net/netfilter/nf_nat_core.c

64 	const struct nf_conntrack_tuple *t = &ct->tuplehash[dir].tuple;
97 	const struct nf_conntrack_tuple *t = &ct->tuplehash[dir].tuple;
158 	    const struct nf_conntrack_tuple *tuple)
173 	combined.src = tuple->src;
175 	combined.protonum = tuple->dst.protonum;
186 /* Is this tuple already taken? (not by us) */
188 nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,
193 	 * so we invert the tuple and look for the incoming reply.
199 	nf_ct_invert_tuple(&reply, tuple);
230 nf_nat_used_tuple_harder(const struct nf_conntrack_tuple *tuple,
243 	nf_ct_invert_tuple(&reply, tuple);
246 	    tuple->dst.protonum != IPPROTO_TCP ||
264 	if (thash->tuple.dst.dir == IP_CT_DIR_ORIGINAL)
296 /* Is the manipable part of the tuple between min and max incl? */
297 static bool l4proto_in_range(const struct nf_conntrack_tuple *tuple,
304 	switch (tuple->dst.protonum) {
307 		return ntohs(tuple->src.u.icmp.id) >= ntohs(min->icmp.id) &&
308 		       ntohs(tuple->src.u.icmp.id) <= ntohs(max->icmp.id);
316 			port = tuple->src.u.all;
318 			port = tuple->dst.u.all;
327 /* If we source map this tuple so reply looks like reply_tuple, will
330 static int nf_in_range(const struct nf_conntrack_tuple *tuple,
337 	    !nf_nat_inet_in_range(tuple, range))
343 	return l4proto_in_range(tuple, NF_NAT_MANIP_SRC,
349 	 const struct nf_conntrack_tuple *tuple)
353 	t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
354 	return (t->dst.protonum == tuple->dst.protonum &&
355 		nf_inet_addr_cmp(&t->src.u3, &tuple->src.u3) &&
356 		t->src.u.all == tuple->src.u.all);
363 		     const struct nf_conntrack_tuple *tuple,
367 	unsigned int h = hash_by_src(net, zone, tuple);
371 		if (same_src(ct, tuple) &&
374 			/* Copy source part from reply tuple. */
376 				       &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
377 			result->dst = tuple->dst;
394 		    struct nf_conntrack_tuple *tuple,
410 		var_ipp = &tuple->src.u3;
412 		var_ipp = &tuple->dst.u3;
432 	j = jhash2((u32 *)&tuple->src.u3, sizeof(tuple->src.u3) / sizeof(u32),
434 			0 : (__force u32)tuple->dst.u3.all[max] ^ zone->id);
456 			j ^= (__force u32)tuple->dst.u3.all[i];
460 /* Alter the per-proto part of the tuple (depending on maniptype), to
461  * give a unique tuple in the given range if possible.
463  * Per-protocol part of tuple is initialized to the incoming packet.
465 static void nf_nat_l4proto_unique_tuple(struct nf_conntrack_tuple *tuple,
474 	switch (tuple->dst.protonum) {
478 		keyptr = &tuple->src.u.icmp.id;
496 			keyptr = &tuple->src.u.gre.key;
498 			keyptr = &tuple->dst.u.gre.key;
515 			keyptr = &tuple->src.u.all;
517 			keyptr = &tuple->dst.u.all;
573 		if (!nf_nat_used_tuple_harder(tuple, ct, attempts - i))
584 /* Manipulate the tuple into the range given. For NF_INET_POST_ROUTING,
587  * range. It might not be possible to get a unique tuple, but we try.
591 get_unique_tuple(struct nf_conntrack_tuple *tuple,
603 	 * and that same mapping gives a unique tuple within the given
612 		/* try the original tuple first */
615 				*tuple = *orig_tuple;
619 						orig_tuple, tuple, range)) {
621 			if (!nf_nat_used_tuple(tuple, ct))
627 	*tuple = *orig_tuple;
628 	find_best_ips_proto(zone, tuple, range, ct, maniptype);
631 	 * the range to make a unique tuple.
638 			    l4proto_in_range(tuple, maniptype,
642 			     !nf_nat_used_tuple(tuple, ct)))
644 		} else if (!nf_nat_used_tuple(tuple, ct)) {
649 	/* Last chance: get protocol to try to obtain unique tuple. */
650 	nf_nat_l4proto_unique_tuple(tuple, range, maniptype, ct);
687 	 * orig_tp = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
690 			   &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
717 				      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
744 		ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3 :
745 		ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3);
895 	h = hash_by_src(nf_ct_net(ct), nf_ct_zone(ct), &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);