1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
5 * Copyright (c) 2012 Intel Corporation
6 */
7
8 #include <linux/module.h>
9 #include <linux/init.h>
10 #include <linux/skbuff.h>
11 #include <linux/ip.h>
12 #include <linux/string.h>
13 #include <linux/netlink.h>
14 #include <linux/netfilter.h>
15 #include <linux/netfilter_ipv4.h>
16 #include <linux/netfilter/nfnetlink.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_conntrack.h>
19 #include <net/netfilter/nf_nat.h>
20 #include <net/netfilter/nf_tables.h>
21 #include <net/ip.h>
22
23 struct nft_nat {
24 u8 sreg_addr_min;
25 u8 sreg_addr_max;
26 u8 sreg_proto_min;
27 u8 sreg_proto_max;
28 enum nf_nat_manip_type type:8;
29 u8 family;
30 u16 flags;
31 };
32
nft_nat_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)33 static void nft_nat_eval(const struct nft_expr *expr,
34 struct nft_regs *regs,
35 const struct nft_pktinfo *pkt)
36 {
37 const struct nft_nat *priv = nft_expr_priv(expr);
38 enum ip_conntrack_info ctinfo;
39 struct nf_conn *ct = nf_ct_get(pkt->skb, &ctinfo);
40 struct nf_nat_range2 range;
41
42 memset(&range, 0, sizeof(range));
43 if (priv->sreg_addr_min) {
44 if (priv->family == AF_INET) {
45 range.min_addr.ip = (__force __be32)
46 regs->data[priv->sreg_addr_min];
47 range.max_addr.ip = (__force __be32)
48 regs->data[priv->sreg_addr_max];
49
50 } else {
51 memcpy(range.min_addr.ip6,
52 ®s->data[priv->sreg_addr_min],
53 sizeof(range.min_addr.ip6));
54 memcpy(range.max_addr.ip6,
55 ®s->data[priv->sreg_addr_max],
56 sizeof(range.max_addr.ip6));
57 }
58 range.flags |= NF_NAT_RANGE_MAP_IPS;
59 }
60
61 if (priv->sreg_proto_min) {
62 range.min_proto.all = (__force __be16)nft_reg_load16(
63 ®s->data[priv->sreg_proto_min]);
64 range.max_proto.all = (__force __be16)nft_reg_load16(
65 ®s->data[priv->sreg_proto_max]);
66 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
67 }
68
69 range.flags |= priv->flags;
70
71 regs->verdict.code = nf_nat_setup_info(ct, &range, priv->type);
72 }
73
74 static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = {
75 [NFTA_NAT_TYPE] = { .type = NLA_U32 },
76 [NFTA_NAT_FAMILY] = { .type = NLA_U32 },
77 [NFTA_NAT_REG_ADDR_MIN] = { .type = NLA_U32 },
78 [NFTA_NAT_REG_ADDR_MAX] = { .type = NLA_U32 },
79 [NFTA_NAT_REG_PROTO_MIN] = { .type = NLA_U32 },
80 [NFTA_NAT_REG_PROTO_MAX] = { .type = NLA_U32 },
81 [NFTA_NAT_FLAGS] = { .type = NLA_U32 },
82 };
83
nft_nat_validate(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nft_data ** data)84 static int nft_nat_validate(const struct nft_ctx *ctx,
85 const struct nft_expr *expr,
86 const struct nft_data **data)
87 {
88 struct nft_nat *priv = nft_expr_priv(expr);
89 int err;
90
91 if (ctx->family != NFPROTO_IPV4 &&
92 ctx->family != NFPROTO_IPV6 &&
93 ctx->family != NFPROTO_INET)
94 return -EOPNOTSUPP;
95
96 err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
97 if (err < 0)
98 return err;
99
100 switch (priv->type) {
101 case NFT_NAT_SNAT:
102 err = nft_chain_validate_hooks(ctx->chain,
103 (1 << NF_INET_POST_ROUTING) |
104 (1 << NF_INET_LOCAL_IN));
105 break;
106 case NFT_NAT_DNAT:
107 err = nft_chain_validate_hooks(ctx->chain,
108 (1 << NF_INET_PRE_ROUTING) |
109 (1 << NF_INET_LOCAL_OUT));
110 break;
111 }
112
113 return err;
