net/ipv6/netfilter/ip6table_nat.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
   4  *
   5  * Based on Rusty Russell's IPv4 NAT code. Development of IPv6 NAT
   6  * funded by Astaro.
   7  */
   8
   9 #include <linux/module.h>
  10 #include <linux/netfilter.h>
  11 #include <linux/netfilter_ipv6.h>
  12 #include <linux/netfilter_ipv6/ip6_tables.h>
  13 #include <linux/ipv6.h>
  14 #include <net/ipv6.h>
  15
  16 #include <net/netfilter/nf_nat.h>
  17
  18 struct ip6table_nat_pernet {
  19         struct nf_hook_ops *nf_nat_ops;
  20 };
  21
  22 static unsigned int ip6table_nat_net_id __read_mostly;
  23
  24 static const struct xt_table nf_nat_ipv6_table = {
  25         .name           = "nat",
  26         .valid_hooks    = (1 << NF_INET_PRE_ROUTING) |
  27                           (1 << NF_INET_POST_ROUTING) |
  28                           (1 << NF_INET_LOCAL_OUT) |
  29                           (1 << NF_INET_LOCAL_IN),
  30         .me             = THIS_MODULE,
  31         .af             = NFPROTO_IPV6,
  32 };
  33
  34 static unsigned int ip6table_nat_do_chain(void *priv,
  35                                           struct sk_buff *skb,
  36                                           const struct nf_hook_state *state)
  37 {
  38         return ip6t_do_table(skb, state, priv);
  39 }
  40
  41 static const struct nf_hook_ops nf_nat_ipv6_ops[] = {
  42         {
  43                 .hook           = ip6table_nat_do_chain,
  44                 .pf             = NFPROTO_IPV6,
  45                 .hooknum        = NF_INET_PRE_ROUTING,
  46                 .priority       = NF_IP6_PRI_NAT_DST,
  47         },
  48         {
  49                 .hook           = ip6table_nat_do_chain,
  50                 .pf             = NFPROTO_IPV6,
  51                 .hooknum        = NF_INET_POST_ROUTING,
  52                 .priority       = NF_IP6_PRI_NAT_SRC,
  53         },
  54         {
  55                 .hook           = ip6table_nat_do_chain,
  56                 .pf             = NFPROTO_IPV6,
  57                 .hooknum        = NF_INET_LOCAL_OUT,
  58                 .priority       = NF_IP6_PRI_NAT_DST,
  59         },
  60         {
  61                 .hook           = ip6table_nat_do_chain,
  62                 .pf             = NFPROTO_IPV6,
  63                 .hooknum        = NF_INET_LOCAL_IN,
  64                 .priority       = NF_IP6_PRI_NAT_SRC,
  65         },
  66 };
  67
  68 static int ip6t_nat_register_lookups(struct net *net)
  69 {
  70         struct ip6table_nat_pernet *xt_nat_net;
  71         struct nf_hook_ops *ops;
  72         struct xt_table *table;
  73         int i, ret;
  74
  75         table = xt_find_table(net, NFPROTO_IPV6, "nat");
  76         if (WARN_ON_ONCE(!table))
  77                 return -ENOENT;
  78
  79         xt_nat_net = net_generic(net, ip6table_nat_net_id);
  80         ops = kmemdup(nf_nat_ipv6_ops, sizeof(nf_nat_ipv6_ops), GFP_KERNEL);
  81         if (!ops)
  82                 return -ENOMEM;
  83
  84         for (i = 0; i < ARRAY_SIZE(nf_nat_ipv6_ops); i++) {
  85                 ops[i].priv = table;
  86                 ret = nf_nat_ipv6_register_fn(net, &ops[i]);
  87                 if (ret) {
  88                         while (i)
  89                                 nf_nat_ipv6_unregister_fn(net, &ops[--i]);
  90
  91                         kfree(ops);
  92                         return ret;
  93                 }
  94         }
  95
  96         xt_nat_net->nf_nat_ops = ops;
  97         return 0;
  98 }
  99
 100 static void ip6t_nat_unregister_lookups(struct net *net)
 101 {
 102         struct ip6table_nat_pernet *xt_nat_net = net_generic(net, ip6table_nat_net_id);
 103         struct nf_hook_ops *ops = xt_nat_net->nf_nat_ops;
 104         int i;
 105
 106         if (!ops)
 107                 return;
 108
 109         for (i = 0; i < ARRAY_SIZE(nf_nat_ipv6_ops); i++)
 110                 nf_nat_ipv6_unregister_fn(net, &ops[i]);
 111
 112         kfree(ops);
 113 }
 114
 115 static int ip6table_nat_table_init(struct net *net)
 116 {
 117         struct ip6t_replace *repl;
 118         int ret;
 119
 120         repl = ip6t_alloc_initial_table(&nf_nat_ipv6_table);
 121         if (repl == NULL)
 122                 return -ENOMEM;
 123         ret = ip6t_register_table(net, &nf_nat_ipv6_table, repl,
 124                                   NULL);
 125         if (ret < 0) {
 126                 kfree(repl);
 127                 return ret;
 128         }
 129
 130         ret = ip6t_nat_register_lookups(net);
 131         if (ret < 0)
 132                 ip6t_unregister_table_exit(net, "nat");
 133
 134         kfree(repl);
 135         return ret;
 136 }
 137
 138 static void __net_exit ip6table_nat_net_pre_exit(struct net *net)
 139 {
 140         ip6t_nat_unregister_lookups(net);
 141 }
 142
 143 static void __net_exit ip6table_nat_net_exit(struct net *net)
 144 {
 145         ip6t_unregister_table_exit(net, "nat");
 146 }
 147
 148 static struct pernet_operations ip6table_nat_net_ops = {
 149         .pre_exit = ip6table_nat_net_pre_exit,
 150         .exit   = ip6table_nat_net_exit,
 151         .id     = &ip6table_nat_net_id,
 152         .size   = sizeof(struct ip6table_nat_pernet),
 153 };
 154
 155 static int __init ip6table_nat_init(void)
 156 {
 157         int ret = xt_register_template(&nf_nat_ipv6_table,
 158                                        ip6table_nat_table_init);
 159
 160         if (ret < 0)
 161                 return ret;
 162
 163         ret = register_pernet_subsys(&ip6table_nat_net_ops);
 164         if (ret)
 165                 xt_unregister_template(&nf_nat_ipv6_table);
 166
 167         return ret;
 168 }
 169
 170 static void __exit ip6table_nat_exit(void)
 171 {
 172         unregister_pernet_subsys(&ip6table_nat_net_ops);
 173         xt_unregister_template(&nf_nat_ipv6_table);
 174 }
 175
 176 module_init(ip6table_nat_init);
 177 module_exit(ip6table_nat_exit);
 178
 179 MODULE_LICENSE("GPL");