LXR linux/net/ipv4/netfilter/nft_chain_nat

   1/*
   2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3 * Copyright (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
   4 * Copyright (c) 2012 Intel Corporation
   5 *
   6 * This program is free software; you can redistribute it and/or modify
   7 * it under the terms of the GNU General Public License version 2 as
   8 * published by the Free Software Foundation.
   9 *
  10 * Development of this code funded by Astaro AG (http://www.astaro.com/)
  11 */
  12
  13#include <linux/module.h>
  14#include <linux/init.h>
  15#include <linux/list.h>
  16#include <linux/skbuff.h>
  17#include <linux/ip.h>
  18#include <linux/netfilter.h>
  19#include <linux/netfilter_ipv4.h>
  20#include <linux/netfilter/nf_tables.h>
  21#include <net/netfilter/nf_conntrack.h>
  22#include <net/netfilter/nf_nat.h>
  23#include <net/netfilter/nf_nat_core.h>
  24#include <net/netfilter/nf_tables.h>
  25#include <net/netfilter/nf_tables_ipv4.h>
  26#include <net/netfilter/nf_nat_l3proto.h>
  27#include <net/ip.h>
  28
  29static unsigned int nft_nat_do_chain(void *priv,
  30                                      struct sk_buff *skb,
  31                                      const struct nf_hook_state *state,
  32                                      struct nf_conn *ct)
  33{
  34        struct nft_pktinfo pkt;
  35
  36        nft_set_pktinfo(&pkt, skb, state);
  37        nft_set_pktinfo_ipv4(&pkt, skb);
  38
  39        return nft_do_chain(&pkt, priv);
  40}
  41
  42static unsigned int nft_nat_ipv4_fn(void *priv,
  43                                    struct sk_buff *skb,
  44                                    const struct nf_hook_state *state)
  45{
  46        return nf_nat_ipv4_fn(priv, skb, state, nft_nat_do_chain);
  47}
  48
  49static unsigned int nft_nat_ipv4_in(void *priv,
  50                                    struct sk_buff *skb,
  51                                    const struct nf_hook_state *state)
  52{
  53        return nf_nat_ipv4_in(priv, skb, state, nft_nat_do_chain);
  54}
  55
  56static unsigned int nft_nat_ipv4_out(void *priv,
  57                                     struct sk_buff *skb,
  58                                     const struct nf_hook_state *state)
  59{
  60        return nf_nat_ipv4_out(priv, skb, state, nft_nat_do_chain);
  61}
  62
  63static unsigned int nft_nat_ipv4_local_fn(void *priv,
  64                                          struct sk_buff *skb,
  65                                          const struct nf_hook_state *state)
  66{
  67        return nf_nat_ipv4_local_fn(priv, skb, state, nft_nat_do_chain);
  68}
  69
  70static int nft_nat_ipv4_init(struct nft_ctx *ctx)
  71{
  72        return nf_ct_netns_get(ctx->net, ctx->family);
  73}
  74
  75static void nft_nat_ipv4_free(struct nft_ctx *ctx)
  76{
  77        nf_ct_netns_put(ctx->net, ctx->family);
  78}
  79
  80static const struct nft_chain_type nft_chain_nat_ipv4 = {
  81        .name           = "nat",
  82        .type           = NFT_CHAIN_T_NAT,
  83        .family         = NFPROTO_IPV4,
  84        .owner          = THIS_MODULE,
  85        .hook_mask      = (1 << NF_INET_PRE_ROUTING) |
  86                          (1 << NF_INET_POST_ROUTING) |
  87                          (1 << NF_INET_LOCAL_OUT) |
  88                          (1 << NF_INET_LOCAL_IN),
  89        .hooks          = {
  90                [NF_INET_PRE_ROUTING]   = nft_nat_ipv4_in,
  91                [NF_INET_POST_ROUTING]  = nft_nat_ipv4_out,
  92                [NF_INET_LOCAL_OUT]     = nft_nat_ipv4_local_fn,
  93                [NF_INET_LOCAL_IN]      = nft_nat_ipv4_fn,
  94        },
  95        .init           = nft_nat_ipv4_init,
  96        .free           = nft_nat_ipv4_free,
  97};
  98
  99static int __init nft_chain_nat_init(void)
 100{
 101        nft_register_chain_type(&nft_chain_nat_ipv4);
 102
 103        return 0;
 104}
 105
 106static void __exit nft_chain_nat_exit(void)
 107{
 108        nft_unregister_chain_type(&nft_chain_nat_ipv4);
 109}
 110
 111module_init(nft_chain_nat_init);
 112module_exit(nft_chain_nat_exit);
 113
 114MODULE_LICENSE("GPL");
 115MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 116MODULE_ALIAS_NFT_CHAIN(AF_INET, "nat");
 117