Blame view
net/netfilter/nf_nat_proto_common.c
3.15 KB
937e0dfd8 [NETFILTER]: nf_n... |
1 2 3 4 5 6 7 8 9 10 11 |
/* (C) 1999-2001 Paul `Rusty' Russell * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> * (C) 2008 Patrick McHardy <kaber@trash.net> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. */ #include <linux/types.h> #include <linux/random.h> |
937e0dfd8 [NETFILTER]: nf_n... |
12 |
#include <linux/netfilter.h> |
bc3b2d7fb net: Add export.h... |
13 |
#include <linux/export.h> |
c7232c997 netfilter: add pr... |
14 |
|
937e0dfd8 [NETFILTER]: nf_n... |
15 16 |
#include <net/netfilter/nf_nat.h> #include <net/netfilter/nf_nat_core.h> |
c7232c997 netfilter: add pr... |
17 18 |
#include <net/netfilter/nf_nat_l3proto.h> #include <net/netfilter/nf_nat_l4proto.h> |
937e0dfd8 [NETFILTER]: nf_n... |
19 |
|
c7232c997 netfilter: add pr... |
20 21 22 23 |
bool nf_nat_l4proto_in_range(const struct nf_conntrack_tuple *tuple, enum nf_nat_manip_type maniptype, const union nf_conntrack_man_proto *min, const union nf_conntrack_man_proto *max) |
937e0dfd8 [NETFILTER]: nf_n... |
24 25 |
{ __be16 port; |
cbc9f2f4f netfilter: nf_nat... |
26 |
if (maniptype == NF_NAT_MANIP_SRC) |
937e0dfd8 [NETFILTER]: nf_n... |
27 28 29 30 31 32 33 |
port = tuple->src.u.all; else port = tuple->dst.u.all; return ntohs(port) >= ntohs(min->all) && ntohs(port) <= ntohs(max->all); } |
c7232c997 netfilter: add pr... |
34 |
EXPORT_SYMBOL_GPL(nf_nat_l4proto_in_range); |
937e0dfd8 [NETFILTER]: nf_n... |
35 |
|
c7232c997 netfilter: add pr... |
36 37 38 39 40 41 |
void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto, struct nf_conntrack_tuple *tuple, const struct nf_nat_range *range, enum nf_nat_manip_type maniptype, const struct nf_conn *ct, u16 *rover) |
937e0dfd8 [NETFILTER]: nf_n... |
42 |
{ |
53f94e611 netfilter: nat: c... |
43 |
unsigned int range_size, min, max, i; |
937e0dfd8 [NETFILTER]: nf_n... |
44 |
__be16 *portptr; |
5abd363f7 [NETFILTER]: nf_n... |
45 |
u_int16_t off; |
937e0dfd8 [NETFILTER]: nf_n... |
46 |
|
cbc9f2f4f netfilter: nf_nat... |
47 |
if (maniptype == NF_NAT_MANIP_SRC) |
937e0dfd8 [NETFILTER]: nf_n... |
48 49 50 51 52 |
portptr = &tuple->src.u.all; else portptr = &tuple->dst.u.all; /* If no range specified... */ |
cbc9f2f4f netfilter: nf_nat... |
53 |
if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED)) { |
937e0dfd8 [NETFILTER]: nf_n... |
54 |
/* If it's dst rewrite, can't change port */ |
cbc9f2f4f netfilter: nf_nat... |
55 |
if (maniptype == NF_NAT_MANIP_DST) |
f43dc98b3 netfilter: nf_nat... |
56 |
return; |
937e0dfd8 [NETFILTER]: nf_n... |
57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 |
if (ntohs(*portptr) < 1024) { /* Loose convention: >> 512 is credential passing */ if (ntohs(*portptr) < 512) { min = 1; range_size = 511 - min + 1; } else { min = 600; range_size = 1023 - min + 1; } } else { min = 1024; range_size = 65535 - 1024 + 1; } } else { |
