[deliverable/linux.git] / net / ipv4 / netfilter / nf_nat_standalone.c

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/types.h>
#include <linux/icmp.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/proc_fs.h>
#include <net/ip.h>
#include <net/checksum.h>
#include <linux/spinlock.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_extend.h>
#include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_nat_rule.h>
#include <net/netfilter/nf_nat_protocol.h>
#include <net/netfilter/nf_nat_core.h>
#include <net/netfilter/nf_nat_helper.h>
#include <linux/netfilter_ipv4/ip_tables.h>

#ifdef CONFIG_XFRM
static void nat_decode_session(struct sk_buff *skb, struct flowi *fl)
{
	const struct nf_conn *ct;
	const struct nf_conntrack_tuple *t;
	enum ip_conntrack_info ctinfo;
	enum ip_conntrack_dir dir;
	unsigned long statusbit;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return;
	dir = CTINFO2DIR(ctinfo);
	t = &ct->tuplehash[dir].tuple;

	if (dir == IP_CT_DIR_ORIGINAL)
		statusbit = IPS_DST_NAT;
	else
		statusbit = IPS_SRC_NAT;

	if (ct->status & statusbit) {
		fl->fl4_dst = t->dst.u3.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP ||
		    t->dst.protonum == IPPROTO_UDPLITE ||
		    t->dst.protonum == IPPROTO_DCCP ||
		    t->dst.protonum == IPPROTO_SCTP)
			fl->fl_ip_dport = t->dst.u.tcp.port;
	}

	statusbit ^= IPS_NAT_MASK;

	if (ct->status & statusbit) {
		fl->fl4_src = t->src.u3.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP ||
		    t->dst.protonum == IPPROTO_UDPLITE ||
		    t->dst.protonum == IPPROTO_DCCP ||
		    t->dst.protonum == IPPROTO_SCTP)
			fl->fl_ip_sport = t->src.u.tcp.port;
	}
}
#endif

static unsigned int
nf_nat_fn(unsigned int hooknum,
	  struct sk_buff *skb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	struct nf_conn_nat *nat;
	/* maniptype == SRC for postrouting. */
	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);

	/* We never see fragments: conntrack defrags on pre-routing
	   and local-out, and nf_nat_out protects post-routing. */
	NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)));

	ct = nf_ct_get(skb, &ctinfo);
	/* Can't track?  It's not due to stress, or conntrack would
	   have dropped it.  Hence it's the user's responsibilty to
	   packet filter it out, or implement conntrack/NAT for that
	   protocol. 8) --RR */
	if (!ct)
		return NF_ACCEPT;

	/* Don't try to NAT if this packet is not conntracked */
	if (ct == &nf_conntrack_untracked)
		return NF_ACCEPT;

	nat = nfct_nat(ct);
	if (!nat) {
		/* NAT module was loaded late. */
		if (nf_ct_is_confirmed(ct))
			return NF_ACCEPT;
		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
		if (nat == NULL) {
			pr_debug("failed to add NAT extension\n");
			return NF_ACCEPT;
		}
	}

	switch (ctinfo) {
	case IP_CT_RELATED:
	case IP_CT_RELATED+IP_CT_IS_REPLY:
		if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
			if (!nf_nat_icmp_reply_translation(ct, ctinfo,
							   hooknum, skb))
				return NF_DROP;
			else
				return NF_ACCEPT;
		}
		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	case IP_CT_NEW:

		/* Seen it before?  This can happen for loopback, retrans,
		   or local packets.. */
		if (!nf_nat_initialized(ct, maniptype)) {
			unsigned int ret;

			if (hooknum == NF_INET_LOCAL_IN)
				/* LOCAL_IN hook doesn't have a chain!  */
				ret = alloc_null_binding(ct, hooknum);
			else
				ret = nf_nat_rule_find(skb, hooknum, in, out,
						       ct);

			if (ret != NF_ACCEPT) {
				return ret;
			}
		} else
			pr_debug("Already setup manip %s for ct %p\n",
				 maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
				 ct);
		break;

	default:
		/* ESTABLISHED */
		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
			     ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
	}

	return nf_nat_packet(ct, ctinfo, hooknum, skb);
}

static unsigned int
nf_nat_in(unsigned int hooknum,
	  struct sk_buff *skb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	unsigned int ret;
	__be32 daddr = ip_hdr(skb)->daddr;

