netfilter: add protocol independent NAT core
Convert the IPv4 NAT implementation to a protocol independent core and address family specific modules. Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Patrick McHardy
committed by
Pablo Neira Ayuso
Pablo Neira Ayuso
parent
051966c0c6
commit
c7232c9979
@@ -43,7 +43,7 @@ struct nf_conntrack_expect {
|
||||
unsigned int class;
|
||||
|
||||
#ifdef CONFIG_NF_NAT_NEEDED
|
||||
__be32 saved_ip;
|
||||
union nf_inet_addr saved_addr;
|
||||
/* This is the original per-proto part, used to map the
|
||||
* expected connection the way the recipient expects. */
|
||||
union nf_conntrack_man_proto saved_proto;
|
||||
|
||||
@@ -50,7 +50,7 @@ struct nf_conn_nat {
|
||||
|
||||
/* Set up the info structure to map into this range. */
|
||||
extern unsigned int nf_nat_setup_info(struct nf_conn *ct,
|
||||
const struct nf_nat_ipv4_range *range,
|
||||
const struct nf_nat_range *range,
|
||||
enum nf_nat_manip_type maniptype);
|
||||
|
||||
/* Is this tuple already taken? (not by us)*/
|
||||
|
||||
@@ -12,10 +12,7 @@ extern unsigned int nf_nat_packet(struct nf_conn *ct,
|
||||
unsigned int hooknum,
|
||||
struct sk_buff *skb);
|
||||
|
||||
extern int nf_nat_icmp_reply_translation(struct nf_conn *ct,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
unsigned int hooknum,
|
||||
struct sk_buff *skb);
|
||||
extern int nf_xfrm_me_harder(struct sk_buff *skb, unsigned int family);
|
||||
|
||||
static inline int nf_nat_initialized(struct nf_conn *ct,
|
||||
enum nf_nat_manip_type manip)
|
||||
|
||||
47
include/net/netfilter/nf_nat_l3proto.h
Normal file
47
include/net/netfilter/nf_nat_l3proto.h
Normal file
@@ -0,0 +1,47 @@
|
||||
#ifndef _NF_NAT_L3PROTO_H
|
||||
#define _NF_NAT_L3PROTO_H
|
||||
|
||||
struct nf_nat_l4proto;
|
||||
struct nf_nat_l3proto {
|
||||
u8 l3proto;
|
||||
|
||||
bool (*in_range)(const struct nf_conntrack_tuple *t,
|
||||
const struct nf_nat_range *range);
|
||||
|
||||
u32 (*secure_port)(const struct nf_conntrack_tuple *t, __be16);
|
||||
|
||||
bool (*manip_pkt)(struct sk_buff *skb,
|
||||
unsigned int iphdroff,
|
||||
const struct nf_nat_l4proto *l4proto,
|
||||
const struct nf_conntrack_tuple *target,
|
||||
enum nf_nat_manip_type maniptype);
|
||||
|
||||
void (*csum_update)(struct sk_buff *skb, unsigned int iphdroff,
|
||||
__sum16 *check,
|
||||
const struct nf_conntrack_tuple *t,
|
||||
enum nf_nat_manip_type maniptype);
|
||||
|
||||
void (*csum_recalc)(struct sk_buff *skb, u8 proto,
|
||||
void *data, __sum16 *check,
|
||||
int datalen, int oldlen);
|
||||
|
||||
void (*decode_session)(struct sk_buff *skb,
|
||||
const struct nf_conn *ct,
|
||||
enum ip_conntrack_dir dir,
|
||||
unsigned long statusbit,
|
||||
struct flowi *fl);
|
||||
|
||||
int (*nlattr_to_range)(struct nlattr *tb[],
|
||||
struct nf_nat_range *range);
|
||||
};
|
||||
|
||||
extern int nf_nat_l3proto_register(const struct nf_nat_l3proto *);
|
||||
extern void nf_nat_l3proto_unregister(const struct nf_nat_l3proto *);
|
||||
extern const struct nf_nat_l3proto *__nf_nat_l3proto_find(u8 l3proto);
|
||||
|
||||
extern int nf_nat_icmp_reply_translation(struct sk_buff *skb,
|
||||
struct nf_conn *ct,
|
||||
enum ip_conntrack_info ctinfo,
|
||||
unsigned int hooknum);
|
||||
|
||||
#endif /* _NF_NAT_L3PROTO_H */
|
||||
71
include/net/netfilter/nf_nat_l4proto.h
Normal file
71
include/net/netfilter/nf_nat_l4proto.h
Normal file
@@ -0,0 +1,71 @@
|
||||
/* Header for use in defining a given protocol. */
|
||||
#ifndef _NF_NAT_L4PROTO_H
|
||||
#define _NF_NAT_L4PROTO_H
|
||||
#include <net/netfilter/nf_nat.h>
|
||||
#include <linux/netfilter/nfnetlink_conntrack.h>
|
||||
|
||||
struct nf_nat_range;
|
||||
struct nf_nat_l3proto;
|
||||
|
||||
struct nf_nat_l4proto {
|
||||
/* Protocol number. */
|
||||
u8 l4proto;
|
||||
|
||||
/* Translate a packet to the target according to manip type.
