htons(oldlen), htons(datalen), pseudohdr: true);
492 }
493}
494#endif
495
496void nf_nat_csum_recalc(struct sk_buff *skb,
497 u8 nfproto, u8 proto, void *data, __sum16 *check,
498 int datalen, int oldlen)
499{
500 switch (nfproto) {
501 case NFPROTO_IPV4:
502 nf_nat_ipv4_csum_recalc(skb, proto, data, check,
503 datalen, oldlen);
504 return;
505#if IS_ENABLED(CONFIG_IPV6)
506 case NFPROTO_IPV6:
507 nf_nat_ipv6_csum_recalc(skb, proto, data, check,
508 datalen, oldlen);
509 return;
510#endif
511 }
512
513 WARN_ON_ONCE(1);
514}
515
516int nf_nat_icmp_reply_translation(struct sk_buff *skb,
517 struct nf_conn *ct,
518 enum ip_conntrack_info ctinfo,
519 unsigned int hooknum)
520{
521 struct {
522 struct icmphdr icmp;
523 struct iphdr ip;
524 } *inside;
525 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
526 enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
527 unsigned int hdrlen = ip_hdrlen(skb);
528 struct nf_conntrack_tuple target;
529 unsigned long statusbit;
530
531 WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY);
532
533 if (skb_ensure_writable(skb, write_len: hdrlen + sizeof(*inside)))
534 return 0;
535 if (nf_ip_checksum(skb, hook: hooknum, dataoff: hdrlen, IPPROTO_ICMP))
536 return 0;
537
538 inside = (void *)skb->data + hdrlen;
539 if (inside->icmp.type == ICMP_REDIRECT) {
540 if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
541 return 0;
542 if (ct->status & IPS_NAT_MASK)
543 return 0;
544 }
545
546 if (manip == NF_NAT_MANIP_SRC)
547 statusbit = IPS_SRC_NAT;
548 else
549 statusbit = IPS_DST_NAT;
550
551 /* Invert if this is reply direction */
552 if (dir == IP_CT_DIR_REPLY)
553 statusbit ^= IPS_NAT_MASK;
554
555 if (!(ct->status & statusbit))
556 return 1;
557
558 if (!nf_nat_ipv4_manip_pkt(skb, iphdroff: hdrlen + sizeof(inside->icmp),
559 target: &ct->tuplehash[!dir].tuple, maniptype: !manip))
560 return 0;
561
562 if (skb->ip_summed != CHECKSUM_PARTIAL) {
563 /* Reloading "inside" here since manip_pkt may reallocate */
564 inside = (void *)skb->data + hdrlen;
565 inside->icmp.checksum = 0;
566 inside->icmp.checksum =
567 csum_fold(sum: skb_checksum(skb, offset: hdrlen,
568 len: skb->len - hdrlen, csum: 0));
569 }
570
571 /* Change outer to look like the reply to an incoming packet */
572 nf_ct_invert_tuple(inverse: &target, orig: &ct->tuplehash[!dir].tuple);
573 target.dst.protonum = IPPROTO_ICMP;
574 if (!nf_nat_ipv4_manip_pkt(skb, iphdroff: 0, target: &target, maniptype: manip))
575 return 0;
576
577 return 1;
578}
579EXPORT_SYMBOL_GPL(nf_nat_icmp_reply_translation);
580
581static unsigned int
582nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
583 const struct nf_hook_state *state)
584{
585 struct nf_conn *ct;
586 enum ip_conntrack_info ctinfo;
587
588 ct = nf_ct_get(skb, ctinfo: &ctinfo);
589 if (!ct)
590 return NF_ACCEPT;
591
592 if (ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY) {
