1 // SPDX-License-Identifier: GPL-2.0-only
2 /* (C) 1999-2001 Paul `Rusty' Russell
3 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
6 #include <linux/types.h>
7 #include <linux/export.h>
8 #include <linux/init.h>
10 #include <linux/tcp.h>
11 #include <linux/icmp.h>
12 #include <linux/icmpv6.h>
14 #include <linux/dccp.h>
15 #include <linux/sctp.h>
16 #include <net/sctp/checksum.h>
18 #include <linux/netfilter.h>
19 #include <net/netfilter/nf_nat.h>
21 #include <linux/ipv6.h>
22 #include <linux/netfilter_ipv6.h>
23 #include <net/checksum.h>
24 #include <net/ip6_checksum.h>
25 #include <net/ip6_route.h>
29 #include <net/netfilter/nf_conntrack_core.h>
30 #include <net/netfilter/nf_conntrack.h>
31 #include <linux/netfilter/nfnetlink_conntrack.h>
33 static void nf_csum_update(struct sk_buff *skb,
34 unsigned int iphdroff, __sum16 *check,
35 const struct nf_conntrack_tuple *t,
36 enum nf_nat_manip_type maniptype);
39 __udp_manip_pkt(struct sk_buff *skb,
40 unsigned int iphdroff, struct udphdr *hdr,
41 const struct nf_conntrack_tuple *tuple,
42 enum nf_nat_manip_type maniptype, bool do_csum)
44 __be16 *portptr, newport;
46 if (maniptype == NF_NAT_MANIP_SRC) {
47 /* Get rid of src port */
48 newport = tuple->src.u.udp.port;
49 portptr = &hdr->source;
51 /* Get rid of dst port */
52 newport = tuple->dst.u.udp.port;
56 nf_csum_update(skb, iphdroff, &hdr->check, tuple, maniptype);
57 inet_proto_csum_replace2(&hdr->check, skb, *portptr, newport,
60 hdr->check = CSUM_MANGLED_0;
65 static bool udp_manip_pkt(struct sk_buff *skb,
66 unsigned int iphdroff, unsigned int hdroff,
67 const struct nf_conntrack_tuple *tuple,
68 enum nf_nat_manip_type maniptype)
73 if (skb_ensure_writable(skb, hdroff + sizeof(*hdr)))
76 hdr = (struct udphdr *)(skb->data + hdroff);
77 do_csum = hdr->check || skb->ip_summed == CHECKSUM_PARTIAL;
79 __udp_manip_pkt(skb, iphdroff, hdr, tuple, maniptype, do_csum);
83 static bool udplite_manip_pkt(struct sk_buff *skb,
84 unsigned int iphdroff, unsigned int hdroff,
85 const struct nf_conntrack_tuple *tuple,
86 enum nf_nat_manip_type maniptype)
88 #ifdef CONFIG_NF_CT_PROTO_UDPLITE
91 if (skb_ensure_writable(skb, hdroff + sizeof(*hdr)))
94 hdr = (struct udphdr *)(skb->data + hdroff);
95 __udp_manip_pkt(skb, iphdroff, hdr, tuple, maniptype, true);
101 sctp_manip_pkt(struct sk_buff *skb,
102 unsigned int iphdroff, unsigned int hdroff,
103 const struct nf_conntrack_tuple *tuple,
104 enum nf_nat_manip_type maniptype)
106 #ifdef CONFIG_NF_CT_PROTO_SCTP
110 /* This could be an inner header returned in imcp packet; in such
111 * cases we cannot update the checksum field since it is outside
112 * of the 8 bytes of transport layer headers we are guaranteed.
