[people/ms/linux.git] / net / netfilter / nft_nat.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
 * Copyright (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
 * Copyright (c) 2012 Intel Corporation
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/string.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_tables.h>
#include <net/ip.h>

struct nft_nat {
	u8			sreg_addr_min;
	u8			sreg_addr_max;
	u8			sreg_proto_min;
	u8			sreg_proto_max;
	enum nf_nat_manip_type  type:8;
	u8			family;
	u16			flags;
};

static void nft_nat_setup_addr(struct nf_nat_range2 *range,
			       const struct nft_regs *regs,
			       const struct nft_nat *priv)
{
	switch (priv->family) {
	case AF_INET:
		range->min_addr.ip = (__force __be32)
				regs->data[priv->sreg_addr_min];
		range->max_addr.ip = (__force __be32)
				regs->data[priv->sreg_addr_max];
		break;
	case AF_INET6:
		memcpy(range->min_addr.ip6, &regs->data[priv->sreg_addr_min],
		       sizeof(range->min_addr.ip6));
		memcpy(range->max_addr.ip6, &regs->data[priv->sreg_addr_max],
		       sizeof(range->max_addr.ip6));
		break;
	}
}

static void nft_nat_setup_proto(struct nf_nat_range2 *range,
				const struct nft_regs *regs,
				const struct nft_nat *priv)
{
	range->min_proto.all = (__force __be16)
		nft_reg_load16(&regs->data[priv->sreg_proto_min]);
	range->max_proto.all = (__force __be16)
		nft_reg_load16(&regs->data[priv->sreg_proto_max]);
}

static void nft_nat_setup_netmap(struct nf_nat_range2 *range,
				 const struct nft_pktinfo *pkt,
				 const struct nft_nat *priv)
{
	struct sk_buff *skb = pkt->skb;
	union nf_inet_addr new_addr;
	__be32 netmask;
	int i, len = 0;

	switch (priv->type) {
	case NFT_NAT_SNAT:
		if (nft_pf(pkt) == NFPROTO_IPV4) {
			new_addr.ip = ip_hdr(skb)->saddr;
			len = sizeof(struct in_addr);
		} else {
			new_addr.in6 = ipv6_hdr(skb)->saddr;
			len = sizeof(struct in6_addr);
		}
		break;
	case NFT_NAT_DNAT:
		if (nft_pf(pkt) == NFPROTO_IPV4) {
			new_addr.ip = ip_hdr(skb)->daddr;
			len = sizeof(struct in_addr);
		} else {
			new_addr.in6 = ipv6_hdr(skb)->daddr;
			len = sizeof(struct in6_addr);
		}
		break;
	}

	for (i = 0; i < len / sizeof(__be32); i++) {
		netmask = ~(range->min_addr.ip6[i] ^ range->max_addr.ip6[i]);
		new_addr.ip6[i] &= ~netmask;
		new_addr.ip6[i] |= range->min_addr.ip6[i] & netmask;
	}

	range->min_addr = new_addr;
	range->max_addr = new_addr;
}

static void nft_nat_eval(const struct nft_expr *expr,
			 struct nft_regs *regs,
			 const struct nft_pktinfo *pkt)
{
	const struct nft_nat *priv = nft_expr_priv(expr);
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct = nf_ct_get(pkt->skb, &ctinfo);
	struct nf_nat_range2 range;

	memset(&range, 0, sizeof(range));

	if (priv->sreg_addr_min) {
		nft_nat_setup_addr(&range, regs, priv);
		if (priv->flags & NF_NAT_RANGE_NETMAP)
			nft_nat_setup_netmap(&range, pkt, priv);
	}

	if (priv->sreg_proto_min)
		nft_nat_setup_proto(&range, regs, priv);

	range.flags = priv->flags;

