Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 1 | /* |
| 2 | * nf_nat_proto_gre.c |
| 3 | * |
| 4 | * NAT protocol helper module for GRE. |
| 5 | * |
| 6 | * GRE is a generic encapsulation protocol, which is generally not very |
| 7 | * suited for NAT, as it has no protocol-specific part as port numbers. |
| 8 | * |
| 9 | * It has an optional key field, which may help us distinguishing two |
| 10 | * connections between the same two hosts. |
| 11 | * |
| 12 | * GRE is defined in RFC 1701 and RFC 1702, as well as RFC 2784 |
| 13 | * |
| 14 | * PPTP is built on top of a modified version of GRE, and has a mandatory |
| 15 | * field called "CallID", which serves us for the same purpose as the key |
| 16 | * field in plain GRE. |
| 17 | * |
| 18 | * Documentation about PPTP can be found in RFC 2637 |
| 19 | * |
| 20 | * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org> |
| 21 | * |
| 22 | * Development of this code funded by Astaro AG (http://www.astaro.com/) |
| 23 | * |
Patrick McHardy | f229f6c | 2013-04-06 15:24:29 +0200 | [diff] [blame] | 24 | * (C) 2006-2012 Patrick McHardy <kaber@trash.net> |
| 25 | * |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 26 | */ |
| 27 | |
| 28 | #include <linux/module.h> |
| 29 | #include <linux/skbuff.h> |
| 30 | #include <linux/ip.h> |
| 31 | |
| 32 | #include <net/netfilter/nf_nat.h> |
Patrick McHardy | c7232c9 | 2012-08-26 19:14:06 +0200 | [diff] [blame] | 33 | #include <net/netfilter/nf_nat_l4proto.h> |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 34 | #include <linux/netfilter/nf_conntrack_proto_gre.h> |
| 35 | |
| 36 | MODULE_LICENSE("GPL"); |
| 37 | MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>"); |
| 38 | MODULE_DESCRIPTION("Netfilter NAT protocol helper module for GRE"); |
| 39 | |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 40 | /* generate unique tuple ... */ |
Changli Gao | f43dc98 | 2010-08-02 17:20:54 +0200 | [diff] [blame] | 41 | static void |
Patrick McHardy | c7232c9 | 2012-08-26 19:14:06 +0200 | [diff] [blame] | 42 | gre_unique_tuple(const struct nf_nat_l3proto *l3proto, |
| 43 | struct nf_conntrack_tuple *tuple, |
| 44 | const struct nf_nat_range *range, |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 45 | enum nf_nat_manip_type maniptype, |
Patrick McHardy | c88130b | 2008-01-31 04:42:11 -0800 | [diff] [blame] | 46 | const struct nf_conn *ct) |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 47 | { |
| 48 | static u_int16_t key; |
| 49 | __be16 *keyptr; |
| 50 | unsigned int min, i, range_size; |
| 51 | |
Jorge Boncompte | c2a1910 | 2007-05-03 03:34:42 -0700 | [diff] [blame] | 52 | /* If there is no master conntrack we are not PPTP, |
| 53 | do not change tuples */ |
Patrick McHardy | c88130b | 2008-01-31 04:42:11 -0800 | [diff] [blame] | 54 | if (!ct->master) |
Changli Gao | f43dc98 | 2010-08-02 17:20:54 +0200 | [diff] [blame] | 55 | return; |
Jorge Boncompte | c2a1910 | 2007-05-03 03:34:42 -0700 | [diff] [blame] | 56 | |
Patrick McHardy | cbc9f2f | 2011-12-23 13:59:49 +0100 | [diff] [blame] | 57 | if (maniptype == NF_NAT_MANIP_SRC) |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 58 | keyptr = &tuple->src.u.gre.key; |
| 59 | else |
