[deliverable/linux.git] / net / ipv4 / netfilter / nf_nat_standalone.c

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/types.h>
#include <linux/icmp.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/proc_fs.h>
#include <net/ip.h>
#include <net/checksum.h>
#include <linux/spinlock.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_nat_rule.h>
#include <net/netfilter/nf_nat_protocol.h>
#include <net/netfilter/nf_nat_core.h>
#include <net/netfilter/nf_nat_helper.h>
#include <linux/netfilter_ipv4/ip_tables.h>

#if 0
#define DEBUGP printk
#else
#define DEBUGP(format, args...)
#endif

#ifdef CONFIG_XFRM
static void nat_decode_session(struct sk_buff *skb, struct flowi *fl)
{
	struct nf_conn *ct;
	struct nf_conntrack_tuple *t;
	enum ip_conntrack_info ctinfo;
	enum ip_conntrack_dir dir;
	unsigned long statusbit;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return;
	dir = CTINFO2DIR(ctinfo);
	t = &ct->tuplehash[dir].tuple;

	if (dir == IP_CT_DIR_ORIGINAL)
		statusbit = IPS_DST_NAT;
	else
		statusbit = IPS_SRC_NAT;

	if (ct->status & statusbit) {
		fl->fl4_dst = t->dst.u3.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP)
			fl->fl_ip_dport = t->dst.u.tcp.port;
	}

	statusbit ^= IPS_NAT_MASK;

	if (ct->status & statusbit) {
		fl->fl4_src = t->src.u3.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP)
			fl->fl_ip_sport = t->src.u.tcp.port;
	}
}
#endif

static unsigned int
nf_nat_fn(unsigned int hooknum,
	  struct sk_buff **pskb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	struct nf_conn_nat *nat;
	/* maniptype == SRC for postrouting. */
	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);

	/* We never see fragments: conntrack defrags on pre-routing
	   and local-out, and nf_nat_out protects post-routing. */
	NF_CT_ASSERT(!(ip_hdr(*pskb)->frag_off & htons(IP_MF | IP_OFFSET)));

	ct = nf_ct_get(*pskb, &ctinfo);
	/* Can't track?  It's not due to stress, or conntrack would
	   have dropped it.  Hence it's the user's responsibilty to
	   packet filter it out, or implement conntrack/NAT for that
	   protocol. 8) --RR */
	if (!ct) {
		/* Exception: ICMP redirect to new connection (not in
		   hash table yet).  We must not let this through, in
		   case we're doing NAT to the same network. */
		if (ip_hdr(*pskb)->protocol == IPPROTO_ICMP) {
			struct icmphdr _hdr, *hp;

			hp = skb_header_pointer(*pskb, ip_hdrlen(*pskb),
						sizeof(_hdr), &_hdr);
			if (hp != NULL &&
			    hp->type == ICMP_REDIRECT)
				return NF_DROP;
		}
		return NF_ACCEPT;
	}

	/* Don't try to NAT if this packet is not conntracked */
	if (ct == &nf_conntrack_untracked)
		return NF_ACCEPT;

	nat = nfct_nat(ct);
	if (!nat)
		return NF_ACCEPT;

	switch (ctinfo) {
	case IP_CT_RELATED:
	case IP_CT_RELATED+IP_CT_IS_REPLY:
		if (ip_hdr(*pskb)->protocol == IPPROTO_ICMP) {
			if (!nf_nat_icmp_reply_translation(ct, ctinfo,
							   hooknum, pskb))
				return NF_DROP;
			else
				return NF_ACCEPT;
		}
		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	case IP_CT_NEW:

		/* Seen it before?  This can happen for loopback, retrans,
		   or local packets.. */
		if (!nf_nat_initialized(ct, maniptype)) {
			unsigned int ret;

			if (unlikely(nf_ct_is_confirmed(ct)))
				/* NAT module was loaded late */
				ret = alloc_null_binding_confirmed(ct, hooknum);
			else if (hooknum == NF_IP_LOCAL_IN)
				/* LOCAL_IN hook doesn't have a chain!  */
				ret = alloc_null_binding(ct, hooknum);
			else
				ret = nf_nat_rule_find(pskb, hooknum, in, out,
						       ct);

			if (ret != NF_ACCEPT) {
				return ret;
			}
		} else
			DEBUGP("Already setup manip %s for ct %p\n",
			       maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
			       ct);
		break;

	default:
		/* ESTABLISHED */
		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
			     ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
	}

	return nf_nat_packet(ct, ctinfo, hooknum, pskb);
}

static unsigned int
nf_nat_in(unsigned int hooknum,
	  struct sk_buff **pskb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	unsigned int ret;
	__be32 daddr = ip_hdr(*pskb)->daddr;

