Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8b13eddf authored by Arturo Borrero's avatar Arturo Borrero Committed by Pablo Neira Ayuso
Browse files

netfilter: refactor NAT redirect IPv4 to use it from nf_tables 



This patch refactors the IPv4 code so it can be usable both from xt and
nf_tables.

A similar patch follows-up to handle IPv6.

Signed-off-by: default avatarArturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b8901ac3

include/net/netfilter/ipv4/nf_nat_redirect.h

0 → 100644
+9 −0
Original line number Diff line number Diff line 
#ifndef _NF_NAT_REDIRECT_IPV4_H_

#define _NF_NAT_REDIRECT_IPV4_H_



unsigned int

nf_nat_redirect_ipv4(struct sk_buff *skb,

		     const struct nf_nat_ipv4_multi_range_compat *mr,

		     unsigned int hooknum);



#endif /* _NF_NAT_REDIRECT_IPV4_H_ */

net/ipv4/netfilter/Kconfig

+6 −0
Original line number Diff line number Diff line
@@ -104,6 +104,12 @@ config NF_NAT_MASQUERADE_IPV4 
	  This is the kernel functionality to provide NAT in the masquerade

	  flavour (automatic source address selection).



config NF_NAT_REDIRECT_IPV4

	tristate "IPv4 redirect support"

	help

	  This is the kernel functionality to provide NAT in the redirect

	  flavour (redirect packets to local machine).



config NFT_MASQ_IPV4

	tristate "IPv4 masquerading support for nf_tables"

	depends on NF_TABLES_IPV4

net/ipv4/netfilter/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ obj-$(CONFIG_NF_NAT_H323) += nf_nat_h323.o 
obj-$(CONFIG_NF_NAT_PPTP) += nf_nat_pptp.o

obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o

obj-$(CONFIG_NF_NAT_MASQUERADE_IPV4) += nf_nat_masquerade_ipv4.o

obj-$(CONFIG_NF_NAT_REDIRECT_IPV4) += nf_nat_redirect_ipv4.o



# NAT protocols (nf_nat)

obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o

net/ipv4/netfilter/nf_nat_redirect_ipv4.c

0 → 100644
+82 −0
Original line number Diff line number Diff line 
/*

 * (C) 1999-2001 Paul `Rusty' Russell

 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>

 * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as

 * published by the Free Software Foundation.

 *

 * Based on Rusty Russell's IPv4 REDIRECT target. Development of IPv6

 * NAT funded by Astaro.

 */



#include <linux/if.h>

#include <linux/inetdevice.h>

#include <linux/ip.h>

#include <linux/kernel.h>

#include <linux/module.h>

#include <linux/netdevice.h>

#include <linux/netfilter.h>

#include <linux/types.h>

#include <linux/netfilter_ipv4.h>

#include <linux/netfilter/x_tables.h>

#include <net/addrconf.h>

#include <net/checksum.h>

#include <net/protocol.h>

#include <net/netfilter/nf_nat.h>

#include <net/netfilter/ipv4/nf_nat_redirect.h>



unsigned int

nf_nat_redirect_ipv4(struct sk_buff *skb,

		     const struct nf_nat_ipv4_multi_range_compat *mr,

		     unsigned int hooknum)

{

	struct nf_conn *ct;

	enum ip_conntrack_info ctinfo;

	__be32 newdst;

	struct nf_nat_range newrange;



	NF_CT_ASSERT(hooknum == NF_INET_PRE_ROUTING ||

		     hooknum == NF_INET_LOCAL_OUT);



	ct = nf_ct_get(skb, &ctinfo);

	NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));



	/* Local packets: make them go to loopback */

	if (hooknum == NF_INET_LOCAL_OUT) {

		newdst = htonl(0x7F000001);

	} else {

		struct in_device *indev;

		struct in_ifaddr *ifa;



		newdst = 0;



		rcu_read_lock();

		indev = __in_dev_get_rcu(skb->dev);

		if (indev != NULL) {

			ifa = indev->ifa_list;

			newdst = ifa->ifa_local;

		}

		rcu_read_unlock();



		if (!newdst)

			return NF_DROP;

	}



	/* Transfer from original range. */

	memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));

	memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));

	newrange.flags	     = mr->range[0].flags | NF_NAT_RANGE_MAP_IPS;

	newrange.min_addr.ip = newdst;

	newrange.max_addr.ip = newdst;

	newrange.min_proto   = mr->range[0].min;

	newrange.max_proto   = mr->range[0].max;



	/* Hand modified range to generic setup. */

	return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);

}

EXPORT_SYMBOL_GPL(nf_nat_redirect_ipv4);



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");

net/netfilter/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -835,6 +835,7 @@ config NETFILTER_XT_TARGET_RATEEST 
config NETFILTER_XT_TARGET_REDIRECT

	tristate "REDIRECT target support"

	depends on NF_NAT

	select NF_NAT_REDIRECT_IPV4

	---help---

	REDIRECT is a special case of NAT: all incoming connections are

	mapped onto the incoming interface's address, causing the packets to