net/netfilter/nf_nat_core.c

   1 /*
   2  * (C) 1999-2001 Paul `Rusty' Russell
   3  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
   4  * (C) 2011 Patrick McHardy <kaber@trash.net>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 #include <linux/module.h>
  12 #include <linux/types.h>
  13 #include <linux/timer.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/gfp.h>
  16 #include <net/xfrm.h>
  17 #include <linux/jhash.h>
  18 #include <linux/rtnetlink.h>
  19
  20 #include <net/netfilter/nf_conntrack.h>
  21 #include <net/netfilter/nf_conntrack_core.h>
  22 #include <net/netfilter/nf_nat.h>
  23 #include <net/netfilter/nf_nat_l3proto.h>
  24 #include <net/netfilter/nf_nat_l4proto.h>
  25 #include <net/netfilter/nf_nat_core.h>
  26 #include <net/netfilter/nf_nat_helper.h>
  27 #include <net/netfilter/nf_conntrack_helper.h>
  28 #include <net/netfilter/nf_conntrack_seqadj.h>
  29 #include <net/netfilter/nf_conntrack_l3proto.h>
  30 #include <net/netfilter/nf_conntrack_zones.h>
  31 #include <linux/netfilter/nf_nat.h>
  32
  33 static DEFINE_SPINLOCK(nf_nat_lock);
  34
  35 static DEFINE_MUTEX(nf_nat_proto_mutex);
  36 static const struct nf_nat_l3proto __rcu *nf_nat_l3protos[NFPROTO_NUMPROTO]
  37                                                 __read_mostly;
  38 static const struct nf_nat_l4proto __rcu **nf_nat_l4protos[NFPROTO_NUMPROTO]
  39                                                 __read_mostly;
  40
  41 static struct hlist_head *nf_nat_bysource __read_mostly;
  42 static unsigned int nf_nat_htable_size __read_mostly;
  43 static unsigned int nf_nat_hash_rnd __read_mostly;
  44
  45 inline const struct nf_nat_l3proto *
  46 __nf_nat_l3proto_find(u8 family)
  47 {
  48         return rcu_dereference(nf_nat_l3protos[family]);
  49 }
  50
  51 inline const struct nf_nat_l4proto *
  52 __nf_nat_l4proto_find(u8 family, u8 protonum)
  53 {
  54         return rcu_dereference(nf_nat_l4protos[family][protonum]);
  55 }
  56 EXPORT_SYMBOL_GPL(__nf_nat_l4proto_find);
  57
  58 #ifdef CONFIG_XFRM
  59 static void __nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl)
  60 {
  61         const struct nf_nat_l3proto *l3proto;
  62         const struct nf_conn *ct;
  63         enum ip_conntrack_info ctinfo;
  64         enum ip_conntrack_dir dir;
  65         unsigned  long statusbit;
  66         u8 family;
  67
  68         ct = nf_ct_get(skb, &ctinfo);
  69         if (ct == NULL)
  70                 return;
  71
  72         family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
  73         rcu_read_lock();
  74         l3proto = __nf_nat_l3proto_find(family);
  75         if (l3proto == NULL)
  76                 goto out;
  77
  78         dir = CTINFO2DIR(ctinfo);
  79         if (dir == IP_CT_DIR_ORIGINAL)
  80                 statusbit = IPS_DST_NAT;
  81         else
  82                 statusbit = IPS_SRC_NAT;
  83
  84         l3proto->decode_session(skb, ct, dir, statusbit, fl);
  85 out:
  86         rcu_read_unlock();
  87 }
  88
  89 int nf_xfrm_me_harder(struct net *net, struct sk_buff *skb, unsigned int family)
  90 {
  91         struct flowi fl;
  92         unsigned int hh_len;
  93         struct dst_entry *dst;
  94         int err;
  95
  96         err = xfrm_decode_session(skb, &fl, family);
  97         if (err < 0)
  98                 return err;
  99
 100         dst = skb_dst(skb);
 101         if (dst->xfrm)
 102                 dst = ((struct xfrm_dst *)dst)->route;
 103         dst_hold(dst);
 104
 105         dst = xfrm_lookup(net, dst, &fl, skb->sk, 0);
 106         if (IS_ERR(dst))
 107                 return PTR_ERR(dst);
 108
 109         skb_dst_drop(skb);
 110         skb_dst_set(skb, dst);
 111
 112         /* Change in oif may mean change in hh_len. */
 113         hh_len = skb_dst(skb)->dev->hard_header_len;
 114         if (skb_headroom(skb) < hh_len &&
 115             pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
 116                 return -ENOMEM;
 117         return 0;
 118 }
 119 EXPORT_SYMBOL(nf_xfrm_me_harder);
 120 #endif /* CONFIG_XFRM */
 121
 122 /* We keep an extra hash for each conntrack, for fast searching. */
 123 static inline unsigned int
 124 hash_by_src(const struct net *n, const struct nf_conntrack_tuple *tuple)
 125 {
 126         unsigned int hash;
 127
 128         get_random_once(&nf_nat_hash_rnd, sizeof(nf_nat_hash_rnd));
 129
 130         /* Original src, to ensure we map it consistently if poss. */
 131         hash = jhash2((u32 *)&tuple->src, sizeof(tuple->src) / sizeof(u32),
 132                       tuple->dst.protonum ^ nf_nat_hash_rnd ^ net_hash_mix(n));
 133
 134         return reciprocal_scale(hash, nf_nat_htable_size);
 135 }
 136
 137 /* Is this tuple already taken? (not by us) */
 138 int
 139 nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,
 140                   const struct nf_conn *ignored_conntrack)
 141 {
 142         /* Conntrack tracking doesn't keep track of outgoing tuples; only
 143          * incoming ones.  NAT means they don't have a fixed mapping,
 144          * so we invert the tuple and look for the incoming reply.