593 if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
594 if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
595 state->hook))
596 return NF_DROP;
597 else
598 return NF_ACCEPT;
599 }
600 }
601
602 return nf_nat_inet_fn(priv, skb, state);
603}
604
605static unsigned int
606nf_nat_ipv4_pre_routing(void *priv, struct sk_buff *skb,
607 const struct nf_hook_state *state)
608{
609 unsigned int ret;
610 __be32 daddr = ip_hdr(skb)->daddr;
611
612 ret = nf_nat_ipv4_fn(priv, skb, state);
613 if (ret == NF_ACCEPT && daddr != ip_hdr(skb)->daddr)
614 skb_dst_drop(skb);
615
616 return ret;
617}
618
619#ifdef CONFIG_XFRM
620static int nf_xfrm_me_harder(struct net *net, struct sk_buff *skb, unsigned int family)
621{
622 struct sock *sk = skb->sk;
623 struct dst_entry *dst;
624 unsigned int hh_len;
625 struct flowi fl;
626 int err;
627
628 err = xfrm_decode_session(net, skb, fl: &fl, family);
629 if (err < 0)
630 return err;
631
632 dst = skb_dst(skb);
633 if (dst->xfrm)
634 dst = ((struct xfrm_dst *)dst)->route;
635 if (!dst_hold_safe(dst))
636 return -EHOSTUNREACH;
637
638 if (sk && !net_eq(net1: net, net2: sock_net(sk)))
639 sk = NULL;
640
641 dst = xfrm_lookup(net, dst_orig: dst, fl: &fl, sk, flags: 0);
642 if (IS_ERR(ptr: dst))
643 return PTR_ERR(ptr: dst);
644
645 skb_dst_drop(skb);
646 skb_dst_set(skb, dst);
647
648 /* Change in oif may mean change in hh_len. */
649 hh_len = skb_dst(skb)->dev->hard_header_len;
650 if (skb_headroom(skb) < hh_len &&
651 pskb_expand_head(skb, nhead: hh_len - skb_headroom(skb), ntail: 0, GFP_ATOMIC))
652 return -ENOMEM;
653 return 0;
654}
655#endif
656
657static bool nf_nat_inet_port_was_mangled(const struct sk_buff *skb, __be16 sport)
658{
659 enum ip_conntrack_info ctinfo;
660 enum ip_conntrack_dir dir;
661 const struct nf_conn *ct;
662
663 ct = nf_ct_get(skb, ctinfo: &ctinfo);
664 if (!ct)
665 return false;
666
667 switch (nf_ct_protonum(ct)) {
668 case IPPROTO_TCP:
669 case IPPROTO_UDP:
670 break;
671 default:
672 return false;
673 }
674
675 dir = CTINFO2DIR(ctinfo);
676 if (dir != IP_CT_DIR_ORIGINAL)
677 return false;
678
679 return ct->tuplehash[!dir].tuple.dst.u.all != sport;
680}
681
682static unsigned int
683nf_nat_ipv4_local_in(void *priv, struct sk_buff *skb,
684 const struct nf_hook_state *state)
685{
686 __be32 saddr = ip_hdr(skb)->saddr;
687 struct sock *sk = skb->sk;
688 unsigned int ret;
689
690 ret = nf_nat_ipv4_fn(priv, skb, state);
691
692 if (ret != NF_ACCEPT || !sk || inet_sk_transparent(sk))
693 return ret;
694
695 /* skb has a socket assigned via tcp edemux. We need to check
696 * if nf_nat_ipv4_fn() has mangled the packet in a way that
697 * edemux would not have found this socket.
698 *
699 * This includes both changes to the source address and changes
700 * to the source port, which are both handled by the
701 * nf_nat_ipv4_fn() call above -- long after tcp/udp early demux
702 * might have found a socket for the old (pre-snat) address.