114 if (skb->len >= hdroff + sizeof(*hdr))
115 hdrsize = sizeof(*hdr);
117 if (skb_ensure_writable(skb, hdroff + hdrsize))
120 hdr = (struct sctphdr *)(skb->data + hdroff);
122 if (maniptype == NF_NAT_MANIP_SRC) {
123 /* Get rid of src port */
124 hdr->source = tuple->src.u.sctp.port;
126 /* Get rid of dst port */
127 hdr->dest = tuple->dst.u.sctp.port;
130 if (hdrsize < sizeof(*hdr))
133 if (skb->ip_summed != CHECKSUM_PARTIAL) {
134 hdr->checksum = sctp_compute_cksum(skb, hdroff);
135 skb->ip_summed = CHECKSUM_NONE;
143 tcp_manip_pkt(struct sk_buff *skb,
144 unsigned int iphdroff, unsigned int hdroff,
145 const struct nf_conntrack_tuple *tuple,
146 enum nf_nat_manip_type maniptype)
149 __be16 *portptr, newport, oldport;
150 int hdrsize = 8; /* TCP connection tracking guarantees this much */
152 /* this could be a inner header returned in icmp packet; in such
153 cases we cannot update the checksum field since it is outside of
154 the 8 bytes of transport layer headers we are guaranteed */
155 if (skb->len >= hdroff + sizeof(struct tcphdr))
156 hdrsize = sizeof(struct tcphdr);
158 if (skb_ensure_writable(skb, hdroff + hdrsize))
161 hdr = (struct tcphdr *)(skb->data + hdroff);
163 if (maniptype == NF_NAT_MANIP_SRC) {
164 /* Get rid of src port */
165 newport = tuple->src.u.tcp.port;
166 portptr = &hdr->source;
168 /* Get rid of dst port */
169 newport = tuple->dst.u.tcp.port;
170 portptr = &hdr->dest;
176 if (hdrsize < sizeof(*hdr))
179 nf_csum_update(skb, iphdroff, &hdr->check, tuple, maniptype);
180 inet_proto_csum_replace2(&hdr->check, skb, oldport, newport, false);
185 dccp_manip_pkt(struct sk_buff *skb,
186 unsigned int iphdroff, unsigned int hdroff,
187 const struct nf_conntrack_tuple *tuple,
188 enum nf_nat_manip_type maniptype)
190 #ifdef CONFIG_NF_CT_PROTO_DCCP
191 struct dccp_hdr *hdr;
192 __be16 *portptr, oldport, newport;
193 int hdrsize = 8; /* DCCP connection tracking guarantees this much */
195 if (skb->len >= hdroff + sizeof(struct dccp_hdr))
196 hdrsize = sizeof(struct dccp_hdr);
198 if (skb_ensure_writable(skb, hdroff + hdrsize))
201 hdr = (struct dccp_hdr *)(skb->data + hdroff);
203 if (maniptype == NF_NAT_MANIP_SRC) {
204 newport = tuple->src.u.dccp.port;
205 portptr = &hdr->dccph_sport;
207 newport = tuple->dst.u.dccp.port;
208 portptr = &hdr->dccph_dport;
214 if (hdrsize < sizeof(*hdr))
217 nf_csum_update(skb, iphdroff, &hdr->dccph_checksum, tuple, maniptype);
218 inet_proto_csum_replace2(&hdr->dccph_checksum, skb, oldport, newport,
225 icmp_manip_pkt(struct sk_buff *skb,
226 unsigned int iphdroff, unsigned int hdroff,
227 const struct nf_conntrack_tuple *tuple,
228 enum nf_nat_manip_type maniptype)
232 if (skb_ensure_writable(skb, hdroff + sizeof(*hdr)))
235 hdr = (struct icmphdr *)(skb->data + hdroff);
236 inet_proto_csum_replace2(&hdr->checksum, skb,
237 hdr->un.echo.id, tuple->src.u.icmp.id, false);
238 hdr->un.echo.id = tuple->src.u.icmp.id;
243 icmpv6_manip_pkt(struct sk_buff *skb,
244 unsigned int iphdroff, unsigned int hdroff,
245 const struct nf_conntrack_tuple *tuple,
246 enum nf_nat_manip_type maniptype)
248 struct icmp6hdr *hdr;
250 if (skb_ensure_writable(skb, hdroff + sizeof(*hdr)))
253 hdr = (struct icmp6hdr *)(skb->data + hdroff);
254 nf_csum_update(skb, iphdroff, &hdr->icmp6_cksum, tuple, maniptype);
255 if (hdr->icmp6_type == ICMPV6_ECHO_REQUEST ||
256 hdr->icmp6_type == ICMPV6_ECHO_REPLY) {
257 inet_proto_csum_replace2(&hdr->icmp6_cksum, skb,
258 hdr->icmp6_identifier,
259 tuple->src.u.icmp.id, false);
260 hdr->icmp6_identifier = tuple->src.u.icmp.id;
265 /* manipulate a GRE packet according to maniptype */
267 gre_manip_pkt(struct sk_buff *skb,
268 unsigned int iphdroff, unsigned int hdroff,
269 const struct nf_conntrack_tuple *tuple,
270 enum nf_nat_manip_type maniptype)
272 #if IS_ENABLED(CONFIG_NF_CT_PROTO_GRE)
273 const struct gre_base_hdr *greh;
274 struct pptp_gre_header *pgreh;
276 /* pgreh includes two optional 32bit fields which are not required
277 * to be there. That's where the magic '8' comes from */
278 if (skb_ensure_writable(skb, hdroff + sizeof(*pgreh) - 8))
281 greh = (void *)skb->data + hdroff;
282 pgreh = (struct pptp_gre_header *)greh;
284 /* we only have destination manip of a packet, since 'source key'
285 * is not present in the packet itself */
286 if (maniptype != NF_NAT_MANIP_DST)
289 switch (greh->flags & GRE_VERSION) {
291 /* We do not currently NAT any GREv0 packets.
