ip_nat_seq_adjust in a l4 protocol helper

diff -u -r1.1.1.1 ip_nat_core.h
@@ -26,6 +26,10 @@
 extern void place_in_hashes(struct ip_conntrack *conntrack,
 			    struct ip_nat_info *info);
 
+extern u_int16_t
+ip_nat_cheat_check(u_int32_t oldvalinv, u_int32_t newval, 
+		   u_int16_t oldcheck);
+
 /* Built-in protocols. */
 extern struct ip_nat_protocol ip_nat_protocol_tcp;
 extern struct ip_nat_protocol ip_nat_protocol_udp;

diff -u -r1.1.1.1 ip_nat_protocol.h
@@ -45,6 +45,9 @@
 
 	unsigned int (*print_range)(char *buffer,
 				    const struct ip_nat_range *range);
+
+	unsigned int (*adjust)(struct sk_buff **pskb, struct ip_conntrack *ct,
+			       enum ip_conntrack_info ctinfo, int hooknum);
 };
 
 /* Protocol registration. */

diff -u -r1.2 ip_nat_core.c
@@ -709,7 +709,7 @@
 
 /* Returns true if succeeded. */
 static int
-manip_pkt(u_int16_t proto,
+manip_pkt(struct ip_nat_protocol *protocol,
 	  struct sk_buff **pskb,
 	  unsigned int iphdroff,
 	  const struct ip_conntrack_manip *manip,

@@ -724,9 +724,7 @@
 	iph = (void *)(*pskb)->data + iphdroff;
 
 	/* Manipulate protcol part. */
-	if (!find_nat_proto(proto)->manip_pkt(pskb,
-					      iphdroff + iph->ihl*4,
-					      manip, maniptype))
+	if (!protocol->manip_pkt(pskb, iphdroff + iph->ihl*4, manip, maniptype))
 		return 0;
 
 	iph = (void *)(*pskb)->data + iphdroff;

@@ -769,6 +767,9 @@
 	struct ip_nat_helper *helper;
 	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 	int proto = (*pskb)->nh.iph->protocol;
+	struct ip_nat_protocol *protocol;
+
+	protocol = find_nat_proto(proto);
 
 	/* Need nat lock to protect against modification, but neither
 	   conntrack (referenced) and helper (deleted with

@@ -783,7 +784,7 @@
 			       ? "SRC" : "DST",
 			       NIPQUAD(info->manips[i].manip.ip),
 			       htons(info->manips[i].manip.u.all));
-			if (!manip_pkt(proto, pskb, 0,
+			if (!manip_pkt(protocol, pskb, 0,
 				       &info->manips[i].manip,
 				       info->manips[i].maniptype)) {
 				READ_UNLOCK(&ip_nat_lock);

@@ -844,13 +845,9 @@
 		
 		/* Adjust sequence number only once per packet 
 		 * (helper is called at all hooks) */
-		if (proto == IPPROTO_TCP
-		    && (hooknum == NF_IP_POST_ROUTING
-			|| hooknum == NF_IP_LOCAL_IN)) {
+		if (protocol->adjust != NULL) {
 			DEBUGP("ip_nat_core: adjusting sequence number\n");
-			/* future: put this in a l4-proto specific function,
-			 * and call this function here. */
-			if (!ip_nat_seq_adjust(pskb, ct, ctinfo))
+			if (!protocol->adjust(pskb, ct, ctinfo, hooknum))
 				ret = NF_DROP;
 		}
 

@@ -935,12 +932,15 @@
 		   where we would normally apply a dst manip, we apply
 		   a src, and vice versa. */
 		if (info->manips[i].hooknum == hooknum) {
+			struct ip_nat_protocol *proto;
+			proto = find_nat_proto(inside->ip.protocol);
+			
 			DEBUGP("icmp_reply: inner %s -> %u.%u.%u.%u %u\n",
 			       info->manips[i].maniptype == IP_NAT_MANIP_SRC
 			       ? "DST" : "SRC",
 			       NIPQUAD(info->manips[i].manip.ip),
 			       ntohs(info->manips[i].manip.u.udp.port));
-			if (!manip_pkt(inside->ip.protocol, pskb,
+			if (!manip_pkt(proto, pskb,
 				       (*pskb)->nh.iph->ihl*4
 				       + sizeof(inside->icmp),
 				       &info->manips[i].manip,

@@ -950,13 +950,13 @@
 			/* Outer packet needs to have IP header NATed like
 	                   it's a reply. */
 
-			/* Use mapping to map outer packet: 0 give no
-                           per-proto mapping */
+			/* Use mapping to map outer packet: 
+			 * unknown_nat_protocol, no per-proto mapping */
 			DEBUGP("icmp_reply: outer %s -> %u.%u.%u.%u\n",
 			       info->manips[i].maniptype == IP_NAT_MANIP_SRC
 			       ? "SRC" : "DST",
 			       NIPQUAD(info->manips[i].manip.ip));
-			if (!manip_pkt(0, pskb, 0,
+			if (!manip_pkt(&unknown_nat_protocol, pskb, 0,
 				       &info->manips[i].manip,
 				       info->manips[i].maniptype))
 				goto unlock_fail;

149 lines not on this page · raw message

191 lines not on this page · raw message