| 60 | keyptr = &tuple->dst.u.gre.key; |
| 61 | |
Patrick McHardy | cbc9f2f | 2011-12-23 13:59:49 +0100 | [diff] [blame] | 62 | if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED)) { |
Patrick McHardy | c88130b | 2008-01-31 04:42:11 -0800 | [diff] [blame] | 63 | pr_debug("%p: NATing GRE PPTP\n", ct); |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 64 | min = 1; |
| 65 | range_size = 0xffff; |
| 66 | } else { |
Patrick McHardy | c7232c9 | 2012-08-26 19:14:06 +0200 | [diff] [blame] | 67 | min = ntohs(range->min_proto.gre.key); |
| 68 | range_size = ntohs(range->max_proto.gre.key) - min + 1; |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 69 | } |
| 70 | |
Patrick McHardy | 0d53778 | 2007-07-07 22:39:38 -0700 | [diff] [blame] | 71 | pr_debug("min = %u, range_size = %u\n", min, range_size); |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 72 | |
Changli Gao | 2452a99 | 2010-08-02 17:35:49 +0200 | [diff] [blame] | 73 | for (i = 0; ; ++key) { |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 74 | *keyptr = htons(min + key % range_size); |
Changli Gao | 2452a99 | 2010-08-02 17:35:49 +0200 | [diff] [blame] | 75 | if (++i == range_size || !nf_nat_used_tuple(tuple, ct)) |
Changli Gao | f43dc98 | 2010-08-02 17:20:54 +0200 | [diff] [blame] | 76 | return; |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 77 | } |
| 78 | |
Patrick McHardy | c88130b | 2008-01-31 04:42:11 -0800 | [diff] [blame] | 79 | pr_debug("%p: no NAT mapping\n", ct); |
Changli Gao | f43dc98 | 2010-08-02 17:20:54 +0200 | [diff] [blame] | 80 | return; |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 81 | } |
| 82 | |
| 83 | /* manipulate a GRE packet according to maniptype */ |
Jan Engelhardt | f2ea825 | 2008-04-14 11:15:53 +0200 | [diff] [blame] | 84 | static bool |
Patrick McHardy | c7232c9 | 2012-08-26 19:14:06 +0200 | [diff] [blame] | 85 | gre_manip_pkt(struct sk_buff *skb, |
| 86 | const struct nf_nat_l3proto *l3proto, |
| 87 | unsigned int iphdroff, unsigned int hdroff, |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 88 | const struct nf_conntrack_tuple *tuple, |
| 89 | enum nf_nat_manip_type maniptype) |
| 90 | { |
Gao Feng | c579a9e | 2016-08-25 23:08:47 +0800 | [diff] [blame] | 91 | const struct gre_base_hdr *greh; |
| 92 | struct pptp_gre_header *pgreh; |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 93 | |
| 94 | /* pgreh includes two optional 32bit fields which are not required |
| 95 | * to be there. That's where the magic '8' comes from */ |
Herbert Xu | 3db05fe | 2007-10-15 00:53:15 -0700 | [diff] [blame] | 96 | if (!skb_make_writable(skb, hdroff + sizeof(*pgreh) - 8)) |
Jan Engelhardt | f2ea825 | 2008-04-14 11:15:53 +0200 | [diff] [blame] | 97 | return false; |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 98 | |
Herbert Xu | 3db05fe | 2007-10-15 00:53:15 -0700 | [diff] [blame] | 99 | greh = (void *)skb->data + hdroff; |
Gao Feng | c579a9e | 2016-08-25 23:08:47 +0800 | [diff] [blame] | 100 | pgreh = (struct pptp_gre_header *)greh; |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 101 | |
| 102 | /* we only have destination manip of a packet, since 'source key' |
| 103 | * is not present in the packet itself */ |
