1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * (C) 2000-2001 Svenning Soerensen <svenning@post5.tele.dk>
4  * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
5  */
6 
7 #include <linux/ip.h>
8 #include <linux/kernel.h>
9 #include <linux/module.h>
10 #include <linux/netdevice.h>
11 #include <linux/ipv6.h>
12 #include <linux/netfilter.h>
13 #include <linux/netfilter_ipv4.h>
14 #include <linux/netfilter_ipv6.h>
15 #include <linux/netfilter/x_tables.h>
16 #include <net/netfilter/nf_nat.h>
17 
18 static unsigned int
netmap_tg6(struct sk_buff * skb,const struct xt_action_param * par)19 netmap_tg6(struct sk_buff *skb, const struct xt_action_param *par)
20 {
21 	const struct nf_nat_range2 *range = par->targinfo;
22 	struct nf_nat_range2 newrange;
23 	struct nf_conn *ct;
24 	enum ip_conntrack_info ctinfo;
25 	union nf_inet_addr new_addr, netmask;
26 	unsigned int i;
27 
28 	ct = nf_ct_get(skb, &ctinfo);
29 	for (i = 0; i < ARRAY_SIZE(range->min_addr.ip6); i++)
30 		netmask.ip6[i] = ~(range->min_addr.ip6[i] ^
31 				   range->max_addr.ip6[i]);
32 
33 	if (xt_hooknum(par) == NF_INET_PRE_ROUTING ||
34 	    xt_hooknum(par) == NF_INET_LOCAL_OUT)
35 		new_addr.in6 = ipv6_hdr(skb)->daddr;
36 	else
37 		new_addr.in6 = ipv6_hdr(skb)->saddr;
38 
39 	for (i = 0; i < ARRAY_SIZE(new_addr.ip6); i++) {
40 		new_addr.ip6[i] &= ~netmask.ip6[i];
41 		new_addr.ip6[i] |= range->min_addr.ip6[i] &
42 				   netmask.ip6[i];
43 	}
44 
45 	newrange.flags	= range->flags | NF_NAT_RANGE_MAP_IPS;
46 	newrange.min_addr	= new_addr;
47 	newrange.max_addr	= new_addr;
48 	newrange.min_proto	= range->min_proto;
49 	newrange.max_proto	= range->max_proto;
50 
51 	return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(xt_hooknum(par)));
52 }
53 
netmap_tg6_checkentry(const struct xt_tgchk_param * par)54 static int netmap_tg6_checkentry(const struct xt_tgchk_param *par)
55 {
56 	const struct nf_nat_range2 *range = par->targinfo;
57 
58 	if (!(range->flags & NF_NAT_RANGE_MAP_IPS))
59 		return -EINVAL;
60 	return nf_ct_netns_get(par->net, par->family);
61 }
62 
netmap_tg_destroy(const struct xt_tgdtor_param * par)63 static void netmap_tg_destroy(const struct xt_tgdtor_param *par)
64 {
65 	nf_ct_netns_put(par->net, par->family);
66 }
67 
68 static unsigned int
netmap_tg4(struct sk_buff * skb,const struct xt_action_param * par)69 netmap_tg4(struct sk_buff *skb, const struct xt_action_param *par)
70 {
71 	struct nf_conn *ct;
72 	enum ip_conntrack_info ctinfo;
73 	__be32 new_ip, netmask;
74 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
75 	struct nf_nat_range2 newrange;
76 
77 	WARN_ON(xt_hooknum(par) != NF_INET_PRE_ROUTING &&
78 		xt_hooknum(par) != NF_INET_POST_ROUTING &&
79 		xt_hooknum(par) != NF_INET_LOCAL_OUT &&
80 		xt_hooknum(par) != NF_INET_LOCAL_IN);
81 	ct = nf_ct_get(skb, &ctinfo);
82 
83 	netmask = ~(mr->range[0].min_ip ^ mr->range[0].max_ip);
84 
85 	if (xt_hooknum(par) == NF_INET_PRE_ROUTING ||
86 	    xt_hooknum(par) == NF_INET_LOCAL_OUT)
87 		new_ip = ip_hdr(skb)->daddr & ~netmask;
88 	else
89 		new_ip = ip_hdr(skb)->saddr & ~netmask;
90 	new_ip |= mr->range[0].min_ip & netmask;
91 
92 	memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
93 	memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
94 	newrange.flags	     = mr->range[0].flags | NF_NAT_RANGE_MAP_IPS;
95 	newrange.min_addr.ip = new_ip;
96 	newrange.max_addr.ip = new_ip;
97 	newrange.min_proto   = mr->range[0].min;
98 	newrange.max_proto   = mr->range[0].max;
99 
100 	/* Hand modified range to generic setup. */
101 	return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(xt_hooknum(par)));
102 }
103 
netmap_tg4_check(const struct xt_tgchk_param * par)104 static int netmap_tg4_check(const struct xt_tgchk_param *par)
105 {
106 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
107 
108 	if (!(mr->range[0].flags & NF_NAT_RANGE_MAP_IPS)) {
109 		pr_debug("bad MAP_IPS.\n");
110 		return -EINVAL;
111 	}
112 	if (mr->rangesize != 1) {
113 		pr_debug("bad rangesize %u.\n", mr->rangesize);
114 		return -EINVAL;
115 	}
116 	return nf_ct_netns_get(par->net, par->family);
117 }
118 
119 static struct xt_target netmap_tg_reg[] __read_mostly = {
120 	{
121 		.name       = "NETMAP",
122 		.family     = NFPROTO_IPV6,
123 		.revision   = 0,
124 		.target     = netmap_tg6,
125 		.targetsize = sizeof(struct nf_nat_range),
126 		.table      = "nat",
127 		.hooks      = (1 << NF_INET_PRE_ROUTING) |
128 		              (1 << NF_INET_POST_ROUTING) |
129 		              (1 << NF_INET_LOCAL_OUT) |
130 		              (1 << NF_INET_LOCAL_IN),
131 		.checkentry = netmap_tg6_checkentry,
132 		.destroy    = netmap_tg_destroy,
133 		.me         = THIS_MODULE,
134 	},
135 	{
136 		.name       = "NETMAP",
137 		.family     = NFPROTO_IPV4,
138 		.revision   = 0,
139 		.target     = netmap_tg4,
140 		.targetsize = sizeof(struct nf_nat_ipv4_multi_range_compat),
141 		.table      = "nat",
142 		.hooks      = (1 << NF_INET_PRE_ROUTING) |
143 		              (1 << NF_INET_POST_ROUTING) |
144 		              (1 << NF_INET_LOCAL_OUT) |
145 		              (1 << NF_INET_LOCAL_IN),
146 		.checkentry = netmap_tg4_check,
147 		.destroy    = netmap_tg_destroy,
148 		.me         = THIS_MODULE,
149 	},
150 };
151 
netmap_tg_init(void)152 static int __init netmap_tg_init(void)
153 {
154 	return xt_register_targets(netmap_tg_reg, ARRAY_SIZE(netmap_tg_reg));
155 }
156 
netmap_tg_exit(void)157 static void netmap_tg_exit(void)
158 {
159 	xt_unregister_targets(netmap_tg_reg, ARRAY_SIZE(netmap_tg_reg));
160 }
161 
162 module_init(netmap_tg_init);
163 module_exit(netmap_tg_exit);
164 
165 MODULE_LICENSE("GPL");
166 MODULE_DESCRIPTION("Xtables: 1:1 NAT mapping of subnets");
167 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
168 MODULE_ALIAS("ip6t_NETMAP");
169 MODULE_ALIAS("ipt_NETMAP");
170