[linux-2.6-block.git] / net / ipv6 / netfilter / ip6table_nat.c

/*
 * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Based on Rusty Russell's IPv4 NAT code. Development of IPv6 NAT
 * funded by Astaro.
 */

#include <linux/module.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/ipv6.h>
#include <net/ipv6.h>

#include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_nat_core.h>
#include <net/netfilter/nf_nat_l3proto.h>

static const struct xt_table nf_nat_ipv6_table = {
	.name		= "nat",
	.valid_hooks	= (1 << NF_INET_PRE_ROUTING) |
			  (1 << NF_INET_POST_ROUTING) |
			  (1 << NF_INET_LOCAL_OUT) |
			  (1 << NF_INET_LOCAL_IN),
	.me		= THIS_MODULE,
	.af		= NFPROTO_IPV6,
};

static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops,
					  struct sk_buff *skb,
					  const struct nf_hook_state *state,
					  struct nf_conn *ct)
{
	struct net *net = nf_ct_net(ct);

	return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_nat);
}

static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops,
				    struct sk_buff *skb,
				    const struct nf_hook_state *state)
{
	return nf_nat_ipv6_fn(ops, skb, state, ip6table_nat_do_chain);
}

static unsigned int ip6table_nat_in(const struct nf_hook_ops *ops,
				    struct sk_buff *skb,
				    const struct nf_hook_state *state)
{
	return nf_nat_ipv6_in(ops, skb, state, ip6table_nat_do_chain);
}

static unsigned int ip6table_nat_out(const struct nf_hook_ops *ops,
				     struct sk_buff *skb,
				     const struct nf_hook_state *state)
{
	return nf_nat_ipv6_out(ops, skb, state, ip6table_nat_do_chain);
}

static unsigned int ip6table_nat_local_fn(const struct nf_hook_ops *ops,
					  struct sk_buff *skb,
					  const struct nf_hook_state *state)
{
	return nf_nat_ipv6_local_fn(ops, skb, state, ip6table_nat_do_chain);
}

static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
	/* Before packet filtering, change destination */
	{
		.hook		= ip6table_nat_in,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV6,
		.hooknum	= NF_INET_PRE_ROUTING,
		.priority	= NF_IP6_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= ip6table_nat_out,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV6,
		.hooknum	= NF_INET_POST_ROUTING,
		.priority	= NF_IP6_PRI_NAT_SRC,
	},
	/* Before packet filtering, change destination */
	{
		.hook		= ip6table_nat_local_fn,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV6,
		.hooknum	= NF_INET_LOCAL_OUT,
		.priority	= NF_IP6_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= ip6table_nat_fn,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV6,
		.hooknum	= NF_INET_LOCAL_IN,
		.priority	= NF_IP6_PRI_NAT_SRC,
	},
};

static int __net_init ip6table_nat_net_init(struct net *net)
{
	struct ip6t_replace *repl;

	repl = ip6t_alloc_initial_table(&nf_nat_ipv6_table);
	if (repl == NULL)
		return -ENOMEM;
	net->ipv6.ip6table_nat = ip6t_register_table(net, &nf_nat_ipv6_table, repl);
	kfree(repl);
	return PTR_ERR_OR_ZERO(net->ipv6.ip6table_nat);
}

static void __net_exit ip6table_nat_net_exit(struct net *net)
{
	ip6t_unregister_table(net, net->ipv6.ip6table_nat);
}

static struct pernet_operations ip6table_nat_net_ops = {
	.init	= ip6table_nat_net_init,
	.exit	= ip6table_nat_net_exit,
};

static int __init ip6table_nat_init(void)
{
	int err;

	err = register_pernet_subsys(&ip6table_nat_net_ops);
	if (err < 0)
		goto err1;

	err = nf_register_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
	if (err < 0)
		goto err2;
	return 0;

err2:
	unregister_pernet_subsys(&ip6table_nat_net_ops);
err1:
	return err;
}

static void __exit ip6table_nat_exit(void)
{
	nf_unregister_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
	unregister_pernet_subsys(&ip6table_nat_net_ops);
}

module_init(ip6table_nat_init);
module_exit(ip6table_nat_exit);