	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    daddr != ip_hdr(*pskb)->daddr) {
		dst_release((*pskb)->dst);
		(*pskb)->dst = NULL;
	}
	return ret;
}

static unsigned int
nf_nat_out(unsigned int hooknum,
	   struct sk_buff **pskb,
	   const struct net_device *in,
	   const struct net_device *out,
	   int (*okfn)(struct sk_buff *))
{
#ifdef CONFIG_XFRM
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
#endif
	unsigned int ret;

	/* root is playing with raw sockets. */
	if ((*pskb)->len < sizeof(struct iphdr) ||
	    ip_hdrlen(*pskb) < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
#ifdef CONFIG_XFRM
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    (ct = nf_ct_get(*pskb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if (ct->tuplehash[dir].tuple.src.u3.ip !=
		    ct->tuplehash[!dir].tuple.dst.u3.ip
		    || ct->tuplehash[dir].tuple.src.u.all !=
		       ct->tuplehash[!dir].tuple.dst.u.all
		    )
			return ip_xfrm_me_harder(pskb) == 0 ? ret : NF_DROP;
	}
#endif
	return ret;
}

static unsigned int
nf_nat_local_fn(unsigned int hooknum,
		struct sk_buff **pskb,
		const struct net_device *in,
		const struct net_device *out,
		int (*okfn)(struct sk_buff *))
{
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	unsigned int ret;

	/* root is playing with raw sockets. */
	if ((*pskb)->len < sizeof(struct iphdr) ||
	    ip_hdrlen(*pskb) < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    (ct = nf_ct_get(*pskb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if (ct->tuplehash[dir].tuple.dst.u3.ip !=
		    ct->tuplehash[!dir].tuple.src.u3.ip) {
			if (ip_route_me_harder(pskb, RTN_UNSPEC))
				ret = NF_DROP;
		}
#ifdef CONFIG_XFRM
		else if (ct->tuplehash[dir].tuple.dst.u.all !=
			 ct->tuplehash[!dir].tuple.src.u.all)
			if (ip_xfrm_me_harder(pskb))
				ret = NF_DROP;
#endif
	}
	return ret;
}

static unsigned int
nf_nat_adjust(unsigned int hooknum,
	      struct sk_buff **pskb,
	      const struct net_device *in,
	      const struct net_device *out,
	      int (*okfn)(struct sk_buff *))
{
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;

	ct = nf_ct_get(*pskb, &ctinfo);
	if (ct && test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
		DEBUGP("nf_nat_standalone: adjusting sequence number\n");
		if (!nf_nat_seq_adjust(pskb, ct, ctinfo))
			return NF_DROP;
	}
	return NF_ACCEPT;
}

/* We must be after connection tracking and before packet filtering. */

static struct nf_hook_ops nf_nat_ops[] = {
	/* Before packet filtering, change destination */
	{
		.hook		= nf_nat_in,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_PRE_ROUTING,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= nf_nat_out,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_POST_ROUTING,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
	/* After conntrack, adjust sequence number */
	{
		.hook		= nf_nat_adjust,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_POST_ROUTING,
		.priority	= NF_IP_PRI_NAT_SEQ_ADJUST,
	},
	/* Before packet filtering, change destination */
	{
		.hook		= nf_nat_local_fn,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_LOCAL_OUT,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= nf_nat_fn,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_LOCAL_IN,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
	/* After conntrack, adjust sequence number */
	{
		.hook		= nf_nat_adjust,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_LOCAL_IN,
		.priority	= NF_IP_PRI_NAT_SEQ_ADJUST,
	},
};

static int __init nf_nat_standalone_init(void)
{
	int size, ret = 0;

	need_conntrack();

	size = ALIGN(sizeof(struct nf_conn), __alignof__(struct nf_conn_nat)) +
	       sizeof(struct nf_conn_nat);
	ret = nf_conntrack_register_cache(NF_CT_F_NAT, "nf_nat:base", size);
	if (ret < 0) {
		printk(KERN_ERR "nf_nat_init: Unable to create slab cache\n");
		return ret;
	}

