[net-next-2.6.git] / net / ipv4 / netfilter / ip_nat_standalone.c

/* This file contains all the functions required for the standalone
   ip_nat module.

   These are not required by the compatibility layer.
*/

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

/*
 * 23 Apr 2001: Harald Welte <laforge@gnumonks.org>
 * 	- new API and handling of conntrack/nat helpers
 * 	- now capable of multiple expectations for one master
 * */

#include <linux/types.h>
#include <linux/icmp.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/proc_fs.h>
#include <net/ip.h>
#include <net/checksum.h>
#include <linux/spinlock.h>

#include <linux/netfilter_ipv4/ip_nat.h>
#include <linux/netfilter_ipv4/ip_nat_rule.h>
#include <linux/netfilter_ipv4/ip_nat_protocol.h>
#include <linux/netfilter_ipv4/ip_nat_core.h>
#include <linux/netfilter_ipv4/ip_nat_helper.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ip_conntrack_core.h>

#if 0
#define DEBUGP printk
#else
#define DEBUGP(format, args...)
#endif

#ifdef CONFIG_XFRM
static void nat_decode_session(struct sk_buff *skb, struct flowi *fl)
{
	struct ip_conntrack *ct;
	struct ip_conntrack_tuple *t;
	enum ip_conntrack_info ctinfo;
	enum ip_conntrack_dir dir;
	unsigned long statusbit;

	ct = ip_conntrack_get(skb, &ctinfo);
	if (ct == NULL)
		return;
	dir = CTINFO2DIR(ctinfo);
	t = &ct->tuplehash[dir].tuple;

	if (dir == IP_CT_DIR_ORIGINAL)
		statusbit = IPS_DST_NAT;
	else
		statusbit = IPS_SRC_NAT;

	if (ct->status & statusbit) {
		fl->fl4_dst = t->dst.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP)
			fl->fl_ip_dport = t->dst.u.tcp.port;
	}

	statusbit ^= IPS_NAT_MASK;

	if (ct->status & statusbit) {
		fl->fl4_src = t->src.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP)
			fl->fl_ip_sport = t->src.u.tcp.port;
	}
}
#endif

static unsigned int
ip_nat_fn(unsigned int hooknum,
	  struct sk_buff **pskb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	struct ip_conntrack *ct;
	enum ip_conntrack_info ctinfo;
	struct ip_nat_info *info;
	/* maniptype == SRC for postrouting. */
	enum ip_nat_manip_type maniptype = HOOK2MANIP(hooknum);

	/* We never see fragments: conntrack defrags on pre-routing
	   and local-out, and ip_nat_out protects post-routing. */
	IP_NF_ASSERT(!((*pskb)->nh.iph->frag_off
		       & htons(IP_MF|IP_OFFSET)));

	ct = ip_conntrack_get(*pskb, &ctinfo);
	/* Can't track?  It's not due to stress, or conntrack would
	   have dropped it.  Hence it's the user's responsibilty to
	   packet filter it out, or implement conntrack/NAT for that
	   protocol. 8) --RR */
	if (!ct) {
		/* Exception: ICMP redirect to new connection (not in
		   hash table yet).  We must not let this through, in
		   case we're doing NAT to the same network. */
		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
			struct icmphdr _hdr, *hp;

			hp = skb_header_pointer(*pskb,
						(*pskb)->nh.iph->ihl*4,
						sizeof(_hdr), &_hdr);
			if (hp != NULL &&
			    hp->type == ICMP_REDIRECT)
				return NF_DROP;
		}
		return NF_ACCEPT;
	}

	/* Don't try to NAT if this packet is not conntracked */
	if (ct == &ip_conntrack_untracked)
		return NF_ACCEPT;

	switch (ctinfo) {
	case IP_CT_RELATED:
	case IP_CT_RELATED+IP_CT_IS_REPLY:
		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
			if (!ip_nat_icmp_reply_translation(ct, ctinfo,
							   hooknum, pskb))
				return NF_DROP;
			else
				return NF_ACCEPT;
		}
		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	case IP_CT_NEW:
		info = &ct->nat.info;