 145          *
 146          * We could keep a separate hash if this proves too slow.
 147          */
 148         struct nf_conntrack_tuple reply;
 149
 150         nf_ct_invert_tuplepr(&reply, tuple);
 151         return nf_conntrack_tuple_taken(&reply, ignored_conntrack);
 152 }
 153 EXPORT_SYMBOL(nf_nat_used_tuple);
 154
 155 /* If we source map this tuple so reply looks like reply_tuple, will
 156  * that meet the constraints of range.
 157  */
 158 static int in_range(const struct nf_nat_l3proto *l3proto,
 159                     const struct nf_nat_l4proto *l4proto,
 160                     const struct nf_conntrack_tuple *tuple,
 161                     const struct nf_nat_range *range)
 162 {
 163         /* If we are supposed to map IPs, then we must be in the
 164          * range specified, otherwise let this drag us onto a new src IP.
 165          */
 166         if (range->flags & NF_NAT_RANGE_MAP_IPS &&
 167             !l3proto->in_range(tuple, range))
 168                 return 0;
 169
 170         if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED) ||
 171             l4proto->in_range(tuple, NF_NAT_MANIP_SRC,
 172                               &range->min_proto, &range->max_proto))
 173                 return 1;
 174
 175         return 0;
 176 }
 177
 178 static inline int
 179 same_src(const struct nf_conn *ct,
 180          const struct nf_conntrack_tuple *tuple)
 181 {
 182         const struct nf_conntrack_tuple *t;
 183
 184         t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
 185         return (t->dst.protonum == tuple->dst.protonum &&
 186                 nf_inet_addr_cmp(&t->src.u3, &tuple->src.u3) &&
 187                 t->src.u.all == tuple->src.u.all);
 188 }
 189
 190 /* Only called for SRC manip */
 191 static int
 192 find_appropriate_src(struct net *net,
 193                      const struct nf_conntrack_zone *zone,
 194                      const struct nf_nat_l3proto *l3proto,
 195                      const struct nf_nat_l4proto *l4proto,
 196                      const struct nf_conntrack_tuple *tuple,
 197                      struct nf_conntrack_tuple *result,
 198                      const struct nf_nat_range *range)
 199 {
 200         unsigned int h = hash_by_src(net, tuple);
 201         const struct nf_conn *ct;
 202
 203         hlist_for_each_entry_rcu(ct, &nf_nat_bysource[h], nat_bysource) {
 204                 if (same_src(ct, tuple) &&
 205                     net_eq(net, nf_ct_net(ct)) &&
 206                     nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL)) {
 207                         /* Copy source part from reply tuple. */
 208                         nf_ct_invert_tuplepr(result,
 209                                        &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 210                         result->dst = tuple->dst;
 211
 212                         if (in_range(l3proto, l4proto, result, range))
 213                                 return 1;
 214                 }
 215         }
 216         return 0;
 217 }
 218
 219 /* For [FUTURE] fragmentation handling, we want the least-used
 220  * src-ip/dst-ip/proto triple.  Fairness doesn't come into it.  Thus
 221  * if the range specifies 1.2.3.4 ports 10000-10005 and 1.2.3.5 ports
 222  * 1-65535, we don't do pro-rata allocation based on ports; we choose
 223  * the ip with the lowest src-ip/dst-ip/proto usage.
