Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 1 | /* |
| 2 | * nf_nat_proto_gre.c |
| 3 | * |
| 4 | * NAT protocol helper module for GRE. |
| 5 | * |
| 6 | * GRE is a generic encapsulation protocol, which is generally not very |
| 7 | * suited for NAT, as it has no protocol-specific part as port numbers. |
| 8 | * |
| 9 | * It has an optional key field, which may help us distinguishing two |
| 10 | * connections between the same two hosts. |
| 11 | * |
| 12 | * GRE is defined in RFC 1701 and RFC 1702, as well as RFC 2784 |
| 13 | * |
| 14 | * PPTP is built on top of a modified version of GRE, and has a mandatory |
| 15 | * field called "CallID", which serves us for the same purpose as the key |
| 16 | * field in plain GRE. |
| 17 | * |
| 18 | * Documentation about PPTP can be found in RFC 2637 |
| 19 | * |
| 20 | * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org> |
| 21 | * |
| 22 | * Development of this code funded by Astaro AG (http://www.astaro.com/) |
| 23 | * |
| 24 | */ |
| 25 | |
| 26 | #include <linux/module.h> |
| 27 | #include <linux/skbuff.h> |
| 28 | #include <linux/ip.h> |
| 29 | |
| 30 | #include <net/netfilter/nf_nat.h> |
| 31 | #include <net/netfilter/nf_nat_rule.h> |
| 32 | #include <net/netfilter/nf_nat_protocol.h> |
| 33 | #include <linux/netfilter/nf_conntrack_proto_gre.h> |
| 34 | |
| 35 | MODULE_LICENSE("GPL"); |
| 36 | MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>"); |
| 37 | MODULE_DESCRIPTION("Netfilter NAT protocol helper module for GRE"); |
| 38 | |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 39 | /* is key in given range between min and max */ |
| 40 | static int |
| 41 | gre_in_range(const struct nf_conntrack_tuple *tuple, |
| 42 | enum nf_nat_manip_type maniptype, |
| 43 | const union nf_conntrack_man_proto *min, |
| 44 | const union nf_conntrack_man_proto *max) |
| 45 | { |
| 46 | __be16 key; |
| 47 | |
| 48 | if (maniptype == IP_NAT_MANIP_SRC) |
| 49 | key = tuple->src.u.gre.key; |
| 50 | else |
| 51 | key = tuple->dst.u.gre.key; |
| 52 | |
| 53 | return ntohs(key) >= ntohs(min->gre.key) && |
| 54 | ntohs(key) <= ntohs(max->gre.key); |
| 55 | } |
| 56 | |
| 57 | /* generate unique tuple ... */ |
| 58 | static int |
| 59 | gre_unique_tuple(struct nf_conntrack_tuple *tuple, |
| 60 | const struct nf_nat_range *range, |
| 61 | enum nf_nat_manip_type maniptype, |
| 62 | const struct nf_conn *conntrack) |
| 63 | { |
| 64 | static u_int16_t key; |
| 65 | __be16 *keyptr; |
| 66 | unsigned int min, i, range_size; |
| 67 | |
Jorge Boncompte | c2a1910 | 2007-05-03 03:34:42 -0700 | [diff] [blame] | 68 | /* If there is no master conntrack we are not PPTP, |
| 69 | do not change tuples */ |
| 70 | if (!conntrack->master) |
| 71 | return 0; |
| 72 | |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 73 | if (maniptype == IP_NAT_MANIP_SRC) |
| 74 | keyptr = &tuple->src.u.gre.key; |
| 75 | else |
| 76 | keyptr = &tuple->dst.u.gre.key; |
| 77 | |
| 78 | if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) { |
Patrick McHardy | 0d53778 | 2007-07-07 22:39:38 -0700 | [diff] [blame] | 79 | pr_debug("%p: NATing GRE PPTP\n", conntrack); |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 80 | min = 1; |
| 81 | range_size = 0xffff; |
| 82 | } else { |
| 83 | min = ntohs(range->min.gre.key); |
| 84 | range_size = ntohs(range->max.gre.key) - min + 1; |
| 85 | } |
| 86 | |
Patrick McHardy | 0d53778 | 2007-07-07 22:39:38 -0700 | [diff] [blame] | 87 | pr_debug("min = %u, range_size = %u\n", min, range_size); |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 88 | |
| 89 | for (i = 0; i < range_size; i++, key++) { |
| 90 | *keyptr = htons(min + key % range_size); |
| 91 | if (!nf_nat_used_tuple(tuple, conntrack)) |
| 92 | return 1; |
| 93 | } |
| 94 | |
Patrick McHardy | 0d53778 | 2007-07-07 22:39:38 -0700 | [diff] [blame] | 95 | pr_debug("%p: no NAT mapping\n", conntrack); |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 96 | return 0; |
| 97 | } |
| 98 | |