	regs->verdict.code = nf_nat_setup_info(ct, &range, priv->type);
}

static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = {
	[NFTA_NAT_TYPE]		 = { .type = NLA_U32 },
	[NFTA_NAT_FAMILY]	 = { .type = NLA_U32 },
	[NFTA_NAT_REG_ADDR_MIN]	 = { .type = NLA_U32 },
	[NFTA_NAT_REG_ADDR_MAX]	 = { .type = NLA_U32 },
	[NFTA_NAT_REG_PROTO_MIN] = { .type = NLA_U32 },
	[NFTA_NAT_REG_PROTO_MAX] = { .type = NLA_U32 },
	[NFTA_NAT_FLAGS]	 = { .type = NLA_U32 },
};

static int nft_nat_validate(const struct nft_ctx *ctx,
			    const struct nft_expr *expr,
			    const struct nft_data **data)
{
	struct nft_nat *priv = nft_expr_priv(expr);
	int err;

	err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
	if (err < 0)
		return err;

	switch (priv->type) {
	case NFT_NAT_SNAT:
		err = nft_chain_validate_hooks(ctx->chain,
					       (1 << NF_INET_POST_ROUTING) |
					       (1 << NF_INET_LOCAL_IN));
		break;
	case NFT_NAT_DNAT:
		err = nft_chain_validate_hooks(ctx->chain,
					       (1 << NF_INET_PRE_ROUTING) |
					       (1 << NF_INET_LOCAL_OUT));
		break;
	}

	return err;
}

static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
			const struct nlattr * const tb[])
{
	struct nft_nat *priv = nft_expr_priv(expr);
	unsigned int alen, plen;
	u32 family;
	int err;

	if (tb[NFTA_NAT_TYPE] == NULL ||
	    (tb[NFTA_NAT_REG_ADDR_MIN] == NULL &&
	     tb[NFTA_NAT_REG_PROTO_MIN] == NULL))
		return -EINVAL;

	switch (ntohl(nla_get_be32(tb[NFTA_NAT_TYPE]))) {
	case NFT_NAT_SNAT:
		priv->type = NF_NAT_MANIP_SRC;
		break;
	case NFT_NAT_DNAT:
		priv->type = NF_NAT_MANIP_DST;
		break;
	default:
		return -EOPNOTSUPP;
	}

	if (tb[NFTA_NAT_FAMILY] == NULL)
		return -EINVAL;

	family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY]));
	if (ctx->family != NFPROTO_INET && ctx->family != family)
		return -EOPNOTSUPP;

	switch (family) {
	case NFPROTO_IPV4:
		alen = sizeof_field(struct nf_nat_range, min_addr.ip);
		break;
	case NFPROTO_IPV6:
		alen = sizeof_field(struct nf_nat_range, min_addr.ip6);
		break;
	default:
		if (tb[NFTA_NAT_REG_ADDR_MIN])
			return -EAFNOSUPPORT;
		break;
	}
	priv->family = family;

	if (tb[NFTA_NAT_REG_ADDR_MIN]) {
		err = nft_parse_register_load(tb[NFTA_NAT_REG_ADDR_MIN],
					      &priv->sreg_addr_min, alen);
		if (err < 0)
			return err;

		if (tb[NFTA_NAT_REG_ADDR_MAX]) {
			err = nft_parse_register_load(tb[NFTA_NAT_REG_ADDR_MAX],
						      &priv->sreg_addr_max,
						      alen);
			if (err < 0)
				return err;
		} else {
			priv->sreg_addr_max = priv->sreg_addr_min;
		}

		priv->flags |= NF_NAT_RANGE_MAP_IPS;
	}

	plen = sizeof_field(struct nf_nat_range, min_addr.all);
	if (tb[NFTA_NAT_REG_PROTO_MIN]) {
		err = nft_parse_register_load(tb[NFTA_NAT_REG_PROTO_MIN],
					      &priv->sreg_proto_min, plen);
		if (err < 0)
			return err;