114 }
115
nft_nat_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])116 static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
117 const struct nlattr * const tb[])
118 {
119 struct nft_nat *priv = nft_expr_priv(expr);
120 unsigned int alen, plen;
121 u32 family;
122 int err;
123
124 if (tb[NFTA_NAT_TYPE] == NULL ||
125 (tb[NFTA_NAT_REG_ADDR_MIN] == NULL &&
126 tb[NFTA_NAT_REG_PROTO_MIN] == NULL))
127 return -EINVAL;
128
129 switch (ntohl(nla_get_be32(tb[NFTA_NAT_TYPE]))) {
130 case NFT_NAT_SNAT:
131 priv->type = NF_NAT_MANIP_SRC;
132 break;
133 case NFT_NAT_DNAT:
134 priv->type = NF_NAT_MANIP_DST;
135 break;
136 default:
137 return -EOPNOTSUPP;
138 }
139
140 if (tb[NFTA_NAT_FAMILY] == NULL)
141 return -EINVAL;
142
143 family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY]));
144 if (ctx->family != NFPROTO_INET && ctx->family != family)
145 return -EOPNOTSUPP;
146
147 switch (family) {
148 case NFPROTO_IPV4:
149 alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip);
150 break;
151 case NFPROTO_IPV6:
152 alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip6);
153 break;
154 default:
155 if (tb[NFTA_NAT_REG_ADDR_MIN])
156 return -EAFNOSUPPORT;
157 break;
158 }
159 priv->family = family;
160
161 if (tb[NFTA_NAT_REG_ADDR_MIN]) {
162 err = nft_parse_register_load(tb[NFTA_NAT_REG_ADDR_MIN],
163 &priv->sreg_addr_min, alen);
164 if (err < 0)
165 return err;
166
167 if (tb[NFTA_NAT_REG_ADDR_MAX]) {
168 err = nft_parse_register_load(tb[NFTA_NAT_REG_ADDR_MAX],
169 &priv->sreg_addr_max,
170 alen);
171 if (err < 0)
172 return err;
173 } else {
174 priv->sreg_addr_max = priv->sreg_addr_min;
175 }
176 }
177
178 plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all);
179 if (tb[NFTA_NAT_REG_PROTO_MIN]) {
180 err = nft_parse_register_load(tb[NFTA_NAT_REG_PROTO_MIN],
181 &priv->sreg_proto_min, plen);
182 if (err < 0)
183 return err;
184
185 if (tb[NFTA_NAT_REG_PROTO_MAX]) {
186 err = nft_parse_register_load(tb[NFTA_NAT_REG_PROTO_MAX],
187 &priv->sreg_proto_max,
188 plen);
189 if (err < 0)
190 return err;
191 } else {
192 priv->sreg_proto_max = priv->sreg_proto_min;
193 }
194 }
195
196 if (tb[NFTA_NAT_FLAGS]) {
197 priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
198 if (priv->flags & ~NF_NAT_RANGE_MASK)
199 return -EOPNOTSUPP;
200 }
201
202 return nf_ct_netns_get(ctx->net, family);
203 }
204
nft_nat_dump(struct sk_buff * skb,const struct nft_expr * expr)205 static int nft_nat_dump(struct sk_buff *skb, const struct nft_expr *expr)
206 {
207 const struct nft_nat *priv = nft_expr_priv(expr);
208
209 switch (priv->type) {
210 case NF_NAT_MANIP_SRC:
211 if (nla_put_be32(skb, NFTA_NAT_TYPE, htonl(NFT_NAT_SNAT)))
212 goto nla_put_failure;
213 break;
214 case NF_NAT_MANIP_DST:
215 if (nla_put_be32(skb, NFTA_NAT_TYPE, htonl(NFT_NAT_DNAT)))
216 goto nla_put_failure;
217 break;
218 }
219
220 if (nla_put_be32(skb, NFTA_NAT_FAMILY, htonl(priv->family)))
221 goto nla_put_failure;
222
223 if (priv->sreg_addr_min) {
224 if (nft_dump_register(skb, NFTA_NAT_REG_ADDR_MIN,
225 priv->sreg_addr_min) ||
226 nft_dump_register(skb, NFTA_NAT_REG_ADDR_MAX,
227 priv->sreg_addr_max))
228 goto nla_put_failure;
229 }
230
231 if (priv->sreg_proto_min) {
232 if (nft_dump_register(skb, NFTA_NAT_REG_PROTO_MIN,