MODULE_LICENSE("GPL");
Commit	Line	Data
58a317f1 PM	1	/*
	2	* Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*
	8	* Based on Rusty Russell's IPv4 NAT code. Development of IPv6 NAT
	9	* funded by Astaro.
	10	*/
	11
	12	#include <linux/module.h>
	13	#include <linux/netfilter.h>
	14	#include <linux/netfilter_ipv6.h>
	15	#include <linux/netfilter_ipv6/ip6_tables.h>
	16	#include <linux/ipv6.h>
	17	#include <net/ipv6.h>
	18
	19	#include <net/netfilter/nf_nat.h>
	20	#include <net/netfilter/nf_nat_core.h>
	21	#include <net/netfilter/nf_nat_l3proto.h>
	22
	23	static const struct xt_table nf_nat_ipv6_table = {
	24	.name = "nat",
	25	.valid_hooks = (1 << NF_INET_PRE_ROUTING) \|
	26	(1 << NF_INET_POST_ROUTING) \|
	27	(1 << NF_INET_LOCAL_OUT) \|
	28	(1 << NF_INET_LOCAL_IN),
	29	.me = THIS_MODULE,
	30	.af = NFPROTO_IPV6,
	31	};
	32
2a5538e9 PNA	33	static unsigned int ip6table_nat_do_chain(const struct nf_hook_ops *ops,
2a5538e9 PNA	34	struct sk_buff *skb,
8fe22382	35	const struct nf_hook_state *state,
2a5538e9	36	struct nf_conn *ct)
58a317f1 PM	37	{
58a317f1 PM	38	struct net *net = nf_ct_net(ct);
58a317f1	39
8f8a3715	40	return ip6t_do_table(skb, ops->hooknum, state, net->ipv6.ip6table_nat);
58a317f1 PM	41	}
58a317f1 PM	42
2a5538e9 PNA	43	static unsigned int ip6table_nat_fn(const struct nf_hook_ops *ops,
2a5538e9 PNA	44	struct sk_buff *skb,
238e54c9	45	const struct nf_hook_state *state)
58a317f1	46	{
8fe22382	47	return nf_nat_ipv6_fn(ops, skb, state, ip6table_nat_do_chain);
58a317f1 PM	48	}
58a317f1 PM	49
2a5538e9 PNA	50	static unsigned int ip6table_nat_in(const struct nf_hook_ops *ops,
2a5538e9 PNA	51	struct sk_buff *skb,
238e54c9	52	const struct nf_hook_state *state)
58a317f1	53	{
8fe22382	54	return nf_nat_ipv6_in(ops, skb, state, ip6table_nat_do_chain);
58a317f1 PM	55	}
58a317f1 PM	56
2a5538e9 PNA	57	static unsigned int ip6table_nat_out(const struct nf_hook_ops *ops,
2a5538e9 PNA	58	struct sk_buff *skb,
238e54c9	59	const struct nf_hook_state *state)
58a317f1	60	{
8fe22382	61	return nf_nat_ipv6_out(ops, skb, state, ip6table_nat_do_chain);
58a317f1 PM	62	}
58a317f1 PM	63
2a5538e9 PNA	64	static unsigned int ip6table_nat_local_fn(const struct nf_hook_ops *ops,
2a5538e9 PNA	65	struct sk_buff *skb,
238e54c9	66	const struct nf_hook_state *state)
58a317f1	67	{
8fe22382	68	return nf_nat_ipv6_local_fn(ops, skb, state, ip6table_nat_do_chain);
58a317f1 PM	69	}
	70
	71	static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
	72	/* Before packet filtering, change destination */
	73	{
2a5538e9	74	.hook = ip6table_nat_in,
58a317f1 PM	75	.owner = THIS_MODULE,
	76	.pf = NFPROTO_IPV6,
	77	.hooknum = NF_INET_PRE_ROUTING,
	78	.priority = NF_IP6_PRI_NAT_DST,
	79	},
	80	/* After packet filtering, change source */
	81	{
2a5538e9	82	.hook = ip6table_nat_out,
58a317f1 PM	83	.owner = THIS_MODULE,
	84	.pf = NFPROTO_IPV6,
	85	.hooknum = NF_INET_POST_ROUTING,
	86	.priority = NF_IP6_PRI_NAT_SRC,
	87	},
	88	/* Before packet filtering, change destination */
	89	{
2a5538e9	90	.hook = ip6table_nat_local_fn,
58a317f1 PM	91	.owner = THIS_MODULE,
	92	.pf = NFPROTO_IPV6,
	93	.hooknum = NF_INET_LOCAL_OUT,
	94	.priority = NF_IP6_PRI_NAT_DST,
	95	},
	96	/* After packet filtering, change source */
	97	{
2a5538e9	98	.hook = ip6table_nat_fn,
58a317f1 PM	99	.owner = THIS_MODULE,
	100	.pf = NFPROTO_IPV6,
	101	.hooknum = NF_INET_LOCAL_IN,
	102	.priority = NF_IP6_PRI_NAT_SRC,
	103	},
	104	};
	105
	106	static int __net_init ip6table_nat_net_init(struct net *net)
	107	{
	108	struct ip6t_replace *repl;
	109
	110	repl = ip6t_alloc_initial_table(&nf_nat_ipv6_table);
	111	if (repl == NULL)
	112	return -ENOMEM;
	113	net->ipv6.ip6table_nat = ip6t_register_table(net, &nf_nat_ipv6_table, repl);
	114	kfree(repl);
8c6ffba0	115	return PTR_ERR_OR_ZERO(net->ipv6.ip6table_nat);
58a317f1 PM	116	}
	117
	118	static void __net_exit ip6table_nat_net_exit(struct net *net)
	119	{
	120	ip6t_unregister_table(net, net->ipv6.ip6table_nat);
	121	}
	122
	123	static struct pernet_operations ip6table_nat_net_ops = {
	124	.init = ip6table_nat_net_init,
	125	.exit = ip6table_nat_net_exit,
	126	};
	127
	128	static int __init ip6table_nat_init(void)
	129	{
	130	int err;
	131
	132	err = register_pernet_subsys(&ip6table_nat_net_ops);
	133	if (err < 0)
	134	goto err1;
	135
	136	err = nf_register_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
	137	if (err < 0)
	138	goto err2;
	139	return 0;
	140
	141	err2:
	142	unregister_pernet_subsys(&ip6table_nat_net_ops);
	143	err1:
	144	return err;
	145	}
	146
	147	static void __exit ip6table_nat_exit(void)
	148	{
	149	nf_unregister_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
	150	unregister_pernet_subsys(&ip6table_nat_net_ops);
	151	}
	152
	153	module_init(ip6table_nat_init);
	154	module_exit(ip6table_nat_exit);
	155
	156	MODULE_LICENSE("GPL");