|
||||
* Return true if succeeded.
|
||||
*/
|
||||
bool (*manip_pkt)(struct sk_buff *skb,
|
||||
const struct nf_nat_l3proto *l3proto,
|
||||
unsigned int iphdroff, unsigned int hdroff,
|
||||
const struct nf_conntrack_tuple *tuple,
|
||||
enum nf_nat_manip_type maniptype);
|
||||
|
||||
/* Is the manipable part of the tuple between min and max incl? */
|
||||
bool (*in_range)(const struct nf_conntrack_tuple *tuple,
|
||||
enum nf_nat_manip_type maniptype,
|
||||
const union nf_conntrack_man_proto *min,
|
||||
const union nf_conntrack_man_proto *max);
|
||||
|
||||
/* Alter the per-proto part of the tuple (depending on
|
||||
* maniptype), to give a unique tuple in the given range if
|
||||
* possible. Per-protocol part of tuple is initialized to the
|
||||
* incoming packet.
|
||||
*/
|
||||
void (*unique_tuple)(const struct nf_nat_l3proto *l3proto,
|
||||
struct nf_conntrack_tuple *tuple,
|
||||
const struct nf_nat_range *range,
|
||||
enum nf_nat_manip_type maniptype,
|
||||
const struct nf_conn *ct);
|
||||
|
||||
int (*nlattr_to_range)(struct nlattr *tb[],
|
||||
struct nf_nat_range *range);
|
||||
};
|
||||
|
||||
/* Protocol registration. */
|
||||
extern int nf_nat_l4proto_register(u8 l3proto, const struct nf_nat_l4proto *l4proto);
|
||||
extern void nf_nat_l4proto_unregister(u8 l3proto, const struct nf_nat_l4proto *l4proto);
|
||||
|
||||
extern const struct nf_nat_l4proto *__nf_nat_l4proto_find(u8 l3proto, u8 l4proto);
|
||||
|
||||
/* Built-in protocols. */
|
||||
extern const struct nf_nat_l4proto nf_nat_l4proto_tcp;
|
||||
extern const struct nf_nat_l4proto nf_nat_l4proto_udp;
|
||||
extern const struct nf_nat_l4proto nf_nat_l4proto_icmp;
|
||||
extern const struct nf_nat_l4proto nf_nat_l4proto_unknown;
|
||||
|
||||
extern bool nf_nat_l4proto_in_range(const struct nf_conntrack_tuple *tuple,
|
||||
enum nf_nat_manip_type maniptype,
|
||||
const union nf_conntrack_man_proto *min,
|
||||
const union nf_conntrack_man_proto *max);
|
||||
|
||||
extern void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
|
||||
struct nf_conntrack_tuple *tuple,
|
||||
const struct nf_nat_range *range,
|
||||
enum nf_nat_manip_type maniptype,
|
||||
const struct nf_conn *ct,
|
||||
u16 *rover);
|
||||
|
||||
extern int nf_nat_l4proto_nlattr_to_range(struct nlattr *tb[],
|
||||
struct nf_nat_range *range);
|
||||
|
||||
#endif /*_NF_NAT_L4PROTO_H*/
|
||||
@@ -1,67 +0,0 @@
|
||||
/* Header for use in defining a given protocol. */
|
||||
#ifndef _NF_NAT_PROTOCOL_H
|
||||
#define _NF_NAT_PROTOCOL_H
|
||||
#include <net/netfilter/nf_nat.h>
|
||||
#include <linux/netfilter/nfnetlink_conntrack.h>
|
||||
|
||||
struct nf_nat_ipv4_range;
|
||||
|
||||
struct nf_nat_protocol {
|
||||
/* Protocol number. */
|
||||
unsigned int protonum;
|
||||
|
||||
/* Translate a packet to the target according to manip type.