292 * Try to behave like "nf_nat_proto_unknown" */
295 pr_debug("call_id -> 0x%04x\n", ntohs(tuple->dst.u.gre.key));
296 pgreh->call_id = tuple->dst.u.gre.key;
299 pr_debug("can't nat unknown GRE version\n");
306 static bool l4proto_manip_pkt(struct sk_buff *skb,
307 unsigned int iphdroff, unsigned int hdroff,
308 const struct nf_conntrack_tuple *tuple,
309 enum nf_nat_manip_type maniptype)
311 switch (tuple->dst.protonum) {
313 return tcp_manip_pkt(skb, iphdroff, hdroff,
316 return udp_manip_pkt(skb, iphdroff, hdroff,
318 case IPPROTO_UDPLITE:
319 return udplite_manip_pkt(skb, iphdroff, hdroff,
322 return sctp_manip_pkt(skb, iphdroff, hdroff,
325 return icmp_manip_pkt(skb, iphdroff, hdroff,
328 return icmpv6_manip_pkt(skb, iphdroff, hdroff,
331 return dccp_manip_pkt(skb, iphdroff, hdroff,
334 return gre_manip_pkt(skb, iphdroff, hdroff,
338 /* If we don't know protocol -- no error, pass it unmodified. */
342 static bool nf_nat_ipv4_manip_pkt(struct sk_buff *skb,
343 unsigned int iphdroff,
344 const struct nf_conntrack_tuple *target,
345 enum nf_nat_manip_type maniptype)
350 if (skb_ensure_writable(skb, iphdroff + sizeof(*iph)))
353 iph = (void *)skb->data + iphdroff;
354 hdroff = iphdroff + iph->ihl * 4;
356 if (!l4proto_manip_pkt(skb, iphdroff, hdroff, target, maniptype))
358 iph = (void *)skb->data + iphdroff;
360 if (maniptype == NF_NAT_MANIP_SRC) {
361 csum_replace4(&iph->check, iph->saddr, target->src.u3.ip);
362 iph->saddr = target->src.u3.ip;
364 csum_replace4(&iph->check, iph->daddr, target->dst.u3.ip);
365 iph->daddr = target->dst.u3.ip;
370 static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb,
371 unsigned int iphdroff,
372 const struct nf_conntrack_tuple *target,
373 enum nf_nat_manip_type maniptype)
375 #if IS_ENABLED(CONFIG_IPV6)
376 struct ipv6hdr *ipv6h;
381 if (skb_ensure_writable(skb, iphdroff + sizeof(*ipv6h)))
384 ipv6h = (void *)skb->data + iphdroff;
385 nexthdr = ipv6h->nexthdr;
386 hdroff = ipv6_skip_exthdr(skb, iphdroff + sizeof(*ipv6h),
387 &nexthdr, &frag_off);
391 if ((frag_off & htons(~0x7)) == 0 &&
392 !l4proto_manip_pkt(skb, iphdroff, hdroff, target, maniptype))
395 /* must reload, offset might have changed */
396 ipv6h = (void *)skb->data + iphdroff;
399 if (maniptype == NF_NAT_MANIP_SRC)
400 ipv6h->saddr = target->src.u3.in6;
402 ipv6h->daddr = target->dst.u3.in6;
408 unsigned int nf_nat_manip_pkt(struct sk_buff *skb, struct nf_conn *ct,
409 enum nf_nat_manip_type mtype,
410 enum ip_conntrack_dir dir)
412 struct nf_conntrack_tuple target;
414 /* We are aiming to look like inverse of other direction. */
415 nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple);
417 switch (target.src.l3num) {
419 if (nf_nat_ipv6_manip_pkt(skb, 0, &target, mtype))
423 if (nf_nat_ipv4_manip_pkt(skb, 0, &target, mtype))
434 static void nf_nat_ipv4_csum_update(struct sk_buff *skb,
435 unsigned int iphdroff, __sum16 *check,
436 const struct nf_conntrack_tuple *t,
437 enum nf_nat_manip_type maniptype)
439 struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
442 if (maniptype == NF_NAT_MANIP_SRC) {
444 newip = t->src.u3.ip;
447 newip = t->dst.u3.ip;
449 inet_proto_csum_replace4(check, skb, oldip, newip, true);
452 static void nf_nat_ipv6_csum_update(struct sk_buff *skb,
453 unsigned int iphdroff, __sum16 *check,