 224  */
 225 static void
 226 find_best_ips_proto(const struct nf_conntrack_zone *zone,
 227                     struct nf_conntrack_tuple *tuple,
 228                     const struct nf_nat_range *range,
 229                     const struct nf_conn *ct,
 230                     enum nf_nat_manip_type maniptype)
 231 {
 232         union nf_inet_addr *var_ipp;
 233         unsigned int i, max;
 234         /* Host order */
 235         u32 minip, maxip, j, dist;
 236         bool full_range;
 237
 238         /* No IP mapping?  Do nothing. */
 239         if (!(range->flags & NF_NAT_RANGE_MAP_IPS))
 240                 return;
 241
 242         if (maniptype == NF_NAT_MANIP_SRC)
 243                 var_ipp = &tuple->src.u3;
 244         else
 245                 var_ipp = &tuple->dst.u3;
 246
 247         /* Fast path: only one choice. */
 248         if (nf_inet_addr_cmp(&range->min_addr, &range->max_addr)) {
 249                 *var_ipp = range->min_addr;
 250                 return;
 251         }
 252
 253         if (nf_ct_l3num(ct) == NFPROTO_IPV4)
 254                 max = sizeof(var_ipp->ip) / sizeof(u32) - 1;
 255         else
 256                 max = sizeof(var_ipp->ip6) / sizeof(u32) - 1;
 257
 258         /* Hashing source and destination IPs gives a fairly even
 259          * spread in practice (if there are a small number of IPs
 260          * involved, there usually aren't that many connections
 261          * anyway).  The consistency means that servers see the same
 262          * client coming from the same IP (some Internet Banking sites
 263          * like this), even across reboots.
 264          */
 265         j = jhash2((u32 *)&tuple->src.u3, sizeof(tuple->src.u3) / sizeof(u32),
 266                    range->flags & NF_NAT_RANGE_PERSISTENT ?
 267                         0 : (__force u32)tuple->dst.u3.all[max] ^ zone->id);
 268
 269         full_range = false;
 270         for (i = 0; i <= max; i++) {
 271                 /* If first bytes of the address are at the maximum, use the
 272                  * distance. Otherwise use the full range.
 273                  */
 274                 if (!full_range) {
 275                         minip = ntohl((__force __be32)range->min_addr.all[i]);
 276                         maxip = ntohl((__force __be32)range->max_addr.all[i]);
 277                         dist  = maxip - minip + 1;
 278                 } else {
 279                         minip = 0;
 280                         dist  = ~0;
 281                 }
 282
 283                 var_ipp->all[i] = (__force __u32)
 284                         htonl(minip + reciprocal_scale(j, dist));
 285                 if (var_ipp->all[i] != range->max_addr.all[i])
 286                         full_range = true;
 287
 288                 if (!(range->flags & NF_NAT_RANGE_PERSISTENT))
 289                         j ^= (__force u32)tuple->dst.u3.all[i];
 290         }
 291 }
 292
 293 /* Manipulate the tuple into the range given. For NF_INET_POST_ROUTING,
 294  * we change the source to map into the range. For NF_INET_PRE_ROUTING
 295  * and NF_INET_LOCAL_OUT, we change the destination to map into the
 296  * range. It might not be possible to get a unique tuple, but we try.
 297  * At worst (or if we race), we will end up with a final duplicate in
 298  * __ip_conntrack_confirm and drop the packet. */
 299 static void
 300 get_unique_tuple(struct nf_conntrack_tuple *tuple,
 301                  const struct nf_conntrack_tuple *orig_tuple,
 302                  const struct nf_nat_range *range,
 303                  struct nf_conn *ct,
 304                  enum nf_nat_manip_type maniptype)
 305 {
 306         const struct nf_conntrack_zone *zone;
 307         const struct nf_nat_l3proto *l3proto;
 308         const struct nf_nat_l4proto *l4proto;
 309         struct net *net = nf_ct_net(ct);
 310
 311         zone = nf_ct_zone(ct);
 312
 313         rcu_read_lock();
 314         l3proto = __nf_nat_l3proto_find(orig_tuple->src.l3num);
 315         l4proto = __nf_nat_l4proto_find(orig_tuple->src.l3num,
 316                                         orig_tuple->dst.protonum);
 317
 318         /* 1) If this srcip/proto/src-proto-part is currently mapped,
 319          * and that same mapping gives a unique tuple within the given
 320          * range, use that.
 321          *
 322          * This is only required for source (ie. NAT/masq) mappings.