	size = ALIGN(size, __alignof__(struct nf_conn_help)) +
	       sizeof(struct nf_conn_help);
	ret = nf_conntrack_register_cache(NF_CT_F_NAT|NF_CT_F_HELP,
					  "nf_nat:help", size);
	if (ret < 0) {
		printk(KERN_ERR "nf_nat_init: Unable to create slab cache\n");
		goto cleanup_register_cache;
	}
#ifdef CONFIG_XFRM
	BUG_ON(ip_nat_decode_session != NULL);
	ip_nat_decode_session = nat_decode_session;
#endif
	ret = nf_nat_rule_init();
	if (ret < 0) {
		printk("nf_nat_init: can't setup rules.\n");
		goto cleanup_decode_session;
	}
	ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	if (ret < 0) {
		printk("nf_nat_init: can't register hooks.\n");
		goto cleanup_rule_init;
	}
	nf_nat_module_is_loaded = 1;
	return ret;

 cleanup_rule_init:
	nf_nat_rule_cleanup();
 cleanup_decode_session:
#ifdef CONFIG_XFRM
	ip_nat_decode_session = NULL;
	synchronize_net();
#endif
	nf_conntrack_unregister_cache(NF_CT_F_NAT|NF_CT_F_HELP);
 cleanup_register_cache:
	nf_conntrack_unregister_cache(NF_CT_F_NAT);
	return ret;
}

static void __exit nf_nat_standalone_fini(void)
{
	nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	nf_nat_rule_cleanup();
	nf_nat_module_is_loaded = 0;
#ifdef CONFIG_XFRM
	ip_nat_decode_session = NULL;
	synchronize_net();
#endif
	/* Conntrack caches are unregistered in nf_conntrack_cleanup */
}

module_init(nf_nat_standalone_init);
module_exit(nf_nat_standalone_fini);