703 */
704 if (saddr != ip_hdr(skb)->saddr ||
705 nf_nat_inet_port_was_mangled(skb, sport: sk->sk_dport))
706 skb_orphan(skb); /* TCP edemux obtained wrong socket */
707
708 return ret;
709}
710
711static unsigned int
712nf_nat_ipv4_out(void *priv, struct sk_buff *skb,
713 const struct nf_hook_state *state)
714{
715#ifdef CONFIG_XFRM
716 const struct nf_conn *ct;
717 enum ip_conntrack_info ctinfo;
718 int err;
719#endif
720 unsigned int ret;
721
722 ret = nf_nat_ipv4_fn(priv, skb, state);
723#ifdef CONFIG_XFRM
724 if (ret != NF_ACCEPT)
725 return ret;
726
727 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
728 return ret;
729
730 ct = nf_ct_get(skb, ctinfo: &ctinfo);
731 if (ct) {
732 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
733
734 if (ct->tuplehash[dir].tuple.src.u3.ip !=
735 ct->tuplehash[!dir].tuple.dst.u3.ip ||
736 (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
737 ct->tuplehash[dir].tuple.src.u.all !=
738 ct->tuplehash[!dir].tuple.dst.u.all)) {
739 err = nf_xfrm_me_harder(net: state->net, skb, AF_INET);
740 if (err < 0)
741 ret = NF_DROP_ERR(err);
742 }
743 }
744#endif
745 return ret;
746}
747
748static unsigned int
749nf_nat_ipv4_local_fn(void *priv, struct sk_buff *skb,
750 const struct nf_hook_state *state)
751{
752 const struct nf_conn *ct;
753 enum ip_conntrack_info ctinfo;
754 unsigned int ret;
755 int err;
756
757 ret = nf_nat_ipv4_fn(priv, skb, state);
758 if (ret != NF_ACCEPT)
759 return ret;
760
761 ct = nf_ct_get(skb, ctinfo: &ctinfo);
762 if (ct) {
763 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
764
765 if (ct->tuplehash[dir].tuple.dst.u3.ip !=
766 ct->tuplehash[!dir].tuple.src.u3.ip) {
767 err = ip_route_me_harder(net: state->net, sk: state->sk, skb, addr_type: RTN_UNSPEC);
768 if (err < 0)
769 ret = NF_DROP_ERR(err);
770 }
771#ifdef CONFIG_XFRM
772 else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
773 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
774 ct->tuplehash[dir].tuple.dst.u.all !=
775 ct->tuplehash[!dir].tuple.src.u.all) {
776 err = nf_xfrm_me_harder(net: state->net, skb, AF_INET);
777 if (err < 0)
778 ret = NF_DROP_ERR(err);
779 }
780#endif
781 }
782 return ret;
783}
784
785static const struct nf_hook_ops nf_nat_ipv4_ops[] = {
786 /* Before packet filtering, change destination */
787 {
788 .hook = nf_nat_ipv4_pre_routing,
789 .pf = NFPROTO_IPV4,
790 .hooknum = NF_INET_PRE_ROUTING,
791 .priority = NF_IP_PRI_NAT_DST,
792 },
793 /* After packet filtering, change source */
794 {
795 .hook = nf_nat_ipv4_out,
796 .pf = NFPROTO_IPV4,
797 .hooknum = NF_INET_POST_ROUTING,
798 .priority = NF_IP_PRI_NAT_SRC,
799 },
800 /* Before packet filtering, change destination */
801 {
802 .hook = nf_nat_ipv4_local_fn,
803 .pf = NFPROTO_IPV4,
804 .hooknum = NF_INET_LOCAL_OUT,
805 .priority = NF_IP_PRI_NAT_DST,
806 },
807 /* After packet filtering, change source */
808 {
809 .hook = nf_nat_ipv4_local_in,
810 .pf = NFPROTO_IPV4,
811 .hooknum = NF_INET_LOCAL_IN,
812 .priority = NF_IP_PRI_NAT_SRC,
813 },
814};