 323          * So far, we don't do local source mappings, so multiple
 324          * manips not an issue.
 325          */
 326         if (maniptype == NF_NAT_MANIP_SRC &&
 327             !(range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL)) {
 328                 /* try the original tuple first */
 329                 if (in_range(l3proto, l4proto, orig_tuple, range)) {
 330                         if (!nf_nat_used_tuple(orig_tuple, ct)) {
 331                                 *tuple = *orig_tuple;
 332                                 goto out;
 333                         }
 334                 } else if (find_appropriate_src(net, zone, l3proto, l4proto,
 335                                                 orig_tuple, tuple, range)) {
 336                         pr_debug("get_unique_tuple: Found current src map\n");
 337                         if (!nf_nat_used_tuple(tuple, ct))
 338                                 goto out;
 339                 }
 340         }
 341
 342         /* 2) Select the least-used IP/proto combination in the given range */
 343         *tuple = *orig_tuple;
 344         find_best_ips_proto(zone, tuple, range, ct, maniptype);
 345
 346         /* 3) The per-protocol part of the manip is made to map into
 347          * the range to make a unique tuple.
 348          */
 349
 350         /* Only bother mapping if it's not already in range and unique */
 351         if (!(range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL)) {
 352                 if (range->flags & NF_NAT_RANGE_PROTO_SPECIFIED) {
 353                         if (l4proto->in_range(tuple, maniptype,
 354                                               &range->min_proto,
 355                                               &range->max_proto) &&
 356                             (range->min_proto.all == range->max_proto.all ||
 357                              !nf_nat_used_tuple(tuple, ct)))
 358                                 goto out;
 359                 } else if (!nf_nat_used_tuple(tuple, ct)) {
 360                         goto out;
 361                 }
 362         }
 363
 364         /* Last change: get protocol to try to obtain unique tuple. */
 365         l4proto->unique_tuple(l3proto, tuple, range, maniptype, ct);
 366 out:
 367         rcu_read_unlock();
 368 }
 369
 370 struct nf_conn_nat *nf_ct_nat_ext_add(struct nf_conn *ct)
 371 {
 372         struct nf_conn_nat *nat = nfct_nat(ct);
 373         if (nat)
 374                 return nat;
 375
 376         if (!nf_ct_is_confirmed(ct))
 377                 nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
 378
 379         return nat;
 380 }
 381 EXPORT_SYMBOL_GPL(nf_ct_nat_ext_add);
 382
 383 unsigned int
 384 nf_nat_setup_info(struct nf_conn *ct,
 385                   const struct nf_nat_range *range,
 386                   enum nf_nat_manip_type maniptype)
 387 {
 388         struct net *net = nf_ct_net(ct);
 389         struct nf_conntrack_tuple curr_tuple, new_tuple;
 390         struct nf_conn_nat *nat;
 391
 392         /* nat helper or nfctnetlink also setup binding */
 393         nat = nf_ct_nat_ext_add(ct);
 394         if (nat == NULL)
 395                 return NF_ACCEPT;
 396
 397         NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||
 398                      maniptype == NF_NAT_MANIP_DST);
 399         BUG_ON(nf_nat_initialized(ct, maniptype));
 400
 401         /* What we've got will look like inverse of reply. Normally
 402          * this is what is in the conntrack, except for prior
 403          * manipulations (future optimization: if num_manips == 0,
 404          * orig_tp = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
 405          */
 406         nf_ct_invert_tuplepr(&curr_tuple,
 407                              &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 408
 409         get_unique_tuple(&new_tuple, &curr_tuple, range, ct, maniptype);
 410
 411         if (!nf_ct_tuple_equal(&new_tuple, &curr_tuple)) {
 412                 struct nf_conntrack_tuple reply;
 413
 414                 /* Alter conntrack table so will recognize replies. */
 415                 nf_ct_invert_tuplepr(&reply, &new_tuple);
 416                 nf_conntrack_alter_reply(ct, &reply);
 417
 418                 /* Non-atomic: we own this at the moment. */
 419                 if (maniptype == NF_NAT_MANIP_SRC)
 420                         ct->status |= IPS_SRC_NAT;
 421                 else
 422                         ct->status |= IPS_DST_NAT;
 423
 424                 if (nfct_help(ct) && !nfct_seqadj(ct))
 425                         if (!nfct_seqadj_ext_add(ct))
 426                                 return NF_DROP;
 427         }
 428
 429         if (maniptype == NF_NAT_MANIP_SRC) {
 430                 unsigned int srchash;
 431
 432                 srchash = hash_by_src(net,
 433                                       &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 434                 spin_lock_bh(&nf_nat_lock);
 435                 /* nf_conntrack_alter_reply might re-allocate extension aera */
 436                 nat = nfct_nat(ct);
 437                 hlist_add_head_rcu(&ct->nat_bysource,
 438                                    &nf_nat_bysource[srchash]);
 439                 spin_unlock_bh(&nf_nat_lock);
 440         }
 441
 442         /* It's done. */
 443         if (maniptype == NF_NAT_MANIP_DST)
 444                 ct->status |= IPS_DST_NAT_DONE;
 445         else
 446                 ct->status |= IPS_SRC_NAT_DONE;
 447
 448         return NF_ACCEPT;
 449 }
 450 EXPORT_SYMBOL(nf_nat_setup_info);
 451
 452 static unsigned int
 453 __nf_nat_alloc_null_binding(struct nf_conn *ct, enum nf_nat_manip_type manip)
 454 {
 455         /* Force range to this IP; let proto decide mapping for
 456          * per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
 457          * Use reply in case it's already been mangled (eg local packet).