|
||||
Return true if succeeded. */
|
||||
bool (*manip_pkt)(struct sk_buff *skb,
|
||||
unsigned int iphdroff,
|
||||
const struct nf_conntrack_tuple *tuple,
|
||||
enum nf_nat_manip_type maniptype);
|
||||
|
||||
/* Is the manipable part of the tuple between min and max incl? */
|
||||
bool (*in_range)(const struct nf_conntrack_tuple *tuple,
|
||||
enum nf_nat_manip_type maniptype,
|
||||
const union nf_conntrack_man_proto *min,
|
||||
const union nf_conntrack_man_proto *max);
|
||||
|
||||
/* Alter the per-proto part of the tuple (depending on
|
||||
maniptype), to give a unique tuple in the given range if
|
||||
possible. Per-protocol part of tuple is initialized to the
|
||||
incoming packet. */
|
||||
void (*unique_tuple)(struct nf_conntrack_tuple *tuple,
|
||||
const struct nf_nat_ipv4_range *range,
|
||||
enum nf_nat_manip_type maniptype,
|
||||
const struct nf_conn *ct);
|
||||
|
||||
int (*nlattr_to_range)(struct nlattr *tb[],
|
||||
struct nf_nat_ipv4_range *range);
|
||||
};
|
||||
|
||||
/* Protocol registration. */
|
||||
extern int nf_nat_protocol_register(const struct nf_nat_protocol *proto);
|
||||
extern void nf_nat_protocol_unregister(const struct nf_nat_protocol *proto);
|
||||
|
||||
/* Built-in protocols. */
|
||||
extern const struct nf_nat_protocol nf_nat_protocol_tcp;
|
||||
extern const struct nf_nat_protocol nf_nat_protocol_udp;
|
||||
extern const struct nf_nat_protocol nf_nat_protocol_icmp;
|
||||
extern const struct nf_nat_protocol nf_nat_unknown_protocol;
|
||||
|
||||
extern int init_protocols(void) __init;
|
||||
extern void cleanup_protocols(void);
|
||||
extern const struct nf_nat_protocol *find_nat_proto(u_int16_t protonum);
|
||||
|
||||
extern bool nf_nat_proto_in_range(const struct nf_conntrack_tuple *tuple,
|
||||
enum nf_nat_manip_type maniptype,
|
||||
const union nf_conntrack_man_proto *min,
|
||||
const union nf_conntrack_man_proto *max);
|
||||
|
||||
extern void nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
|
||||
const struct nf_nat_ipv4_range *range,
|
||||
enum nf_nat_manip_type maniptype,
|
||||
const struct nf_conn *ct,
|
||||
u_int16_t *rover);
|
||||
|
||||
extern int nf_nat_proto_nlattr_to_range(struct nlattr *tb[],
|
||||
struct nf_nat_ipv4_range *range);
|
||||
|
||||
#endif /*_NF_NAT_PROTO_H*/
|
||||
@@ -1,15 +0,0 @@
|
||||
#ifndef _NF_NAT_RULE_H
|
||||
#define _NF_NAT_RULE_H
|
||||
#include <net/netfilter/nf_conntrack.h>
|
||||
#include <net/netfilter/nf_nat.h>
|
||||
#include <linux/netfilter_ipv4/ip_tables.h>
|
||||
|
||||
extern int nf_nat_rule_init(void) __init;
|
||||
extern void nf_nat_rule_cleanup(void);
|
||||
extern int nf_nat_rule_find(struct sk_buff *skb,
|
||||
unsigned int hooknum,
|
||||
const struct net_device *in,
|
||||
const struct net_device *out,
|
||||
struct nf_conn *ct);
|
||||
|
||||
#endif /* _NF_NAT_RULE_H */
|
||||
Reference in New Issue
Block a user