[deliverable/linux.git] / net / ipv4 / netfilter / nf_nat_standalone.c

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/types.h>
#include <linux/icmp.h>
#include <linux/gfp.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/proc_fs.h>
#include <net/ip.h>
#include <net/checksum.h>
#include <linux/spinlock.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_extend.h>
#include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_nat_rule.h>
#include <net/netfilter/nf_nat_protocol.h>
#include <net/netfilter/nf_nat_core.h>
#include <net/netfilter/nf_nat_helper.h>
#include <linux/netfilter_ipv4/ip_tables.h>

#ifdef CONFIG_XFRM
static void nat_decode_session(struct sk_buff *skb, struct flowi *fl)
{
	const struct nf_conn *ct;
	const struct nf_conntrack_tuple *t;
	enum ip_conntrack_info ctinfo;
	enum ip_conntrack_dir dir;
	unsigned long statusbit;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return;
	dir = CTINFO2DIR(ctinfo);
	t = &ct->tuplehash[dir].tuple;

	if (dir == IP_CT_DIR_ORIGINAL)
		statusbit = IPS_DST_NAT;
	else
		statusbit = IPS_SRC_NAT;

	if (ct->status & statusbit) {
		fl->fl4_dst = t->dst.u3.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP ||
		    t->dst.protonum == IPPROTO_UDPLITE ||
		    t->dst.protonum == IPPROTO_DCCP ||
		    t->dst.protonum == IPPROTO_SCTP)
			fl->fl_ip_dport = t->dst.u.tcp.port;
	}

	statusbit ^= IPS_NAT_MASK;

	if (ct->status & statusbit) {
		fl->fl4_src = t->src.u3.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP ||
		    t->dst.protonum == IPPROTO_UDPLITE ||
		    t->dst.protonum == IPPROTO_DCCP ||
		    t->dst.protonum == IPPROTO_SCTP)
			fl->fl_ip_sport = t->src.u.tcp.port;
	}
}
#endif

static unsigned int
nf_nat_fn(unsigned int hooknum,
	  struct sk_buff *skb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	struct nf_conn_nat *nat;
	/* maniptype == SRC for postrouting. */
	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);

	/* We never see fragments: conntrack defrags on pre-routing
	   and local-out, and nf_nat_out protects post-routing. */
	NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)));

	ct = nf_ct_get(skb, &ctinfo);
	/* Can't track?  It's not due to stress, or conntrack would
	   have dropped it.  Hence it's the user's responsibilty to
	   packet filter it out, or implement conntrack/NAT for that
	   protocol. 8) --RR */
	if (!ct)
		return NF_ACCEPT;

	/* Don't try to NAT if this packet is not conntracked */
	if (nf_ct_is_untracked(ct))
		return NF_ACCEPT;

	nat = nfct_nat(ct);
	if (!nat) {
		/* NAT module was loaded late. */
		if (nf_ct_is_confirmed(ct))
			return NF_ACCEPT;
		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
		if (nat == NULL) {
			pr_debug("failed to add NAT extension\n");
			return NF_ACCEPT;
		}
	}

	switch (ctinfo) {
	case IP_CT_RELATED:
	case IP_CT_RELATED+IP_CT_IS_REPLY:
		if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
			if (!nf_nat_icmp_reply_translation(ct, ctinfo,
							   hooknum, skb))
				return NF_DROP;
			else
				return NF_ACCEPT;
		}
		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	case IP_CT_NEW:

		/* Seen it before?  This can happen for loopback, retrans,
		   or local packets.. */
		if (!nf_nat_initialized(ct, maniptype)) {
			unsigned int ret;

			if (hooknum == NF_INET_LOCAL_IN)
				/* LOCAL_IN hook doesn't have a chain!  */
				ret = alloc_null_binding(ct, hooknum);
			else
				ret = nf_nat_rule_find(skb, hooknum, in, out,
						       ct);

			if (ret != NF_ACCEPT)
				return ret;
		} else
			pr_debug("Already setup manip %s for ct %p\n",
				 maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
				 ct);
		break;

	default:
		/* ESTABLISHED */
		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
			     ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
	}

	return nf_nat_packet(ct, ctinfo, hooknum, skb);
}

static unsigned int
nf_nat_in(unsigned int hooknum,
	  struct sk_buff *skb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	unsigned int ret;
	__be32 daddr = ip_hdr(skb)->daddr;