 458          */
 459         union nf_inet_addr ip =
 460                 (manip == NF_NAT_MANIP_SRC ?
 461                 ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3 :
 462                 ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3);
 463         struct nf_nat_range range = {
 464                 .flags          = NF_NAT_RANGE_MAP_IPS,
 465                 .min_addr       = ip,
 466                 .max_addr       = ip,
 467         };
 468         return nf_nat_setup_info(ct, &range, manip);
 469 }
 470
 471 unsigned int
 472 nf_nat_alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
 473 {
 474         return __nf_nat_alloc_null_binding(ct, HOOK2MANIP(hooknum));
 475 }
 476 EXPORT_SYMBOL_GPL(nf_nat_alloc_null_binding);
 477
 478 /* Do packet manipulations according to nf_nat_setup_info. */
 479 unsigned int nf_nat_packet(struct nf_conn *ct,
 480                            enum ip_conntrack_info ctinfo,
 481                            unsigned int hooknum,
 482                            struct sk_buff *skb)
 483 {
 484         const struct nf_nat_l3proto *l3proto;
 485         const struct nf_nat_l4proto *l4proto;
 486         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 487         unsigned long statusbit;
 488         enum nf_nat_manip_type mtype = HOOK2MANIP(hooknum);
 489
 490         if (mtype == NF_NAT_MANIP_SRC)
 491                 statusbit = IPS_SRC_NAT;
 492         else
 493                 statusbit = IPS_DST_NAT;
 494
 495         /* Invert if this is reply dir. */
 496         if (dir == IP_CT_DIR_REPLY)
 497                 statusbit ^= IPS_NAT_MASK;
 498
 499         /* Non-atomic: these bits don't change. */
 500         if (ct->status & statusbit) {
 501                 struct nf_conntrack_tuple target;
 502
 503                 /* We are aiming to look like inverse of other direction. */
 504                 nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
 505
 506                 l3proto = __nf_nat_l3proto_find(target.src.l3num);
 507                 l4proto = __nf_nat_l4proto_find(target.src.l3num,
 508                                                 target.dst.protonum);
 509                 if (!l3proto->manip_pkt(skb, 0, l4proto, &target, mtype))
 510                         return NF_DROP;
 511         }
 512         return NF_ACCEPT;
 513 }
 514 EXPORT_SYMBOL_GPL(nf_nat_packet);
 515
 516 struct nf_nat_proto_clean {
 517         u8      l3proto;
 518         u8      l4proto;
 519 };
 520
 521 /* kill conntracks with affected NAT section */
 522 static int nf_nat_proto_remove(struct nf_conn *i, void *data)
 523 {
 524         const struct nf_nat_proto_clean *clean = data;
 525
 526         if ((clean->l3proto && nf_ct_l3num(i) != clean->l3proto) ||
 527             (clean->l4proto && nf_ct_protonum(i) != clean->l4proto))
 528                 return 0;
 529
 530         return i->status & IPS_NAT_MASK ? 1 : 0;
 531 }
 532
 533 static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
 534 {
 535         if (nf_nat_proto_remove(ct, data))
 536                 return 1;
 537
 538         if ((ct->status & IPS_SRC_NAT_DONE) == 0)
 539                 return 0;
 540
 541         /* This netns is being destroyed, and conntrack has nat null binding.
 542          * Remove it from bysource hash, as the table will be freed soon.
 543          *
 544          * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
 545          * will delete entry from already-freed table.
