ebtable_nat.c 2.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * ebtable_nat
  4. *
  5. * Authors:
  6. * Bart De Schuymer <bdschuym@pandora.be>
  7. *
  8. * April, 2002
  9. *
  10. */
  11. #include <linux/netfilter_bridge/ebtables.h>
  12. #include <uapi/linux/netfilter_bridge.h>
  13. #include <linux/module.h>
  14. #define NAT_VALID_HOOKS ((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT) | \
  15. (1 << NF_BR_POST_ROUTING))
  16. static struct ebt_entries initial_chains[] = {
  17. {
  18. .name = "PREROUTING",
  19. .policy = EBT_ACCEPT,
  20. },
  21. {
  22. .name = "OUTPUT",
  23. .policy = EBT_ACCEPT,
  24. },
  25. {
  26. .name = "POSTROUTING",
  27. .policy = EBT_ACCEPT,
  28. }
  29. };
  30. static struct ebt_replace_kernel initial_table = {
  31. .name = "nat",
  32. .valid_hooks = NAT_VALID_HOOKS,
  33. .entries_size = 3 * sizeof(struct ebt_entries),
  34. .hook_entry = {
  35. [NF_BR_PRE_ROUTING] = &initial_chains[0],
  36. [NF_BR_LOCAL_OUT] = &initial_chains[1],
  37. [NF_BR_POST_ROUTING] = &initial_chains[2],
  38. },
  39. .entries = (char *)initial_chains,
  40. };
  41. static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
  42. {
  43. if (valid_hooks & ~NAT_VALID_HOOKS)
  44. return -EINVAL;
  45. return 0;
  46. }
  47. static const struct ebt_table frame_nat = {
  48. .name = "nat",
  49. .table = &initial_table,
  50. .valid_hooks = NAT_VALID_HOOKS,
  51. .check = check,
  52. .me = THIS_MODULE,
  53. };
  54. static unsigned int
  55. ebt_nat_in(void *priv, struct sk_buff *skb,
  56. const struct nf_hook_state *state)
  57. {
  58. return ebt_do_table(skb, state, state->net->xt.frame_nat);
  59. }
  60. static unsigned int
  61. ebt_nat_out(void *priv, struct sk_buff *skb,
  62. const struct nf_hook_state *state)
  63. {
  64. return ebt_do_table(skb, state, state->net->xt.frame_nat);
  65. }
  66. static const struct nf_hook_ops ebt_ops_nat[] = {
  67. {
  68. .hook = ebt_nat_out,
  69. .pf = NFPROTO_BRIDGE,
  70. .hooknum = NF_BR_LOCAL_OUT,
  71. .priority = NF_BR_PRI_NAT_DST_OTHER,
  72. },
  73. {
  74. .hook = ebt_nat_out,
  75. .pf = NFPROTO_BRIDGE,
  76. .hooknum = NF_BR_POST_ROUTING,
  77. .priority = NF_BR_PRI_NAT_SRC,
  78. },
  79. {
  80. .hook = ebt_nat_in,
  81. .pf = NFPROTO_BRIDGE,
  82. .hooknum = NF_BR_PRE_ROUTING,
  83. .priority = NF_BR_PRI_NAT_DST_BRIDGED,
  84. },
  85. };
  86. static int __net_init frame_nat_net_init(struct net *net)
  87. {
  88. return ebt_register_table(net, &frame_nat, ebt_ops_nat,
  89. &net->xt.frame_nat);
  90. }
  91. static void __net_exit frame_nat_net_pre_exit(struct net *net)
  92. {
  93. ebt_unregister_table_pre_exit(net, "nat", ebt_ops_nat);
  94. }
  95. static void __net_exit frame_nat_net_exit(struct net *net)
  96. {
  97. ebt_unregister_table(net, net->xt.frame_nat);
  98. }
  99. static struct pernet_operations frame_nat_net_ops = {
  100. .init = frame_nat_net_init,
  101. .exit = frame_nat_net_exit,
  102. .pre_exit = frame_nat_net_pre_exit,
  103. };
  104. static int __init ebtable_nat_init(void)
  105. {
  106. return register_pernet_subsys(&frame_nat_net_ops);
  107. }
  108. static void __exit ebtable_nat_fini(void)
  109. {
  110. unregister_pernet_subsys(&frame_nat_net_ops);
  111. }
  112. module_init(ebtable_nat_init);
  113. module_exit(ebtable_nat_fini);
  114. MODULE_LICENSE("GPL");