	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    daddr != ip_hdr(skb)->daddr)
		skb_dst_drop(skb);

	return ret;
}

static unsigned int
nf_nat_out(unsigned int hooknum,
	   struct sk_buff *skb,
	   const struct net_device *in,
	   const struct net_device *out,
	   int (*okfn)(struct sk_buff *))
{
#ifdef CONFIG_XFRM
	const struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
#endif
	unsigned int ret;

	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr) ||
	    ip_hdrlen(skb) < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
#ifdef CONFIG_XFRM
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if ((ct->tuplehash[dir].tuple.src.u3.ip !=
		     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
		    (ct->tuplehash[dir].tuple.src.u.all !=
		     ct->tuplehash[!dir].tuple.dst.u.all)
		   )
			return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
	}
#endif
	return ret;
}

static unsigned int
nf_nat_local_fn(unsigned int hooknum,
		struct sk_buff *skb,
		const struct net_device *in,
		const struct net_device *out,
		int (*okfn)(struct sk_buff *))
{
	const struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	unsigned int ret;

	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr) ||
	    ip_hdrlen(skb) < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if (ct->tuplehash[dir].tuple.dst.u3.ip !=
		    ct->tuplehash[!dir].tuple.src.u3.ip) {
			if (ip_route_me_harder(skb, RTN_UNSPEC))
				ret = NF_DROP;
		}
#ifdef CONFIG_XFRM
		else if (ct->tuplehash[dir].tuple.dst.u.all !=
			 ct->tuplehash[!dir].tuple.src.u.all)
			if (ip_xfrm_me_harder(skb))
				ret = NF_DROP;
#endif
	}
	return ret;
}

/* We must be after connection tracking and before packet filtering. */

static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
	/* Before packet filtering, change destination */
	{
		.hook		= nf_nat_in,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_PRE_ROUTING,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= nf_nat_out,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_POST_ROUTING,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
	/* Before packet filtering, change destination */
	{
		.hook		= nf_nat_local_fn,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_OUT,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= nf_nat_fn,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_IN,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
};

static int __init nf_nat_standalone_init(void)
{
	int ret = 0;

	need_ipv4_conntrack();

#ifdef CONFIG_XFRM
	BUG_ON(ip_nat_decode_session != NULL);
	rcu_assign_pointer(ip_nat_decode_session, nat_decode_session);
#endif
	ret = nf_nat_rule_init();
	if (ret < 0) {
		pr_err("nf_nat_init: can't setup rules.\n");
		goto cleanup_decode_session;
	}
	ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	if (ret < 0) {
		pr_err("nf_nat_init: can't register hooks.\n");
		goto cleanup_rule_init;
	}
	return ret;

 cleanup_rule_init:
	nf_nat_rule_cleanup();
 cleanup_decode_session:
#ifdef CONFIG_XFRM
	rcu_assign_pointer(ip_nat_decode_session, NULL);
	synchronize_net();
#endif
	return ret;
}

static void __exit nf_nat_standalone_fini(void)
{
	nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	nf_nat_rule_cleanup();
#ifdef CONFIG_XFRM
	rcu_assign_pointer(ip_nat_decode_session, NULL);
	synchronize_net();
#endif
	/* Conntrack caches are unregistered in nf_conntrack_cleanup */
}

module_init(nf_nat_standalone_init);
module_exit(nf_nat_standalone_fini);