 546          */
 547         spin_lock_bh(&nf_nat_lock);
 548         hlist_del_rcu(&ct->nat_bysource);
 549         ct->status &= ~IPS_NAT_DONE_MASK;
 550         spin_unlock_bh(&nf_nat_lock);
 551
 552         /* don't delete conntrack.  Although that would make things a lot
 553          * simpler, we'd end up flushing all conntracks on nat rmmod.
 554          */
 555         return 0;
 556 }
 557
 558 static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto)
 559 {
 560         struct nf_nat_proto_clean clean = {
 561                 .l3proto = l3proto,
 562                 .l4proto = l4proto,
 563         };
 564         struct net *net;
 565
 566         rtnl_lock();
 567         for_each_net(net)
 568                 nf_ct_iterate_cleanup(net, nf_nat_proto_remove, &clean, 0, 0);
 569         rtnl_unlock();
 570 }
 571
 572 static void nf_nat_l3proto_clean(u8 l3proto)
 573 {
 574         struct nf_nat_proto_clean clean = {
 575                 .l3proto = l3proto,
 576         };
 577         struct net *net;
 578
 579         rtnl_lock();
 580
 581         for_each_net(net)
 582                 nf_ct_iterate_cleanup(net, nf_nat_proto_remove, &clean, 0, 0);
 583         rtnl_unlock();
 584 }
 585
 586 /* Protocol registration. */
 587 int nf_nat_l4proto_register(u8 l3proto, const struct nf_nat_l4proto *l4proto)
 588 {
 589         const struct nf_nat_l4proto **l4protos;
 590         unsigned int i;
 591         int ret = 0;
 592
 593         mutex_lock(&nf_nat_proto_mutex);
 594         if (nf_nat_l4protos[l3proto] == NULL) {
 595                 l4protos = kmalloc(IPPROTO_MAX * sizeof(struct nf_nat_l4proto *),
 596                                    GFP_KERNEL);
 597                 if (l4protos == NULL) {
 598                         ret = -ENOMEM;
 599                         goto out;
 600                 }
 601
 602                 for (i = 0; i < IPPROTO_MAX; i++)
 603                         RCU_INIT_POINTER(l4protos[i], &nf_nat_l4proto_unknown);
 604
 605                 /* Before making proto_array visible to lockless readers,
 606                  * we must make sure its content is committed to memory.
 607                  */
 608                 smp_wmb();
 609
 610                 nf_nat_l4protos[l3proto] = l4protos;
 611         }
 612
 613         if (rcu_dereference_protected(
 614                         nf_nat_l4protos[l3proto][l4proto->l4proto],
 615                         lockdep_is_held(&nf_nat_proto_mutex)
 616                         ) != &nf_nat_l4proto_unknown) {
 617                 ret = -EBUSY;
 618                 goto out;
 619         }
 620         RCU_INIT_POINTER(nf_nat_l4protos[l3proto][l4proto->l4proto], l4proto);
 621  out:
 622         mutex_unlock(&nf_nat_proto_mutex);
 623         return ret;
 624 }
 625 EXPORT_SYMBOL_GPL(nf_nat_l4proto_register);
 626
 627 /* No one stores the protocol anywhere; simply delete it. */
 628 void nf_nat_l4proto_unregister(u8 l3proto, const struct nf_nat_l4proto *l4proto)
 629 {
 630         mutex_lock(&nf_nat_proto_mutex);
 631         RCU_INIT_POINTER(nf_nat_l4protos[l3proto][l4proto->l4proto],
 632                          &nf_nat_l4proto_unknown);
 633         mutex_unlock(&nf_nat_proto_mutex);
 634         synchronize_rcu();
 635
 636         nf_nat_l4proto_clean(l3proto, l4proto->l4proto);
 637 }
 638 EXPORT_SYMBOL_GPL(nf_nat_l4proto_unregister);
 639
 640 int nf_nat_l3proto_register(const struct nf_nat_l3proto *l3proto)
 641 {
 642         int err;
 643
 644         err = nf_ct_l3proto_try_module_get(l3proto->l3proto);
 645         if (err < 0)
 646                 return err;
 647
 648         mutex_lock(&nf_nat_proto_mutex);
 649         RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_TCP],
 650                          &nf_nat_l4proto_tcp);
 651         RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_UDP],
 652                          &nf_nat_l4proto_udp);
 653         mutex_unlock(&nf_nat_proto_mutex);
 654
 655         RCU_INIT_POINTER(nf_nat_l3protos[l3proto->l3proto], l3proto);