454 const struct nf_conntrack_tuple *t,
455 enum nf_nat_manip_type maniptype)
457 #if IS_ENABLED(CONFIG_IPV6)
458 const struct ipv6hdr *ipv6h = (struct ipv6hdr *)(skb->data + iphdroff);
459 const struct in6_addr *oldip, *newip;
461 if (maniptype == NF_NAT_MANIP_SRC) {
462 oldip = &ipv6h->saddr;
463 newip = &t->src.u3.in6;
465 oldip = &ipv6h->daddr;
466 newip = &t->dst.u3.in6;
468 inet_proto_csum_replace16(check, skb, oldip->s6_addr32,
469 newip->s6_addr32, true);
473 static void nf_csum_update(struct sk_buff *skb,
474 unsigned int iphdroff, __sum16 *check,
475 const struct nf_conntrack_tuple *t,
476 enum nf_nat_manip_type maniptype)
478 switch (t->src.l3num) {
480 nf_nat_ipv4_csum_update(skb, iphdroff, check, t, maniptype);
483 nf_nat_ipv6_csum_update(skb, iphdroff, check, t, maniptype);
488 static void nf_nat_ipv4_csum_recalc(struct sk_buff *skb,
489 u8 proto, void *data, __sum16 *check,
490 int datalen, int oldlen)
492 if (skb->ip_summed != CHECKSUM_PARTIAL) {
493 const struct iphdr *iph = ip_hdr(skb);
495 skb->ip_summed = CHECKSUM_PARTIAL;
496 skb->csum_start = skb_headroom(skb) + skb_network_offset(skb) +
498 skb->csum_offset = (void *)check - data;
499 *check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, datalen,
502 inet_proto_csum_replace2(check, skb,
503 htons(oldlen), htons(datalen), true);
507 #if IS_ENABLED(CONFIG_IPV6)
508 static void nf_nat_ipv6_csum_recalc(struct sk_buff *skb,
509 u8 proto, void *data, __sum16 *check,
510 int datalen, int oldlen)
512 if (skb->ip_summed != CHECKSUM_PARTIAL) {
513 const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
515 skb->ip_summed = CHECKSUM_PARTIAL;
516 skb->csum_start = skb_headroom(skb) + skb_network_offset(skb) +
517 (data - (void *)skb->data);
518 skb->csum_offset = (void *)check - data;
519 *check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
522 inet_proto_csum_replace2(check, skb,
523 htons(oldlen), htons(datalen), true);
528 void nf_nat_csum_recalc(struct sk_buff *skb,
529 u8 nfproto, u8 proto, void *data, __sum16 *check,
530 int datalen, int oldlen)
534 nf_nat_ipv4_csum_recalc(skb, proto, data, check,
537 #if IS_ENABLED(CONFIG_IPV6)
539 nf_nat_ipv6_csum_recalc(skb, proto, data, check,
548 int nf_nat_icmp_reply_translation(struct sk_buff *skb,
550 enum ip_conntrack_info ctinfo,
551 unsigned int hooknum)
557 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
558 enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
559 unsigned int hdrlen = ip_hdrlen(skb);
560 struct nf_conntrack_tuple target;
561 unsigned long statusbit;
563 WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY);
565 if (skb_ensure_writable(skb, hdrlen + sizeof(*inside)))
567 if (nf_ip_checksum(skb, hooknum, hdrlen, IPPROTO_ICMP))
570 inside = (void *)skb->data + hdrlen;
571 if (inside->icmp.type == ICMP_REDIRECT) {
572 if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
574 if (ct->status & IPS_NAT_MASK)
578 if (manip == NF_NAT_MANIP_SRC)
579 statusbit = IPS_SRC_NAT;
581 statusbit = IPS_DST_NAT;
583 /* Invert if this is reply direction */
584 if (dir == IP_CT_DIR_REPLY)
585 statusbit ^= IPS_NAT_MASK;
587 if (!(ct->status & statusbit))
590 if (!nf_nat_ipv4_manip_pkt(skb, hdrlen + sizeof(inside->icmp),
591 &ct->tuplehash[!dir].tuple, !manip))