		if (tb[NFTA_NAT_REG_PROTO_MAX]) {
			err = nft_parse_register_load(tb[NFTA_NAT_REG_PROTO_MAX],
						      &priv->sreg_proto_max,
						      plen);
			if (err < 0)
				return err;
		} else {
			priv->sreg_proto_max = priv->sreg_proto_min;
		}

		priv->flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
	}

	if (tb[NFTA_NAT_FLAGS]) {
		priv->flags |= ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
		if (priv->flags & ~NF_NAT_RANGE_MASK)
			return -EOPNOTSUPP;
	}

	return nf_ct_netns_get(ctx->net, family);
}

static int nft_nat_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_nat *priv = nft_expr_priv(expr);

	switch (priv->type) {
	case NF_NAT_MANIP_SRC:
		if (nla_put_be32(skb, NFTA_NAT_TYPE, htonl(NFT_NAT_SNAT)))
			goto nla_put_failure;
		break;
	case NF_NAT_MANIP_DST:
		if (nla_put_be32(skb, NFTA_NAT_TYPE, htonl(NFT_NAT_DNAT)))
			goto nla_put_failure;
		break;
	}

	if (nla_put_be32(skb, NFTA_NAT_FAMILY, htonl(priv->family)))
		goto nla_put_failure;

	if (priv->sreg_addr_min) {
		if (nft_dump_register(skb, NFTA_NAT_REG_ADDR_MIN,
				      priv->sreg_addr_min) ||
		    nft_dump_register(skb, NFTA_NAT_REG_ADDR_MAX,
				      priv->sreg_addr_max))
			goto nla_put_failure;
	}

	if (priv->sreg_proto_min) {
		if (nft_dump_register(skb, NFTA_NAT_REG_PROTO_MIN,
				      priv->sreg_proto_min) ||
		    nft_dump_register(skb, NFTA_NAT_REG_PROTO_MAX,
				      priv->sreg_proto_max))
			goto nla_put_failure;
	}

	if (priv->flags != 0) {
		if (nla_put_be32(skb, NFTA_NAT_FLAGS, htonl(priv->flags)))
			goto nla_put_failure;
	}

	return 0;

nla_put_failure:
	return -1;
}

static void
nft_nat_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
{
	const struct nft_nat *priv = nft_expr_priv(expr);

	nf_ct_netns_put(ctx->net, priv->family);
}

static struct nft_expr_type nft_nat_type;
static const struct nft_expr_ops nft_nat_ops = {
	.type           = &nft_nat_type,
	.size           = NFT_EXPR_SIZE(sizeof(struct nft_nat)),
	.eval           = nft_nat_eval,
	.init           = nft_nat_init,
	.destroy        = nft_nat_destroy,
	.dump           = nft_nat_dump,
	.validate	= nft_nat_validate,
};

static struct nft_expr_type nft_nat_type __read_mostly = {
	.name           = "nat",
	.ops            = &nft_nat_ops,
	.policy         = nft_nat_policy,
	.maxattr        = NFTA_NAT_MAX,
	.owner          = THIS_MODULE,
};

#ifdef CONFIG_NF_TABLES_INET
static void nft_nat_inet_eval(const struct nft_expr *expr,
			      struct nft_regs *regs,
			      const struct nft_pktinfo *pkt)
{
	const struct nft_nat *priv = nft_expr_priv(expr);

	if (priv->family == nft_pf(pkt))
		nft_nat_eval(expr, regs, pkt);
}

static const struct nft_expr_ops nft_nat_inet_ops = {
	.type           = &nft_nat_type,
	.size           = NFT_EXPR_SIZE(sizeof(struct nft_nat)),
	.eval           = nft_nat_inet_eval,
	.init           = nft_nat_init,
	.destroy        = nft_nat_destroy,
	.dump           = nft_nat_dump,
	.validate	= nft_nat_validate,
};