 656         return 0;
 657 }
 658 EXPORT_SYMBOL_GPL(nf_nat_l3proto_register);
 659
 660 void nf_nat_l3proto_unregister(const struct nf_nat_l3proto *l3proto)
 661 {
 662         mutex_lock(&nf_nat_proto_mutex);
 663         RCU_INIT_POINTER(nf_nat_l3protos[l3proto->l3proto], NULL);
 664         mutex_unlock(&nf_nat_proto_mutex);
 665         synchronize_rcu();
 666
 667         nf_nat_l3proto_clean(l3proto->l3proto);
 668         nf_ct_l3proto_module_put(l3proto->l3proto);
 669 }
 670 EXPORT_SYMBOL_GPL(nf_nat_l3proto_unregister);
 671
 672 /* No one using conntrack by the time this called. */
 673 static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
 674 {
 675         if (ct->status & IPS_SRC_NAT_DONE) {
 676                 spin_lock_bh(&nf_nat_lock);
 677                 hlist_del_rcu(&ct->nat_bysource);
 678                 spin_unlock_bh(&nf_nat_lock);
 679         }
 680 }
 681
 682 static struct nf_ct_ext_type nat_extend __read_mostly = {
 683         .len            = sizeof(struct nf_conn_nat),
 684         .align          = __alignof__(struct nf_conn_nat),
 685         .destroy        = nf_nat_cleanup_conntrack,
 686         .id             = NF_CT_EXT_NAT,
 687         .flags          = NF_CT_EXT_F_PREALLOC,
 688 };
 689
 690 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
 691
 692 #include <linux/netfilter/nfnetlink.h>
 693 #include <linux/netfilter/nfnetlink_conntrack.h>
 694
 695 static const struct nla_policy protonat_nla_policy[CTA_PROTONAT_MAX+1] = {
 696         [CTA_PROTONAT_PORT_MIN] = { .type = NLA_U16 },
 697         [CTA_PROTONAT_PORT_MAX] = { .type = NLA_U16 },
 698 };
 699
 700 static int nfnetlink_parse_nat_proto(struct nlattr *attr,
 701                                      const struct nf_conn *ct,
 702                                      struct nf_nat_range *range)
 703 {
 704         struct nlattr *tb[CTA_PROTONAT_MAX+1];
 705         const struct nf_nat_l4proto *l4proto;
 706         int err;
 707
 708         err = nla_parse_nested(tb, CTA_PROTONAT_MAX, attr, protonat_nla_policy);
 709         if (err < 0)
 710                 return err;
 711
 712         l4proto = __nf_nat_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
 713         if (l4proto->nlattr_to_range)
 714                 err = l4proto->nlattr_to_range(tb, range);
 715
 716         return err;
 717 }
 718
 719 static const struct nla_policy nat_nla_policy[CTA_NAT_MAX+1] = {
 720         [CTA_NAT_V4_MINIP]      = { .type = NLA_U32 },
 721         [CTA_NAT_V4_MAXIP]      = { .type = NLA_U32 },
 722         [CTA_NAT_V6_MINIP]      = { .len = sizeof(struct in6_addr) },
 723         [CTA_NAT_V6_MAXIP]      = { .len = sizeof(struct in6_addr) },
 724         [CTA_NAT_PROTO]         = { .type = NLA_NESTED },
 725 };
 726
 727 static int
 728 nfnetlink_parse_nat(const struct nlattr *nat,
 729                     const struct nf_conn *ct, struct nf_nat_range *range,
 730                     const struct nf_nat_l3proto *l3proto)
 731 {
 732         struct nlattr *tb[CTA_NAT_MAX+1];
 733         int err;
 734
 735         memset(range, 0, sizeof(*range));
 736
 737         err = nla_parse_nested(tb, CTA_NAT_MAX, nat, nat_nla_policy);
 738         if (err < 0)
 739                 return err;
 740
 741         err = l3proto->nlattr_to_range(tb, range);
 742         if (err < 0)
 743                 return err;
 744
 745         if (!tb[CTA_NAT_PROTO])
 746                 return 0;
 747
 748         return nfnetlink_parse_nat_proto(tb[CTA_NAT_PROTO], ct, range);
 749 }
 750
 751 /* This function is called under rcu_read_lock() */
 752 static int
 753 nfnetlink_parse_nat_setup(struct nf_conn *ct,
 754                           enum nf_nat_manip_type manip,
 755                           const struct nlattr *attr)
 756 {
 757         struct nf_nat_range range;
 758         const struct nf_nat_l3proto *l3proto;
 759         int err;
 760
 761         /* Should not happen, restricted to creating new conntracks
 762          * via ctnetlink.
