net/ipv6/netfilter/nf_nat_l3proto_ipv6.c

   1 /*
   2  * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Development of IPv6 NAT funded by Astaro.
   9  */
  10 #include <linux/types.h>
  11 #include <linux/module.h>
  12 #include <linux/skbuff.h>
  13 #include <linux/ipv6.h>
  14 #include <linux/netfilter.h>
  15 #include <linux/netfilter_ipv6.h>
  16 #include <net/secure_seq.h>
  17 #include <net/checksum.h>
  18 #include <net/ip6_route.h>
  19 #include <net/ipv6.h>
  20
  21 #include <net/netfilter/nf_conntrack_core.h>
  22 #include <net/netfilter/nf_conntrack.h>
  23 #include <net/netfilter/nf_nat_core.h>
  24 #include <net/netfilter/nf_nat_l3proto.h>
  25 #include <net/netfilter/nf_nat_l4proto.h>
  26
  27 static const struct nf_nat_l3proto nf_nat_l3proto_ipv6;
  28
  29 #ifdef CONFIG_XFRM
  30 static void nf_nat_ipv6_decode_session(struct sk_buff *skb,
  31                                        const struct nf_conn *ct,
  32                                        enum ip_conntrack_dir dir,
  33                                        unsigned long statusbit,
  34                                        struct flowi *fl)
  35 {
  36         const struct nf_conntrack_tuple *t = &ct->tuplehash[dir].tuple;
  37         struct flowi6 *fl6 = &fl->u.ip6;
  38
  39         if (ct->status & statusbit) {
  40                 fl6->daddr = t->dst.u3.in6;
  41                 if (t->dst.protonum == IPPROTO_TCP ||
  42                     t->dst.protonum == IPPROTO_UDP ||
  43                     t->dst.protonum == IPPROTO_UDPLITE ||
  44                     t->dst.protonum == IPPROTO_DCCP ||
  45                     t->dst.protonum == IPPROTO_SCTP)
  46                         fl6->fl6_dport = t->dst.u.all;
  47         }
  48
  49         statusbit ^= IPS_NAT_MASK;
  50
  51         if (ct->status & statusbit) {
  52                 fl6->saddr = t->src.u3.in6;
  53                 if (t->dst.protonum == IPPROTO_TCP ||
  54                     t->dst.protonum == IPPROTO_UDP ||
  55                     t->dst.protonum == IPPROTO_UDPLITE ||
  56                     t->dst.protonum == IPPROTO_DCCP ||
  57                     t->dst.protonum == IPPROTO_SCTP)
  58                         fl6->fl6_sport = t->src.u.all;
  59         }
  60 }
  61 #endif
  62
  63 static bool nf_nat_ipv6_in_range(const struct nf_conntrack_tuple *t,
  64                                  const struct nf_nat_range *range)
  65 {
  66         return ipv6_addr_cmp(&t->src.u3.in6, &range->min_addr.in6) >= 0 &&
  67                ipv6_addr_cmp(&t->src.u3.in6, &range->max_addr.in6) <= 0;
  68 }
  69
  70 static u32 nf_nat_ipv6_secure_port(const struct nf_conntrack_tuple *t,
  71                                    __be16 dport)
  72 {
  73         return secure_ipv6_port_ephemeral(t->src.u3.ip6, t->dst.u3.ip6, dport);
  74 }
  75
  76 static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb,
  77                                   unsigned int iphdroff,
  78                                   const struct nf_nat_l4proto *l4proto,
  79                                   const struct nf_conntrack_tuple *target,
  80                                   enum nf_nat_manip_type maniptype)
  81 {
  82         struct ipv6hdr *ipv6h;
  83         __be16 frag_off;
  84         int hdroff;
  85         u8 nexthdr;
  86
  87         if (!skb_make_writable(skb, iphdroff + sizeof(*ipv6h)))
  88                 return false;
  89
  90         ipv6h = (void *)skb->data + iphdroff;
  91         nexthdr = ipv6h->nexthdr;
  92         hdroff = ipv6_skip_exthdr(skb, iphdroff + sizeof(*ipv6h),
  93                                   &nexthdr, &frag_off);
  94         if (hdroff < 0)
  95                 goto manip_addr;
  96
  97         if ((frag_off & htons(~0x7)) == 0 &&
  98             !l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv6, iphdroff, hdroff,
  99                                 target, maniptype))
 100                 return false;
 101 manip_addr:
 102         if (maniptype == NF_NAT_MANIP_SRC)