MODULE_LICENSE("GPL");
MODULE_ALIAS("ip_nat");
Commit	Line	Data
5b1158e9 JK	1	/* (C) 1999-2001 Paul `Rusty' Russell
	2	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8	#include <linux/types.h>
	9	#include <linux/icmp.h>
5a0e3ad6	10	#include <linux/gfp.h>
5b1158e9 JK	11	#include <linux/ip.h>
	12	#include <linux/netfilter.h>
	13	#include <linux/netfilter_ipv4.h>
	14	#include <linux/module.h>
	15	#include <linux/skbuff.h>
	16	#include <linux/proc_fs.h>
	17	#include <net/ip.h>
	18	#include <net/checksum.h>
	19	#include <linux/spinlock.h>
	20
	21	#include <net/netfilter/nf_conntrack.h>
	22	#include <net/netfilter/nf_conntrack_core.h>
2d59e5ca	23	#include <net/netfilter/nf_conntrack_extend.h>
5b1158e9 JK	24	#include <net/netfilter/nf_nat.h>
	25	#include <net/netfilter/nf_nat_rule.h>
	26	#include <net/netfilter/nf_nat_protocol.h>
	27	#include <net/netfilter/nf_nat_core.h>
	28	#include <net/netfilter/nf_nat_helper.h>
	29	#include <linux/netfilter_ipv4/ip_tables.h>
	30
5b1158e9 JK	31	#ifdef CONFIG_XFRM
	32	static void nat_decode_session(struct sk_buff skb, struct flowi fl)
	33	{
72b72949 JE	34	const struct nf_conn *ct;
72b72949 JE	35	const struct nf_conntrack_tuple *t;
5b1158e9 JK	36	enum ip_conntrack_info ctinfo;
	37	enum ip_conntrack_dir dir;
	38	unsigned long statusbit;
	39
	40	ct = nf_ct_get(skb, &ctinfo);
	41	if (ct == NULL)
	42	return;
	43	dir = CTINFO2DIR(ctinfo);
	44	t = &ct->tuplehash[dir].tuple;
	45
	46	if (dir == IP_CT_DIR_ORIGINAL)
	47	statusbit = IPS_DST_NAT;
	48	else
	49	statusbit = IPS_SRC_NAT;
	50
	51	if (ct->status & statusbit) {
	52	fl->fl4_dst = t->dst.u3.ip;
	53	if (t->dst.protonum == IPPROTO_TCP \|\|
6185f870	54	t->dst.protonum == IPPROTO_UDP \|\|
4910a087	55	t->dst.protonum == IPPROTO_UDPLITE \|\|
9d908a69 PM	56	t->dst.protonum == IPPROTO_DCCP \|\|
9d908a69 PM	57	t->dst.protonum == IPPROTO_SCTP)
5b1158e9 JK	58	fl->fl_ip_dport = t->dst.u.tcp.port;
	59	}
	60
	61	statusbit ^= IPS_NAT_MASK;
	62
	63	if (ct->status & statusbit) {
	64	fl->fl4_src = t->src.u3.ip;
	65	if (t->dst.protonum == IPPROTO_TCP \|\|
6185f870	66	t->dst.protonum == IPPROTO_UDP \|\|
4910a087	67	t->dst.protonum == IPPROTO_UDPLITE \|\|
9d908a69 PM	68	t->dst.protonum == IPPROTO_DCCP \|\|
9d908a69 PM	69	t->dst.protonum == IPPROTO_SCTP)
5b1158e9 JK	70	fl->fl_ip_sport = t->src.u.tcp.port;
	71	}
	72	}
	73	#endif
	74
	75	static unsigned int
	76	nf_nat_fn(unsigned int hooknum,
3db05fea	77	struct sk_buff *skb,
5b1158e9 JK	78	const struct net_device *in,
	79	const struct net_device *out,
	80	int (okfn)(struct sk_buff ))
	81	{
	82	struct nf_conn *ct;
	83	enum ip_conntrack_info ctinfo;
	84	struct nf_conn_nat *nat;
5b1158e9 JK	85	/* maniptype == SRC for postrouting. */
	86	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
	87
	88	/* We never see fragments: conntrack defrags on pre-routing
	89	and local-out, and nf_nat_out protects post-routing. */
3db05fea	90	NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF \| IP_OFFSET)));
5b1158e9	91
3db05fea	92	ct = nf_ct_get(skb, &ctinfo);
5b1158e9 JK	93	/* Can't track? It's not due to stress, or conntrack would
	94	have dropped it. Hence it's the user's responsibilty to
	95	packet filter it out, or implement conntrack/NAT for that
	96	protocol. 8) --RR */
42cf800c	97	if (!ct)
5b1158e9	98	return NF_ACCEPT;
5b1158e9 JK	99
5b1158e9 JK	100	/* Don't try to NAT if this packet is not conntracked */
5bfddbd4	101	if (nf_ct_is_untracked(ct))
5b1158e9 JK	102	return NF_ACCEPT;
	103
	104	nat = nfct_nat(ct);
2d59e5ca	105	if (!nat) {
8c87238b PM	106	/* NAT module was loaded late. */
	107	if (nf_ct_is_confirmed(ct))
	108	return NF_ACCEPT;
