1 /* (C) 2001-2002 Magnus Boden <mb@ozaba.mine.nu>
3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License version 2 as
5 * published by the Free Software Foundation.
9 * Thu 21 Mar 2002 Harald Welte <laforge@gnumonks.org>
10 * - Port to newnat API
12 * This module currently supports DNAT:
13 * iptables -t nat -A PREROUTING -d x.x.x.x -j DNAT --to-dest x.x.x.y
16 * iptables -t nat -A POSTROUTING { -j MASQUERADE , -j SNAT --to-source x.x.x.x }
18 * It has not been tested with
19 * -j SNAT --to-source x.x.x.x-x.x.x.y since I only have one external ip
20 * If you do test this please let me know if it works or not.
24 #include <linux/module.h>
25 #include <linux/netfilter_ipv4.h>
27 #include <linux/udp.h>
29 #include <linux/netfilter.h>
30 #include <linux/netfilter_ipv4/ip_tables.h>
31 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
32 #include <linux/netfilter_ipv4/ip_conntrack_tftp.h>
33 #include <linux/netfilter_ipv4/ip_nat_helper.h>
34 #include <linux/netfilter_ipv4/ip_nat_rule.h>
36 MODULE_AUTHOR("Magnus Boden <mb@ozaba.mine.nu>");
37 MODULE_DESCRIPTION("tftp NAT helper");
38 MODULE_LICENSE("GPL");
42 static int ports[MAX_PORTS];
43 static int ports_c = 0;
44 MODULE_PARM(ports,"1-" __MODULE_STRING(MAX_PORTS) "i");
45 MODULE_PARM_DESC(ports, "port numbers of tftp servers");
48 #define DEBUGP(format, args...) printk("%s:%s:" format, \
49 __FILE__, __FUNCTION__ , ## args)
51 #define DEBUGP(format, args...)
54 tftp_nat_help(struct ip_conntrack *ct,
55 struct ip_conntrack_expect *exp,
56 struct ip_nat_info *info,
57 enum ip_conntrack_info ctinfo,
59 struct sk_buff **pskb)
61 int dir = CTINFO2DIR(ctinfo);
63 struct ip_conntrack_tuple repl;
65 if (!((hooknum == NF_IP_POST_ROUTING && dir == IP_CT_DIR_ORIGINAL)
66 || (hooknum == NF_IP_PRE_ROUTING && dir == IP_CT_DIR_REPLY)))
70 DEBUGP("no conntrack expectation to modify\n");
74 if (skb_copy_bits(*pskb, (*pskb)->nh.iph->ihl*4+sizeof(struct udphdr),
75 &tftph, sizeof(tftph)) != 0)
78 switch (ntohs(tftph.opcode)) {
79 /* RRQ and WRQ works the same way */
80 case TFTP_OPCODE_READ:
81 case TFTP_OPCODE_WRITE:
82 repl = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
84 DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
85 DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
86 DEBUGP("expecting: ");
88 DUMP_TUPLE(&exp->mask);
89 ip_conntrack_change_expect(exp, &repl);
92 DEBUGP("Unknown opcode\n");
99 tftp_nat_expected(struct sk_buff **pskb,
100 unsigned int hooknum,
101 struct ip_conntrack *ct,
102 struct ip_nat_info *info)
104 const struct ip_conntrack *master = ct->master->expectant;
105 const struct ip_conntrack_tuple *orig =
106 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
107 struct ip_nat_multi_range mr;
109 const struct ip_conntrack_tuple *repl =
110 &master->tuplehash[IP_CT_DIR_REPLY].tuple;
113 if (skb_copy_bits(*pskb,(*pskb)->nh.iph->ihl*4,&udph,sizeof(udph))!=0)
118 IP_NF_ASSERT(master);
119 IP_NF_ASSERT(!(info->initialized & (1 << HOOK2MANIP(hooknum))));
122 mr.range[0].flags = IP_NAT_RANGE_MAP_IPS;
124 if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC) {
125 mr.range[0].min_ip = mr.range[0].max_ip = orig->dst.ip;
126 DEBUGP("orig: %u.%u.%u.%u:%u <-> %u.%u.%u.%u:%u "
127 "newsrc: %u.%u.%u.%u\n",
128 NIPQUAD((*pskb)->nh.iph->saddr), ntohs(udph.source),
129 NIPQUAD((*pskb)->nh.iph->daddr), ntohs(udph.dest),
130 NIPQUAD(orig->dst.ip));
132 mr.range[0].min_ip = mr.range[0].max_ip = orig->src.ip;
133 mr.range[0].min.udp.port = mr.range[0].max.udp.port =
134 orig->src.u.udp.port;
135 mr.range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
137 DEBUGP("orig: %u.%u.%u.%u:%u <-> %u.%u.%u.%u:%u "
138 "newdst: %u.%u.%u.%u:%u\n",
139 NIPQUAD((*pskb)->nh.iph->saddr), ntohs(udph.source),
140 NIPQUAD((*pskb)->nh.iph->daddr), ntohs(udph.dest),
141 NIPQUAD(orig->src.ip), ntohs(orig->src.u.udp.port));
144 return ip_nat_setup_info(ct,&mr,hooknum);
147 static struct ip_nat_helper tftp[MAX_PORTS];
148 static char tftp_names[MAX_PORTS][10];
150 static void fini(void)
154 for (i = 0 ; i < ports_c; i++) {
155 DEBUGP("unregistering helper for port %d\n", ports[i]);
156 ip_nat_helper_unregister(&tftp[i]);
160 static int __init init(void)
166 ports[0] = TFTP_PORT;
168 for (i = 0 ; (i < MAX_PORTS) && ports[i] ; i++) {
169 memset(&tftp[i], 0, sizeof(struct ip_nat_helper));
171 tftp[i].tuple.dst.protonum = IPPROTO_UDP;
172 tftp[i].tuple.src.u.udp.port = htons(ports[i]);
173 tftp[i].mask.dst.protonum = 0xFFFF;
174 tftp[i].mask.src.u.udp.port = 0xFFFF;
175 tftp[i].help = tftp_nat_help;
177 tftp[i].me = THIS_MODULE;
178 tftp[i].expect = tftp_nat_expected;
180 tmpname = &tftp_names[i][0];
181 if (ports[i] == TFTP_PORT)
182 sprintf(tmpname, "tftp");
184 sprintf(tmpname, "tftp-%d", i);
185 tftp[i].name = tmpname;
187 DEBUGP("ip_nat_tftp: registering for port %d: name %s\n",
188 ports[i], tftp[i].name);
189 ret = ip_nat_helper_register(&tftp[i]);
192 printk("ip_nat_tftp: unable to register for port %d\n",