594 if (skb->ip_summed != CHECKSUM_PARTIAL) {
595 /* Reloading "inside" here since manip_pkt may reallocate */
596 inside = (void *)skb->data + hdrlen;
597 inside->icmp.checksum = 0;
598 inside->icmp.checksum =
599 csum_fold(skb_checksum(skb, hdrlen,
600 skb->len - hdrlen, 0));
603 /* Change outer to look like the reply to an incoming packet */
604 nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple);
605 target.dst.protonum = IPPROTO_ICMP;
606 if (!nf_nat_ipv4_manip_pkt(skb, 0, &target, manip))
611 EXPORT_SYMBOL_GPL(nf_nat_icmp_reply_translation);
614 nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
615 const struct nf_hook_state *state)
618 enum ip_conntrack_info ctinfo;
620 ct = nf_ct_get(skb, &ctinfo);
624 if (ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY) {
625 if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
626 if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
634 return nf_nat_inet_fn(priv, skb, state);
638 nf_nat_ipv4_in(void *priv, struct sk_buff *skb,
639 const struct nf_hook_state *state)
642 __be32 daddr = ip_hdr(skb)->daddr;
644 ret = nf_nat_ipv4_fn(priv, skb, state);
645 if (ret == NF_ACCEPT && daddr != ip_hdr(skb)->daddr)
652 nf_nat_ipv4_out(void *priv, struct sk_buff *skb,
653 const struct nf_hook_state *state)
656 const struct nf_conn *ct;
657 enum ip_conntrack_info ctinfo;
662 ret = nf_nat_ipv4_fn(priv, skb, state);
664 if (ret != NF_ACCEPT)
667 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
670 ct = nf_ct_get(skb, &ctinfo);
672 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
674 if (ct->tuplehash[dir].tuple.src.u3.ip !=
675 ct->tuplehash[!dir].tuple.dst.u3.ip ||
676 (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
677 ct->tuplehash[dir].tuple.src.u.all !=
678 ct->tuplehash[!dir].tuple.dst.u.all)) {
679 err = nf_xfrm_me_harder(state->net, skb, AF_INET);
681 ret = NF_DROP_ERR(err);
689 nf_nat_ipv4_local_fn(void *priv, struct sk_buff *skb,
690 const struct nf_hook_state *state)
692 const struct nf_conn *ct;
693 enum ip_conntrack_info ctinfo;
697 ret = nf_nat_ipv4_fn(priv, skb, state);
698 if (ret != NF_ACCEPT)
701 ct = nf_ct_get(skb, &ctinfo);
703 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
705 if (ct->tuplehash[dir].tuple.dst.u3.ip !=
706 ct->tuplehash[!dir].tuple.src.u3.ip) {
707 err = ip_route_me_harder(state->net, skb, RTN_UNSPEC);
709 ret = NF_DROP_ERR(err);
712 else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
713 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
714 ct->tuplehash[dir].tuple.dst.u.all !=
715 ct->tuplehash[!dir].tuple.src.u.all) {
716 err = nf_xfrm_me_harder(state->net, skb, AF_INET);
718 ret = NF_DROP_ERR(err);
725 const struct nf_hook_ops nf_nat_ipv4_ops[] = {
726 /* Before packet filtering, change destination */
728 .hook = nf_nat_ipv4_in,
730 .hooknum = NF_INET_PRE_ROUTING,
731 .priority = NF_IP_PRI_NAT_DST,
733 /* After packet filtering, change source */
735 .hook = nf_nat_ipv4_out,
737 .hooknum = NF_INET_POST_ROUTING,
738 .priority = NF_IP_PRI_NAT_SRC,
740 /* Before packet filtering, change destination */
742 .hook = nf_nat_ipv4_local_fn,
744 .hooknum = NF_INET_LOCAL_OUT,
745 .priority = NF_IP_PRI_NAT_DST,
747 /* After packet filtering, change source */
749 .hook = nf_nat_ipv4_fn,
751 .hooknum = NF_INET_LOCAL_IN,