 103                 ipv6h->saddr = target->src.u3.in6;
 104         else
 105                 ipv6h->daddr = target->dst.u3.in6;
 106
 107         return true;
 108 }
 109
 110 static void nf_nat_ipv6_csum_update(struct sk_buff *skb,
 111                                     unsigned int iphdroff, __sum16 *check,
 112                                     const struct nf_conntrack_tuple *t,
 113                                     enum nf_nat_manip_type maniptype)
 114 {
 115         const struct ipv6hdr *ipv6h = (struct ipv6hdr *)(skb->data + iphdroff);
 116         const struct in6_addr *oldip, *newip;
 117
 118         if (maniptype == NF_NAT_MANIP_SRC) {
 119                 oldip = &ipv6h->saddr;
 120                 newip = &t->src.u3.in6;
 121         } else {
 122                 oldip = &ipv6h->daddr;
 123                 newip = &t->dst.u3.in6;
 124         }
 125         inet_proto_csum_replace16(check, skb, oldip->s6_addr32,
 126                                   newip->s6_addr32, 1);
 127 }
 128
 129 static void nf_nat_ipv6_csum_recalc(struct sk_buff *skb,
 130                                     u8 proto, void *data, __sum16 *check,
 131                                     int datalen, int oldlen)
 132 {
 133         const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 134         struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
 135
 136         if (skb->ip_summed != CHECKSUM_PARTIAL) {
 137                 if (!(rt->rt6i_flags & RTF_LOCAL) &&
 138                     (!skb->dev || skb->dev->features & NETIF_F_V6_CSUM)) {
 139                         skb->ip_summed = CHECKSUM_PARTIAL;
 140                         skb->csum_start = skb_headroom(skb) +
 141                                           skb_network_offset(skb) +
 142                                           (data - (void *)skb->data);
 143                         skb->csum_offset = (void *)check - data;
 144                         *check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
 145                                                   datalen, proto, 0);
 146                 } else {
 147                         *check = 0;
 148                         *check = csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
 149                                                  datalen, proto,
 150                                                  csum_partial(data, datalen,
 151                                                               0));
 152                         if (proto == IPPROTO_UDP && !*check)
 153                                 *check = CSUM_MANGLED_0;
 154                 }
 155         } else
 156                 inet_proto_csum_replace2(check, skb,
 157                                          htons(oldlen), htons(datalen), 1);
 158 }
 159
 160 static int nf_nat_ipv6_nlattr_to_range(struct nlattr *tb[],
 161                                        struct nf_nat_range *range)
 162 {
 163         if (tb[CTA_NAT_V6_MINIP]) {
 164                 nla_memcpy(&range->min_addr.ip6, tb[CTA_NAT_V6_MINIP],
 165                            sizeof(struct in6_addr));
 166                 range->flags |= NF_NAT_RANGE_MAP_IPS;
 167         }
 168
 169         if (tb[CTA_NAT_V6_MAXIP])
 170                 nla_memcpy(&range->max_addr.ip6, tb[CTA_NAT_V6_MAXIP],
 171                            sizeof(struct in6_addr));
 172         else
 173                 range->max_addr = range->min_addr;
 174
 175         return 0;
 176 }
 177
 178 static const struct nf_nat_l3proto nf_nat_l3proto_ipv6 = {
 179         .l3proto                = NFPROTO_IPV6,
 180         .secure_port            = nf_nat_ipv6_secure_port,
 181         .in_range               = nf_nat_ipv6_in_range,
 182         .manip_pkt              = nf_nat_ipv6_manip_pkt,
 183         .csum_update            = nf_nat_ipv6_csum_update,
 184         .csum_recalc            = nf_nat_ipv6_csum_recalc,
 185         .nlattr_to_range        = nf_nat_ipv6_nlattr_to_range,
 186 #ifdef CONFIG_XFRM