		/* Seen it before?  This can happen for loopback, retrans,
		   or local packets.. */
		if (!ip_nat_initialized(ct, maniptype)) {
			unsigned int ret;

			if (unlikely(is_confirmed(ct)))
				/* NAT module was loaded late */
				ret = alloc_null_binding_confirmed(ct, info,
								   hooknum);
			else if (hooknum == NF_IP_LOCAL_IN)
				/* LOCAL_IN hook doesn't have a chain!  */
				ret = alloc_null_binding(ct, info, hooknum);
			else
				ret = ip_nat_rule_find(pskb, hooknum,
						       in, out, ct,
						       info);

			if (ret != NF_ACCEPT) {
				return ret;
			}
		} else
			DEBUGP("Already setup manip %s for ct %p\n",
			       maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
			       ct);
		break;

	default:
		/* ESTABLISHED */
		IP_NF_ASSERT(ctinfo == IP_CT_ESTABLISHED
			     || ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
		info = &ct->nat.info;
	}

	IP_NF_ASSERT(info);
	return ip_nat_packet(ct, ctinfo, hooknum, pskb);
}

static unsigned int
ip_nat_in(unsigned int hooknum,
	  struct sk_buff **pskb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	unsigned int ret;
	__be32 daddr = (*pskb)->nh.iph->daddr;

	ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN
	    && daddr != (*pskb)->nh.iph->daddr) {
		dst_release((*pskb)->dst);
		(*pskb)->dst = NULL;
	}
	return ret;
}

static unsigned int
ip_nat_out(unsigned int hooknum,
	   struct sk_buff **pskb,
	   const struct net_device *in,
	   const struct net_device *out,
	   int (*okfn)(struct sk_buff *))
{
#ifdef CONFIG_XFRM
	struct ip_conntrack *ct;
	enum ip_conntrack_info ctinfo;
#endif
	unsigned int ret;

	/* root is playing with raw sockets. */
	if ((*pskb)->len < sizeof(struct iphdr)
	    || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
#ifdef CONFIG_XFRM
	if (ret != NF_DROP && ret != NF_STOLEN
	    && (ct = ip_conntrack_get(*pskb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if (ct->tuplehash[dir].tuple.src.ip !=
		    ct->tuplehash[!dir].tuple.dst.ip
		    || ct->tuplehash[dir].tuple.src.u.all !=
		       ct->tuplehash[!dir].tuple.dst.u.all
		    )
			return ip_xfrm_me_harder(pskb) == 0 ? ret : NF_DROP;
	}
#endif
	return ret;
}

static unsigned int
ip_nat_local_fn(unsigned int hooknum,
		struct sk_buff **pskb,
		const struct net_device *in,
		const struct net_device *out,
		int (*okfn)(struct sk_buff *))
{
	struct ip_conntrack *ct;
	enum ip_conntrack_info ctinfo;
	unsigned int ret;

	/* root is playing with raw sockets. */
	if ((*pskb)->len < sizeof(struct iphdr)
	    || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN
	    && (ct = ip_conntrack_get(*pskb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if (ct->tuplehash[dir].tuple.dst.ip !=
		    ct->tuplehash[!dir].tuple.src.ip
#ifdef CONFIG_XFRM
		    || ct->tuplehash[dir].tuple.dst.u.all !=
		       ct->tuplehash[!dir].tuple.src.u.all
#endif
		    )
			if (ip_route_me_harder(pskb, RTN_UNSPEC))
				ret = NF_DROP;
	}
	return ret;
}

static unsigned int
ip_nat_adjust(unsigned int hooknum,
	      struct sk_buff **pskb,
	      const struct net_device *in,
	      const struct net_device *out,
	      int (*okfn)(struct sk_buff *))
{
	struct ip_conntrack *ct;
	enum ip_conntrack_info ctinfo;

	ct = ip_conntrack_get(*pskb, &ctinfo);
	if (ct && test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
		DEBUGP("ip_nat_standalone: adjusting sequence number\n");
		if (!ip_nat_seq_adjust(pskb, ct, ctinfo))
			return NF_DROP;
	}
	return NF_ACCEPT;
}