static struct nft_expr_type nft_inet_nat_type __read_mostly = {
	.name           = "nat",
	.family		= NFPROTO_INET,
	.ops            = &nft_nat_inet_ops,
	.policy         = nft_nat_policy,
	.maxattr        = NFTA_NAT_MAX,
	.owner          = THIS_MODULE,
};

static int nft_nat_inet_module_init(void)
{
	return nft_register_expr(&nft_inet_nat_type);
}

static void nft_nat_inet_module_exit(void)
{
	nft_unregister_expr(&nft_inet_nat_type);
}
#else
static int nft_nat_inet_module_init(void) { return 0; }
static void nft_nat_inet_module_exit(void) { }
#endif

static int __init nft_nat_module_init(void)
{
	int ret = nft_nat_inet_module_init();

	if (ret)
		return ret;

	ret = nft_register_expr(&nft_nat_type);
	if (ret)
		nft_nat_inet_module_exit();

	return ret;
}

static void __exit nft_nat_module_exit(void)
{
	nft_nat_inet_module_exit();
	nft_unregister_expr(&nft_nat_type);
}

module_init(nft_nat_module_init);
module_exit(nft_nat_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>");
MODULE_ALIAS_NFT_EXPR("nat");
MODULE_DESCRIPTION("Network Address Translation support");
Commit	Line	Data
75a6faf6	1	// SPDX-License-Identifier: GPL-2.0-only
eb31628e TB	2	/*
	3	* Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
	4	* Copyright (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
	5	* Copyright (c) 2012 Intel Corporation
eb31628e TB	6	*/
	7
	8	#include <linux/module.h>
	9	#include <linux/init.h>
	10	#include <linux/skbuff.h>
	11	#include <linux/ip.h>
	12	#include <linux/string.h>
	13	#include <linux/netlink.h>
	14	#include <linux/netfilter.h>
	15	#include <linux/netfilter_ipv4.h>
	16	#include <linux/netfilter/nfnetlink.h>
	17	#include <linux/netfilter/nf_tables.h>
	18	#include <net/netfilter/nf_conntrack.h>
	19	#include <net/netfilter/nf_nat.h>
eb31628e	20	#include <net/netfilter/nf_tables.h>
eb31628e TB	21	#include <net/ip.h>
	22
	23	struct nft_nat {
4f16d25c PNA	24	u8 sreg_addr_min;
	25	u8 sreg_addr_max;
	26	u8 sreg_proto_min;
	27	u8 sreg_proto_max;
a4c2e8be PM	28	enum nf_nat_manip_type type:8;
a4c2e8be PM	29	u8 family;
e42eff8a	30	u16 flags;
eb31628e TB	31	};
eb31628e TB	32
acd766e3 PNA	33	static void nft_nat_setup_addr(struct nf_nat_range2 *range,
	34	const struct nft_regs *regs,
	35	const struct nft_nat *priv)
	36	{
	37	switch (priv->family) {
	38	case AF_INET:
	39	range->min_addr.ip = (__force __be32)
	40	regs->data[priv->sreg_addr_min];
	41	range->max_addr.ip = (__force __be32)
	42	regs->data[priv->sreg_addr_max];
	43	break;
	44	case AF_INET6:
	45	memcpy(range->min_addr.ip6, &regs->data[priv->sreg_addr_min],
	46	sizeof(range->min_addr.ip6));
	47	memcpy(range->max_addr.ip6, &regs->data[priv->sreg_addr_max],
	48	sizeof(range->max_addr.ip6));