	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    daddr != ip_hdr(skb)->daddr) {
		dst_release(skb->dst);
		skb->dst = NULL;
	}
	return ret;
}

static unsigned int
nf_nat_out(unsigned int hooknum,
	   struct sk_buff *skb,
	   const struct net_device *in,
	   const struct net_device *out,
	   int (*okfn)(struct sk_buff *))
{
#ifdef CONFIG_XFRM
	const struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
#endif
	unsigned int ret;

	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr) ||
	    ip_hdrlen(skb) < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
#ifdef CONFIG_XFRM
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if (ct->tuplehash[dir].tuple.src.u3.ip !=
		    ct->tuplehash[!dir].tuple.dst.u3.ip
		    || ct->tuplehash[dir].tuple.src.u.all !=
		       ct->tuplehash[!dir].tuple.dst.u.all
		    )
			return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
	}
#endif
	return ret;
}

static unsigned int
nf_nat_local_fn(unsigned int hooknum,
		struct sk_buff *skb,
		const struct net_device *in,
		const struct net_device *out,
		int (*okfn)(struct sk_buff *))
{
	const struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	unsigned int ret;

	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr) ||
	    ip_hdrlen(skb) < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if (ct->tuplehash[dir].tuple.dst.u3.ip !=
		    ct->tuplehash[!dir].tuple.src.u3.ip) {
			if (ip_route_me_harder(skb, RTN_UNSPEC))
				ret = NF_DROP;
		}
#ifdef CONFIG_XFRM
		else if (ct->tuplehash[dir].tuple.dst.u.all !=
			 ct->tuplehash[!dir].tuple.src.u.all)
			if (ip_xfrm_me_harder(skb))
				ret = NF_DROP;
#endif
	}
	return ret;
}

/* We must be after connection tracking and before packet filtering. */

static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
	/* Before packet filtering, change destination */
	{
		.hook		= nf_nat_in,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_PRE_ROUTING,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= nf_nat_out,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_POST_ROUTING,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
	/* Before packet filtering, change destination */
	{
		.hook		= nf_nat_local_fn,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_LOCAL_OUT,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= nf_nat_fn,
		.owner		= THIS_MODULE,
		.pf		= PF_INET,
		.hooknum	= NF_INET_LOCAL_IN,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
};

static int __init nf_nat_standalone_init(void)
{
	int ret = 0;

	need_ipv4_conntrack();

#ifdef CONFIG_XFRM
	BUG_ON(ip_nat_decode_session != NULL);
	rcu_assign_pointer(ip_nat_decode_session, nat_decode_session);
#endif
	ret = nf_nat_rule_init();
	if (ret < 0) {
		printk("nf_nat_init: can't setup rules.\n");
		goto cleanup_decode_session;
	}
	ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	if (ret < 0) {
		printk("nf_nat_init: can't register hooks.\n");
		goto cleanup_rule_init;
	}
	return ret;

 cleanup_rule_init:
	nf_nat_rule_cleanup();
 cleanup_decode_session:
#ifdef CONFIG_XFRM
	rcu_assign_pointer(ip_nat_decode_session, NULL);
	synchronize_net();
#endif
	return ret;
}

static void __exit nf_nat_standalone_fini(void)
{
	nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	nf_nat_rule_cleanup();
#ifdef CONFIG_XFRM
	rcu_assign_pointer(ip_nat_decode_session, NULL);
	synchronize_net();
#endif
	/* Conntrack caches are unregistered in nf_conntrack_cleanup */
}

module_init(nf_nat_standalone_init);
module_exit(nf_nat_standalone_fini);