/* We must be after connection tracking and before packet filtering. */

static struct nf_hook_ops ip_nat_ops[] = {
	/* Before packet filtering, change destination */
	{
		.hook		= ip_nat_in,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_PRE_ROUTING,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= ip_nat_out,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_POST_ROUTING,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
	/* After conntrack, adjust sequence number */
	{
		.hook		= ip_nat_adjust,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_POST_ROUTING,
		.priority	= NF_IP_PRI_NAT_SEQ_ADJUST,
	},
	/* Before packet filtering, change destination */
	{
		.hook		= ip_nat_local_fn,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_LOCAL_OUT,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= ip_nat_fn,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_LOCAL_IN,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
	/* After conntrack, adjust sequence number */
	{
		.hook		= ip_nat_adjust,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_IP_LOCAL_IN,
		.priority	= NF_IP_PRI_NAT_SEQ_ADJUST,
	},
};

static int __init ip_nat_standalone_init(void)
{
	int ret = 0;

	need_conntrack();

#ifdef CONFIG_XFRM
	BUG_ON(ip_nat_decode_session != NULL);
	ip_nat_decode_session = nat_decode_session;
#endif
	ret = ip_nat_rule_init();
	if (ret < 0) {
		printk("ip_nat_init: can't setup rules.\n");
		goto cleanup_decode_session;
	}
	ret = nf_register_hooks(ip_nat_ops, ARRAY_SIZE(ip_nat_ops));
	if (ret < 0) {
		printk("ip_nat_init: can't register hooks.\n");
		goto cleanup_rule_init;
	}
	return ret;

 cleanup_rule_init:
	ip_nat_rule_cleanup();
 cleanup_decode_session:
#ifdef CONFIG_XFRM
	ip_nat_decode_session = NULL;
	synchronize_net();
#endif
	return ret;
}

static void __exit ip_nat_standalone_fini(void)
{
	nf_unregister_hooks(ip_nat_ops, ARRAY_SIZE(ip_nat_ops));
	ip_nat_rule_cleanup();
#ifdef CONFIG_XFRM
	ip_nat_decode_session = NULL;
	synchronize_net();
#endif
}

module_init(ip_nat_standalone_init);
module_exit(ip_nat_standalone_fini);