	49	break;
	50	}
	51	}
	52
	53	static void nft_nat_setup_proto(struct nf_nat_range2 *range,
	54	const struct nft_regs *regs,
	55	const struct nft_nat *priv)
	56	{
	57	range->min_proto.all = (__force __be16)
	58	nft_reg_load16(&regs->data[priv->sreg_proto_min]);
	59	range->max_proto.all = (__force __be16)
	60	nft_reg_load16(&regs->data[priv->sreg_proto_max]);
	61	}
	62
3ff7ddb1 PNA	63	static void nft_nat_setup_netmap(struct nf_nat_range2 *range,
	64	const struct nft_pktinfo *pkt,
	65	const struct nft_nat *priv)
	66	{
	67	struct sk_buff *skb = pkt->skb;
	68	union nf_inet_addr new_addr;
	69	__be32 netmask;
	70	int i, len = 0;
	71
	72	switch (priv->type) {
	73	case NFT_NAT_SNAT:
	74	if (nft_pf(pkt) == NFPROTO_IPV4) {
	75	new_addr.ip = ip_hdr(skb)->saddr;
	76	len = sizeof(struct in_addr);
	77	} else {
	78	new_addr.in6 = ipv6_hdr(skb)->saddr;
	79	len = sizeof(struct in6_addr);
	80	}
	81	break;
	82	case NFT_NAT_DNAT:
	83	if (nft_pf(pkt) == NFPROTO_IPV4) {
	84	new_addr.ip = ip_hdr(skb)->daddr;
	85	len = sizeof(struct in_addr);
	86	} else {
	87	new_addr.in6 = ipv6_hdr(skb)->daddr;
	88	len = sizeof(struct in6_addr);
	89	}
	90	break;
	91	}
	92
	93	for (i = 0; i < len / sizeof(__be32); i++) {
	94	netmask = ~(range->min_addr.ip6[i] ^ range->max_addr.ip6[i]);
	95	new_addr.ip6[i] &= ~netmask;
	96	new_addr.ip6[i] \|= range->min_addr.ip6[i] & netmask;
	97	}
	98
	99	range->min_addr = new_addr;
	100	range->max_addr = new_addr;
	101	}
	102
eb31628e	103	static void nft_nat_eval(const struct nft_expr *expr,
a55e22e9	104	struct nft_regs *regs,
eb31628e TB	105	const struct nft_pktinfo *pkt)
	106	{
	107	const struct nft_nat *priv = nft_expr_priv(expr);
	108	enum ip_conntrack_info ctinfo;
	109	struct nf_conn *ct = nf_ct_get(pkt->skb, &ctinfo);
2eb0f624	110	struct nf_nat_range2 range;
eb31628e TB	111
eb31628e TB	112	memset(&range, 0, sizeof(range));
3ff7ddb1 PNA	113
3ff7ddb1 PNA	114	if (priv->sreg_addr_min) {
acd766e3	115	nft_nat_setup_addr(&range, regs, priv);
3ff7ddb1 PNA	116	if (priv->flags & NF_NAT_RANGE_NETMAP)
	117	nft_nat_setup_netmap(&range, pkt, priv);
	118	}
eb31628e	119
acd766e3 PNA	120	if (priv->sreg_proto_min)
acd766e3 PNA	121	nft_nat_setup_proto(&range, regs, priv);
eb31628e	122
4566aa44	123	range.flags = priv->flags;
e42eff8a	124
a55e22e9	125	regs->verdict.code = nf_nat_setup_info(ct, &range, priv->type);
eb31628e TB	126	}
	127
	128	static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = {
	129	[NFTA_NAT_TYPE] = { .type = NLA_U32 },
	130	[NFTA_NAT_FAMILY] = { .type = NLA_U32 },
	131	[NFTA_NAT_REG_ADDR_MIN] = { .type = NLA_U32 },
	132	[NFTA_NAT_REG_ADDR_MAX] = { .type = NLA_U32 },
	133	[NFTA_NAT_REG_PROTO_MIN] = { .type = NLA_U32 },