MODULE_LICENSE("GPL");
MODULE_ALIAS("ip_nat");
Commit	Line	Data
5b1158e9 JK	1	/* (C) 1999-2001 Paul `Rusty' Russell
	2	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8	#include <linux/types.h>
	9	#include <linux/icmp.h>
	10	#include <linux/ip.h>
	11	#include <linux/netfilter.h>
	12	#include <linux/netfilter_ipv4.h>
	13	#include <linux/module.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/proc_fs.h>
	16	#include <net/ip.h>
	17	#include <net/checksum.h>
	18	#include <linux/spinlock.h>
	19
	20	#include <net/netfilter/nf_conntrack.h>
	21	#include <net/netfilter/nf_conntrack_core.h>
	22	#include <net/netfilter/nf_nat.h>
	23	#include <net/netfilter/nf_nat_rule.h>
	24	#include <net/netfilter/nf_nat_protocol.h>
	25	#include <net/netfilter/nf_nat_core.h>
	26	#include <net/netfilter/nf_nat_helper.h>
	27	#include <linux/netfilter_ipv4/ip_tables.h>
	28
	29	#if 0
	30	#define DEBUGP printk
	31	#else
	32	#define DEBUGP(format, args...)
	33	#endif
	34
5b1158e9 JK	35	#ifdef CONFIG_XFRM
	36	static void nat_decode_session(struct sk_buff skb, struct flowi fl)
	37	{
	38	struct nf_conn *ct;
	39	struct nf_conntrack_tuple *t;
	40	enum ip_conntrack_info ctinfo;
	41	enum ip_conntrack_dir dir;
	42	unsigned long statusbit;
	43
	44	ct = nf_ct_get(skb, &ctinfo);
	45	if (ct == NULL)
	46	return;
	47	dir = CTINFO2DIR(ctinfo);
	48	t = &ct->tuplehash[dir].tuple;
	49
	50	if (dir == IP_CT_DIR_ORIGINAL)
	51	statusbit = IPS_DST_NAT;
	52	else
	53	statusbit = IPS_SRC_NAT;
	54
	55	if (ct->status & statusbit) {
	56	fl->fl4_dst = t->dst.u3.ip;
	57	if (t->dst.protonum == IPPROTO_TCP \|\|
	58	t->dst.protonum == IPPROTO_UDP)
	59	fl->fl_ip_dport = t->dst.u.tcp.port;
	60	}
	61
	62	statusbit ^= IPS_NAT_MASK;
	63
	64	if (ct->status & statusbit) {
	65	fl->fl4_src = t->src.u3.ip;
	66	if (t->dst.protonum == IPPROTO_TCP \|\|
	67	t->dst.protonum == IPPROTO_UDP)
	68	fl->fl_ip_sport = t->src.u.tcp.port;
	69	}
	70	}
	71	#endif
	72
	73	static unsigned int
	74	nf_nat_fn(unsigned int hooknum,
	75	struct sk_buff **pskb,
	76	const struct net_device *in,
	77	const struct net_device *out,
	78	int (okfn)(struct sk_buff ))
	79	{
	80	struct nf_conn *ct;
	81	enum ip_conntrack_info ctinfo;
	82	struct nf_conn_nat *nat;
5b1158e9 JK	83	/* maniptype == SRC for postrouting. */
	84	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
	85
	86	/* We never see fragments: conntrack defrags on pre-routing
	87	and local-out, and nf_nat_out protects post-routing. */
eddc9ec5	88	NF_CT_ASSERT(!(ip_hdr(*pskb)->frag_off & htons(IP_MF \| IP_OFFSET)));
5b1158e9 JK	89
	90	ct = nf_ct_get(*pskb, &ctinfo);
	91	/* Can't track? It's not due to stress, or conntrack would
	92	have dropped it. Hence it's the user's responsibilty to
	93	packet filter it out, or implement conntrack/NAT for that
	94	protocol. 8) --RR */
	95	if (!ct) {
	96	/* Exception: ICMP redirect to new connection (not in
e905a9ed YH	97	hash table yet). We must not let this through, in
e905a9ed YH	98	case we're doing NAT to the same network. */
eddc9ec5	99	if (ip_hdr(*pskb)->protocol == IPPROTO_ICMP) {
5b1158e9 JK	100	struct icmphdr _hdr, *hp;
5b1158e9 JK	101
c9bdd4b5	102	hp = skb_header_pointer(pskb, ip_hdrlen(pskb),
5b1158e9 JK	103	sizeof(_hdr), &_hdr);
	104	if (hp != NULL &&
	105	hp->type == ICMP_REDIRECT)
	106	return NF_DROP;
	107	}
	108	return NF_ACCEPT;
	109	}
	110
	111	/* Don't try to NAT if this packet is not conntracked */
	112	if (ct == &nf_conntrack_untracked)
	113	return NF_ACCEPT;
	114
	115	nat = nfct_nat(ct);
	116	if (!nat)
ffed53d2	117	return NF_ACCEPT;
5b1158e9 JK	118
	119	switch (ctinfo) {
	120	case IP_CT_RELATED:
	121	case IP_CT_RELATED+IP_CT_IS_REPLY:
eddc9ec5	122	if (ip_hdr(*pskb)->protocol == IPPROTO_ICMP) {
5b1158e9 JK	123	if (!nf_nat_icmp_reply_translation(ct, ctinfo,
	124	hooknum, pskb))
	125	return NF_DROP;
	126	else
	127	return NF_ACCEPT;
	128	}
	129	/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	130	case IP_CT_NEW:
5b1158e9 JK	131