MODULE_LICENSE("GPL");
Commit	Line	Data
1da177e4 LT	1	/* This file contains all the functions required for the standalone
	2	ip_nat module.
	3
	4	These are not required by the compatibility layer.
	5	*/
	6
	7	/* (C) 1999-2001 Paul `Rusty' Russell
	8	* (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
	9	*
	10	* This program is free software; you can redistribute it and/or modify
	11	* it under the terms of the GNU General Public License version 2 as
	12	* published by the Free Software Foundation.
	13	*/
	14
	15	/*
	16	* 23 Apr 2001: Harald Welte <laforge@gnumonks.org>
	17	* - new API and handling of conntrack/nat helpers
	18	* - now capable of multiple expectations for one master
	19	* */
	20
1da177e4 LT	21	#include <linux/types.h>
	22	#include <linux/icmp.h>
	23	#include <linux/ip.h>
	24	#include <linux/netfilter.h>
	25	#include <linux/netfilter_ipv4.h>
	26	#include <linux/module.h>
	27	#include <linux/skbuff.h>
	28	#include <linux/proc_fs.h>
	29	#include <net/ip.h>
	30	#include <net/checksum.h>
	31	#include <linux/spinlock.h>
	32
1da177e4 LT	33	#include <linux/netfilter_ipv4/ip_nat.h>
	34	#include <linux/netfilter_ipv4/ip_nat_rule.h>
	35	#include <linux/netfilter_ipv4/ip_nat_protocol.h>
	36	#include <linux/netfilter_ipv4/ip_nat_core.h>
	37	#include <linux/netfilter_ipv4/ip_nat_helper.h>
	38	#include <linux/netfilter_ipv4/ip_tables.h>
	39	#include <linux/netfilter_ipv4/ip_conntrack_core.h>
1da177e4 LT	40
	41	#if 0
	42	#define DEBUGP printk
	43	#else
	44	#define DEBUGP(format, args...)
	45	#endif
	46
eb9c7ebe PM	47	#ifdef CONFIG_XFRM
	48	static void nat_decode_session(struct sk_buff skb, struct flowi fl)
	49	{
	50	struct ip_conntrack *ct;
	51	struct ip_conntrack_tuple *t;
	52	enum ip_conntrack_info ctinfo;
	53	enum ip_conntrack_dir dir;
	54	unsigned long statusbit;
	55
	56	ct = ip_conntrack_get(skb, &ctinfo);
	57	if (ct == NULL)
	58	return;
	59	dir = CTINFO2DIR(ctinfo);
	60	t = &ct->tuplehash[dir].tuple;
	61
	62	if (dir == IP_CT_DIR_ORIGINAL)
	63	statusbit = IPS_DST_NAT;
	64	else
	65	statusbit = IPS_SRC_NAT;
	66
	67	if (ct->status & statusbit) {
	68	fl->fl4_dst = t->dst.ip;
	69	if (t->dst.protonum == IPPROTO_TCP \|\|
	70	t->dst.protonum == IPPROTO_UDP)
	71	fl->fl_ip_dport = t->dst.u.tcp.port;
	72	}
	73
	74	statusbit ^= IPS_NAT_MASK;
	75
	76	if (ct->status & statusbit) {
	77	fl->fl4_src = t->src.ip;
	78	if (t->dst.protonum == IPPROTO_TCP \|\|
	79	t->dst.protonum == IPPROTO_UDP)
	80	fl->fl_ip_sport = t->src.u.tcp.port;
	81	}
	82	}
	83	#endif
e905a9ed	84
1da177e4 LT	85	static unsigned int
	86	ip_nat_fn(unsigned int hooknum,
	87	struct sk_buff **pskb,
	88	const struct net_device *in,
	89	const struct net_device *out,
	90	int (okfn)(struct sk_buff ))
	91	{
	92	struct ip_conntrack *ct;
	93	enum ip_conntrack_info ctinfo;
	94	struct ip_nat_info *info;
	95	/* maniptype == SRC for postrouting. */
	96	enum ip_nat_manip_type maniptype = HOOK2MANIP(hooknum);
	97
	98	/* We never see fragments: conntrack defrags on pre-routing
	99	and local-out, and ip_nat_out protects post-routing. */
