URL https://opencores.org/ocsvn/or1k/or1k/trunk

Subversion Repositories or1k

[/] [or1k/] [trunk/] [linux/] [linux-2.4/] [net/] [ipv4/] [netfilter/] [ip_nat_proto_tcp.c] - Blame information for rev 1765

Details | Compare with Previous | View Log


#include <linux/types.h>
#include <linux/init.h>
#include <linux/netfilter.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/if.h>
#include <linux/netfilter_ipv4/ip_nat.h>
#include <linux/netfilter_ipv4/ip_nat_rule.h>
#include <linux/netfilter_ipv4/ip_nat_protocol.h>
 
static int
tcp_in_range(const struct ip_conntrack_tuple *tuple,
             enum ip_nat_manip_type maniptype,
             const union ip_conntrack_manip_proto *min,
             const union ip_conntrack_manip_proto *max)
{
        u_int16_t port;
 
        if (maniptype == IP_NAT_MANIP_SRC)
                port = tuple->src.u.tcp.port;
        else
                port = tuple->dst.u.tcp.port;
 
        return ntohs(port) >= ntohs(min->tcp.port)
                && ntohs(port) <= ntohs(max->tcp.port);
}
 
static int
tcp_unique_tuple(struct ip_conntrack_tuple *tuple,
                 const struct ip_nat_range *range,
                 enum ip_nat_manip_type maniptype,
                 const struct ip_conntrack *conntrack)
{
        static u_int16_t port = 0, *portptr;
        unsigned int range_size, min, i;
 
        if (maniptype == IP_NAT_MANIP_SRC)
                portptr = &tuple->src.u.tcp.port;
        else
                portptr = &tuple->dst.u.tcp.port;
 
        /* If no range specified... */
        if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) {
                /* If it's dst rewrite, can't change port */
                if (maniptype == IP_NAT_MANIP_DST)
                        return 0;
 
                /* Map privileged onto privileged. */
                if (ntohs(*portptr) < 1024) {
                        /* Loose convention: >> 512 is credential passing */
                        if (ntohs(*portptr)<512) {
                                min = 1;
                                range_size = 511 - min + 1;
                        } else {
                                min = 600;
                                range_size = 1023 - min + 1;
                        }
                } else {
                        min = 1024;
                        range_size = 65535 - 1024 + 1;
                }
        } else {
                min = ntohs(range->min.tcp.port);
                range_size = ntohs(range->max.tcp.port) - min + 1;
        }
 
        for (i = 0; i < range_size; i++, port++) {
                *portptr = htons(min + port % range_size);
                if (!ip_nat_used_tuple(tuple, conntrack)) {
                        return 1;
                }
        }
        return 0;
}
 
static void
tcp_manip_pkt(struct iphdr *iph, size_t len,
              const struct ip_conntrack_manip *manip,
              enum ip_nat_manip_type maniptype)
{
        struct tcphdr *hdr = (struct tcphdr *)((u_int32_t *)iph + iph->ihl);
        u_int32_t oldip;
        u_int16_t *portptr;
 
        if (maniptype == IP_NAT_MANIP_SRC) {
                /* Get rid of src ip and src pt */
                oldip = iph->saddr;
                portptr = &hdr->source;
        } else {
                /* Get rid of dst ip and dst pt */
                oldip = iph->daddr;
                portptr = &hdr->dest;
        }
 
        /* this could be a inner header returned in icmp packet; in such
           cases we cannot update the checksum field since it is outside of
           the 8 bytes of transport layer headers we are guaranteed */
        if(((void *)&hdr->check + sizeof(hdr->check) - (void *)iph) <= len) {
                hdr->check = ip_nat_cheat_check(~oldip, manip->ip,
                                        ip_nat_cheat_check(*portptr ^ 0xFFFF,
                                                           manip->u.tcp.port,
                                                           hdr->check));
        }
 
        *portptr = manip->u.tcp.port;
}
 
static unsigned int
tcp_print(char *buffer,
          const struct ip_conntrack_tuple *match,
          const struct ip_conntrack_tuple *mask)
{
        unsigned int len = 0;
 
        if (mask->src.u.tcp.port)
                len += sprintf(buffer + len, "srcpt=%u ",
                               ntohs(match->src.u.tcp.port));
 
 
        if (mask->dst.u.tcp.port)
                len += sprintf(buffer + len, "dstpt=%u ",
                               ntohs(match->dst.u.tcp.port));
 
        return len;
}
 
static unsigned int
tcp_print_range(char *buffer, const struct ip_nat_range *range)
{
        if (range->min.tcp.port != 0 || range->max.tcp.port != 0xFFFF) {
                if (range->min.tcp.port == range->max.tcp.port)
                        return sprintf(buffer, "port %u ",
                                       ntohs(range->min.tcp.port));
                else
                        return sprintf(buffer, "ports %u-%u ",
                                       ntohs(range->min.tcp.port),
                                       ntohs(range->max.tcp.port));
        }
        else return 0;
}
 
struct ip_nat_protocol ip_nat_protocol_tcp
= { { NULL, NULL }, "TCP", IPPROTO_TCP,
    tcp_manip_pkt,
    tcp_in_range,
    tcp_unique_tuple,
    tcp_print,
    tcp_print_range
};