MODULE_LICENSE("GPL");
MODULE_ALIAS("ip_nat");
Commit	Line	Data
5b1158e9 JK	1	/* (C) 1999-2001 Paul `Rusty' Russell
	2	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8	#include <linux/types.h>
	9	#include <linux/icmp.h>
	10	#include <linux/ip.h>
	11	#include <linux/netfilter.h>
	12	#include <linux/netfilter_ipv4.h>
	13	#include <linux/module.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/proc_fs.h>
	16	#include <net/ip.h>
	17	#include <net/checksum.h>
	18	#include <linux/spinlock.h>
	19
	20	#include <net/netfilter/nf_conntrack.h>
	21	#include <net/netfilter/nf_conntrack_core.h>
2d59e5ca	22	#include <net/netfilter/nf_conntrack_extend.h>
5b1158e9 JK	23	#include <net/netfilter/nf_nat.h>
	24	#include <net/netfilter/nf_nat_rule.h>
	25	#include <net/netfilter/nf_nat_protocol.h>
	26	#include <net/netfilter/nf_nat_core.h>
	27	#include <net/netfilter/nf_nat_helper.h>
	28	#include <linux/netfilter_ipv4/ip_tables.h>
	29
5b1158e9 JK	30	#ifdef CONFIG_XFRM
	31	static void nat_decode_session(struct sk_buff skb, struct flowi fl)
	32	{
72b72949 JE	33	const struct nf_conn *ct;
72b72949 JE	34	const struct nf_conntrack_tuple *t;
5b1158e9 JK	35	enum ip_conntrack_info ctinfo;
	36	enum ip_conntrack_dir dir;
	37	unsigned long statusbit;
	38
	39	ct = nf_ct_get(skb, &ctinfo);
	40	if (ct == NULL)
	41	return;
	42	dir = CTINFO2DIR(ctinfo);
	43	t = &ct->tuplehash[dir].tuple;
	44
	45	if (dir == IP_CT_DIR_ORIGINAL)
	46	statusbit = IPS_DST_NAT;
	47	else
	48	statusbit = IPS_SRC_NAT;
	49
	50	if (ct->status & statusbit) {
	51	fl->fl4_dst = t->dst.u3.ip;
	52	if (t->dst.protonum == IPPROTO_TCP \|\|
6185f870	53	t->dst.protonum == IPPROTO_UDP \|\|
4910a087	54	t->dst.protonum == IPPROTO_UDPLITE \|\|
9d908a69 PM	55	t->dst.protonum == IPPROTO_DCCP \|\|
9d908a69 PM	56	t->dst.protonum == IPPROTO_SCTP)
5b1158e9 JK	57	fl->fl_ip_dport = t->dst.u.tcp.port;
	58	}
	59
	60	statusbit ^= IPS_NAT_MASK;
	61
	62	if (ct->status & statusbit) {
	63	fl->fl4_src = t->src.u3.ip;
	64	if (t->dst.protonum == IPPROTO_TCP \|\|
6185f870	65	t->dst.protonum == IPPROTO_UDP \|\|
4910a087	66	t->dst.protonum == IPPROTO_UDPLITE \|\|
9d908a69 PM	67	t->dst.protonum == IPPROTO_DCCP \|\|
9d908a69 PM	68	t->dst.protonum == IPPROTO_SCTP)
5b1158e9 JK	69	fl->fl_ip_sport = t->src.u.tcp.port;
	70	}
	71	}
	72	#endif
	73
	74	static unsigned int
	75	nf_nat_fn(unsigned int hooknum,
3db05fea	76	struct sk_buff *skb,
5b1158e9 JK	77	const struct net_device *in,
	78	const struct net_device *out,
	79	int (okfn)(struct sk_buff ))
	80	{
	81	struct nf_conn *ct;
	82	enum ip_conntrack_info ctinfo;
	83	struct nf_conn_nat *nat;
5b1158e9 JK	84	/* maniptype == SRC for postrouting. */
	85	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
	86
	87	/* We never see fragments: conntrack defrags on pre-routing
	88	and local-out, and nf_nat_out protects post-routing. */
3db05fea	89	NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF \| IP_OFFSET)));
5b1158e9	90
3db05fea	91	ct = nf_ct_get(skb, &ctinfo);
5b1158e9 JK	92	/* Can't track? It's not due to stress, or conntrack would
	93	have dropped it. Hence it's the user's responsibilty to
	94	packet filter it out, or implement conntrack/NAT for that
	95	protocol. 8) --RR */
42cf800c	96	if (!ct)
5b1158e9	97	return NF_ACCEPT;
5b1158e9 JK	98
	99	/* Don't try to NAT if this packet is not conntracked */
	100	if (ct == &nf_conntrack_untracked)
	101	return NF_ACCEPT;
	102
	103	nat = nfct_nat(ct);
2d59e5ca	104	if (!nat) {
8c87238b PM	105	/* NAT module was loaded late. */
	106	if (nf_ct_is_confirmed(ct))
	107	return NF_ACCEPT;
2d59e5ca YK	108	nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
