net/ipv4/netfilter/ip_nat_tftp.c

   1 /*
   2  * Licensed under GNU GPL version 2 Copyright Magnus Boden <mb@ozaba.mine.nu>
   3  * Version: 0.0.7
   4  *
   5  * Thu 21 Mar 2002 Harald Welte <laforge@gnumonks.org>
   6  *      - Port to newnat API
   7  *
   8  * This module currently supports DNAT:
   9  * iptables -t nat -A PREROUTING -d x.x.x.x -j DNAT --to-dest x.x.x.y
  10  *
  11  * and SNAT:
  12  * iptables -t nat -A POSTROUTING { -j MASQUERADE , -j SNAT --to-source x.x.x.x }
  13  *
  14  * It has not been tested with
  15  * -j SNAT --to-source x.x.x.x-x.x.x.y since I only have one external ip
  16  * If you do test this please let me know if it works or not.
  17  *
  18  */
  19
  20 #include <linux/module.h>
  21 #include <linux/netfilter_ipv4.h>
  22 #include <linux/ip.h>
  23 #include <linux/udp.h>
  24
  25 #include <linux/netfilter.h>
  26 #include <linux/netfilter_ipv4/ip_tables.h>
  27 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
  28 #include <linux/netfilter_ipv4/ip_conntrack_tftp.h>
  29 #include <linux/netfilter_ipv4/ip_nat_helper.h>
  30 #include <linux/netfilter_ipv4/ip_nat_rule.h>
  31
  32 MODULE_AUTHOR("Magnus Boden <mb@ozaba.mine.nu>");
  33 MODULE_DESCRIPTION("Netfilter NAT helper for tftp");
  34 MODULE_LICENSE("GPL");
  35
  36 #define MAX_PORTS 8
  37
  38 static int ports[MAX_PORTS];
  39 static int ports_c = 0;
  40 #ifdef MODULE_PARM
  41 MODULE_PARM(ports,"1-" __MODULE_STRING(MAX_PORTS) "i");
  42 MODULE_PARM_DESC(ports, "port numbers of tftp servers");
  43 #endif
  44
  45 #if 0
  46 #define DEBUGP(format, args...) printk(__FILE__ ":" __FUNCTION__ ": " \
  47                                        format, ## args)
  48 #else
  49 #define DEBUGP(format, args...)
  50 #endif
  51 static unsigned int
  52 tftp_nat_help(struct ip_conntrack *ct,
  53               struct ip_conntrack_expect *exp,
  54               struct ip_nat_info *info,
  55               enum ip_conntrack_info ctinfo,
  56               unsigned int hooknum,
  57               struct sk_buff **pskb)
  58 {
  59         int dir = CTINFO2DIR(ctinfo);
  60         struct iphdr *iph = (*pskb)->nh.iph;
  61         struct udphdr *udph = (void *)iph + iph->ihl * 4;
  62         struct tftphdr *tftph = (void *)udph + 8;
  63         struct ip_conntrack_tuple repl;
  64
  65         if (!((hooknum == NF_IP_POST_ROUTING && dir == IP_CT_DIR_ORIGINAL)
  66               || (hooknum == NF_IP_PRE_ROUTING && dir == IP_CT_DIR_REPLY)))
  67                 return NF_ACCEPT;
  68
  69         if (!exp) {
  70                 DEBUGP("no conntrack expectation to modify\n");
  71                 return NF_ACCEPT;
  72         }
  73
  74         switch (ntohs(tftph->opcode)) {
  75         /* RRQ and WRQ works the same way */
  76         case TFTP_OPCODE_READ:
  77         case TFTP_OPCODE_WRITE:
  78                 repl = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
  79                 DEBUGP("");
  80                 DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
  81                 DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
  82                 DEBUGP("expecting: ");
  83                 DUMP_TUPLE(&repl);
  84                 DUMP_TUPLE(&exp->mask);
  85                 ip_conntrack_change_expect(exp, &repl);
  86                 break;
  87         default:
  88                 DEBUGP("Unknown opcode\n");
  89         }
  90
  91         return NF_ACCEPT;
  92 }
  93
  94 static unsigned int
  95 tftp_nat_expected(struct sk_buff **pskb,
  96                   unsigned int hooknum,
  97                   struct ip_conntrack *ct,
  98                   struct ip_nat_info *info)
  99 {
 100         const struct ip_conntrack *master = ct->master->expectant;
 101         const struct ip_conntrack_tuple *orig =