	134	[NFTA_NAT_REG_PROTO_MAX] = { .type = NLA_U32 },
e42eff8a	135	[NFTA_NAT_FLAGS] = { .type = NLA_U32 },
eb31628e TB	136	};
eb31628e TB	137
75e8d06d PNA	138	static int nft_nat_validate(const struct nft_ctx *ctx,
	139	const struct nft_expr *expr,
	140	const struct nft_data **data)
eb31628e TB	141	{
	142	struct nft_nat *priv = nft_expr_priv(expr);
	143	int err;
	144
7210e4e3 PNA	145	err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
	146	if (err < 0)
	147	return err;
	148
75e8d06d PNA	149	switch (priv->type) {
	150	case NFT_NAT_SNAT:
	151	err = nft_chain_validate_hooks(ctx->chain,
	152	(1 << NF_INET_POST_ROUTING) \|
	153	(1 << NF_INET_LOCAL_IN));
	154	break;
	155	case NFT_NAT_DNAT:
	156	err = nft_chain_validate_hooks(ctx->chain,
	157	(1 << NF_INET_PRE_ROUTING) \|
	158	(1 << NF_INET_LOCAL_OUT));
	159	break;
	160	}
	161
	162	return err;
	163	}
	164
	165	static int nft_nat_init(const struct nft_ctx ctx, const struct nft_expr expr,
	166	const struct nlattr * const tb[])
	167	{
	168	struct nft_nat *priv = nft_expr_priv(expr);
d07db988	169	unsigned int alen, plen;
75e8d06d PNA	170	u32 family;
	171	int err;
	172
5c819a39 PNA	173	if (tb[NFTA_NAT_TYPE] == NULL \|\|
	174	(tb[NFTA_NAT_REG_ADDR_MIN] == NULL &&
	175	tb[NFTA_NAT_REG_PROTO_MIN] == NULL))
eb31628e TB	176	return -EINVAL;
	177
	178	switch (ntohl(nla_get_be32(tb[NFTA_NAT_TYPE]))) {
	179	case NFT_NAT_SNAT:
	180	priv->type = NF_NAT_MANIP_SRC;
	181	break;
	182	case NFT_NAT_DNAT:
	183	priv->type = NF_NAT_MANIP_DST;
	184	break;
	185	default:
0d7c8346	186	return -EOPNOTSUPP;
eb31628e TB	187	}
	188
	189	if (tb[NFTA_NAT_FAMILY] == NULL)
	190	return -EINVAL;
	191
a4c2e8be	192	family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY]));
d164385e	193	if (ctx->family != NFPROTO_INET && ctx->family != family)
a4c2e8be	194	return -EOPNOTSUPP;
d07db988 PM	195
	196	switch (family) {
	197	case NFPROTO_IPV4:
c593642c	198	alen = sizeof_field(struct nf_nat_range, min_addr.ip);
d07db988 PM	199	break;
d07db988 PM	200	case NFPROTO_IPV6:
c593642c	201	alen = sizeof_field(struct nf_nat_range, min_addr.ip6);
d07db988 PM	202	break;
d07db988 PM	203	default:
a33f387e PNA	204	if (tb[NFTA_NAT_REG_ADDR_MIN])
	205	return -EAFNOSUPPORT;
	206	break;
d07db988	207	}
a4c2e8be	208	priv->family = family;
eb31628e TB	209
eb31628e TB	210	if (tb[NFTA_NAT_REG_ADDR_MIN]) {
4f16d25c PNA	211	err = nft_parse_register_load(tb[NFTA_NAT_REG_ADDR_MIN],
4f16d25c PNA	212	&priv->sreg_addr_min, alen);
eb31628e TB	213	if (err < 0)
eb31628e TB	214	return err;
eb31628e	215
61cfac6b	216	if (tb[NFTA_NAT_REG_ADDR_MAX]) {
4f16d25c PNA	217	err = nft_parse_register_load(tb[NFTA_NAT_REG_ADDR_MAX],
	218	&priv->sreg_addr_max,
	219	alen);
61cfac6b PNA	220	if (err < 0)