752 .priority = NF_IP_PRI_NAT_SRC,
756 int nf_nat_ipv4_register_fn(struct net *net, const struct nf_hook_ops *ops)
758 return nf_nat_register_fn(net, ops->pf, ops, nf_nat_ipv4_ops,
759 ARRAY_SIZE(nf_nat_ipv4_ops));
761 EXPORT_SYMBOL_GPL(nf_nat_ipv4_register_fn);
763 void nf_nat_ipv4_unregister_fn(struct net *net, const struct nf_hook_ops *ops)
765 nf_nat_unregister_fn(net, ops->pf, ops, ARRAY_SIZE(nf_nat_ipv4_ops));
767 EXPORT_SYMBOL_GPL(nf_nat_ipv4_unregister_fn);
769 #if IS_ENABLED(CONFIG_IPV6)
770 int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
772 enum ip_conntrack_info ctinfo,
773 unsigned int hooknum,
777 struct icmp6hdr icmp6;
780 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
781 enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
782 struct nf_conntrack_tuple target;
783 unsigned long statusbit;
785 WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY);
787 if (skb_ensure_writable(skb, hdrlen + sizeof(*inside)))
789 if (nf_ip6_checksum(skb, hooknum, hdrlen, IPPROTO_ICMPV6))
792 inside = (void *)skb->data + hdrlen;
793 if (inside->icmp6.icmp6_type == NDISC_REDIRECT) {
794 if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
796 if (ct->status & IPS_NAT_MASK)
800 if (manip == NF_NAT_MANIP_SRC)
801 statusbit = IPS_SRC_NAT;
803 statusbit = IPS_DST_NAT;
805 /* Invert if this is reply direction */
806 if (dir == IP_CT_DIR_REPLY)
807 statusbit ^= IPS_NAT_MASK;
809 if (!(ct->status & statusbit))
812 if (!nf_nat_ipv6_manip_pkt(skb, hdrlen + sizeof(inside->icmp6),
813 &ct->tuplehash[!dir].tuple, !manip))
816 if (skb->ip_summed != CHECKSUM_PARTIAL) {
817 struct ipv6hdr *ipv6h = ipv6_hdr(skb);
819 inside = (void *)skb->data + hdrlen;
820 inside->icmp6.icmp6_cksum = 0;
821 inside->icmp6.icmp6_cksum =
822 csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
823 skb->len - hdrlen, IPPROTO_ICMPV6,
824 skb_checksum(skb, hdrlen,
825 skb->len - hdrlen, 0));
828 nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple);
829 target.dst.protonum = IPPROTO_ICMPV6;
830 if (!nf_nat_ipv6_manip_pkt(skb, 0, &target, manip))
835 EXPORT_SYMBOL_GPL(nf_nat_icmpv6_reply_translation);
838 nf_nat_ipv6_fn(void *priv, struct sk_buff *skb,
839 const struct nf_hook_state *state)
842 enum ip_conntrack_info ctinfo;
847 ct = nf_ct_get(skb, &ctinfo);
848 /* Can't track? It's not due to stress, or conntrack would
849 * have dropped it. Hence it's the user's responsibilty to
850 * packet filter it out, or implement conntrack/NAT for that
856 if (ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY) {
857 nexthdr = ipv6_hdr(skb)->nexthdr;
858 hdrlen = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
859 &nexthdr, &frag_off);
861 if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
862 if (!nf_nat_icmpv6_reply_translation(skb, ct, ctinfo,
871 return nf_nat_inet_fn(priv, skb, state);
875 nf_nat_ipv6_in(void *priv, struct sk_buff *skb,
876 const struct nf_hook_state *state)
879 struct in6_addr daddr = ipv6_hdr(skb)->daddr;
881 ret = nf_nat_ipv6_fn(priv, skb, state);
882 if (ret != NF_DROP && ret != NF_STOLEN &&
883 ipv6_addr_cmp(&daddr, &ipv6_hdr(skb)->daddr))
890 nf_nat_ipv6_out(void *priv, struct sk_buff *skb,
891 const struct nf_hook_state *state)
894 const struct nf_conn *ct;
895 enum ip_conntrack_info ctinfo;
