1 // SPDX-License-Identifier: GPL-2.0-only 2 /* (C) 1999-2001 Paul `Rusty' Russell 3 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 4 * (C) 2011 Patrick McHardy <kaber@trash.net> 5 */ 6 7 #include <linux/module.h> 8 #include <linux/netfilter.h> 9 #include <linux/netfilter_ipv4.h> 10 #include <linux/netfilter_ipv4/ip_tables.h> 11 #include <linux/ip.h> 12 #include <net/ip.h> 13 14 #include <net/netfilter/nf_nat.h> 15 16 struct iptable_nat_pernet { 17 struct nf_hook_ops *nf_nat_ops; 18 }; 19 20 static unsigned int iptable_nat_net_id __read_mostly; 21 22 static const struct xt_table nf_nat_ipv4_table = { 23 .name = "nat", 24 .valid_hooks = (1 << NF_INET_PRE_ROUTING) | 25 (1 << NF_INET_POST_ROUTING) | 26 (1 << NF_INET_LOCAL_OUT) | 27 (1 << NF_INET_LOCAL_IN), 28 .me = THIS_MODULE, 29 .af = NFPROTO_IPV4, 30 }; 31 32 static const struct nf_hook_ops nf_nat_ipv4_ops[] = { 33 { 34 .hook = ipt_do_table, 35 .pf = NFPROTO_IPV4, 36 .hooknum = NF_INET_PRE_ROUTING, 37 .priority = NF_IP_PRI_NAT_DST, 38 }, 39 { 40 .hook = ipt_do_table, 41 .pf = NFPROTO_IPV4, 42 .hooknum = NF_INET_POST_ROUTING, 43 .priority = NF_IP_PRI_NAT_SRC, 44 }, 45 { 46 .hook = ipt_do_table, 47 .pf = NFPROTO_IPV4, 48 .hooknum = NF_INET_LOCAL_OUT, 49 .priority = NF_IP_PRI_NAT_DST, 50 }, 51 { 52 .hook = ipt_do_table, 53 .pf = NFPROTO_IPV4, 54 .hooknum = NF_INET_LOCAL_IN, 55 .priority = NF_IP_PRI_NAT_SRC, 56 }, 57 }; 58 59 static int ipt_nat_register_lookups(struct net *net) 60 { 61 struct iptable_nat_pernet *xt_nat_net; 62 struct nf_hook_ops *ops; 63 struct xt_table *table; 64 int i, ret; 65 66 xt_nat_net = net_generic(net, iptable_nat_net_id); 67 table = xt_find_table(net, NFPROTO_IPV4, "nat"); 68 if (WARN_ON_ONCE(!table)) 69 return -ENOENT; 70 71 ops = kmemdup(nf_nat_ipv4_ops, sizeof(nf_nat_ipv4_ops), GFP_KERNEL); 72 if (!ops) 73 return -ENOMEM; 74 75 for (i = 0; i < ARRAY_SIZE(nf_nat_ipv4_ops); i++) { 76 ops[i].priv = table; 77 ret = nf_nat_ipv4_register_fn(net, &ops[i]); 78 if (ret) { 79 while (i) 80 nf_nat_ipv4_unregister_fn(net, &ops[--i]); 81 82 kfree(ops); 83 return ret; 84 } 85 } 86 87 xt_nat_net->nf_nat_ops = ops; 88 return 0; 89 } 90 91 static void ipt_nat_unregister_lookups(struct net *net) 92 { 93 struct iptable_nat_pernet *xt_nat_net = net_generic(net, iptable_nat_net_id); 94 struct nf_hook_ops *ops = xt_nat_net->nf_nat_ops; 95 int i; 96 97 if (!ops) 98 return; 99 100 for (i = 0; i < ARRAY_SIZE(nf_nat_ipv4_ops); i++) 101 nf_nat_ipv4_unregister_fn(net, &ops[i]); 102 103 kfree(ops); 104 } 105 106 static int iptable_nat_table_init(struct net *net) 107 { 108 struct ipt_replace *repl; 109 int ret; 110 111 repl = ipt_alloc_initial_table(&nf_nat_ipv4_table); 112 if (repl == NULL) 113 return -ENOMEM; 114 115 ret = ipt_register_table(net, &nf_nat_ipv4_table, repl, NULL); 116 if (ret < 0) { 117 kfree(repl); 118 return ret; 119 } 120 121 ret = ipt_nat_register_lookups(net); 122 if (ret < 0) 123 ipt_unregister_table_exit(net, "nat"); 124 125 kfree(repl); 126 return ret; 127 } 128 129 static void __net_exit iptable_nat_net_pre_exit(struct net *net) 130 { 131 ipt_nat_unregister_lookups(net); 132 } 133 134 static void __net_exit iptable_nat_net_exit(struct net *net) 135 { 136 ipt_unregister_table_exit(net, "nat"); 137 } 138 139 static struct pernet_operations iptable_nat_net_ops = { 140 .pre_exit = iptable_nat_net_pre_exit, 141 .exit = iptable_nat_net_exit, 142 .id = &iptable_nat_net_id, 143 .size = sizeof(struct iptable_nat_pernet), 144 }; 145 146 static int __init iptable_nat_init(void) 147 { 148 int ret = xt_register_template(&nf_nat_ipv4_table, 149 iptable_nat_table_init); 150 151 if (ret < 0) 152 return ret; 153 154 ret = register_pernet_subsys(&iptable_nat_net_ops); 155 if (ret < 0) { 156 xt_unregister_template(&nf_nat_ipv4_table); 157 return ret; 158 } 159 160 return ret; 161 } 162 163 static void __exit iptable_nat_exit(void) 164 { 165 unregister_pernet_subsys(&iptable_nat_net_ops); 166 xt_unregister_template(&nf_nat_ipv4_table); 167 } 168 169 module_init(iptable_nat_init); 170 module_exit(iptable_nat_exit); 171 172 MODULE_LICENSE("GPL"); 173