2d59e5ca YK	109	if (nat == NULL) {
0d53778e	110	pr_debug("failed to add NAT extension\n");
2d59e5ca YK	111	return NF_ACCEPT;
	112	}
	113	}
5b1158e9 JK	114
	115	switch (ctinfo) {
	116	case IP_CT_RELATED:
	117	case IP_CT_RELATED+IP_CT_IS_REPLY:
3db05fea	118	if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
5b1158e9	119	if (!nf_nat_icmp_reply_translation(ct, ctinfo,
3db05fea	120	hooknum, skb))
5b1158e9 JK	121	return NF_DROP;
	122	else
	123	return NF_ACCEPT;
	124	}
	125	/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	126	case IP_CT_NEW:
5b1158e9 JK	127
	128	/* Seen it before? This can happen for loopback, retrans,
	129	or local packets.. */
	130	if (!nf_nat_initialized(ct, maniptype)) {
	131	unsigned int ret;
	132
8c87238b	133	if (hooknum == NF_INET_LOCAL_IN)
5b1158e9	134	/* LOCAL_IN hook doesn't have a chain! */
ba4c7cba	135	ret = alloc_null_binding(ct, hooknum);
5b1158e9	136	else
3db05fea	137	ret = nf_nat_rule_find(skb, hooknum, in, out,
ba4c7cba	138	ct);
5b1158e9 JK	139
	140	if (ret != NF_ACCEPT) {
	141	return ret;
	142	}
	143	} else
0d53778e PM	144	pr_debug("Already setup manip %s for ct %p\n",
	145	maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
	146	ct);
5b1158e9 JK	147	break;
	148
	149	default:
	150	/* ESTABLISHED */
	151	NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED \|\|
	152	ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
5b1158e9 JK	153	}
5b1158e9 JK	154
3db05fea	155	return nf_nat_packet(ct, ctinfo, hooknum, skb);
5b1158e9 JK	156	}
	157
	158	static unsigned int
	159	nf_nat_in(unsigned int hooknum,
3db05fea	160	struct sk_buff *skb,
e905a9ed YH	161	const struct net_device *in,
	162	const struct net_device *out,
	163	int (okfn)(struct sk_buff ))
5b1158e9 JK	164	{
5b1158e9 JK	165	unsigned int ret;
3db05fea	166	__be32 daddr = ip_hdr(skb)->daddr;
5b1158e9	167
3db05fea	168	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
5b1158e9	169	if (ret != NF_DROP && ret != NF_STOLEN &&
3db05fea HX	170	daddr != ip_hdr(skb)->daddr) {
	171	dst_release(skb->dst);
	172	skb->dst = NULL;
5b1158e9 JK	173	}
	174	return ret;
	175	}
	176
	177	static unsigned int
	178	nf_nat_out(unsigned int hooknum,
3db05fea	179	struct sk_buff *skb,
5b1158e9 JK	180	const struct net_device *in,
	181	const struct net_device *out,
	182	int (okfn)(struct sk_buff ))
	183	{
	184	#ifdef CONFIG_XFRM
72b72949	185	const struct nf_conn *ct;
5b1158e9 JK	186	enum ip_conntrack_info ctinfo;
	187	#endif
	188	unsigned int ret;
	189
	190	/* root is playing with raw sockets. */
3db05fea HX	191	if (skb->len < sizeof(struct iphdr) \|\|
3db05fea HX	192	ip_hdrlen(skb) < sizeof(struct iphdr))
5b1158e9 JK	193	return NF_ACCEPT;
5b1158e9 JK	194
3db05fea	195	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
5b1158e9 JK	196	#ifdef CONFIG_XFRM
5b1158e9 JK	197	if (ret != NF_DROP && ret != NF_STOLEN &&
3db05fea	198	(ct = nf_ct_get(skb, &ctinfo)) != NULL) {
5b1158e9 JK	199	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	200
	201	if (ct->tuplehash[dir].tuple.src.u3.ip !=
	202	ct->tuplehash[!dir].tuple.dst.u3.ip
	203	\|\| ct->tuplehash[dir].tuple.src.u.all !=
	204	ct->tuplehash[!dir].tuple.dst.u.all
	205	)
3db05fea	206	return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
5b1158e9 JK	207	}
	208	#endif
	209	return ret;
	210	}
	211
	212	static unsigned int
	213	nf_nat_local_fn(unsigned int hooknum,
3db05fea	214	struct sk_buff *skb,
5b1158e9 JK	215	const struct net_device *in,
	216	const struct net_device *out,
	217	int (okfn)(struct sk_buff ))
	218	{
72b72949	219	const struct nf_conn *ct;
5b1158e9 JK	220	enum ip_conntrack_info ctinfo;