Patrick McHardy | cbc9f2f | 2011-12-23 13:59:49 +0100 | [diff] [blame] | 104 | if (maniptype != NF_NAT_MANIP_DST) |
Jan Engelhardt | f2ea825 | 2008-04-14 11:15:53 +0200 | [diff] [blame] | 105 | return true; |
Gao Feng | c579a9e | 2016-08-25 23:08:47 +0800 | [diff] [blame] | 106 | |
| 107 | switch (greh->flags & GRE_VERSION) { |
| 108 | case GRE_VERSION_0: |
Jorge Boncompte | c2a1910 | 2007-05-03 03:34:42 -0700 | [diff] [blame] | 109 | /* We do not currently NAT any GREv0 packets. |
| 110 | * Try to behave like "nf_nat_proto_unknown" */ |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 111 | break; |
Gao Feng | c579a9e | 2016-08-25 23:08:47 +0800 | [diff] [blame] | 112 | case GRE_VERSION_1: |
Patrick McHardy | 0d53778 | 2007-07-07 22:39:38 -0700 | [diff] [blame] | 113 | pr_debug("call_id -> 0x%04x\n", ntohs(tuple->dst.u.gre.key)); |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 114 | pgreh->call_id = tuple->dst.u.gre.key; |
| 115 | break; |
| 116 | default: |
Patrick McHardy | 0d53778 | 2007-07-07 22:39:38 -0700 | [diff] [blame] | 117 | pr_debug("can't nat unknown GRE version\n"); |
Jan Engelhardt | f2ea825 | 2008-04-14 11:15:53 +0200 | [diff] [blame] | 118 | return false; |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 119 | } |
Jan Engelhardt | f2ea825 | 2008-04-14 11:15:53 +0200 | [diff] [blame] | 120 | return true; |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 121 | } |
| 122 | |
Patrick McHardy | c7232c9 | 2012-08-26 19:14:06 +0200 | [diff] [blame] | 123 | static const struct nf_nat_l4proto gre = { |
| 124 | .l4proto = IPPROTO_GRE, |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 125 | .manip_pkt = gre_manip_pkt, |
Patrick McHardy | c7232c9 | 2012-08-26 19:14:06 +0200 | [diff] [blame] | 126 | .in_range = nf_nat_l4proto_in_range, |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 127 | .unique_tuple = gre_unique_tuple, |
Duan Jiong | 24de3d3 | 2014-06-30 09:19:32 +0800 | [diff] [blame] | 128 | #if IS_ENABLED(CONFIG_NF_CT_NETLINK) |
Patrick McHardy | c7232c9 | 2012-08-26 19:14:06 +0200 | [diff] [blame] | 129 | .nlattr_to_range = nf_nat_l4proto_nlattr_to_range, |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 130 | #endif |
| 131 | }; |
| 132 | |
Stephen Hemminger | f4f6fb7 | 2008-01-31 04:08:39 -0800 | [diff] [blame] | 133 | static int __init nf_nat_proto_gre_init(void) |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 134 | { |
Patrick McHardy | c7232c9 | 2012-08-26 19:14:06 +0200 | [diff] [blame] | 135 | return nf_nat_l4proto_register(NFPROTO_IPV4, &gre); |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 136 | } |
| 137 | |
Stephen Hemminger | f4f6fb7 | 2008-01-31 04:08:39 -0800 | [diff] [blame] | 138 | static void __exit nf_nat_proto_gre_fini(void) |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 139 | { |
Patrick McHardy | c7232c9 | 2012-08-26 19:14:06 +0200 | [diff] [blame] | 140 | nf_nat_l4proto_unregister(NFPROTO_IPV4, &gre); |
Patrick McHardy | f09943f | 2006-12-02 22:09:41 -0800 | [diff] [blame] | 141 | } |
| 142 | |
| 143 | module_init(nf_nat_proto_gre_init); |
| 144 | module_exit(nf_nat_proto_gre_fini); |
| 145 | |
| 146 | void nf_nat_need_gre(void) |
| 147 | { |
| 148 | return; |
| 149 | } |
| 150 | EXPORT_SYMBOL_GPL(nf_nat_need_gre); |