815
816int nf_nat_ipv4_register_fn(struct net *net, const struct nf_hook_ops *ops)
817{
818 return nf_nat_register_fn(net, pf: ops->pf, ops, nat_ops: nf_nat_ipv4_ops,
819 ARRAY_SIZE(nf_nat_ipv4_ops));
820}
821EXPORT_SYMBOL_GPL(nf_nat_ipv4_register_fn);
822
823void nf_nat_ipv4_unregister_fn(struct net *net, const struct nf_hook_ops *ops)
824{
825 nf_nat_unregister_fn(net, pf: ops->pf, ops, ARRAY_SIZE(nf_nat_ipv4_ops));
826}
827EXPORT_SYMBOL_GPL(nf_nat_ipv4_unregister_fn);
828
829#if IS_ENABLED(CONFIG_IPV6)
830int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
831 struct nf_conn *ct,
832 enum ip_conntrack_info ctinfo,
833 unsigned int hooknum,
834 unsigned int hdrlen)
835{
836 struct {
837 struct icmp6hdr icmp6;
838 struct ipv6hdr ip6;
839 } *inside;
840 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
841 enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
842 struct nf_conntrack_tuple target;
843 unsigned long statusbit;
844
845 WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY);
846
847 if (skb_ensure_writable(skb, write_len: hdrlen + sizeof(*inside)))
848 return 0;
849 if (nf_ip6_checksum(skb, hook: hooknum, dataoff: hdrlen, IPPROTO_ICMPV6))
850 return 0;
851
852 inside = (void *)skb->data + hdrlen;
853 if (inside->icmp6.icmp6_type == NDISC_REDIRECT) {
854 if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
855 return 0;
856 if (ct->status & IPS_NAT_MASK)
857 return 0;
858 }
859
860 if (manip == NF_NAT_MANIP_SRC)
861 statusbit = IPS_SRC_NAT;
862 else
863 statusbit = IPS_DST_NAT;
864
865 /* Invert if this is reply direction */
866 if (dir == IP_CT_DIR_REPLY)
867 statusbit ^= IPS_NAT_MASK;
868
869 if (!(ct->status & statusbit))
870 return 1;
871
872 if (!nf_nat_ipv6_manip_pkt(skb, iphdroff: hdrlen + sizeof(inside->icmp6),
873 target: &ct->tuplehash[!dir].tuple, maniptype: !manip))
874 return 0;
875
876 if (skb->ip_summed != CHECKSUM_PARTIAL) {
877 struct ipv6hdr *ipv6h = ipv6_hdr(skb);
878
879 inside = (void *)skb->data + hdrlen;
880 inside->icmp6.icmp6_cksum = 0;
881 inside->icmp6.icmp6_cksum =
882 csum_ipv6_magic(saddr: &ipv6h->saddr, daddr: &ipv6h->daddr,
883 len: skb->len - hdrlen, IPPROTO_ICMPV6,
884 sum: skb_checksum(skb, offset: hdrlen,
885 len: skb->len - hdrlen, csum: 0));
886 }
887
888 nf_ct_invert_tuple(inverse: &target, orig: &ct->tuplehash[!dir].tuple);
889 target.dst.protonum = IPPROTO_ICMPV6;
890 if (!nf_nat_ipv6_manip_pkt(skb, iphdroff: 0, target: &target, maniptype: manip))
891 return 0;
892
893 return 1;
894}
895EXPORT_SYMBOL_GPL(nf_nat_icmpv6_reply_translation);
896
897static unsigned int
898nf_nat_ipv6_fn(void *priv, struct sk_buff *skb,
899 const struct nf_hook_state *state)
900{
901 struct nf_conn *ct;
902 enum ip_conntrack_info ctinfo;
903 __be16 frag_off;
904 int hdrlen;
905 u8 nexthdr;
906
907 ct = nf_ct_get(skb, ctinfo: &ctinfo);
908 /* Can't track? It's not due to stress, or conntrack would
909 * have dropped it. Hence it's the user's responsibilty to
910 * packet filter it out, or implement conntrack/NAT for that
