1 /* (C) 1999-2001 Paul `Rusty' Russell 2 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 3 * (C) 2011 Patrick McHardy <kaber@trash.net> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 */ 9 10 #include <linux/module.h> 11 #include <linux/netfilter.h> 12 #include <linux/netfilter_ipv4.h> 13 #include <linux/netfilter_ipv4/ip_tables.h> 14 #include <linux/ip.h> 15 #include <net/ip.h> 16 17 #include <net/netfilter/nf_nat.h> 18 #include <net/netfilter/nf_nat_core.h> 19 #include <net/netfilter/nf_nat_l3proto.h> 20 21 static const struct xt_table nf_nat_ipv4_table = { 22 .name = "nat", 23 .valid_hooks = (1 << NF_INET_PRE_ROUTING) | 24 (1 << NF_INET_POST_ROUTING) | 25 (1 << NF_INET_LOCAL_OUT) | 26 (1 << NF_INET_LOCAL_IN), 27 .me = THIS_MODULE, 28 .af = NFPROTO_IPV4, 29 }; 30 31 static unsigned int iptable_nat_do_chain(const struct nf_hook_ops *ops, 32 struct sk_buff *skb, 33 const struct net_device *in, 34 const struct net_device *out, 35 struct nf_conn *ct) 36 { 37 struct net *net = nf_ct_net(ct); 38 39 return ipt_do_table(skb, ops->hooknum, in, out, net->ipv4.nat_table); 40 } 41 42 static unsigned int iptable_nat_ipv4_fn(const struct nf_hook_ops *ops, 43 struct sk_buff *skb, 44 const struct nf_hook_state *state) 45 { 46 return nf_nat_ipv4_fn(ops, skb, state->in, state->out, 47 iptable_nat_do_chain); 48 } 49 50 static unsigned int iptable_nat_ipv4_in(const struct nf_hook_ops *ops, 51 struct sk_buff *skb, 52 const struct nf_hook_state *state) 53 { 54 return nf_nat_ipv4_in(ops, skb, state->in, state->out, 55 iptable_nat_do_chain); 56 } 57 58 static unsigned int iptable_nat_ipv4_out(const struct nf_hook_ops *ops, 59 struct sk_buff *skb, 60 const struct nf_hook_state *state) 61 { 62 return nf_nat_ipv4_out(ops, skb, state->in, state->out, 63 iptable_nat_do_chain); 64 } 65 66 static unsigned int iptable_nat_ipv4_local_fn(const struct nf_hook_ops *ops, 67 struct sk_buff *skb, 68 const struct nf_hook_state *state) 69 { 70 return nf_nat_ipv4_local_fn(ops, skb, state->in, state->out, 71 iptable_nat_do_chain); 72 } 73 74 static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = { 75 /* Before packet filtering, change destination */ 76 { 77 .hook = iptable_nat_ipv4_in, 78 .owner = THIS_MODULE, 79 .pf = NFPROTO_IPV4, 80 .hooknum = NF_INET_PRE_ROUTING, 81 .priority = NF_IP_PRI_NAT_DST, 82 }, 83 /* After packet filtering, change source */ 84 { 85 .hook = iptable_nat_ipv4_out, 86 .owner = THIS_MODULE, 87 .pf = NFPROTO_IPV4, 88 .hooknum = NF_INET_POST_ROUTING, 89 .priority = NF_IP_PRI_NAT_SRC, 90 }, 91 /* Before packet filtering, change destination */ 92 { 93 .hook = iptable_nat_ipv4_local_fn, 94 .owner = THIS_MODULE, 95 .pf = NFPROTO_IPV4, 96 .hooknum = NF_INET_LOCAL_OUT, 97 .priority = NF_IP_PRI_NAT_DST, 98 }, 99 /* After packet filtering, change source */ 100 { 101 .hook = iptable_nat_ipv4_fn, 102 .owner = THIS_MODULE, 103 .pf = NFPROTO_IPV4, 104 .hooknum = NF_INET_LOCAL_IN, 105 .priority = NF_IP_PRI_NAT_SRC, 106 }, 107 }; 108 109 static int __net_init iptable_nat_net_init(struct net *net) 110 { 111 struct ipt_replace *repl; 112 113 repl = ipt_alloc_initial_table(&nf_nat_ipv4_table); 114 if (repl == NULL) 115 return -ENOMEM; 116 net->ipv4.nat_table = ipt_register_table(net, &nf_nat_ipv4_table, repl); 117 kfree(repl); 118 return PTR_ERR_OR_ZERO(net->ipv4.nat_table); 119 } 120 121 static void __net_exit iptable_nat_net_exit(struct net *net) 122 { 123 ipt_unregister_table(net, net->ipv4.nat_table); 124 } 125 126 static struct pernet_operations iptable_nat_net_ops = { 127 .init = iptable_nat_net_init, 128 .exit = iptable_nat_net_exit, 129 }; 130 131 static int __init iptable_nat_init(void) 132 { 133 int err; 134 135 err = register_pernet_subsys(&iptable_nat_net_ops); 136 if (err < 0) 137 goto err1; 138 139 err = nf_register_hooks(nf_nat_ipv4_ops, ARRAY_SIZE(nf_nat_ipv4_ops)); 140 if (err < 0) 141 goto err2; 142 return 0; 143 144 err2: 145 unregister_pernet_subsys(&iptable_nat_net_ops); 146 err1: 147 return err; 148 } 149 150 static void __exit iptable_nat_exit(void) 151 { 152 nf_unregister_hooks(nf_nat_ipv4_ops, ARRAY_SIZE(nf_nat_ipv4_ops)); 153 unregister_pernet_subsys(&iptable_nat_net_ops); 154 } 155 156 module_init(iptable_nat_init); 157 module_exit(iptable_nat_exit); 158 159 MODULE_LICENSE("GPL"); 160