	100	IP_NF_ASSERT(!((*pskb)->nh.iph->frag_off
	101	& htons(IP_MF\|IP_OFFSET)));
	102
1da177e4 LT	103	ct = ip_conntrack_get(*pskb, &ctinfo);
	104	/* Can't track? It's not due to stress, or conntrack would
	105	have dropped it. Hence it's the user's responsibilty to
	106	packet filter it out, or implement conntrack/NAT for that
	107	protocol. 8) --RR */
	108	if (!ct) {
	109	/* Exception: ICMP redirect to new connection (not in
e905a9ed YH	110	hash table yet). We must not let this through, in
e905a9ed YH	111	case we're doing NAT to the same network. */
1da177e4 LT	112	if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
	113	struct icmphdr _hdr, *hp;
	114
	115	hp = skb_header_pointer(*pskb,
	116	(pskb)->nh.iph->ihl4,
	117	sizeof(_hdr), &_hdr);
	118	if (hp != NULL &&
	119	hp->type == ICMP_REDIRECT)
	120	return NF_DROP;
	121	}
	122	return NF_ACCEPT;
	123	}
	124
8b83bc77 HW	125	/* Don't try to NAT if this packet is not conntracked */
	126	if (ct == &ip_conntrack_untracked)
	127	return NF_ACCEPT;
	128
1da177e4 LT	129	switch (ctinfo) {
	130	case IP_CT_RELATED:
	131	case IP_CT_RELATED+IP_CT_IS_REPLY:
	132	if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
4cf411de PM	133	if (!ip_nat_icmp_reply_translation(ct, ctinfo,
4cf411de PM	134	hooknum, pskb))
1da177e4 LT	135	return NF_DROP;
	136	else
	137	return NF_ACCEPT;
	138	}
	139	/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	140	case IP_CT_NEW:
	141	info = &ct->nat.info;
	142
	143	/* Seen it before? This can happen for loopback, retrans,
	144	or local packets.. */
	145	if (!ip_nat_initialized(ct, maniptype)) {
	146	unsigned int ret;
	147
03486a4f PM	148	if (unlikely(is_confirmed(ct)))
	149	/* NAT module was loaded late */
	150	ret = alloc_null_binding_confirmed(ct, info,
e905a9ed	151	hooknum);
03486a4f PM	152	else if (hooknum == NF_IP_LOCAL_IN)
03486a4f PM	153	/* LOCAL_IN hook doesn't have a chain! */
1da177e4 LT	154	ret = alloc_null_binding(ct, info, hooknum);
	155	else
	156	ret = ip_nat_rule_find(pskb, hooknum,
	157	in, out, ct,
	158	info);
	159
	160	if (ret != NF_ACCEPT) {
	161	return ret;
	162	}
	163	} else
	164	DEBUGP("Already setup manip %s for ct %p\n",
	165	maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
	166	ct);
	167	break;
	168
	169	default:
	170	/* ESTABLISHED */
	171	IP_NF_ASSERT(ctinfo == IP_CT_ESTABLISHED
	172	\|\| ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
	173	info = &ct->nat.info;
	174	}
	175
	176	IP_NF_ASSERT(info);
188bab3a	177	return ip_nat_packet(ct, ctinfo, hooknum, pskb);
1da177e4 LT	178	}
	179
	180	static unsigned int
	181	ip_nat_in(unsigned int hooknum,
e905a9ed YH	182	struct sk_buff **pskb,
	183	const struct net_device *in,
	184	const struct net_device *out,
	185	int (okfn)(struct sk_buff ))
1da177e4	186	{
1da177e4	187	unsigned int ret;
a76b11dd	188	__be32 daddr = (*pskb)->nh.iph->daddr;
1da177e4	189
1da177e4 LT	190	ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
1da177e4 LT	191	if (ret != NF_DROP && ret != NF_STOLEN