900 ret = nf_nat_ipv6_fn(priv, skb, state);
902 if (ret != NF_ACCEPT)
905 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
907 ct = nf_ct_get(skb, &ctinfo);
909 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
911 if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
912 &ct->tuplehash[!dir].tuple.dst.u3) ||
913 (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
914 ct->tuplehash[dir].tuple.src.u.all !=
915 ct->tuplehash[!dir].tuple.dst.u.all)) {
916 err = nf_xfrm_me_harder(state->net, skb, AF_INET6);
918 ret = NF_DROP_ERR(err);
927 nf_nat_ipv6_local_fn(void *priv, struct sk_buff *skb,
928 const struct nf_hook_state *state)
930 const struct nf_conn *ct;
931 enum ip_conntrack_info ctinfo;
935 ret = nf_nat_ipv6_fn(priv, skb, state);
936 if (ret != NF_ACCEPT)
939 ct = nf_ct_get(skb, &ctinfo);
941 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
943 if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3,
944 &ct->tuplehash[!dir].tuple.src.u3)) {
945 err = nf_ip6_route_me_harder(state->net, skb);
947 ret = NF_DROP_ERR(err);
950 else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
951 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
952 ct->tuplehash[dir].tuple.dst.u.all !=
953 ct->tuplehash[!dir].tuple.src.u.all) {
954 err = nf_xfrm_me_harder(state->net, skb, AF_INET6);
956 ret = NF_DROP_ERR(err);
964 const struct nf_hook_ops nf_nat_ipv6_ops[] = {
965 /* Before packet filtering, change destination */
967 .hook = nf_nat_ipv6_in,
969 .hooknum = NF_INET_PRE_ROUTING,
970 .priority = NF_IP6_PRI_NAT_DST,
972 /* After packet filtering, change source */
974 .hook = nf_nat_ipv6_out,
976 .hooknum = NF_INET_POST_ROUTING,
977 .priority = NF_IP6_PRI_NAT_SRC,
979 /* Before packet filtering, change destination */
981 .hook = nf_nat_ipv6_local_fn,
983 .hooknum = NF_INET_LOCAL_OUT,
984 .priority = NF_IP6_PRI_NAT_DST,
986 /* After packet filtering, change source */
988 .hook = nf_nat_ipv6_fn,
990 .hooknum = NF_INET_LOCAL_IN,
991 .priority = NF_IP6_PRI_NAT_SRC,
995 int nf_nat_ipv6_register_fn(struct net *net, const struct nf_hook_ops *ops)
997 return nf_nat_register_fn(net, ops->pf, ops, nf_nat_ipv6_ops,
998 ARRAY_SIZE(nf_nat_ipv6_ops));
1000 EXPORT_SYMBOL_GPL(nf_nat_ipv6_register_fn);
1002 void nf_nat_ipv6_unregister_fn(struct net *net, const struct nf_hook_ops *ops)
1004 nf_nat_unregister_fn(net, ops->pf, ops, ARRAY_SIZE(nf_nat_ipv6_ops));
1006 EXPORT_SYMBOL_GPL(nf_nat_ipv6_unregister_fn);
1007 #endif /* CONFIG_IPV6 */
1009 #if defined(CONFIG_NF_TABLES_INET) && IS_ENABLED(CONFIG_NFT_NAT)
1010 int nf_nat_inet_register_fn(struct net *net, const struct nf_hook_ops *ops)
1014 if (WARN_ON_ONCE(ops->pf != NFPROTO_INET))
1017 ret = nf_nat_register_fn(net, NFPROTO_IPV6, ops, nf_nat_ipv6_ops,
1018 ARRAY_SIZE(nf_nat_ipv6_ops));
1022 ret = nf_nat_register_fn(net, NFPROTO_IPV4, ops, nf_nat_ipv4_ops,
1023 ARRAY_SIZE(nf_nat_ipv4_ops));
1025 nf_nat_ipv6_unregister_fn(net, ops);
1029 EXPORT_SYMBOL_GPL(nf_nat_inet_register_fn);
1031 void nf_nat_inet_unregister_fn(struct net *net, const struct nf_hook_ops *ops)
1033 nf_nat_unregister_fn(net, NFPROTO_IPV4, ops, ARRAY_SIZE(nf_nat_ipv4_ops));
1034 nf_nat_unregister_fn(net, NFPROTO_IPV6, ops, ARRAY_SIZE(nf_nat_ipv6_ops));
1036 EXPORT_SYMBOL_GPL(nf_nat_inet_unregister_fn);
1037 #endif /* NFT INET NAT */