 763          */
 764         if (WARN_ON_ONCE(nf_nat_initialized(ct, manip)))
 765                 return -EEXIST;
 766
 767         /* Make sure that L3 NAT is there by when we call nf_nat_setup_info to
 768          * attach the null binding, otherwise this may oops.
 769          */
 770         l3proto = __nf_nat_l3proto_find(nf_ct_l3num(ct));
 771         if (l3proto == NULL)
 772                 return -EAGAIN;
 773
 774         /* No NAT information has been passed, allocate the null-binding */
 775         if (attr == NULL)
 776                 return __nf_nat_alloc_null_binding(ct, manip);
 777
 778         err = nfnetlink_parse_nat(attr, ct, &range, l3proto);
 779         if (err < 0)
 780                 return err;
 781
 782         return nf_nat_setup_info(ct, &range, manip) == NF_DROP ? -ENOMEM : 0;
 783 }
 784 #else
 785 static int
 786 nfnetlink_parse_nat_setup(struct nf_conn *ct,
 787                           enum nf_nat_manip_type manip,
 788                           const struct nlattr *attr)
 789 {
 790         return -EOPNOTSUPP;
 791 }
 792 #endif
 793
 794 static void __net_exit nf_nat_net_exit(struct net *net)
 795 {
 796         struct nf_nat_proto_clean clean = {};
 797
 798         nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean, 0, 0);
 799 }
 800
 801 static struct pernet_operations nf_nat_net_ops = {
 802         .exit = nf_nat_net_exit,
 803 };
 804
 805 static struct nf_ct_helper_expectfn follow_master_nat = {
 806         .name           = "nat-follow-master",
 807         .expectfn       = nf_nat_follow_master,
 808 };
 809
 810 static int __init nf_nat_init(void)
 811 {
 812         int ret;
 813
 814         /* Leave them the same for the moment. */
 815         nf_nat_htable_size = nf_conntrack_htable_size;
 816
 817         nf_nat_bysource = nf_ct_alloc_hashtable(&nf_nat_htable_size, 0);
 818         if (!nf_nat_bysource)
 819                 return -ENOMEM;
 820
 821         ret = nf_ct_extend_register(&nat_extend);
 822         if (ret < 0) {
 823                 nf_ct_free_hashtable(nf_nat_bysource, nf_nat_htable_size);
 824                 printk(KERN_ERR "nf_nat_core: Unable to register extension\n");
 825                 return ret;
 826         }
 827
 828         ret = register_pernet_subsys(&nf_nat_net_ops);
 829         if (ret < 0)
 830                 goto cleanup_extend;
 831
 832         nf_ct_helper_expectfn_register(&follow_master_nat);
 833
 834         /* Initialize fake conntrack so that NAT will skip it */
 835         nf_ct_untracked_status_or(IPS_NAT_DONE_MASK);
 836
 837         BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
 838         RCU_INIT_POINTER(nfnetlink_parse_nat_setup_hook,
 839                            nfnetlink_parse_nat_setup);
 840 #ifdef CONFIG_XFRM
 841         BUG_ON(nf_nat_decode_session_hook != NULL);
 842         RCU_INIT_POINTER(nf_nat_decode_session_hook, __nf_nat_decode_session);
 843 #endif
 844         return 0;
 845
 846  cleanup_extend:
 847         nf_ct_free_hashtable(nf_nat_bysource, nf_nat_htable_size);
 848         nf_ct_extend_unregister(&nat_extend);
 849         return ret;
 850 }
 851
 852 static void __exit nf_nat_cleanup(void)
 853 {
 854         unsigned int i;
 855
 856         unregister_pernet_subsys(&nf_nat_net_ops);
 857         nf_ct_extend_unregister(&nat_extend);
 858         nf_ct_helper_expectfn_unregister(&follow_master_nat);
 859         RCU_INIT_POINTER(nfnetlink_parse_nat_setup_hook, NULL);
 860 #ifdef CONFIG_XFRM
 861         RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL);
 862 #endif
 863         synchronize_rcu();
 864
 865         for (i = 0; i < NFPROTO_NUMPROTO; i++)
 866                 kfree(nf_nat_l4protos[i]);
 867         synchronize_net();
 868         nf_ct_free_hashtable(nf_nat_bysource, nf_nat_htable_size);
 869 }
 870
 871 MODULE_LICENSE("GPL");
 872
 873 module_init(nf_nat_init);
 874 module_exit(nf_nat_cleanup);