	221	return err;
	222	} else {
	223	priv->sreg_addr_max = priv->sreg_addr_min;
	224	}
4566aa44 PNA	225
4566aa44 PNA	226	priv->flags \|= NF_NAT_RANGE_MAP_IPS;
61cfac6b	227	}
eb31628e	228
c593642c	229	plen = sizeof_field(struct nf_nat_range, min_addr.all);
eb31628e	230	if (tb[NFTA_NAT_REG_PROTO_MIN]) {
4f16d25c PNA	231	err = nft_parse_register_load(tb[NFTA_NAT_REG_PROTO_MIN],
4f16d25c PNA	232	&priv->sreg_proto_min, plen);
eb31628e TB	233	if (err < 0)
eb31628e TB	234	return err;
eb31628e	235
61cfac6b	236	if (tb[NFTA_NAT_REG_PROTO_MAX]) {
4f16d25c PNA	237	err = nft_parse_register_load(tb[NFTA_NAT_REG_PROTO_MAX],
	238	&priv->sreg_proto_max,
	239	plen);
61cfac6b PNA	240	if (err < 0)
	241	return err;
	242	} else {
	243	priv->sreg_proto_max = priv->sreg_proto_min;
	244	}
4566aa44 PNA	245
4566aa44 PNA	246	priv->flags \|= NF_NAT_RANGE_PROTO_SPECIFIED;
61cfac6b	247	}
eb31628e	248
e42eff8a	249	if (tb[NFTA_NAT_FLAGS]) {
4566aa44	250	priv->flags \|= ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
e42eff8a	251	if (priv->flags & ~NF_NAT_RANGE_MASK)
0d7c8346	252	return -EOPNOTSUPP;
e42eff8a AB	253	}
e42eff8a AB	254
20afd423	255	return nf_ct_netns_get(ctx->net, family);
eb31628e TB	256	}
	257
	258	static int nft_nat_dump(struct sk_buff skb, const struct nft_expr expr)
	259	{
	260	const struct nft_nat *priv = nft_expr_priv(expr);
	261
	262	switch (priv->type) {
	263	case NF_NAT_MANIP_SRC:
	264	if (nla_put_be32(skb, NFTA_NAT_TYPE, htonl(NFT_NAT_SNAT)))
	265	goto nla_put_failure;
	266	break;
	267	case NF_NAT_MANIP_DST:
	268	if (nla_put_be32(skb, NFTA_NAT_TYPE, htonl(NFT_NAT_DNAT)))
	269	goto nla_put_failure;
	270	break;
	271	}
	272
	273	if (nla_put_be32(skb, NFTA_NAT_FAMILY, htonl(priv->family)))
	274	goto nla_put_failure;
1e2d56a5 PNA	275
1e2d56a5 PNA	276	if (priv->sreg_addr_min) {
b1c96ed3 PM	277	if (nft_dump_register(skb, NFTA_NAT_REG_ADDR_MIN,
	278	priv->sreg_addr_min) \|\|
	279	nft_dump_register(skb, NFTA_NAT_REG_ADDR_MAX,
	280	priv->sreg_addr_max))
1e2d56a5 PNA	281	goto nla_put_failure;
	282	}
	283
91513606	284	if (priv->sreg_proto_min) {
b1c96ed3 PM	285	if (nft_dump_register(skb, NFTA_NAT_REG_PROTO_MIN,
	286	priv->sreg_proto_min) \|\|
	287	nft_dump_register(skb, NFTA_NAT_REG_PROTO_MAX,
	288	priv->sreg_proto_max))
91513606 PNA	289	goto nla_put_failure;
91513606 PNA	290	}
e42eff8a AB	291
	292	if (priv->flags != 0) {
	293	if (nla_put_be32(skb, NFTA_NAT_FLAGS, htonl(priv->flags)))
	294	goto nla_put_failure;
	295	}
	296
eb31628e TB	297	return 0;
	298
	299	nla_put_failure:
	300	return -1;
	301	}
	302
20afd423 FW	303	static void
	304	nft_nat_destroy(const struct nft_ctx ctx, const struct nft_expr expr)
	305	{
	306	const struct nft_nat *priv = nft_expr_priv(expr);