Line No.	Rev	Author	Line
1	1275	phoenix	`#include <linux/types.h>`
2			`#include <linux/init.h>`
3			`#include <linux/netfilter.h>`
4			`#include <linux/ip.h>`
5			`#include <linux/tcp.h>`
6			`#include <linux/if.h>`
7			`#include <linux/netfilter_ipv4/ip_nat.h>`
8			`#include <linux/netfilter_ipv4/ip_nat_rule.h>`
9			`#include <linux/netfilter_ipv4/ip_nat_protocol.h>`
10
11			`static int`
12			`tcp_in_range(const struct ip_conntrack_tuple *tuple,`
13			`enum ip_nat_manip_type maniptype,`
14			`const union ip_conntrack_manip_proto *min,`
15			`const union ip_conntrack_manip_proto *max)`
16			`{`
17			`u_int16_t port;`
18
19			`if (maniptype == IP_NAT_MANIP_SRC)`
20			`port = tuple->src.u.tcp.port;`
21			`else`
22			`port = tuple->dst.u.tcp.port;`
23
24			`return ntohs(port) >= ntohs(min->tcp.port)`
25			`&& ntohs(port) <= ntohs(max->tcp.port);`
26			`}`
27
28			`static int`
29			`tcp_unique_tuple(struct ip_conntrack_tuple *tuple,`
30			`const struct ip_nat_range *range,`
31			`enum ip_nat_manip_type maniptype,`
32			`const struct ip_conntrack *conntrack)`
33			`{`
34			`static u_int16_t port = 0, *portptr;`
35			`unsigned int range_size, min, i;`
36
37			`if (maniptype == IP_NAT_MANIP_SRC)`
38			`portptr = &tuple->src.u.tcp.port;`
39			`else`
40			`portptr = &tuple->dst.u.tcp.port;`
41
42			`/* If no range specified... */`
43			`if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) {`
44			`/* If it's dst rewrite, can't change port */`
45			`if (maniptype == IP_NAT_MANIP_DST)`
46			`return 0;`
47
48			`/* Map privileged onto privileged. */`
49			`if (ntohs(*portptr) < 1024) {`
50			`/* Loose convention: >> 512 is credential passing */`
51			`if (ntohs(*portptr)<512) {`
52			`min = 1;`
53			`range_size = 511 - min + 1;`
54			`} else {`
55			`min = 600;`
56			`range_size = 1023 - min + 1;`
57			`}`
58			`} else {`
59			`min = 1024;`
60			`range_size = 65535 - 1024 + 1;`
61			`}`
62			`} else {`
63			`min = ntohs(range->min.tcp.port);`
64			`range_size = ntohs(range->max.tcp.port) - min + 1;`
65			`}`
66
67			`for (i = 0; i < range_size; i++, port++) {`
68			`*portptr = htons(min + port % range_size);`
69			`if (!ip_nat_used_tuple(tuple, conntrack)) {`
70			`return 1;`
71			`}`
72			`}`
73			`return 0;`
74			`}`
75
76			`static void`
77			`tcp_manip_pkt(struct iphdr *iph, size_t len,`
78			`const struct ip_conntrack_manip *manip,`
79			`enum ip_nat_manip_type maniptype)`
80			`{`
81			`struct tcphdr hdr = (struct tcphdr )((u_int32_t *)iph + iph->ihl);`
82			`u_int32_t oldip;`
83			`u_int16_t *portptr;`
84
85			`if (maniptype == IP_NAT_MANIP_SRC) {`
86			`/* Get rid of src ip and src pt */`
87			`oldip = iph->saddr;`
88			`portptr = &hdr->source;`
89			`} else {`
90			`/* Get rid of dst ip and dst pt */`
91			`oldip = iph->daddr;`
92			`portptr = &hdr->dest;`
93			`}`
94
95			`/* this could be a inner header returned in icmp packet; in such`
96			`cases we cannot update the checksum field since it is outside of`
97			`the 8 bytes of transport layer headers we are guaranteed */`
98			`if(((void )&hdr->check + sizeof(hdr->check) - (void )iph) <= len) {`
99			`hdr->check = ip_nat_cheat_check(~oldip, manip->ip,`
100			`ip_nat_cheat_check(*portptr ^ 0xFFFF,`
101			`manip->u.tcp.port,`
102			`hdr->check));`
103			`}`
104
105			`*portptr = manip->u.tcp.port;`
106			`}`
107
108			`static unsigned int`
109			`tcp_print(char *buffer,`
110			`const struct ip_conntrack_tuple *match,`
111			`const struct ip_conntrack_tuple *mask)`
112			`{`
113			`unsigned int len = 0;`
114
115			`if (mask->src.u.tcp.port)`
116			`len += sprintf(buffer + len, "srcpt=%u ",`
117			`ntohs(match->src.u.tcp.port));`
118
119
120			`if (mask->dst.u.tcp.port)`
121			`len += sprintf(buffer + len, "dstpt=%u ",`
122			`ntohs(match->dst.u.tcp.port));`
123
124			`return len;`
125			`}`
126
127			`static unsigned int`
128			`tcp_print_range(char buffer, const struct ip_nat_range range)`
129			`{`
130			`if (range->min.tcp.port != 0 \|\| range->max.tcp.port != 0xFFFF) {`
131			`if (range->min.tcp.port == range->max.tcp.port)`
132			`return sprintf(buffer, "port %u ",`
133			`ntohs(range->min.tcp.port));`
134			`else`
135			`return sprintf(buffer, "ports %u-%u ",`
136			`ntohs(range->min.tcp.port),`
137			`ntohs(range->max.tcp.port));`
138			`}`
139			`else return 0;`
140			`}`
141
142			`struct ip_nat_protocol ip_nat_protocol_tcp`
143			`= { { NULL, NULL }, "TCP", IPPROTO_TCP,`
144			`tcp_manip_pkt,`
145			`tcp_in_range,`
146			`tcp_unique_tuple,`
147			`tcp_print,`
148			`tcp_print_range`
149			`};`

Browse

Tools

Subversion Repositories or1k

[/] [or1k/] [trunk/] [linux/] [linux-2.4/] [net/] [ipv4/] [netfilter/] [ip_nat_proto_tcp.c] - Blame information for rev 1765