net/ipv6/netfilter/ip6table_nat.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
   4  *
   5  * Based on Rusty Russell's IPv4 NAT code. Development of IPv6 NAT
   6  * funded by Astaro.
   7  */
   8
   9 #include <linux/module.h>
  10 #include <linux/netfilter.h>
  11 #include <linux/netfilter_ipv6.h>
  12 #include <linux/netfilter_ipv6/ip6_tables.h>
  13 #include <linux/ipv6.h>
  14 #include <net/ipv6.h>
  15
  16 #include <net/netfilter/nf_nat.h>
  17
  18 struct ip6table_nat_pernet {
  19         struct nf_hook_ops *nf_nat_ops;
  20 };
  21
  22 static int __net_init ip6table_nat_table_init(struct net *net);
  23
  24 static unsigned int ip6table_nat_net_id __read_mostly;
  25
  26 static const struct xt_table nf_nat_ipv6_table = {
  27         .name           = "nat",
  28         .valid_hooks    = (1 << NF_INET_PRE_ROUTING) |
  29                           (1 << NF_INET_POST_ROUTING) |
  30                           (1 << NF_INET_LOCAL_OUT) |
  31                           (1 << NF_INET_LOCAL_IN),
  32         .me             = THIS_MODULE,
  33         .af             = NFPROTO_IPV6,
  34         .table_init     = ip6table_nat_table_init,
  35 };
  36
  37 static unsigned int ip6table_nat_do_chain(void *priv,
  38                                           struct sk_buff *skb,
  39                                           const struct nf_hook_state *state)
  40 {
  41         return ip6t_do_table(skb, state, priv);
  42 }
  43
  44 static const struct nf_hook_ops nf_nat_ipv6_ops[] = {
  45         {
  46                 .hook           = ip6table_nat_do_chain,
  47                 .pf             = NFPROTO_IPV6,
  48                 .hooknum        = NF_INET_PRE_ROUTING,
  49                 .priority       = NF_IP6_PRI_NAT_DST,
  50         },
  51         {
  52                 .hook           = ip6table_nat_do_chain,
  53                 .pf             = NFPROTO_IPV6,
  54                 .hooknum        = NF_INET_POST_ROUTING,
  55                 .priority       = NF_IP6_PRI_NAT_SRC,
  56         },
  57         {
  58                 .hook           = ip6table_nat_do_chain,
  59                 .pf             = NFPROTO_IPV6,
  60                 .hooknum        = NF_INET_LOCAL_OUT,
  61                 .priority       = NF_IP6_PRI_NAT_DST,
  62         },
  63         {
  64                 .hook           = ip6table_nat_do_chain,
  65                 .pf             = NFPROTO_IPV6,
  66                 .hooknum        = NF_INET_LOCAL_IN,
  67                 .priority       = NF_IP6_PRI_NAT_SRC,
  68         },
  69 };
  70
  71 static int ip6t_nat_register_lookups(struct net *net)
  72 {
  73         struct ip6table_nat_pernet *xt_nat_net;
  74         struct nf_hook_ops *ops;
  75         struct xt_table *table;
  76         int i, ret;
  77
  78         table = xt_find_table(net, NFPROTO_IPV6, "nat");
  79         if (WARN_ON_ONCE(!table))
  80                 return -ENOENT;
  81
  82         xt_nat_net = net_generic(net, ip6table_nat_net_id);
  83         ops = kmemdup(nf_nat_ipv6_ops, sizeof(nf_nat_ipv6_ops), GFP_KERNEL);
  84         if (!ops)
  85                 return -ENOMEM;
  86
  87         for (i = 0; i < ARRAY_SIZE(nf_nat_ipv6_ops); i++) {
  88                 ops[i].priv = table;
  89                 ret = nf_nat_ipv6_register_fn(net, &ops[i]);
  90                 if (ret) {
  91                         while (i)
  92                                 nf_nat_ipv6_unregister_fn(net, &ops[--i]);
  93
  94                         kfree(ops);
  95                         return ret;
  96                 }
  97         }
  98
  99         xt_nat_net->nf_nat_ops = ops;
 100         return 0;
 101 }
 102
 103 static void ip6t_nat_unregister_lookups(struct net *net)
 104 {
 105         struct ip6table_nat_pernet *xt_nat_net = net_generic(net, ip6table_nat_net_id);
 106         struct nf_hook_ops *ops = xt_nat_net->nf_nat_ops;
 107         int i;
 108
 109         if (!ops)
 110                 return;
 111
 112         for (i = 0; i < ARRAY_SIZE(nf_nat_ipv6_ops); i++)
 113                 nf_nat_ipv6_unregister_fn(net, &ops[i]);
 114
 115         kfree(ops);
 116 }
 117
 118 static int __net_init ip6table_nat_table_init(struct net *net)
 119 {
 120         struct ip6t_replace *repl;
 121         int ret;
 122
 123         repl = ip6t_alloc_initial_table(&nf_nat_ipv6_table);
 124         if (repl == NULL)
 125                 return -ENOMEM;
 126         ret = ip6t_register_table(net, &nf_nat_ipv6_table, repl,
 127                                   NULL);
 128         if (ret < 0) {
 129                 kfree(repl);
 130                 return ret;
 131         }
 132
 133         ret = ip6t_nat_register_lookups(net);
 134         if (ret < 0)
 135                 ip6t_unregister_table_exit(net, "nat");
 136
 137         kfree(repl);
 138         return ret;
 139 }
 140
 141 static void __net_exit ip6table_nat_net_pre_exit(struct net *net)
 142 {
 143         ip6t_nat_unregister_lookups(net);
 144 }
 145
 146 static void __net_exit ip6table_nat_net_exit(struct net *net)
 147 {
 148         ip6t_unregister_table_exit(net, "nat");
 149 }
 150
 151 static struct pernet_operations ip6table_nat_net_ops = {
 152         .pre_exit = ip6table_nat_net_pre_exit,
 153         .exit   = ip6table_nat_net_exit,
 154         .id     = &ip6table_nat_net_id,
 155         .size   = sizeof(struct ip6table_nat_pernet),
 156 };
 157
 158 static int __init ip6table_nat_init(void)
 159 {
 160         int ret = register_pernet_subsys(&ip6table_nat_net_ops);
 161
 162         if (ret)
 163                 return ret;
 164
 165         ret = ip6table_nat_table_init(&init_net);
 166         if (ret)
 167                 unregister_pernet_subsys(&ip6table_nat_net_ops);
 168         return ret;
 169 }
 170
 171 static void __exit ip6table_nat_exit(void)
 172 {
 173         unregister_pernet_subsys(&ip6table_nat_net_ops);
 174 }
 175
 176 module_init(ip6table_nat_init);
 177 module_exit(ip6table_nat_exit);
 178
 179 MODULE_LICENSE("GPL");