911 * protocol. 8) --RR
912 */
913 if (!ct)
914 return NF_ACCEPT;
915
916 if (ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY) {
917 nexthdr = ipv6_hdr(skb)->nexthdr;
918 hdrlen = ipv6_skip_exthdr(skb, start: sizeof(struct ipv6hdr),
919 nexthdrp: &nexthdr, frag_offp: &frag_off);
920
921 if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
922 if (!nf_nat_icmpv6_reply_translation(skb, ct, ctinfo,
923 state->hook,
924 hdrlen))
925 return NF_DROP;
926 else
927 return NF_ACCEPT;
928 }
929 }
930
931 return nf_nat_inet_fn(priv, skb, state);
932}
933
934static unsigned int
935nf_nat_ipv6_local_in(void *priv, struct sk_buff *skb,
936 const struct nf_hook_state *state)
937{
938 struct in6_addr saddr = ipv6_hdr(skb)->saddr;
939 struct sock *sk = skb->sk;
940 unsigned int ret;
941
942 ret = nf_nat_ipv6_fn(priv, skb, state);
943
944 if (ret != NF_ACCEPT || !sk || inet_sk_transparent(sk))
945 return ret;
946
947 /* see nf_nat_ipv4_local_in */
948 if (ipv6_addr_cmp(a1: &saddr, a2: &ipv6_hdr(skb)->saddr) ||
949 nf_nat_inet_port_was_mangled(skb, sport: sk->sk_dport))
950 skb_orphan(skb);
951
952 return ret;
953}
954
955static unsigned int
956nf_nat_ipv6_in(void *priv, struct sk_buff *skb,
957 const struct nf_hook_state *state)
958{
959 unsigned int ret, verdict;
960 struct in6_addr daddr = ipv6_hdr(skb)->daddr;
961
962 ret = nf_nat_ipv6_fn(priv, skb, state);
963 verdict = ret & NF_VERDICT_MASK;
964 if (verdict != NF_DROP && verdict != NF_STOLEN &&
965 ipv6_addr_cmp(a1: &daddr, a2: &ipv6_hdr(skb)->daddr))
966 skb_dst_drop(skb);
967
968 return ret;
969}
970
971static unsigned int
972nf_nat_ipv6_out(void *priv, struct sk_buff *skb,
973 const struct nf_hook_state *state)
974{
975#ifdef CONFIG_XFRM
976 const struct nf_conn *ct;
977 enum ip_conntrack_info ctinfo;
978 int err;
979#endif
980 unsigned int ret;
981
982 ret = nf_nat_ipv6_fn(priv, skb, state);
983#ifdef CONFIG_XFRM
984 if (ret != NF_ACCEPT)
985 return ret;
986
987 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
988 return ret;
989 ct = nf_ct_get(skb, ctinfo: &ctinfo);
990 if (ct) {
991 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
992
993 if (!nf_inet_addr_cmp(a1: &ct->tuplehash[dir].tuple.src.u3,
994 a2: &ct->tuplehash[!dir].tuple.dst.u3) ||
995 (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
996 ct->tuplehash[dir].tuple.src.u.all !=
997 ct->tuplehash[!dir].tuple.dst.u.all)) {
998 err = nf_xfrm_me_harder(net: state->net, skb, AF_INET6);
999 if (err < 0)
1000 ret = NF_DROP_ERR(err);
1001 }
1002 }
1003#endif
1004
1005 return ret;
1006}
1007
1008static unsigned int
1009nf_nat_ipv6_local_fn(void *priv, struct sk_buff *skb,
1010 const struct nf_hook_state *state)
1011{
1012 const struct nf_conn *ct;
1013 enum ip_conntrack_info ctinfo;
1014 unsigned int ret;
1015 int err;
1016
1017 ret = nf_nat_ipv6_fn(priv, skb, state);
1018 if (ret != NF_ACCEPT)
1019 return ret;
1020
1021 ct = nf_ct_get(skb, ctinfo: &ctinfo);
1022 if (ct) {
1023 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
1024
