1 // SPDX-License-Identifier: GPL-2.0
3 #include <linux/module.h>
4 #include <linux/netfilter/nf_tables.h>
5 #include <net/netfilter/nf_nat.h>
6 #include <net/netfilter/nf_tables.h>
7 #include <net/netfilter/nf_tables_ipv4.h>
8 #include <net/netfilter/nf_tables_ipv6.h>
10 static unsigned int nft_nat_do_chain(void *priv, struct sk_buff *skb,
11 const struct nf_hook_state *state)
13 struct nft_pktinfo pkt;
15 nft_set_pktinfo(&pkt, skb, state);
18 #ifdef CONFIG_NF_TABLES_IPV4
20 nft_set_pktinfo_ipv4(&pkt);
23 #ifdef CONFIG_NF_TABLES_IPV6
25 nft_set_pktinfo_ipv6(&pkt);
32 return nft_do_chain(&pkt, priv);
35 #ifdef CONFIG_NF_TABLES_IPV4
36 static const struct nft_chain_type nft_chain_nat_ipv4 = {
38 .type = NFT_CHAIN_T_NAT,
39 .family = NFPROTO_IPV4,
41 .hook_mask = (1 << NF_INET_PRE_ROUTING) |
42 (1 << NF_INET_POST_ROUTING) |
43 (1 << NF_INET_LOCAL_OUT) |
44 (1 << NF_INET_LOCAL_IN),
46 [NF_INET_PRE_ROUTING] = nft_nat_do_chain,
47 [NF_INET_POST_ROUTING] = nft_nat_do_chain,
48 [NF_INET_LOCAL_OUT] = nft_nat_do_chain,
49 [NF_INET_LOCAL_IN] = nft_nat_do_chain,
51 .ops_register = nf_nat_ipv4_register_fn,
52 .ops_unregister = nf_nat_ipv4_unregister_fn,
56 #ifdef CONFIG_NF_TABLES_IPV6
57 static const struct nft_chain_type nft_chain_nat_ipv6 = {
59 .type = NFT_CHAIN_T_NAT,
60 .family = NFPROTO_IPV6,
62 .hook_mask = (1 << NF_INET_PRE_ROUTING) |
63 (1 << NF_INET_POST_ROUTING) |
64 (1 << NF_INET_LOCAL_OUT) |
65 (1 << NF_INET_LOCAL_IN),
67 [NF_INET_PRE_ROUTING] = nft_nat_do_chain,
68 [NF_INET_POST_ROUTING] = nft_nat_do_chain,
69 [NF_INET_LOCAL_OUT] = nft_nat_do_chain,
70 [NF_INET_LOCAL_IN] = nft_nat_do_chain,
72 .ops_register = nf_nat_ipv6_register_fn,
73 .ops_unregister = nf_nat_ipv6_unregister_fn,
77 #ifdef CONFIG_NF_TABLES_INET
78 static int nft_nat_inet_reg(struct net *net, const struct nf_hook_ops *ops)
80 return nf_nat_inet_register_fn(net, ops);
83 static void nft_nat_inet_unreg(struct net *net, const struct nf_hook_ops *ops)
85 nf_nat_inet_unregister_fn(net, ops);
88 static const struct nft_chain_type nft_chain_nat_inet = {
90 .type = NFT_CHAIN_T_NAT,
91 .family = NFPROTO_INET,
93 .hook_mask = (1 << NF_INET_PRE_ROUTING) |
94 (1 << NF_INET_LOCAL_IN) |
95 (1 << NF_INET_LOCAL_OUT) |
96 (1 << NF_INET_POST_ROUTING),
98 [NF_INET_PRE_ROUTING] = nft_nat_do_chain,
99 [NF_INET_LOCAL_IN] = nft_nat_do_chain,
100 [NF_INET_LOCAL_OUT] = nft_nat_do_chain,
101 [NF_INET_POST_ROUTING] = nft_nat_do_chain,
103 .ops_register = nft_nat_inet_reg,
104 .ops_unregister = nft_nat_inet_unreg,
108 static int __init nft_chain_nat_init(void)
110 #ifdef CONFIG_NF_TABLES_IPV6
111 nft_register_chain_type(&nft_chain_nat_ipv6);
113 #ifdef CONFIG_NF_TABLES_IPV4
114 nft_register_chain_type(&nft_chain_nat_ipv4);
116 #ifdef CONFIG_NF_TABLES_INET
117 nft_register_chain_type(&nft_chain_nat_inet);
123 static void __exit nft_chain_nat_exit(void)
125 #ifdef CONFIG_NF_TABLES_IPV4
126 nft_unregister_chain_type(&nft_chain_nat_ipv4);
128 #ifdef CONFIG_NF_TABLES_IPV6
129 nft_unregister_chain_type(&nft_chain_nat_ipv6);
131 #ifdef CONFIG_NF_TABLES_INET
132 nft_unregister_chain_type(&nft_chain_nat_inet);
136 module_init(nft_chain_nat_init);
137 module_exit(nft_chain_nat_exit);
139 MODULE_LICENSE("GPL");
140 MODULE_DESCRIPTION("nftables network address translation support");
141 #ifdef CONFIG_NF_TABLES_IPV4
142 MODULE_ALIAS_NFT_CHAIN(AF_INET, "nat");
144 #ifdef CONFIG_NF_TABLES_IPV6
145 MODULE_ALIAS_NFT_CHAIN(AF_INET6, "nat");
147 #ifdef CONFIG_NF_TABLES_INET
148 MODULE_ALIAS_NFT_CHAIN(1, "nat"); /* NFPROTO_INET */