 187         .decode_session = nf_nat_ipv6_decode_session,
 188 #endif
 189 };
 190
 191 int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
 192                                     struct nf_conn *ct,
 193                                     enum ip_conntrack_info ctinfo,
 194                                     unsigned int hooknum,
 195                                     unsigned int hdrlen)
 196 {
 197         struct {
 198                 struct icmp6hdr icmp6;
 199                 struct ipv6hdr  ip6;
 200         } *inside;
 201         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 202         enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
 203         const struct nf_nat_l4proto *l4proto;
 204         struct nf_conntrack_tuple target;
 205         unsigned long statusbit;
 206
 207         NF_CT_ASSERT(ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY);
 208
 209         if (!skb_make_writable(skb, hdrlen + sizeof(*inside)))
 210                 return 0;
 211         if (nf_ip6_checksum(skb, hooknum, hdrlen, IPPROTO_ICMPV6))
 212                 return 0;
 213
 214         inside = (void *)skb->data + hdrlen;
 215         if (inside->icmp6.icmp6_type == NDISC_REDIRECT) {
 216                 if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
 217                         return 0;
 218                 if (ct->status & IPS_NAT_MASK)
 219                         return 0;
 220         }
 221
 222         if (manip == NF_NAT_MANIP_SRC)
 223                 statusbit = IPS_SRC_NAT;
 224         else
 225                 statusbit = IPS_DST_NAT;
 226
 227         /* Invert if this is reply direction */
 228         if (dir == IP_CT_DIR_REPLY)
 229                 statusbit ^= IPS_NAT_MASK;
 230
 231         if (!(ct->status & statusbit))
 232                 return 1;
 233
 234         l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, inside->ip6.nexthdr);
 235         if (!nf_nat_ipv6_manip_pkt(skb, hdrlen + sizeof(inside->icmp6),
 236                                    l4proto, &ct->tuplehash[!dir].tuple, !manip))
 237                 return 0;
 238
 239         if (skb->ip_summed != CHECKSUM_PARTIAL) {
 240                 struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 241                 inside = (void *)skb->data + hdrlen;
 242                 inside->icmp6.icmp6_cksum = 0;
 243                 inside->icmp6.icmp6_cksum =
 244                         csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
 245                                         skb->len - hdrlen, IPPROTO_ICMPV6,
 246                                         csum_partial(&inside->icmp6,
 247                                                      skb->len - hdrlen, 0));
 248         }
 249
 250         nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
 251         l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, IPPROTO_ICMPV6);
 252         if (!nf_nat_ipv6_manip_pkt(skb, 0, l4proto, &target, manip))
 253                 return 0;
 254
 255         return 1;
 256 }
 257 EXPORT_SYMBOL_GPL(nf_nat_icmpv6_reply_translation);
 258
 259 static int __init nf_nat_l3proto_ipv6_init(void)
 260 {
 261         int err;
 262
 263         err = nf_nat_l4proto_register(NFPROTO_IPV6, &nf_nat_l4proto_icmpv6);
 264         if (err < 0)
 265                 goto err1;
 266         err = nf_nat_l3proto_register(&nf_nat_l3proto_ipv6);
 267         if (err < 0)
 268                 goto err2;
 269         return err;
 270
 271 err2:
 272         nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_icmpv6);
 273 err1:
 274         return err;
 275 }
 276
 277 static void __exit nf_nat_l3proto_ipv6_exit(void)
 278 {
 279         nf_nat_l3proto_unregister(&nf_nat_l3proto_ipv6);
 280         nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_icmpv6);
 281 }
 282
 283 MODULE_LICENSE("GPL");
 284 MODULE_ALIAS("nf-nat-" __stringify(AF_INET6));
 285
 286 module_init(nf_nat_l3proto_ipv6_init);
 287 module_exit(nf_nat_l3proto_ipv6_exit);