LXR linux/net/ipv6/netfilter/nft_chain_nat

   1/*
   2 * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
   3 * Copyright (c) 2012 Intel Corporation
   4 *
   5 * This program is free software; you can redistribute it and/or modify it
   6 * under the terms and conditions of the GNU General Public License,
   7 * version 2, as published by the Free Software Foundation.
   8 *
   9 */
  10
  11#include <linux/module.h>
  12#include <linux/init.h>
  13#include <linux/list.h>
  14#include <linux/skbuff.h>
  15#include <linux/ip.h>
  16#include <linux/netfilter.h>
  17#include <linux/netfilter_ipv6.h>
  18#include <linux/netfilter/nf_tables.h>
  19#include <net/netfilter/nf_conntrack.h>
  20#include <net/netfilter/nf_nat.h>
  21#include <net/netfilter/nf_nat_core.h>
  22#include <net/netfilter/nf_tables.h>
  23#include <net/netfilter/nf_tables_ipv6.h>
  24#include <net/netfilter/nf_nat_l3proto.h>
  25#include <net/ipv6.h>
  26
  27static unsigned int nft_nat_do_chain(void *priv,
  28                                     struct sk_buff *skb,
  29                                     const struct nf_hook_state *state,
  30                                     struct nf_conn *ct)
  31{
  32        struct nft_pktinfo pkt;
  33
  34        nft_set_pktinfo(&pkt, skb, state);
  35        nft_set_pktinfo_ipv6(&pkt, skb);
  36
  37        return nft_do_chain(&pkt, priv);
  38}
  39
  40static unsigned int nft_nat_ipv6_fn(void *priv,
  41                                    struct sk_buff *skb,
  42                                    const struct nf_hook_state *state)
  43{
  44        return nf_nat_ipv6_fn(priv, skb, state, nft_nat_do_chain);
  45}
  46
  47static unsigned int nft_nat_ipv6_in(void *priv,
  48                                    struct sk_buff *skb,
  49                                    const struct nf_hook_state *state)
  50{
  51        return nf_nat_ipv6_in(priv, skb, state, nft_nat_do_chain);
  52}
  53
  54static unsigned int nft_nat_ipv6_out(void *priv,
  55                                     struct sk_buff *skb,
  56                                     const struct nf_hook_state *state)
  57{
  58        return nf_nat_ipv6_out(priv, skb, state, nft_nat_do_chain);
  59}
  60
  61static unsigned int nft_nat_ipv6_local_fn(void *priv,
  62                                          struct sk_buff *skb,
  63                                          const struct nf_hook_state *state)
  64{
  65        return nf_nat_ipv6_local_fn(priv, skb, state, nft_nat_do_chain);
  66}
  67
  68static int nft_nat_ipv6_init(struct nft_ctx *ctx)
  69{
  70        return nf_ct_netns_get(ctx->net, ctx->family);
  71}
  72
  73static void nft_nat_ipv6_free(struct nft_ctx *ctx)
  74{
  75        nf_ct_netns_put(ctx->net, ctx->family);
  76}
  77
  78static const struct nft_chain_type nft_chain_nat_ipv6 = {
  79        .name           = "nat",
  80        .type           = NFT_CHAIN_T_NAT,
  81        .family         = NFPROTO_IPV6,
  82        .owner          = THIS_MODULE,
  83        .hook_mask      = (1 << NF_INET_PRE_ROUTING) |
  84                          (1 << NF_INET_POST_ROUTING) |
  85                          (1 << NF_INET_LOCAL_OUT) |
  86                          (1 << NF_INET_LOCAL_IN),
  87        .hooks          = {
  88                [NF_INET_PRE_ROUTING]   = nft_nat_ipv6_in,
  89                [NF_INET_POST_ROUTING]  = nft_nat_ipv6_out,
  90                [NF_INET_LOCAL_OUT]     = nft_nat_ipv6_local_fn,
  91                [NF_INET_LOCAL_IN]      = nft_nat_ipv6_fn,
  92        },
  93        .init           = nft_nat_ipv6_init,
  94        .free           = nft_nat_ipv6_free,
  95};
  96
  97static int __init nft_chain_nat_ipv6_init(void)
  98{
  99        nft_register_chain_type(&nft_chain_nat_ipv6);
 100
 101        return 0;
 102}
 103
 104static void __exit nft_chain_nat_ipv6_exit(void)
 105{
 106        nft_unregister_chain_type(&nft_chain_nat_ipv6);
 107}
 108
 109module_init(nft_chain_nat_ipv6_init);
 110module_exit(nft_chain_nat_ipv6_exit);
 111
 112MODULE_LICENSE("GPL");
 113MODULE_AUTHOR("Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>");
 114MODULE_ALIAS_NFT_CHAIN(AF_INET6, "nat");
 115