/net/bridge/netfilter/ebtable_nat.c

http://github.com/mirrors/linux · C · 124 lines · 99 code · 15 blank · 10 comment · 1 complexity · 5bd4aec9dd562faca05543c22a8393ca MD5 · raw file

  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * ebtable_nat
  4. *
  5. * Authors:
  6. * Bart De Schuymer <bdschuym@pandora.be>
  7. *
  8. * April, 2002
  9. *
  10. */
  11. #include <linux/netfilter_bridge/ebtables.h>
  12. #include <uapi/linux/netfilter_bridge.h>
  13. #include <linux/module.h>
  14. #define NAT_VALID_HOOKS ((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT) | \
  15. (1 << NF_BR_POST_ROUTING))
  16. static struct ebt_entries initial_chains[] = {
  17. {
  18. .name = "PREROUTING",
  19. .policy = EBT_ACCEPT,
  20. },
  21. {
  22. .name = "OUTPUT",
  23. .policy = EBT_ACCEPT,
  24. },
  25. {
  26. .name = "POSTROUTING",
  27. .policy = EBT_ACCEPT,
  28. }
  29. };
  30. static struct ebt_replace_kernel initial_table = {
  31. .name = "nat",
  32. .valid_hooks = NAT_VALID_HOOKS,
  33. .entries_size = 3 * sizeof(struct ebt_entries),
  34. .hook_entry = {
  35. [NF_BR_PRE_ROUTING] = &initial_chains[0],
  36. [NF_BR_LOCAL_OUT] = &initial_chains[1],
  37. [NF_BR_POST_ROUTING] = &initial_chains[2],
  38. },
  39. .entries = (char *)initial_chains,
  40. };
  41. static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
  42. {
  43. if (valid_hooks & ~NAT_VALID_HOOKS)
  44. return -EINVAL;
  45. return 0;
  46. }
  47. static const struct ebt_table frame_nat = {
  48. .name = "nat",
  49. .table = &initial_table,
  50. .valid_hooks = NAT_VALID_HOOKS,
  51. .check = check,
  52. .me = THIS_MODULE,
  53. };
  54. static unsigned int
  55. ebt_nat_in(void *priv, struct sk_buff *skb,
  56. const struct nf_hook_state *state)
  57. {
  58. return ebt_do_table(skb, state, state->net->xt.frame_nat);
  59. }
  60. static unsigned int
  61. ebt_nat_out(void *priv, struct sk_buff *skb,
  62. const struct nf_hook_state *state)
  63. {
  64. return ebt_do_table(skb, state, state->net->xt.frame_nat);
  65. }
  66. static const struct nf_hook_ops ebt_ops_nat[] = {
  67. {
  68. .hook = ebt_nat_out,
  69. .pf = NFPROTO_BRIDGE,
  70. .hooknum = NF_BR_LOCAL_OUT,
  71. .priority = NF_BR_PRI_NAT_DST_OTHER,
  72. },
  73. {
  74. .hook = ebt_nat_out,
  75. .pf = NFPROTO_BRIDGE,
  76. .hooknum = NF_BR_POST_ROUTING,
  77. .priority = NF_BR_PRI_NAT_SRC,
  78. },
  79. {
  80. .hook = ebt_nat_in,
  81. .pf = NFPROTO_BRIDGE,
  82. .hooknum = NF_BR_PRE_ROUTING,
  83. .priority = NF_BR_PRI_NAT_DST_BRIDGED,
  84. },
  85. };
  86. static int __net_init frame_nat_net_init(struct net *net)
  87. {
  88. return ebt_register_table(net, &frame_nat, ebt_ops_nat,
  89. &net->xt.frame_nat);
  90. }
  91. static void __net_exit frame_nat_net_exit(struct net *net)
  92. {
  93. ebt_unregister_table(net, net->xt.frame_nat, ebt_ops_nat);
  94. }
  95. static struct pernet_operations frame_nat_net_ops = {
  96. .init = frame_nat_net_init,
  97. .exit = frame_nat_net_exit,
  98. };
  99. static int __init ebtable_nat_init(void)
  100. {
  101. return register_pernet_subsys(&frame_nat_net_ops);
  102. }
  103. static void __exit ebtable_nat_fini(void)
  104. {
  105. unregister_pernet_subsys(&frame_nat_net_ops);
  106. }
  107. module_init(ebtable_nat_init);
  108. module_exit(ebtable_nat_fini);
  109. MODULE_LICENSE("GPL");