8e249f08 PM	192	&& daddr != (*pskb)->nh.iph->daddr) {
	193	dst_release((*pskb)->dst);
	194	(*pskb)->dst = NULL;
1da177e4 LT	195	}
	196	return ret;
	197	}
	198
	199	static unsigned int
	200	ip_nat_out(unsigned int hooknum,
	201	struct sk_buff **pskb,
	202	const struct net_device *in,
	203	const struct net_device *out,
	204	int (okfn)(struct sk_buff ))
	205	{
2354feae	206	#ifdef CONFIG_XFRM
5c901daa PM	207	struct ip_conntrack *ct;
5c901daa PM	208	enum ip_conntrack_info ctinfo;
2354feae	209	#endif
5c901daa PM	210	unsigned int ret;
5c901daa PM	211
1da177e4 LT	212	/* root is playing with raw sockets. */
	213	if ((*pskb)->len < sizeof(struct iphdr)
	214	\|\| (pskb)->nh.iph->ihl 4 < sizeof(struct iphdr))
	215	return NF_ACCEPT;
	216
5c901daa	217	ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
ee68cea2	218	#ifdef CONFIG_XFRM
5c901daa PM	219	if (ret != NF_DROP && ret != NF_STOLEN
	220	&& (ct = ip_conntrack_get(*pskb, &ctinfo)) != NULL) {
	221	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	222
	223	if (ct->tuplehash[dir].tuple.src.ip !=
	224	ct->tuplehash[!dir].tuple.dst.ip
5c901daa PM	225	\|\| ct->tuplehash[dir].tuple.src.u.all !=
5c901daa PM	226	ct->tuplehash[!dir].tuple.dst.u.all
5c901daa	227	)
ee68cea2	228	return ip_xfrm_me_harder(pskb) == 0 ? ret : NF_DROP;
5c901daa	229	}
ee68cea2	230	#endif
5c901daa	231	return ret;
1da177e4 LT	232	}
	233
	234	static unsigned int
	235	ip_nat_local_fn(unsigned int hooknum,
	236	struct sk_buff **pskb,
	237	const struct net_device *in,
	238	const struct net_device *out,
	239	int (okfn)(struct sk_buff ))
	240	{
4e8e9de7 PM	241	struct ip_conntrack *ct;
4e8e9de7 PM	242	enum ip_conntrack_info ctinfo;
1da177e4 LT	243	unsigned int ret;
	244
	245	/* root is playing with raw sockets. */
	246	if ((*pskb)->len < sizeof(struct iphdr)
	247	\|\| (pskb)->nh.iph->ihl 4 < sizeof(struct iphdr))
	248	return NF_ACCEPT;
	249
1da177e4 LT	250	ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
1da177e4 LT	251	if (ret != NF_DROP && ret != NF_STOLEN
4e8e9de7 PM	252	&& (ct = ip_conntrack_get(*pskb, &ctinfo)) != NULL) {
	253	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	254
	255	if (ct->tuplehash[dir].tuple.dst.ip !=
5c901daa PM	256	ct->tuplehash[!dir].tuple.src.ip
	257	#ifdef CONFIG_XFRM
	258	\|\| ct->tuplehash[dir].tuple.dst.u.all !=
8e249f08	259	ct->tuplehash[!dir].tuple.src.u.all
5c901daa PM	260	#endif
5c901daa PM	261	)
b4c4ed17 SH	262	if (ip_route_me_harder(pskb, RTN_UNSPEC))
b4c4ed17 SH	263	ret = NF_DROP;
4e8e9de7	264	}
1da177e4 LT	265	return ret;
	266	}
	267
e281e3ac PM	268	static unsigned int
	269	ip_nat_adjust(unsigned int hooknum,
	270	struct sk_buff **pskb,
	271	const struct net_device *in,
	272	const struct net_device *out,
	273	int (okfn)(struct sk_buff ))
	274	{
	275	struct ip_conntrack *ct;
	276	enum ip_conntrack_info ctinfo;
	277
	278	ct = ip_conntrack_get(*pskb, &ctinfo);
	279	if (ct && test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
e905a9ed YH	280	DEBUGP("ip_nat_standalone: adjusting sequence number\n");