	221	unsigned int ret;
	222
	223	/* root is playing with raw sockets. */
3db05fea HX	224	if (skb->len < sizeof(struct iphdr) \|\|
3db05fea HX	225	ip_hdrlen(skb) < sizeof(struct iphdr))
5b1158e9 JK	226	return NF_ACCEPT;
5b1158e9 JK	227
3db05fea	228	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
5b1158e9	229	if (ret != NF_DROP && ret != NF_STOLEN &&
3db05fea	230	(ct = nf_ct_get(skb, &ctinfo)) != NULL) {
5b1158e9 JK	231	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	232
	233	if (ct->tuplehash[dir].tuple.dst.u3.ip !=
848c29fd	234	ct->tuplehash[!dir].tuple.src.u3.ip) {
3db05fea	235	if (ip_route_me_harder(skb, RTN_UNSPEC))
5b1158e9	236	ret = NF_DROP;
848c29fd PM	237	}
	238	#ifdef CONFIG_XFRM
	239	else if (ct->tuplehash[dir].tuple.dst.u.all !=
	240	ct->tuplehash[!dir].tuple.src.u.all)
3db05fea	241	if (ip_xfrm_me_harder(skb))
848c29fd PM	242	ret = NF_DROP;
848c29fd PM	243	#endif
5b1158e9 JK	244	}
	245	return ret;
	246	}
	247
5b1158e9 JK	248	/* We must be after connection tracking and before packet filtering. */
5b1158e9 JK	249
1999414a	250	static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
5b1158e9 JK	251	/* Before packet filtering, change destination */
	252	{
	253	.hook = nf_nat_in,
	254	.owner = THIS_MODULE,
	255	.pf = PF_INET,
6e23ae2a	256	.hooknum = NF_INET_PRE_ROUTING,
5b1158e9 JK	257	.priority = NF_IP_PRI_NAT_DST,
	258	},
	259	/* After packet filtering, change source */
	260	{
	261	.hook = nf_nat_out,
	262	.owner = THIS_MODULE,
	263	.pf = PF_INET,
6e23ae2a	264	.hooknum = NF_INET_POST_ROUTING,
5b1158e9 JK	265	.priority = NF_IP_PRI_NAT_SRC,
5b1158e9 JK	266	},
5b1158e9 JK	267	/* Before packet filtering, change destination */
	268	{
	269	.hook = nf_nat_local_fn,
	270	.owner = THIS_MODULE,
	271	.pf = PF_INET,
6e23ae2a	272	.hooknum = NF_INET_LOCAL_OUT,
5b1158e9 JK	273	.priority = NF_IP_PRI_NAT_DST,
	274	},
	275	/* After packet filtering, change source */
	276	{
	277	.hook = nf_nat_fn,
	278	.owner = THIS_MODULE,
	279	.pf = PF_INET,
6e23ae2a	280	.hooknum = NF_INET_LOCAL_IN,
5b1158e9 JK	281	.priority = NF_IP_PRI_NAT_SRC,
5b1158e9 JK	282	},
5b1158e9 JK	283	};
	284
	285	static int __init nf_nat_standalone_init(void)
	286	{
2d59e5ca	287	int ret = 0;
5b1158e9	288
591e6206	289	need_ipv4_conntrack();
5b1158e9	290
5b1158e9 JK	291	#ifdef CONFIG_XFRM
5b1158e9 JK	292	BUG_ON(ip_nat_decode_session != NULL);
051578cc	293	rcu_assign_pointer(ip_nat_decode_session, nat_decode_session);
5b1158e9 JK	294	#endif
	295	ret = nf_nat_rule_init();
	296	if (ret < 0) {
	297	printk("nf_nat_init: can't setup rules.\n");
	298	goto cleanup_decode_session;
	299	}
	300	ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	301	if (ret < 0) {
	302	printk("nf_nat_init: can't register hooks.\n");
	303	goto cleanup_rule_init;
	304	}
5b1158e9 JK	305	return ret;
	306
	307	cleanup_rule_init:
	308	nf_nat_rule_cleanup();
	309	cleanup_decode_session:
	310	#ifdef CONFIG_XFRM
051578cc	311	rcu_assign_pointer(ip_nat_decode_session, NULL);
5b1158e9 JK	312	synchronize_net();
5b1158e9 JK	313	#endif
5b1158e9 JK	314	return ret;
	315	}
	316
	317	static void __exit nf_nat_standalone_fini(void)
	318	{
	319	nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	320	nf_nat_rule_cleanup();
5b1158e9	321	#ifdef CONFIG_XFRM
051578cc	322	rcu_assign_pointer(ip_nat_decode_session, NULL);
5b1158e9 JK	323	synchronize_net();
	324	#endif
	325	/* Conntrack caches are unregistered in nf_conntrack_cleanup */
	326	}
	327
	328	module_init(nf_nat_standalone_init);
	329	module_exit(nf_nat_standalone_fini);
	330
	331	MODULE_LICENSE("GPL");
	332	MODULE_ALIAS("ip_nat");