	307
	308	nf_ct_netns_put(ctx->net, priv->family);
	309	}
	310
eb31628e TB	311	static struct nft_expr_type nft_nat_type;
	312	static const struct nft_expr_ops nft_nat_ops = {
	313	.type = &nft_nat_type,
	314	.size = NFT_EXPR_SIZE(sizeof(struct nft_nat)),
	315	.eval = nft_nat_eval,
	316	.init = nft_nat_init,
20afd423	317	.destroy = nft_nat_destroy,
eb31628e	318	.dump = nft_nat_dump,
7210e4e3	319	.validate = nft_nat_validate,
eb31628e TB	320	};
	321
	322	static struct nft_expr_type nft_nat_type __read_mostly = {
	323	.name = "nat",
	324	.ops = &nft_nat_ops,
	325	.policy = nft_nat_policy,
	326	.maxattr = NFTA_NAT_MAX,
	327	.owner = THIS_MODULE,
	328	};
	329
d164385e FW	330	#ifdef CONFIG_NF_TABLES_INET
	331	static void nft_nat_inet_eval(const struct nft_expr *expr,
	332	struct nft_regs *regs,
	333	const struct nft_pktinfo *pkt)
	334	{
	335	const struct nft_nat *priv = nft_expr_priv(expr);
	336
	337	if (priv->family == nft_pf(pkt))
	338	nft_nat_eval(expr, regs, pkt);
	339	}
	340
	341	static const struct nft_expr_ops nft_nat_inet_ops = {
	342	.type = &nft_nat_type,
	343	.size = NFT_EXPR_SIZE(sizeof(struct nft_nat)),
	344	.eval = nft_nat_inet_eval,
	345	.init = nft_nat_init,
	346	.destroy = nft_nat_destroy,
	347	.dump = nft_nat_dump,
	348	.validate = nft_nat_validate,
	349	};
	350
	351	static struct nft_expr_type nft_inet_nat_type __read_mostly = {
	352	.name = "nat",
	353	.family = NFPROTO_INET,
	354	.ops = &nft_nat_inet_ops,
	355	.policy = nft_nat_policy,
	356	.maxattr = NFTA_NAT_MAX,
	357	.owner = THIS_MODULE,
	358	};
	359
	360	static int nft_nat_inet_module_init(void)
	361	{
	362	return nft_register_expr(&nft_inet_nat_type);
	363	}
	364
	365	static void nft_nat_inet_module_exit(void)
	366	{
	367	nft_unregister_expr(&nft_inet_nat_type);
	368	}
	369	#else
	370	static int nft_nat_inet_module_init(void) { return 0; }
	371	static void nft_nat_inet_module_exit(void) { }
	372	#endif
	373
eb31628e TB	374	static int __init nft_nat_module_init(void)
eb31628e TB	375	{
d164385e FW	376	int ret = nft_nat_inet_module_init();
	377
	378	if (ret)
	379	return ret;
	380
	381	ret = nft_register_expr(&nft_nat_type);
	382	if (ret)
	383	nft_nat_inet_module_exit();
	384
	385	return ret;
eb31628e TB	386	}
	387
	388	static void __exit nft_nat_module_exit(void)
	389	{
d164385e	390	nft_nat_inet_module_exit();
eb31628e TB	391	nft_unregister_expr(&nft_nat_type);
	392	}
	393
	394	module_init(nft_nat_module_init);
	395	module_exit(nft_nat_module_exit);
	396
	397	MODULE_LICENSE("GPL");
	398	MODULE_AUTHOR("Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>");
	399	MODULE_ALIAS_NFT_EXPR("nat");
4cacc395	400	MODULE_DESCRIPTION("Network Address Translation support");