1/* Masquerade. Simple mapping which alters range to a local IP address 2 (depending on route). */ 3 4/* (C) 1999-2001 Paul `Rusty' Russell 5 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12#include <linux/types.h> 13#include <linux/inetdevice.h> 14#include <linux/ip.h> 15#include <linux/timer.h> 16#include <linux/module.h> 17#include <linux/netfilter.h> 18#include <net/protocol.h> 19#include <net/ip.h> 20#include <net/checksum.h> 21#include <net/route.h> 22#include <net/netfilter/nf_nat_rule.h> 23#include <linux/netfilter_ipv4.h> 24#include <linux/netfilter/x_tables.h> 25#include <linux/netfilter_ipv4.h> 26 27MODULE_LICENSE("GPL"); 28MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 29MODULE_DESCRIPTION("iptables MASQUERADE target module"); 30 31#define DEBUGP(format, args...) 32 33/* Lock protects masq region inside conntrack */ 34static DEFINE_RWLOCK(masq_lock); 35 36static int 37masquerade_check(const char *tablename, 38 const void *e, 39 const struct xt_target *target, 40 void *targinfo, 41 unsigned int hook_mask) 42{ 43 const struct nf_nat_multi_range_compat *mr = targinfo; 44 45 if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) { 46 DEBUGP("masquerade_check: bad MAP_IPS.\n"); 47 return 0; 48 } 49 if (mr->rangesize != 1) { 50 DEBUGP("masquerade_check: bad rangesize %u.\n", mr->rangesize); 51 return 0; 52 } 53 return 1; 54} 55 56static unsigned int 57masquerade_target(struct sk_buff **pskb, 58 const struct net_device *in, 59 const struct net_device *out, 60 unsigned int hooknum, 61 const struct xt_target *target, 62 const void *targinfo) 63{ 64 struct nf_conn *ct; 65 struct nf_conn_nat *nat; 66 enum ip_conntrack_info ctinfo; 67 struct nf_nat_range newrange; 68 const struct nf_nat_multi_range_compat *mr; 69 struct rtable *rt; 70 __be32 newsrc; 71 72 NF_CT_ASSERT(hooknum == NF_IP_POST_ROUTING); 73 74 ct = nf_ct_get(*pskb, &ctinfo); 75 nat = nfct_nat(ct); 76 77 NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED 78 || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)); 79 80 /* Mark the connection as cone if we have such rule configured */ 81 nat->info.nat_type |= ((*pskb)->nfcache & NFC_IP_CONE_NAT) ? NFC_IP_CONE_NAT:0; 82 83 /* Source address is 0.0.0.0 - locally generated packet that is 84 * probably not supposed to be masqueraded. 85 */ 86 if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip == 0) 87 return NF_ACCEPT; 88 89 mr = targinfo; 90 rt = (struct rtable *)(*pskb)->dst; 91 newsrc = inet_select_addr(out, rt->rt_gateway, RT_SCOPE_UNIVERSE); 92 if (!newsrc) { 93 printk("MASQUERADE: %s ate my IP address\n", out->name); 94 return NF_DROP; 95 } 96 97 write_lock_bh(&masq_lock); 98 nat->masq_index = out->ifindex; 99 write_unlock_bh(&masq_lock); 100 101 /* Transfer from original range. */ 102 newrange = ((struct nf_nat_range) 103 { mr->range[0].flags | IP_NAT_RANGE_MAP_IPS, 104 newsrc, newsrc, 105 mr->range[0].min, mr->range[0].max }); 106 107 /* Hand modified range to generic setup. */ 108 return nf_nat_setup_info(ct, &newrange, hooknum); 109} 110 111static inline int 112device_cmp(struct nf_conn *i, void *ifindex) 113{ 114 struct nf_conn_nat *nat = nfct_nat(i); 115 int ret; 116 117 if (!nat) 118 return 0; 119 120 read_lock_bh(&masq_lock); 121 ret = (nat->masq_index == (int)(long)ifindex); 122 read_unlock_bh(&masq_lock); 123 124 return ret; 125} 126 127static int masq_device_event(struct notifier_block *this, 128 unsigned long event, 129 void *ptr) 130{ 131 struct net_device *dev = ptr; 132 133 if (event == NETDEV_DOWN) { 134 /* Device was downed. Search entire table for 135 conntracks which were associated with that device, 136 and forget them. */ 137 NF_CT_ASSERT(dev->ifindex != 0); 138 139 nf_ct_iterate_cleanup(device_cmp, (void *)(long)dev->ifindex); 140 } 141 142 return NOTIFY_DONE; 143} 144 145static int masq_inet_event(struct notifier_block *this, 146 unsigned long event, 147 void *ptr) 148{ 149 struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev; 150 151 if (event == NETDEV_DOWN) { 152 /* IP address was deleted. Search entire table for 153 conntracks which were associated with that device, 154 and forget them. */ 155 NF_CT_ASSERT(dev->ifindex != 0); 156 157 nf_ct_iterate_cleanup(device_cmp, (void *)(long)dev->ifindex); 158 } 159 160 return NOTIFY_DONE; 161} 162 163static struct notifier_block masq_dev_notifier = { 164 .notifier_call = masq_device_event, 165}; 166 167static struct notifier_block masq_inet_notifier = { 168 .notifier_call = masq_inet_event, 169}; 170 171static struct xt_target masquerade = { 172 .name = "MASQUERADE", 173 .family = AF_INET, 174 .target = masquerade_target, 175 .targetsize = sizeof(struct nf_nat_multi_range_compat), 176 .table = "nat", 177 .hooks = 1 << NF_IP_POST_ROUTING, 178 .checkentry = masquerade_check, 179 .me = THIS_MODULE, 180}; 181 182static int __init ipt_masquerade_init(void) 183{ 184 int ret; 185 186 ret = xt_register_target(&masquerade); 187 188 if (ret == 0) { 189 /* Register for device down reports */ 190 register_netdevice_notifier(&masq_dev_notifier); 191 /* Register IP address change reports */ 192 register_inetaddr_notifier(&masq_inet_notifier); 193 } 194 195 return ret; 196} 197 198static void __exit ipt_masquerade_fini(void) 199{ 200 xt_unregister_target(&masquerade); 201 unregister_netdevice_notifier(&masq_dev_notifier); 202 unregister_inetaddr_notifier(&masq_inet_notifier); 203} 204 205module_init(ipt_masquerade_init); 206module_exit(ipt_masquerade_fini); 207