| 99 | /* manipulate a GRE packet according to maniptype */ |
| 100 | static int |
Herbert Xu | 3db05fe | 2007-10-15 00:53:15 -0700 | [diff] [blame] | 101 | gre_manip_pkt(struct sk_buff *skb, unsigned int iphdroff, |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 102 | const struct nf_conntrack_tuple *tuple, |
| 103 | enum nf_nat_manip_type maniptype) |
| 104 | { |
| 105 | struct gre_hdr *greh; |
| 106 | struct gre_hdr_pptp *pgreh; |
Herbert Xu | 3db05fe | 2007-10-15 00:53:15 -0700 | [diff] [blame] | 107 | struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff); |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 108 | unsigned int hdroff = iphdroff + iph->ihl * 4; |
| 109 | |
| 110 | /* pgreh includes two optional 32bit fields which are not required |
| 111 | * to be there. That's where the magic '8' comes from */ |
Herbert Xu | 3db05fe | 2007-10-15 00:53:15 -0700 | [diff] [blame] | 112 | if (!skb_make_writable(skb, hdroff + sizeof(*pgreh) - 8)) |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 113 | return 0; |
| 114 | |
Herbert Xu | 3db05fe | 2007-10-15 00:53:15 -0700 | [diff] [blame] | 115 | greh = (void *)skb->data + hdroff; |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 116 | pgreh = (struct gre_hdr_pptp *)greh; |
| 117 | |
| 118 | /* we only have destination manip of a packet, since 'source key' |
| 119 | * is not present in the packet itself */ |
| 120 | if (maniptype != IP_NAT_MANIP_DST) |
| 121 | return 1; |
| 122 | switch (greh->version) { |
Jorge Boncompte | c2a1910 | 2007-05-03 03:34:42 -0700 | [diff] [blame] | 123 | case GRE_VERSION_1701: |
| 124 | /* We do not currently NAT any GREv0 packets. |
| 125 | * Try to behave like "nf_nat_proto_unknown" */ |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 126 | break; |
| 127 | case GRE_VERSION_PPTP: |
Patrick McHardy | 0d53778 | 2007-07-07 22:39:38 -0700 | [diff] [blame] | 128 | pr_debug("call_id -> 0x%04x\n", ntohs(tuple->dst.u.gre.key)); |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 129 | pgreh->call_id = tuple->dst.u.gre.key; |
| 130 | break; |
| 131 | default: |
Patrick McHardy | 0d53778 | 2007-07-07 22:39:38 -0700 | [diff] [blame] | 132 | pr_debug("can't nat unknown GRE version\n"); |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 133 | return 0; |
| 134 | } |
| 135 | return 1; |
| 136 | } |
| 137 | |
Patrick McHardy | 2b628a0 | 2007-12-17 22:37:36 -0800 | [diff] [blame] | 138 | static const struct nf_nat_protocol gre = { |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 139 | .name = "GRE", |
| 140 | .protonum = IPPROTO_GRE, |
Patrick McHardy | 3ee9e76 | 2007-12-17 22:37:20 -0800 | [diff] [blame] | 141 | .me = THIS_MODULE, |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 142 | .manip_pkt = gre_manip_pkt, |
| 143 | .in_range = gre_in_range, |
| 144 | .unique_tuple = gre_unique_tuple, |
Patrick McHardy | e281db5c | 2007-03-04 15:57:25 -0800 | [diff] [blame] | 145 | #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE) |
Patrick McHardy | fdf7083 | 2007-09-28 14:37:41 -0700 | [diff] [blame] | 146 | .range_to_nlattr = nf_nat_port_range_to_nlattr, |
| 147 | .nlattr_to_range = nf_nat_port_nlattr_to_range, |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 148 | #endif |
| 149 | }; |
| 150 | |
Stephen Hemminger | f4f6fb7 | 2008-01-31 04:08:39 -0800 | [diff] [blame] | 151 | static int __init nf_nat_proto_gre_init(void) |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 152 | { |
| 153 | return nf_nat_protocol_register(&gre); |
| 154 | } |
| 155 | |
Stephen Hemminger | f4f6fb7 | 2008-01-31 04:08:39 -0800 | [diff] [blame] | 156 | static void __exit nf_nat_proto_gre_fini(void) |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 157 | { |
| 158 | nf_nat_protocol_unregister(&gre); |
| 159 | } |
| 160 | |
| 161 | module_init(nf_nat_proto_gre_init); |
| 162 | module_exit(nf_nat_proto_gre_fini); |
| 163 | |
| 164 | void nf_nat_need_gre(void) |
| 165 | { |
| 166 | return; |
| 167 | } |
| 168 | EXPORT_SYMBOL_GPL(nf_nat_need_gre); |