233 priv->sreg_proto_min) ||
234 nft_dump_register(skb, NFTA_NAT_REG_PROTO_MAX,
235 priv->sreg_proto_max))
236 goto nla_put_failure;
237 }
238
239 if (priv->flags != 0) {
240 if (nla_put_be32(skb, NFTA_NAT_FLAGS, htonl(priv->flags)))
241 goto nla_put_failure;
242 }
243
244 return 0;
245
246 nla_put_failure:
247 return -1;
248 }
249
250 static void
nft_nat_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)251 nft_nat_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
252 {
253 const struct nft_nat *priv = nft_expr_priv(expr);
254
255 nf_ct_netns_put(ctx->net, priv->family);
256 }
257
258 static struct nft_expr_type nft_nat_type;
259 static const struct nft_expr_ops nft_nat_ops = {
260 .type = &nft_nat_type,
261 .size = NFT_EXPR_SIZE(sizeof(struct nft_nat)),
262 .eval = nft_nat_eval,
263 .init = nft_nat_init,
264 .destroy = nft_nat_destroy,
265 .dump = nft_nat_dump,
266 .validate = nft_nat_validate,
267 };
268
269 static struct nft_expr_type nft_nat_type __read_mostly = {
270 .name = "nat",
271 .ops = &nft_nat_ops,
272 .policy = nft_nat_policy,
273 .maxattr = NFTA_NAT_MAX,
274 .owner = THIS_MODULE,
275 };
276
277 #ifdef CONFIG_NF_TABLES_INET
nft_nat_inet_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)278 static void nft_nat_inet_eval(const struct nft_expr *expr,
279 struct nft_regs *regs,
280 const struct nft_pktinfo *pkt)
281 {
282 const struct nft_nat *priv = nft_expr_priv(expr);
283
284 if (priv->family == nft_pf(pkt) ||
285 priv->family == NFPROTO_INET)
286 nft_nat_eval(expr, regs, pkt);
287 }
288
289 static const struct nft_expr_ops nft_nat_inet_ops = {
290 .type = &nft_nat_type,
291 .size = NFT_EXPR_SIZE(sizeof(struct nft_nat)),
292 .eval = nft_nat_inet_eval,
293 .init = nft_nat_init,
294 .destroy = nft_nat_destroy,
295 .dump = nft_nat_dump,
296 .validate = nft_nat_validate,
297 };
298
299 static struct nft_expr_type nft_inet_nat_type __read_mostly = {
300 .name = "nat",
301 .family = NFPROTO_INET,
302 .ops = &nft_nat_inet_ops,
303 .policy = nft_nat_policy,
304 .maxattr = NFTA_NAT_MAX,
305 .owner = THIS_MODULE,
306 };
307
nft_nat_inet_module_init(void)308 static int nft_nat_inet_module_init(void)
309 {
310 return nft_register_expr(&nft_inet_nat_type);
311 }
312
nft_nat_inet_module_exit(void)313 static void nft_nat_inet_module_exit(void)
314 {
315 nft_unregister_expr(&nft_inet_nat_type);
316 }
317 #else
nft_nat_inet_module_init(void)318 static int nft_nat_inet_module_init(void) { return 0; }
nft_nat_inet_module_exit(void)319 static void nft_nat_inet_module_exit(void) { }
320 #endif
321
nft_nat_module_init(void)322 static int __init nft_nat_module_init(void)
323 {
324 int ret = nft_nat_inet_module_init();
325
326 if (ret)
327 return ret;
328
329 ret = nft_register_expr(&nft_nat_type);
330 if (ret)
331 nft_nat_inet_module_exit();
332
333 return ret;
334 }
335
nft_nat_module_exit(void)336 static void __exit nft_nat_module_exit(void)
337 {
338 nft_nat_inet_module_exit();
339 nft_unregister_expr(&nft_nat_type);
340 }
341
342 module_init(nft_nat_module_init);
343 module_exit(nft_nat_module_exit);
344
345 MODULE_LICENSE("GPL");
346 MODULE_AUTHOR("Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>");
347 MODULE_ALIAS_NFT_EXPR("nat");
348