 102                         &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
 103         struct ip_nat_multi_range mr;
 104 #if 0
 105         const struct ip_conntrack_tuple *repl =
 106                         &master->tuplehash[IP_CT_DIR_REPLY].tuple;
 107         struct iphdr *iph = (*pskb)->nh.iph;
 108         struct udphdr *udph = (void *)iph + iph->ihl*4;
 109 #endif
 110
 111         IP_NF_ASSERT(info);
 112         IP_NF_ASSERT(master);
 113         IP_NF_ASSERT(!(info->initialized & (1 << HOOK2MANIP(hooknum))));
 114
 115         mr.rangesize = 1;
 116         mr.range[0].flags = IP_NAT_RANGE_MAP_IPS;
 117
 118         if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC) {
 119                 mr.range[0].min_ip = mr.range[0].max_ip = orig->dst.ip;
 120                 DEBUGP("orig: %u.%u.%u.%u:%u <-> %u.%u.%u.%u:%u "
 121                         "newsrc: %u.%u.%u.%u\n",
 122                         NIPQUAD((*pskb)->nh.iph->saddr), ntohs(udph->source),
 123                         NIPQUAD((*pskb)->nh.iph->daddr), ntohs(udph->dest),
 124                         NIPQUAD(orig->dst.ip));
 125         } else {
 126                 mr.range[0].min_ip = mr.range[0].max_ip = orig->src.ip;
 127                 mr.range[0].min.udp.port = mr.range[0].max.udp.port =
 128                                                         orig->src.u.udp.port;
 129                 mr.range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
 130
 131                 DEBUGP("orig: %u.%u.%u.%u:%u <-> %u.%u.%u.%u:%u "
 132                         "newdst: %u.%u.%u.%u:%u\n",
 133                         NIPQUAD((*pskb)->nh.iph->saddr), ntohs(udph->source),
 134                         NIPQUAD((*pskb)->nh.iph->daddr), ntohs(udph->dest),
 135                         NIPQUAD(orig->src.ip), ntohs(orig->src.u.udp.port));
 136         }
 137
 138         return ip_nat_setup_info(ct,&mr,hooknum);
 139 }
 140
 141 static struct ip_nat_helper tftp[MAX_PORTS];
 142 static char tftp_names[MAX_PORTS][10];
 143
 144 static void fini(void)
 145 {
 146         int i;
 147
 148         for (i = 0 ; i < ports_c; i++) {
 149                 DEBUGP("unregistering helper for port %d\n", ports[i]);
 150                 ip_nat_helper_unregister(&tftp[i]);
 151         }
 152 }
 153
 154 static int __init init(void)
 155 {
 156         int i, ret = 0;
 157         char *tmpname;
 158
 159         if (!ports[0])
 160                 ports[0] = TFTP_PORT;
 161
 162         for (i = 0 ; (i < MAX_PORTS) && ports[i] ; i++) {
 163                 tftp[i].tuple.dst.protonum = IPPROTO_UDP;
 164                 tftp[i].tuple.src.u.udp.port = htons(ports[i]);
 165                 tftp[i].mask.dst.protonum = 0xFFFF;
 166                 tftp[i].mask.src.u.udp.port = 0xFFFF;
 167                 tftp[i].help = tftp_nat_help;
 168                 tftp[i].flags = 0;
 169                 tftp[i].me = THIS_MODULE;
 170                 tftp[i].expect = tftp_nat_expected;
 171
 172                 tmpname = &tftp_names[i][0];
 173                 if (ports[i] == TFTP_PORT)
 174                         sprintf(tmpname, "tftp");
 175                 else
 176                         sprintf(tmpname, "tftp-%d", i);
 177                 tftp[i].name = tmpname;
 178
 179                 DEBUGP("ip_nat_tftp: registering for port %d: name %s\n",
 180                         ports[i], tftp[i].name);
 181                 ret = ip_nat_helper_register(&tftp[i]);
 182
 183                 if (ret) {
 184                         printk("ip_nat_tftp: unable to register for port %d\n",
 185                                 ports[i]);
 186                         fini();
 187                         return ret;
 188                 }
 189                 ports_c++;
 190         }
 191         return ret;
 192 }
 193
 194 module_init(init);
 195 module_exit(fini);