1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/module.h> 4 #include <linux/netfilter/nf_tables.h> 5 #include <net/netfilter/nf_nat.h> 6 #include <net/netfilter/nf_tables.h> 7 #include <net/netfilter/nf_tables_ipv4.h> 8 #include <net/netfilter/nf_tables_ipv6.h> 9 10 static unsigned int nft_nat_do_chain(void *priv, struct sk_buff *skb, 11 const struct nf_hook_state *state) 12 { 13 struct nft_pktinfo pkt; 14 15 nft_set_pktinfo(&pkt, skb, state); 16 17 switch (state->pf) { 18 #ifdef CONFIG_NF_TABLES_IPV4 19 case NFPROTO_IPV4: 20 nft_set_pktinfo_ipv4(&pkt, skb); 21 break; 22 #endif 23 #ifdef CONFIG_NF_TABLES_IPV6 24 case NFPROTO_IPV6: 25 nft_set_pktinfo_ipv6(&pkt, skb); 26 break; 27 #endif 28 default: 29 break; 30 } 31 32 return nft_do_chain(&pkt, priv); 33 } 34 35 #ifdef CONFIG_NF_TABLES_IPV4 36 static const struct nft_chain_type nft_chain_nat_ipv4 = { 37 .name = "nat", 38 .type = NFT_CHAIN_T_NAT, 39 .family = NFPROTO_IPV4, 40 .owner = THIS_MODULE, 41 .hook_mask = (1 << NF_INET_PRE_ROUTING) | 42 (1 << NF_INET_POST_ROUTING) | 43 (1 << NF_INET_LOCAL_OUT) | 44 (1 << NF_INET_LOCAL_IN), 45 .hooks = { 46 [NF_INET_PRE_ROUTING] = nft_nat_do_chain, 47 [NF_INET_POST_ROUTING] = nft_nat_do_chain, 48 [NF_INET_LOCAL_OUT] = nft_nat_do_chain, 49 [NF_INET_LOCAL_IN] = nft_nat_do_chain, 50 }, 51 .ops_register = nf_nat_ipv4_register_fn, 52 .ops_unregister = nf_nat_ipv4_unregister_fn, 53 }; 54 #endif 55 56 #ifdef CONFIG_NF_TABLES_IPV6 57 static const struct nft_chain_type nft_chain_nat_ipv6 = { 58 .name = "nat", 59 .type = NFT_CHAIN_T_NAT, 60 .family = NFPROTO_IPV6, 61 .owner = THIS_MODULE, 62 .hook_mask = (1 << NF_INET_PRE_ROUTING) | 63 (1 << NF_INET_POST_ROUTING) | 64 (1 << NF_INET_LOCAL_OUT) | 65 (1 << NF_INET_LOCAL_IN), 66 .hooks = { 67 [NF_INET_PRE_ROUTING] = nft_nat_do_chain, 68 [NF_INET_POST_ROUTING] = nft_nat_do_chain, 69 [NF_INET_LOCAL_OUT] = nft_nat_do_chain, 70 [NF_INET_LOCAL_IN] = nft_nat_do_chain, 71 }, 72 .ops_register = nf_nat_ipv6_register_fn, 73 .ops_unregister = nf_nat_ipv6_unregister_fn, 74 }; 75 #endif 76 77 #ifdef CONFIG_NF_TABLES_INET 78 static int nft_nat_inet_reg(struct net *net, const struct nf_hook_ops *ops) 79 { 80 return nf_nat_inet_register_fn(net, ops); 81 } 82 83 static void nft_nat_inet_unreg(struct net *net, const struct nf_hook_ops *ops) 84 { 85 nf_nat_inet_unregister_fn(net, ops); 86 } 87 88 static const struct nft_chain_type nft_chain_nat_inet = { 89 .name = "nat", 90 .type = NFT_CHAIN_T_NAT, 91 .family = NFPROTO_INET, 92 .hook_mask = (1 << NF_INET_PRE_ROUTING) | 93 (1 << NF_INET_LOCAL_IN) | 94 (1 << NF_INET_LOCAL_OUT) | 95 (1 << NF_INET_POST_ROUTING), 96 .hooks = { 97 [NF_INET_PRE_ROUTING] = nft_nat_do_chain, 98 [NF_INET_LOCAL_IN] = nft_nat_do_chain, 99 [NF_INET_LOCAL_OUT] = nft_nat_do_chain, 100 [NF_INET_POST_ROUTING] = nft_nat_do_chain, 101 }, 102 .ops_register = nft_nat_inet_reg, 103 .ops_unregister = nft_nat_inet_unreg, 104 }; 105 #endif 106 107 static int __init nft_chain_nat_init(void) 108 { 109 #ifdef CONFIG_NF_TABLES_IPV6 110 nft_register_chain_type(&nft_chain_nat_ipv6); 111 #endif 112 #ifdef CONFIG_NF_TABLES_IPV4 113 nft_register_chain_type(&nft_chain_nat_ipv4); 114 #endif 115 #ifdef CONFIG_NF_TABLES_INET 116 nft_register_chain_type(&nft_chain_nat_inet); 117 #endif 118 119 return 0; 120 } 121 122 static void __exit nft_chain_nat_exit(void) 123 { 124 #ifdef CONFIG_NF_TABLES_IPV4 125 nft_unregister_chain_type(&nft_chain_nat_ipv4); 126 #endif 127 #ifdef CONFIG_NF_TABLES_IPV6 128 nft_unregister_chain_type(&nft_chain_nat_ipv6); 129 #endif 130 #ifdef CONFIG_NF_TABLES_INET 131 nft_unregister_chain_type(&nft_chain_nat_inet); 132 #endif 133 } 134 135 module_init(nft_chain_nat_init); 136 module_exit(nft_chain_nat_exit); 137 138 MODULE_LICENSE("GPL"); 139 #ifdef CONFIG_NF_TABLES_IPV4 140 MODULE_ALIAS_NFT_CHAIN(AF_INET, "nat"); 141 #endif 142 #ifdef CONFIG_NF_TABLES_IPV6 143 MODULE_ALIAS_NFT_CHAIN(AF_INET6, "nat"); 144 #endif 145