1 // SPDX-License-Identifier: GPL-2.0
3 #include <linux/module.h>
4 #include <linux/netfilter/nf_tables.h>
5 #include <net/netfilter/nf_nat.h>
6 #include <net/netfilter/nf_tables.h>
7 #include <net/netfilter/nf_tables_ipv4.h>
8 #include <net/netfilter/nf_tables_ipv6.h>
10 static unsigned int nft_nat_do_chain(void *priv, struct sk_buff *skb,
11 const struct nf_hook_state *state)
13 struct nft_pktinfo pkt;
15 nft_set_pktinfo(&pkt, skb, state);
18 #ifdef CONFIG_NF_TABLES_IPV4
20 nft_set_pktinfo_ipv4(&pkt, skb);
23 #ifdef CONFIG_NF_TABLES_IPV6
25 nft_set_pktinfo_ipv6(&pkt, skb);
32 return nft_do_chain(&pkt, priv);
35 #ifdef CONFIG_NF_TABLES_IPV4
36 static const struct nft_chain_type nft_chain_nat_ipv4 = {
38 .type = NFT_CHAIN_T_NAT,
39 .family = NFPROTO_IPV4,
41 .hook_mask = (1 << NF_INET_PRE_ROUTING) |
42 (1 << NF_INET_POST_ROUTING) |
43 (1 << NF_INET_LOCAL_OUT) |
44 (1 << NF_INET_LOCAL_IN),
46 [NF_INET_PRE_ROUTING] = nft_nat_do_chain,
47 [NF_INET_POST_ROUTING] = nft_nat_do_chain,
48 [NF_INET_LOCAL_OUT] = nft_nat_do_chain,
49 [NF_INET_LOCAL_IN] = nft_nat_do_chain,
51 .ops_register = nf_nat_ipv4_register_fn,
52 .ops_unregister = nf_nat_ipv4_unregister_fn,
56 #ifdef CONFIG_NF_TABLES_IPV6
57 static const struct nft_chain_type nft_chain_nat_ipv6 = {
59 .type = NFT_CHAIN_T_NAT,
60 .family = NFPROTO_IPV6,
62 .hook_mask = (1 << NF_INET_PRE_ROUTING) |
63 (1 << NF_INET_POST_ROUTING) |
64 (1 << NF_INET_LOCAL_OUT) |
65 (1 << NF_INET_LOCAL_IN),
67 [NF_INET_PRE_ROUTING] = nft_nat_do_chain,
68 [NF_INET_POST_ROUTING] = nft_nat_do_chain,
69 [NF_INET_LOCAL_OUT] = nft_nat_do_chain,
70 [NF_INET_LOCAL_IN] = nft_nat_do_chain,
72 .ops_register = nf_nat_ipv6_register_fn,
73 .ops_unregister = nf_nat_ipv6_unregister_fn,
77 #ifdef CONFIG_NF_TABLES_INET
78 static int nft_nat_inet_reg(struct net *net, const struct nf_hook_ops *ops)
80 return nf_nat_inet_register_fn(net, ops);
83 static void nft_nat_inet_unreg(struct net *net, const struct nf_hook_ops *ops)
85 nf_nat_inet_unregister_fn(net, ops);
88 static const struct nft_chain_type nft_chain_nat_inet = {
90 .type = NFT_CHAIN_T_NAT,
91 .family = NFPROTO_INET,
92 .hook_mask = (1 << NF_INET_PRE_ROUTING) |
93 (1 << NF_INET_LOCAL_IN) |
94 (1 << NF_INET_LOCAL_OUT) |
95 (1 << NF_INET_POST_ROUTING),
97 [NF_INET_PRE_ROUTING] = nft_nat_do_chain,
98 [NF_INET_LOCAL_IN] = nft_nat_do_chain,
99 [NF_INET_LOCAL_OUT] = nft_nat_do_chain,
100 [NF_INET_POST_ROUTING] = nft_nat_do_chain,
102 .ops_register = nft_nat_inet_reg,
103 .ops_unregister = nft_nat_inet_unreg,
107 static int __init nft_chain_nat_init(void)
109 #ifdef CONFIG_NF_TABLES_IPV6
110 nft_register_chain_type(&nft_chain_nat_ipv6);
112 #ifdef CONFIG_NF_TABLES_IPV4
113 nft_register_chain_type(&nft_chain_nat_ipv4);
115 #ifdef CONFIG_NF_TABLES_INET
116 nft_register_chain_type(&nft_chain_nat_inet);
122 static void __exit nft_chain_nat_exit(void)
124 #ifdef CONFIG_NF_TABLES_IPV4
125 nft_unregister_chain_type(&nft_chain_nat_ipv4);
127 #ifdef CONFIG_NF_TABLES_IPV6
128 nft_unregister_chain_type(&nft_chain_nat_ipv6);
130 #ifdef CONFIG_NF_TABLES_INET
131 nft_unregister_chain_type(&nft_chain_nat_inet);
135 module_init(nft_chain_nat_init);
136 module_exit(nft_chain_nat_exit);
138 MODULE_LICENSE("GPL");
139 #ifdef CONFIG_NF_TABLES_IPV4
140 MODULE_ALIAS_NFT_CHAIN(AF_INET, "nat");
142 #ifdef CONFIG_NF_TABLES_IPV6
143 MODULE_ALIAS_NFT_CHAIN(AF_INET6, "nat");
145 #ifdef CONFIG_NF_TABLES_INET
146 MODULE_ALIAS_NFT_CHAIN(1, "nat"); /* NFPROTO_INET */