1/* Masquerade. Simple mapping which alters range to a local IP address 2 (depending on route). */ 3 4/* (C) 1999-2001 Paul `Rusty' Russell 5 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 12#include <linux/types.h> 13#include <linux/inetdevice.h> 14#include <linux/ip.h> 15#include <linux/timer.h> 16#include <linux/module.h> 17#include <linux/netfilter.h> 18#include <net/protocol.h> 19#include <net/ip.h> 20#include <net/checksum.h> 21#include <net/route.h> 22#include <net/netfilter/nf_nat_rule.h> 23#include <linux/netfilter_ipv4.h> 24#include <linux/netfilter/x_tables.h> 25 26MODULE_LICENSE("GPL"); 27MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 28MODULE_DESCRIPTION("Xtables: automatic-address SNAT"); 29 30static int masquerade_tg_check(const struct xt_tgchk_param *par) 31{ 32 const struct nf_nat_multi_range_compat *mr = par->targinfo; 33 34 if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) { 35 pr_debug("bad MAP_IPS.\n"); 36 return -EINVAL; 37 } 38 if (mr->rangesize != 1) { 39 pr_debug("bad rangesize %u\n", mr->rangesize); 40 return -EINVAL; 41 } 42 return 0; 43} 44 45static unsigned int 46masquerade_tg(struct sk_buff *skb, const struct xt_action_param *par) 47{ 48 struct nf_conn *ct; 49 struct nf_conn_nat *nat; 50 enum ip_conntrack_info ctinfo; 51 struct nf_nat_range newrange; 52 const struct nf_nat_multi_range_compat *mr; 53 const struct rtable *rt; 54 __be32 newsrc; 55 56 NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING); 57 58 ct = nf_ct_get(skb, &ctinfo); 59 nat = nfct_nat(ct); 60 61 NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED || 62 ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)); 63 64#ifdef CONFIG_IP_NF_TARGET_CONE 65 /* Mark the connection as cone if we have such rule configured */ 66 nat->nat_type |= (skb->nfcache & NFC_IP_CONE_NAT) ? NFC_IP_CONE_NAT:0; 67#endif /* CONFIG_IP_NF_TARGET_CONE */ 68 /* Source address is 0.0.0.0 - locally generated packet that is 69 * probably not supposed to be masqueraded. 70 */ 71 if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip == 0) 72 return NF_ACCEPT; 73 74 mr = par->targinfo; 75 rt = skb_rtable(skb); 76 newsrc = inet_select_addr(par->out, rt->rt_gateway, RT_SCOPE_UNIVERSE); 77 if (!newsrc) { 78 pr_info("%s ate my IP address\n", par->out->name); 79 return NF_DROP; 80 } 81 82 nat->masq_index = par->out->ifindex; 83 84 /* Transfer from original range. */ 85 newrange = ((struct nf_nat_range) 86 { mr->range[0].flags | IP_NAT_RANGE_MAP_IPS, 87 newsrc, newsrc, 88 mr->range[0].min, mr->range[0].max }); 89 90 /* Hand modified range to generic setup. */ 91 return nf_nat_setup_info(ct, &newrange, IP_NAT_MANIP_SRC); 92} 93 94static int 95device_cmp(struct nf_conn *i, void *ifindex) 96{ 97 const struct nf_conn_nat *nat = nfct_nat(i); 98 99 if (!nat) 100 return 0; 101 102 return nat->masq_index == (int)(long)ifindex; 103} 104 105static int masq_device_event(struct notifier_block *this, 106 unsigned long event, 107 void *ptr) 108{ 109 const struct net_device *dev = ptr; 110 struct net *net = dev_net(dev); 111 112 if (event == NETDEV_DOWN) { 113 /* Device was downed. Search entire table for 114 conntracks which were associated with that device, 115 and forget them. */ 116 NF_CT_ASSERT(dev->ifindex != 0); 117 118 nf_ct_iterate_cleanup(net, device_cmp, 119 (void *)(long)dev->ifindex); 120 } 121 122 return NOTIFY_DONE; 123} 124 125static int masq_inet_event(struct notifier_block *this, 126 unsigned long event, 127 void *ptr) 128{ 129 struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev; 130 return masq_device_event(this, event, dev); 131} 132 133static struct notifier_block masq_dev_notifier = { 134 .notifier_call = masq_device_event, 135}; 136 137static struct notifier_block masq_inet_notifier = { 138 .notifier_call = masq_inet_event, 139}; 140 141static struct xt_target masquerade_tg_reg __read_mostly = { 142 .name = "MASQUERADE", 143 .family = NFPROTO_IPV4, 144 .target = masquerade_tg, 145 .targetsize = sizeof(struct nf_nat_multi_range_compat), 146 .table = "nat", 147 .hooks = 1 << NF_INET_POST_ROUTING, 148 .checkentry = masquerade_tg_check, 149 .me = THIS_MODULE, 150}; 151 152static int __init masquerade_tg_init(void) 153{ 154 int ret; 155 156 ret = xt_register_target(&masquerade_tg_reg); 157 158 if (ret == 0) { 159 /* Register for device down reports */ 160 register_netdevice_notifier(&masq_dev_notifier); 161 /* Register IP address change reports */ 162 register_inetaddr_notifier(&masq_inet_notifier); 163 } 164 165 return ret; 166} 167 168static void __exit masquerade_tg_exit(void) 169{ 170 xt_unregister_target(&masquerade_tg_reg); 171 unregister_netdevice_notifier(&masq_dev_notifier); 172 unregister_inetaddr_notifier(&masq_inet_notifier); 173} 174 175module_init(masquerade_tg_init); 176module_exit(masquerade_tg_exit); 177