c7232c997 netfilter: add pr... |
72 |
min = ntohs(range->min_proto.all); |
53f94e611 netfilter: nat: c... |
73 74 75 76 |
max = ntohs(range->max_proto.all); if (unlikely(max < min)) swap(max, min); range_size = max - min + 1; |
937e0dfd8 [NETFILTER]: nf_n... |
77 |
} |
34ce32401 netfilter: nf_nat... |
78 |
if (range->flags & NF_NAT_RANGE_PROTO_RANDOM) { |
c7232c997 netfilter: add pr... |
79 80 81 |
off = l3proto->secure_port(tuple, maniptype == NF_NAT_MANIP_SRC ? tuple->dst.u.all : tuple->src.u.all); |
34ce32401 netfilter: nf_nat... |
82 83 84 |
} else if (range->flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY) { off = prandom_u32(); } else { |
9f5936537 nf_nat: use secur... |
85 |
off = *rover; |
34ce32401 netfilter: nf_nat... |
86 |
} |
937e0dfd8 [NETFILTER]: nf_n... |
87 |
|
2452a99dc netfilter: nf_nat... |
88 |
for (i = 0; ; ++off) { |
5abd363f7 [NETFILTER]: nf_n... |
89 |
*portptr = htons(min + off % range_size); |
2452a99dc netfilter: nf_nat... |
90 |
if (++i != range_size && nf_nat_used_tuple(tuple, ct)) |
5abd363f7 [NETFILTER]: nf_n... |
91 |
continue; |
34ce32401 netfilter: nf_nat... |
92 |
if (!(range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL)) |
5abd363f7 [NETFILTER]: nf_n... |
93 |
*rover = off; |
f43dc98b3 netfilter: nf_nat... |
94 |
return; |
937e0dfd8 [NETFILTER]: nf_n... |
95 |
} |
937e0dfd8 [NETFILTER]: nf_n... |
96 |
} |
c7232c997 netfilter: add pr... |
97 |
EXPORT_SYMBOL_GPL(nf_nat_l4proto_unique_tuple); |
535b57c7c [NETFILTER]: nf_n... |
98 |
|
24de3d377 netfilter: use IS... |
99 |
#if IS_ENABLED(CONFIG_NF_CT_NETLINK) |
c7232c997 netfilter: add pr... |
100 101 |
int nf_nat_l4proto_nlattr_to_range(struct nlattr *tb[], struct nf_nat_range *range) |
535b57c7c [NETFILTER]: nf_n... |
102 |
{ |
535b57c7c [NETFILTER]: nf_n... |
103 |
if (tb[CTA_PROTONAT_PORT_MIN]) { |
c7232c997 netfilter: add pr... |
104 105 |
range->min_proto.all = nla_get_be16(tb[CTA_PROTONAT_PORT_MIN]); range->max_proto.all = range->min_proto.all; |
cbc9f2f4f netfilter: nf_nat... |
106 |
range->flags |= NF_NAT_RANGE_PROTO_SPECIFIED; |
535b57c7c [NETFILTER]: nf_n... |
107 |
} |
ca6a50749 [NETFILTER]: nf_c... |
108 |
if (tb[CTA_PROTONAT_PORT_MAX]) { |
c7232c997 netfilter: add pr... |
109 |
range->max_proto.all = nla_get_be16(tb[CTA_PROTONAT_PORT_MAX]); |
cbc9f2f4f netfilter: nf_nat... |
110 |
range->flags |= NF_NAT_RANGE_PROTO_SPECIFIED; |
535b57c7c [NETFILTER]: nf_n... |
111 |
} |
ca6a50749 [NETFILTER]: nf_c... |
112 |
return 0; |
535b57c7c [NETFILTER]: nf_n... |
113 |
} |
c7232c997 netfilter: add pr... |
114 |
EXPORT_SYMBOL_GPL(nf_nat_l4proto_nlattr_to_range); |
535b57c7c [NETFILTER]: nf_n... |
115 |
#endif |