net/netfilter/nft_chain_nat.c

   1 // SPDX-License-Identifier: GPL-2.0
   2
   3 #include <linux/module.h>
   4 #include <linux/netfilter/nf_tables.h>
   5 #include <net/netfilter/nf_nat.h>
   6 #include <net/netfilter/nf_tables.h>
   7 #include <net/netfilter/nf_tables_ipv4.h>
   8 #include <net/netfilter/nf_tables_ipv6.h>
   9
  10 static unsigned int nft_nat_do_chain(void *priv, struct sk_buff *skb,
  11                                      const struct nf_hook_state *state)
  12 {
  13         struct nft_pktinfo pkt;
  14
  15         nft_set_pktinfo(&pkt, skb, state);
  16
  17         switch (state->pf) {
  18 #ifdef CONFIG_NF_TABLES_IPV4
  19         case NFPROTO_IPV4:
  20                 nft_set_pktinfo_ipv4(&pkt, skb);
  21                 break;
  22 #endif
  23 #ifdef CONFIG_NF_TABLES_IPV6
  24         case NFPROTO_IPV6:
  25                 nft_set_pktinfo_ipv6(&pkt, skb);
  26                 break;
  27 #endif
  28         default:
  29                 break;
  30         }
  31
  32         return nft_do_chain(&pkt, priv);
  33 }
  34
  35 #ifdef CONFIG_NF_TABLES_IPV4
  36 static const struct nft_chain_type nft_chain_nat_ipv4 = {
  37         .name           = "nat",
  38         .type           = NFT_CHAIN_T_NAT,
  39         .family         = NFPROTO_IPV4,
  40         .owner          = THIS_MODULE,
  41         .hook_mask      = (1 << NF_INET_PRE_ROUTING) |
  42                           (1 << NF_INET_POST_ROUTING) |
  43                           (1 << NF_INET_LOCAL_OUT) |
  44                           (1 << NF_INET_LOCAL_IN),
  45         .hooks          = {
  46                 [NF_INET_PRE_ROUTING]   = nft_nat_do_chain,
  47                 [NF_INET_POST_ROUTING]  = nft_nat_do_chain,
  48                 [NF_INET_LOCAL_OUT]     = nft_nat_do_chain,
  49                 [NF_INET_LOCAL_IN]      = nft_nat_do_chain,
  50         },
  51         .ops_register = nf_nat_ipv4_register_fn,
  52         .ops_unregister = nf_nat_ipv4_unregister_fn,
  53 };
  54 #endif
  55
  56 #ifdef CONFIG_NF_TABLES_IPV6
  57 static const struct nft_chain_type nft_chain_nat_ipv6 = {
  58         .name           = "nat",
  59         .type           = NFT_CHAIN_T_NAT,
  60         .family         = NFPROTO_IPV6,
  61         .owner          = THIS_MODULE,
  62         .hook_mask      = (1 << NF_INET_PRE_ROUTING) |
  63                           (1 << NF_INET_POST_ROUTING) |
  64                           (1 << NF_INET_LOCAL_OUT) |
  65                           (1 << NF_INET_LOCAL_IN),
  66         .hooks          = {
  67                 [NF_INET_PRE_ROUTING]   = nft_nat_do_chain,
  68                 [NF_INET_POST_ROUTING]  = nft_nat_do_chain,
  69                 [NF_INET_LOCAL_OUT]     = nft_nat_do_chain,
  70                 [NF_INET_LOCAL_IN]      = nft_nat_do_chain,
  71         },
  72         .ops_register           = nf_nat_ipv6_register_fn,
  73         .ops_unregister         = nf_nat_ipv6_unregister_fn,
  74 };
  75 #endif
  76
  77 #ifdef CONFIG_NF_TABLES_INET
  78 static int nft_nat_inet_reg(struct net *net, const struct nf_hook_ops *ops)
  79 {
  80         return nf_nat_inet_register_fn(net, ops);
  81 }
  82
  83 static void nft_nat_inet_unreg(struct net *net, const struct nf_hook_ops *ops)
  84 {
  85         nf_nat_inet_unregister_fn(net, ops);
  86 }
  87
  88 static const struct nft_chain_type nft_chain_nat_inet = {
  89         .name           = "nat",
  90         .type           = NFT_CHAIN_T_NAT,
  91         .family         = NFPROTO_INET,
  92         .hook_mask      = (1 << NF_INET_PRE_ROUTING) |
  93                           (1 << NF_INET_LOCAL_IN) |
  94                           (1 << NF_INET_LOCAL_OUT) |
  95                           (1 << NF_INET_POST_ROUTING),
  96         .hooks          = {
  97                 [NF_INET_PRE_ROUTING]   = nft_nat_do_chain,
  98                 [NF_INET_LOCAL_IN]      = nft_nat_do_chain,
  99                 [NF_INET_LOCAL_OUT]     = nft_nat_do_chain,
 100                 [NF_INET_POST_ROUTING]  = nft_nat_do_chain,
 101         },
 102         .ops_register           = nft_nat_inet_reg,
 103         .ops_unregister         = nft_nat_inet_unreg,
 104 };
 105 #endif
 106
 107 static int __init nft_chain_nat_init(void)
 108 {
 109 #ifdef CONFIG_NF_TABLES_IPV6
 110         nft_register_chain_type(&nft_chain_nat_ipv6);
 111 #endif
 112 #ifdef CONFIG_NF_TABLES_IPV4
 113         nft_register_chain_type(&nft_chain_nat_ipv4);
 114 #endif
 115 #ifdef CONFIG_NF_TABLES_INET
 116         nft_register_chain_type(&nft_chain_nat_inet);
 117 #endif
 118
 119         return 0;
 120 }
 121
 122 static void __exit nft_chain_nat_exit(void)
 123 {
 124 #ifdef CONFIG_NF_TABLES_IPV4
 125         nft_unregister_chain_type(&nft_chain_nat_ipv4);
 126 #endif
 127 #ifdef CONFIG_NF_TABLES_IPV6
 128         nft_unregister_chain_type(&nft_chain_nat_ipv6);
 129 #endif
 130 #ifdef CONFIG_NF_TABLES_INET
 131         nft_unregister_chain_type(&nft_chain_nat_inet);
 132 #endif
 133 }
 134
 135 module_init(nft_chain_nat_init);
 136 module_exit(nft_chain_nat_exit);
 137
 138 MODULE_LICENSE("GPL");
 139 #ifdef CONFIG_NF_TABLES_IPV4
 140 MODULE_ALIAS_NFT_CHAIN(AF_INET, "nat");
 141 #endif
 142 #ifdef CONFIG_NF_TABLES_IPV6
 143 MODULE_ALIAS_NFT_CHAIN(AF_INET6, "nat");
 144 #endif
 145 #ifdef CONFIG_NF_TABLES_INET
 146 MODULE_ALIAS_NFT_CHAIN(1, "nat");       /* NFPROTO_INET */
 147 #endif