	132	/* Seen it before? This can happen for loopback, retrans,
	133	or local packets.. */
	134	if (!nf_nat_initialized(ct, maniptype)) {
	135	unsigned int ret;
	136
	137	if (unlikely(nf_ct_is_confirmed(ct)))
	138	/* NAT module was loaded late */
ba4c7cba	139	ret = alloc_null_binding_confirmed(ct, hooknum);
5b1158e9 JK	140	else if (hooknum == NF_IP_LOCAL_IN)
5b1158e9 JK	141	/* LOCAL_IN hook doesn't have a chain! */
ba4c7cba	142	ret = alloc_null_binding(ct, hooknum);
5b1158e9 JK	143	else
5b1158e9 JK	144	ret = nf_nat_rule_find(pskb, hooknum, in, out,
ba4c7cba	145	ct);
5b1158e9 JK	146
	147	if (ret != NF_ACCEPT) {
	148	return ret;
	149	}
	150	} else
	151	DEBUGP("Already setup manip %s for ct %p\n",
	152	maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
	153	ct);
	154	break;
	155
	156	default:
	157	/* ESTABLISHED */
	158	NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED \|\|
	159	ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
5b1158e9 JK	160	}
5b1158e9 JK	161
5b1158e9 JK	162	return nf_nat_packet(ct, ctinfo, hooknum, pskb);
	163	}
	164
	165	static unsigned int
	166	nf_nat_in(unsigned int hooknum,
e905a9ed YH	167	struct sk_buff **pskb,
	168	const struct net_device *in,
	169	const struct net_device *out,
	170	int (okfn)(struct sk_buff ))
5b1158e9 JK	171	{
5b1158e9 JK	172	unsigned int ret;
eddc9ec5	173	__be32 daddr = ip_hdr(*pskb)->daddr;
5b1158e9 JK	174
	175	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
	176	if (ret != NF_DROP && ret != NF_STOLEN &&
eddc9ec5	177	daddr != ip_hdr(*pskb)->daddr) {
5b1158e9 JK	178	dst_release((*pskb)->dst);
	179	(*pskb)->dst = NULL;
	180	}
	181	return ret;
	182	}
	183
	184	static unsigned int
	185	nf_nat_out(unsigned int hooknum,
	186	struct sk_buff **pskb,
	187	const struct net_device *in,
	188	const struct net_device *out,
	189	int (okfn)(struct sk_buff ))
	190	{
	191	#ifdef CONFIG_XFRM
	192	struct nf_conn *ct;
	193	enum ip_conntrack_info ctinfo;
	194	#endif
	195	unsigned int ret;
	196
	197	/* root is playing with raw sockets. */
	198	if ((*pskb)->len < sizeof(struct iphdr) \|\|
c9bdd4b5	199	ip_hdrlen(*pskb) < sizeof(struct iphdr))
5b1158e9 JK	200	return NF_ACCEPT;
	201
	202	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
	203	#ifdef CONFIG_XFRM
	204	if (ret != NF_DROP && ret != NF_STOLEN &&
	205	(ct = nf_ct_get(*pskb, &ctinfo)) != NULL) {
	206	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	207
	208	if (ct->tuplehash[dir].tuple.src.u3.ip !=
	209	ct->tuplehash[!dir].tuple.dst.u3.ip
	210	\|\| ct->tuplehash[dir].tuple.src.u.all !=
	211	ct->tuplehash[!dir].tuple.dst.u.all
	212	)
	213	return ip_xfrm_me_harder(pskb) == 0 ? ret : NF_DROP;
	214	}
	215	#endif
	216	return ret;
	217	}
	218
	219	static unsigned int
	220	nf_nat_local_fn(unsigned int hooknum,
	221	struct sk_buff **pskb,
	222	const struct net_device *in,
	223	const struct net_device *out,
	224	int (okfn)(struct sk_buff ))
	225	{
	226	struct nf_conn *ct;
	227	enum ip_conntrack_info ctinfo;
	228	unsigned int ret;
	229
	230	/* root is playing with raw sockets. */
	231	if ((*pskb)->len < sizeof(struct iphdr) \|\|
c9bdd4b5	232	ip_hdrlen(*pskb) < sizeof(struct iphdr))
5b1158e9 JK	233	return NF_ACCEPT;
	234
	235	ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
	236	if (ret != NF_DROP && ret != NF_STOLEN &&
	237	(ct = nf_ct_get(*pskb, &ctinfo)) != NULL) {
	238	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	239
	240	if (ct->tuplehash[dir].tuple.dst.u3.ip !=
848c29fd	241	ct->tuplehash[!dir].tuple.src.u3.ip) {
5b1158e9 JK	242	if (ip_route_me_harder(pskb, RTN_UNSPEC))
5b1158e9 JK	243	ret = NF_DROP;
848c29fd PM	244	}
	245	#ifdef CONFIG_XFRM
	246	else if (ct->tuplehash[dir].tuple.dst.u.all !=
	247	ct->tuplehash[!dir].tuple.src.u.all)
	248	if (ip_xfrm_me_harder(pskb))
	249	ret = NF_DROP;
	250	#endif
5b1158e9 JK	251	}
	252	return ret;
	253	}
	254
	255	static unsigned int
	256	nf_nat_adjust(unsigned int hooknum,
	257	struct sk_buff **pskb,