	281	if (!ip_nat_seq_adjust(pskb, ct, ctinfo))
	282	return NF_DROP;
e281e3ac PM	283	}
	284	return NF_ACCEPT;
	285	}
	286
1da177e4 LT	287	/* We must be after connection tracking and before packet filtering. */
1da177e4 LT	288
964ddaa1 PM	289	static struct nf_hook_ops ip_nat_ops[] = {
	290	/* Before packet filtering, change destination */
	291	{
	292	.hook = ip_nat_in,
	293	.owner = THIS_MODULE,
	294	.pf = PF_INET,
	295	.hooknum = NF_IP_PRE_ROUTING,
	296	.priority = NF_IP_PRI_NAT_DST,
	297	},
	298	/* After packet filtering, change source */
	299	{
	300	.hook = ip_nat_out,
	301	.owner = THIS_MODULE,
	302	.pf = PF_INET,
	303	.hooknum = NF_IP_POST_ROUTING,
	304	.priority = NF_IP_PRI_NAT_SRC,
	305	},
	306	/* After conntrack, adjust sequence number */
	307	{
	308	.hook = ip_nat_adjust,
	309	.owner = THIS_MODULE,
	310	.pf = PF_INET,
	311	.hooknum = NF_IP_POST_ROUTING,
	312	.priority = NF_IP_PRI_NAT_SEQ_ADJUST,
	313	},
	314	/* Before packet filtering, change destination */
	315	{
	316	.hook = ip_nat_local_fn,
	317	.owner = THIS_MODULE,
	318	.pf = PF_INET,
	319	.hooknum = NF_IP_LOCAL_OUT,
	320	.priority = NF_IP_PRI_NAT_DST,
	321	},
	322	/* After packet filtering, change source */
	323	{
	324	.hook = ip_nat_fn,
	325	.owner = THIS_MODULE,
	326	.pf = PF_INET,
	327	.hooknum = NF_IP_LOCAL_IN,
	328	.priority = NF_IP_PRI_NAT_SRC,
	329	},
	330	/* After conntrack, adjust sequence number */
	331	{
	332	.hook = ip_nat_adjust,
	333	.owner = THIS_MODULE,
	334	.pf = PF_INET,
	335	.hooknum = NF_IP_LOCAL_IN,
	336	.priority = NF_IP_PRI_NAT_SEQ_ADJUST,
	337	},
1da177e4 LT	338	};
1da177e4 LT	339
32292a7f	340	static int __init ip_nat_standalone_init(void)
1da177e4 LT	341	{
	342	int ret = 0;
	343
2e4e6a17	344	need_conntrack();
1da177e4	345
eb9c7ebe PM	346	#ifdef CONFIG_XFRM
	347	BUG_ON(ip_nat_decode_session != NULL);
	348	ip_nat_decode_session = nat_decode_session;
	349	#endif
1da177e4 LT	350	ret = ip_nat_rule_init();
	351	if (ret < 0) {
	352	printk("ip_nat_init: can't setup rules.\n");
eb9c7ebe	353	goto cleanup_decode_session;
1da177e4	354	}
964ddaa1	355	ret = nf_register_hooks(ip_nat_ops, ARRAY_SIZE(ip_nat_ops));
1da177e4	356	if (ret < 0) {
964ddaa1	357	printk("ip_nat_init: can't register hooks.\n");
188bab3a	358	goto cleanup_rule_init;
1da177e4	359	}
1da177e4 LT	360	return ret;
1da177e4 LT	361
1da177e4 LT	362	cleanup_rule_init:
1da177e4 LT	363	ip_nat_rule_cleanup();
eb9c7ebe PM	364	cleanup_decode_session:
	365	#ifdef CONFIG_XFRM
	366	ip_nat_decode_session = NULL;
	367	synchronize_net();
	368	#endif
1da177e4 LT	369	return ret;
	370	}
	371
65b4b4e8	372	static void __exit ip_nat_standalone_fini(void)
1da177e4	373	{
32292a7f PM	374	nf_unregister_hooks(ip_nat_ops, ARRAY_SIZE(ip_nat_ops));
	375	ip_nat_rule_cleanup();
	376	#ifdef CONFIG_XFRM
	377	ip_nat_decode_session = NULL;
	378	synchronize_net();
	379	#endif
1da177e4 LT	380	}
1da177e4 LT	381
65b4b4e8 AM	382	module_init(ip_nat_standalone_init);
65b4b4e8 AM	383	module_exit(ip_nat_standalone_fini);
1da177e4	384
1da177e4	385	MODULE_LICENSE("GPL");