11 #include <linux/module.h>
12 #include <linux/types.h>
18 #include <linux/rtnetlink.h>
61 unsigned long statusbit;
64 ct = nf_ct_get(skb, &ctinfo);
91 if (xfrm_decode_session(skb, &fl, family) < 0)
96 dst = ((
struct xfrm_dst *)dst)->route;
104 skb_dst_set(skb, dst);
107 hh_len = skb_dst(skb)->dev->hard_header_len;
108 if (skb_headroom(skb) < hh_len &&
117 static inline unsigned int
124 hash = jhash2((
u32 *)&tuple->
src,
sizeof(tuple->
src) /
sizeof(
u32),
125 tuple->
dst.protonum ^ zone ^ nf_conntrack_hash_rnd);
126 return ((
u64)hash * net->ct.nat_htable_size) >> 32;
132 const struct nf_conn *ignored_conntrack)
171 same_src(
const struct nf_conn *ct,
177 return (t->
dst.protonum == tuple->
dst.protonum &&
178 nf_inet_addr_cmp(&t->
src.u3, &tuple->
src.u3) &&
179 t->
src.u.all == tuple->
src.u.all);
184 find_appropriate_src(
struct net *net,
u16 zone,
191 unsigned int h = hash_by_src(net, zone, tuple);
196 hlist_for_each_entry_rcu(nat, n, &net->ct.nat_bysource[h], bysource) {
198 if (same_src(ct, tuple) && nf_ct_zone(ct) == zone) {
204 if (
in_range(l3proto, l4proto, result, range))
234 var_ipp = &tuple->
src.u3;
236 var_ipp = &tuple->
dst.u3;
245 max =
sizeof(var_ipp->
ip) /
sizeof(
u32) - 1;
247 max =
sizeof(var_ipp->
ip6) /
sizeof(
u32) - 1;
256 j = jhash2((
u32 *)&tuple->
src.u3,
sizeof(tuple->
src.u3) /
sizeof(
u32),
261 for (i = 0; i <=
max; i++) {
268 dist = maxip - minip + 1;
275 htonl(minip + (((
u64)j * dist) >> 32));
299 struct net *net = nf_ct_net(ct);
300 u16 zone = nf_ct_zone(ct);
305 orig_tuple->
dst.protonum);
318 if (
in_range(l3proto, l4proto, orig_tuple, range)) {
320 *tuple = *orig_tuple;
323 }
else if (find_appropriate_src(net, zone, l3proto, l4proto,
324 orig_tuple, tuple, range)) {
325 pr_debug(
"get_unique_tuple: Found current src map\n");
332 *tuple = *orig_tuple;
333 find_best_ips_proto(zone, tuple, range, ct, maniptype);
342 if (l4proto->
in_range(tuple, maniptype,
354 l4proto->
unique_tuple(l3proto, tuple, range, maniptype, ct);
364 struct net *net = nf_ct_net(ct);
373 pr_debug(
"failed to add NAT extension\n");
380 BUG_ON(nf_nat_initialized(ct, maniptype));
390 get_unique_tuple(&new_tuple, &curr_tuple, range, ct, maniptype);
392 if (!nf_ct_tuple_equal(&new_tuple, &curr_tuple)) {
407 unsigned int srchash;
409 srchash = hash_by_src(net, nf_ct_zone(ct),
411 spin_lock_bh(&nf_nat_lock);
416 &net->ct.nat_bysource[srchash]);
417 spin_unlock_bh(&nf_nat_lock);
439 unsigned long statusbit;
452 if (ct->
status & statusbit) {
460 target.
dst.protonum);
461 if (!l3proto->
manip_pkt(skb, 0, l4proto, &target, mtype))
489 spin_lock_bh(&nf_nat_lock);
491 spin_unlock_bh(&nf_nat_lock);
493 memset(nat, 0,
sizeof(*nat));
500 static void nf_nat_l4proto_clean(
u8 l3proto,
u8 l4proto)
522 static
void nf_nat_l3proto_clean(
u8 l3proto)
524 struct nf_nat_proto_clean clean = {
551 if (nf_nat_l4protos[l3proto] ==
NULL) {
554 if (l4protos ==
NULL) {
567 nf_nat_l4protos[l3proto] = l4protos;
571 nf_nat_l4protos[l3proto][l4proto->l4proto],
572 lockdep_is_held(&nf_nat_proto_mutex)
593 nf_nat_l4proto_clean(l3proto, l4proto->
l4proto);
624 nf_nat_l3proto_clean(l3proto->
l3proto);
630 static void nf_nat_cleanup_conntrack(
struct nf_conn *ct)
639 spin_lock_bh(&nf_nat_lock);
641 spin_unlock_bh(&nf_nat_lock);
644 static void nf_nat_move_storage(
void *
new,
void *old)
653 spin_lock_bh(&nf_nat_lock);
655 spin_unlock_bh(&nf_nat_lock);
661 .destroy = nf_nat_cleanup_conntrack,
662 .move = nf_nat_move_storage,
667 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
669 #include <linux/netfilter/nfnetlink.h>
677 static int nfnetlink_parse_nat_proto(
struct nlattr *
attr,
705 nfnetlink_parse_nat(
const struct nlattr *nat,
712 memset(range, 0,
sizeof(*range));
714 err = nla_parse_nested(tb,
CTA_NAT_MAX, nat, nat_nla_policy);
720 if (l3proto ==
NULL) {
731 err = nfnetlink_parse_nat_proto(tb[CTA_NAT_PROTO], ct, range);
738 nfnetlink_parse_nat_setup(
struct nf_conn *ct,
740 const struct nlattr *attr)
745 err = nfnetlink_parse_nat(attr, ct, &range);
748 if (nf_nat_initialized(ct, manip))
755 nfnetlink_parse_nat_setup(
struct nf_conn *ct,
757 const struct nlattr *attr)
763 static int __net_init nf_nat_net_init(
struct net *net)
766 net->ct.nat_htable_size = net->ct.htable_size;
768 if (!net->ct.nat_bysource)
773 static void __net_exit nf_nat_net_exit(
struct net *net)
775 struct nf_nat_proto_clean clean = {};
783 .init = nf_nat_net_init,
784 .exit = nf_nat_net_exit,
788 .name =
"nat-follow-master",
792 static struct nfq_ct_nat_hook nfq_ct_nat = {
796 static int __init nf_nat_init(
void)
819 nfnetlink_parse_nat_setup);
834 static void __exit nf_nat_cleanup(
void)
849 kfree(nf_nat_l4protos[i]);