	258	const struct net_device *in,
	259	const struct net_device *out,
	260	int (okfn)(struct sk_buff ))
	261	{
	262	struct nf_conn *ct;
	263	enum ip_conntrack_info ctinfo;
	264
	265	ct = nf_ct_get(*pskb, &ctinfo);
	266	if (ct && test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
e905a9ed YH	267	DEBUGP("nf_nat_standalone: adjusting sequence number\n");
	268	if (!nf_nat_seq_adjust(pskb, ct, ctinfo))
	269	return NF_DROP;
5b1158e9 JK	270	}
	271	return NF_ACCEPT;
	272	}
	273
	274	/* We must be after connection tracking and before packet filtering. */
	275
	276	static struct nf_hook_ops nf_nat_ops[] = {
	277	/* Before packet filtering, change destination */
	278	{
	279	.hook = nf_nat_in,
	280	.owner = THIS_MODULE,
	281	.pf = PF_INET,
	282	.hooknum = NF_IP_PRE_ROUTING,
	283	.priority = NF_IP_PRI_NAT_DST,
	284	},
	285	/* After packet filtering, change source */
	286	{
	287	.hook = nf_nat_out,
	288	.owner = THIS_MODULE,
	289	.pf = PF_INET,
	290	.hooknum = NF_IP_POST_ROUTING,
	291	.priority = NF_IP_PRI_NAT_SRC,
	292	},
	293	/* After conntrack, adjust sequence number */
	294	{
	295	.hook = nf_nat_adjust,
	296	.owner = THIS_MODULE,
	297	.pf = PF_INET,
	298	.hooknum = NF_IP_POST_ROUTING,
	299	.priority = NF_IP_PRI_NAT_SEQ_ADJUST,
	300	},
	301	/* Before packet filtering, change destination */
	302	{
	303	.hook = nf_nat_local_fn,
	304	.owner = THIS_MODULE,
	305	.pf = PF_INET,
	306	.hooknum = NF_IP_LOCAL_OUT,
	307	.priority = NF_IP_PRI_NAT_DST,
	308	},
	309	/* After packet filtering, change source */
	310	{
	311	.hook = nf_nat_fn,
	312	.owner = THIS_MODULE,
	313	.pf = PF_INET,
	314	.hooknum = NF_IP_LOCAL_IN,
	315	.priority = NF_IP_PRI_NAT_SRC,
	316	},
	317	/* After conntrack, adjust sequence number */
	318	{
	319	.hook = nf_nat_adjust,
	320	.owner = THIS_MODULE,
	321	.pf = PF_INET,
	322	.hooknum = NF_IP_LOCAL_IN,
	323	.priority = NF_IP_PRI_NAT_SEQ_ADJUST,
	324	},
	325	};
	326
	327	static int __init nf_nat_standalone_init(void)
	328	{
	329	int size, ret = 0;
	330
	331	need_conntrack();
	332
	333	size = ALIGN(sizeof(struct nf_conn), __alignof__(struct nf_conn_nat)) +
334	sizeof(struct nf_conn_nat);
335	ret = nf_conntrack_register_cache(NF_CT_F_NAT, "nf_nat:base", size);
336	if (ret < 0) {
337	printk(KERN_ERR "nf_nat_init: Unable to create slab cache\n");
338	return ret;
339	}
340
341	size = ALIGN(size, __alignof__(struct nf_conn_help)) +
342	sizeof(struct nf_conn_help);
343	ret = nf_conntrack_register_cache(NF_CT_F_NAT\|NF_CT_F_HELP,
344	"nf_nat:help", size);
345	if (ret < 0) {
346	printk(KERN_ERR "nf_nat_init: Unable to create slab cache\n");
347	goto cleanup_register_cache;
348	}
349	#ifdef CONFIG_XFRM
350	BUG_ON(ip_nat_decode_session != NULL);
351	ip_nat_decode_session = nat_decode_session;
352	#endif
353	ret = nf_nat_rule_init();
354	if (ret < 0) {
355	printk("nf_nat_init: can't setup rules.\n");
356	goto cleanup_decode_session;
357	}
358	ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
359	if (ret < 0) {
360	printk("nf_nat_init: can't register hooks.\n");
361	goto cleanup_rule_init;
362	}
363	nf_nat_module_is_loaded = 1;
364	return ret;
365
366	cleanup_rule_init:
367	nf_nat_rule_cleanup();
368	cleanup_decode_session:
369	#ifdef CONFIG_XFRM
370	ip_nat_decode_session = NULL;
371	synchronize_net();
372	#endif
373	nf_conntrack_unregister_cache(NF_CT_F_NAT\|NF_CT_F_HELP);
374	cleanup_register_cache:
375	nf_conntrack_unregister_cache(NF_CT_F_NAT);
376	return ret;
377	}
378
379	static void __exit nf_nat_standalone_fini(void)
380	{
381	nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
382	nf_nat_rule_cleanup();
383	nf_nat_module_is_loaded = 0;
384	#ifdef CONFIG_XFRM
385	ip_nat_decode_session = NULL;
386	synchronize_net();
387	#endif
388	/* Conntrack caches are unregistered in nf_conntrack_cleanup */
389	}
390
391	module_init(nf_nat_standalone_init);
392	module_exit(nf_nat_standalone_fini);
393
394	MODULE_LICENSE("GPL");
395	MODULE_ALIAS("ip_nat");