1025 if (!nf_inet_addr_cmp(a1: &ct->tuplehash[dir].tuple.dst.u3,
1026 a2: &ct->tuplehash[!dir].tuple.src.u3)) {
1027 err = nf_ip6_route_me_harder(net: state->net, sk: state->sk, skb);
1028 if (err < 0)
1029 ret = NF_DROP_ERR(err);
1030 }
1031#ifdef CONFIG_XFRM
1032 else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
1033 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
1034 ct->tuplehash[dir].tuple.dst.u.all !=
1035 ct->tuplehash[!dir].tuple.src.u.all) {
1036 err = nf_xfrm_me_harder(net: state->net, skb, AF_INET6);
1037 if (err < 0)
1038 ret = NF_DROP_ERR(err);
1039 }
1040#endif
1041 }
1042
1043 return ret;
1044}
1045
1046static const struct nf_hook_ops nf_nat_ipv6_ops[] = {
1047 /* Before packet filtering, change destination */
1048 {
1049 .hook = nf_nat_ipv6_in,
1050 .pf = NFPROTO_IPV6,
1051 .hooknum = NF_INET_PRE_ROUTING,
1052 .priority = NF_IP6_PRI_NAT_DST,
1053 },
1054 /* After packet filtering, change source */
1055 {
1056 .hook = nf_nat_ipv6_out,
1057 .pf = NFPROTO_IPV6,
1058 .hooknum = NF_INET_POST_ROUTING,
1059 .priority = NF_IP6_PRI_NAT_SRC,
1060 },
1061 /* Before packet filtering, change destination */
1062 {
1063 .hook = nf_nat_ipv6_local_fn,
1064 .pf = NFPROTO_IPV6,
1065 .hooknum = NF_INET_LOCAL_OUT,
1066 .priority = NF_IP6_PRI_NAT_DST,
1067 },
1068 /* After packet filtering, change source */
1069 {
1070 .hook = nf_nat_ipv6_local_in,
1071 .pf = NFPROTO_IPV6,
1072 .hooknum = NF_INET_LOCAL_IN,
1073 .priority = NF_IP6_PRI_NAT_SRC,
1074 },
1075};
1076
1077int nf_nat_ipv6_register_fn(struct net *net, const struct nf_hook_ops *ops)
1078{
1079 return nf_nat_register_fn(net, pf: ops->pf, ops, nat_ops: nf_nat_ipv6_ops,
1080 ARRAY_SIZE(nf_nat_ipv6_ops));
1081}
1082EXPORT_SYMBOL_GPL(nf_nat_ipv6_register_fn);
1083
1084void nf_nat_ipv6_unregister_fn(struct net *net, const struct nf_hook_ops *ops)
1085{
1086 nf_nat_unregister_fn(net, pf: ops->pf, ops, ARRAY_SIZE(nf_nat_ipv6_ops));
1087}
1088EXPORT_SYMBOL_GPL(nf_nat_ipv6_unregister_fn);
1089#endif /* CONFIG_IPV6 */
1090
1091#if defined(CONFIG_NF_TABLES_INET) && IS_ENABLED(CONFIG_NFT_NAT)
1092int nf_nat_inet_register_fn(struct net *net, const struct nf_hook_ops *ops)
1093{
1094 int ret;
1095
1096 if (WARN_ON_ONCE(ops->pf != NFPROTO_INET))
1097 return -EINVAL;
1098
1099 ret = nf_nat_register_fn(net, NFPROTO_IPV6, ops, nf_nat_ipv6_ops,
1100 ARRAY_SIZE(nf_nat_ipv6_ops));
1101 if (ret)
1102 return ret;
1103
1104 ret = nf_nat_register_fn(net, NFPROTO_IPV4, ops, nf_nat_ipv4_ops,
1105 ARRAY_SIZE(nf_nat_ipv4_ops));
1106 if (ret)
1107 nf_nat_unregister_fn(net, NFPROTO_IPV6, ops,
1108 ARRAY_SIZE(nf_nat_ipv6_ops));
1109 return ret;
1110}
1111EXPORT_SYMBOL_GPL(nf_nat_inet_register_fn);
1112
1113void nf_nat_inet_unregister_fn(struct net *net, const struct nf_hook_ops *ops)
1114{
1115 nf_nat_unregister_fn(net, NFPROTO_IPV4, ops, ARRAY_SIZE(nf_nat_ipv4_ops));
1116 nf_nat_unregister_fn(net, NFPROTO_IPV6, ops, ARRAY_SIZE(nf_nat_ipv6_ops));
1117}
1118EXPORT_SYMBOL_GPL(nf_nat_inet_unregister_fn);
1119#endif /* NFT INET NAT */
1120