2d59e5ca YK	109	nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
2d59e5ca YK	110	if (nat == NULL) {
0d53778e	111	pr_debug("failed to add NAT extension\n");
2d59e5ca YK	112	return NF_ACCEPT;
	113	}
	114	}
5b1158e9 JK	115
	116	switch (ctinfo) {
	117	case IP_CT_RELATED:
	118	case IP_CT_RELATED+IP_CT_IS_REPLY:
3db05fea	119	if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
5b1158e9	120	if (!nf_nat_icmp_reply_translation(ct, ctinfo,
3db05fea	121	hooknum, skb))
5b1158e9 JK	122	return NF_DROP;
	123	else
	124	return NF_ACCEPT;
	125	}
	126	/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	127	case IP_CT_NEW:
5b1158e9 JK	128
	129	/* Seen it before? This can happen for loopback, retrans,
	130	or local packets.. */
	131	if (!nf_nat_initialized(ct, maniptype)) {
	132	unsigned int ret;
	133
8c87238b	134	if (hooknum == NF_INET_LOCAL_IN)
5b1158e9	135	/* LOCAL_IN hook doesn't have a chain! */
ba4c7cba	136	ret = alloc_null_binding(ct, hooknum);
5b1158e9	137	else
3db05fea	138	ret = nf_nat_rule_find(skb, hooknum, in, out,
ba4c7cba	139	ct);
5b1158e9	140
22068311	141	if (ret != NF_ACCEPT)
5b1158e9	142	return ret;
5b1158e9	143	} else
0d53778e PM	144	pr_debug("Already setup manip %s for ct %p\n",
	145	maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
	146	ct);
5b1158e9 JK	147	break;
	148
	149	default:
	150	/* ESTABLISHED */
	151	NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED \|\|
	152	ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
5b1158e9 JK	153	}
5b1158e9 JK	154
3db05fea	155	return nf_nat_packet(ct, ctinfo, hooknum, skb);
5b1158e9 JK	156	}
	157
	158	static unsigned int
	159	nf_nat_in(unsigned int hooknum,
3db05fea	160	struct sk_buff *skb,
e905a9ed YH	161	const struct net_device *in,
	162	const struct net_device *out,
	163	int (okfn)(struct sk_buff ))
5b1158e9 JK	164	{
5b1158e9 JK	165	unsigned int ret;
3db05fea	166	__be32 daddr = ip_hdr(skb)->daddr;
5b1158e9	167
3db05fea	168	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
5b1158e9	169	if (ret != NF_DROP && ret != NF_STOLEN &&
adf30907 ED	170	daddr != ip_hdr(skb)->daddr)
	171	skb_dst_drop(skb);
	172
5b1158e9 JK	173	return ret;
	174	}
	175
	176	static unsigned int
	177	nf_nat_out(unsigned int hooknum,
3db05fea	178	struct sk_buff *skb,
5b1158e9 JK	179	const struct net_device *in,
	180	const struct net_device *out,
	181	int (okfn)(struct sk_buff ))
	182	{
	183	#ifdef CONFIG_XFRM
72b72949	184	const struct nf_conn *ct;
5b1158e9 JK	185	enum ip_conntrack_info ctinfo;
	186	#endif
	187	unsigned int ret;
	188
	189	/* root is playing with raw sockets. */
3db05fea HX	190	if (skb->len < sizeof(struct iphdr) \|\|
3db05fea HX	191	ip_hdrlen(skb) < sizeof(struct iphdr))
5b1158e9 JK	192	return NF_ACCEPT;
5b1158e9 JK	193
3db05fea	194	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
5b1158e9 JK	195	#ifdef CONFIG_XFRM
5b1158e9 JK	196	if (ret != NF_DROP && ret != NF_STOLEN &&
3db05fea	197	(ct = nf_ct_get(skb, &ctinfo)) != NULL) {
5b1158e9 JK	198	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
5b1158e9 JK	199
3666ed1c JP	200	if ((ct->tuplehash[dir].tuple.src.u3.ip !=
	201	ct->tuplehash[!dir].tuple.dst.u3.ip) \|\|
	202	(ct->tuplehash[dir].tuple.src.u.all !=
	203	ct->tuplehash[!dir].tuple.dst.u.all)
	204	)
3db05fea	205	return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
5b1158e9 JK	206	}
	207	#endif
	208	return ret;
	209	}
	210
	211	static unsigned int
	212	nf_nat_local_fn(unsigned int hooknum,
3db05fea	213	struct sk_buff *skb,
5b1158e9 JK	214	const struct net_device *in,
	215	const struct net_device *out,
	216	int (okfn)(struct sk_buff ))
	217	{
72b72949	218	const struct nf_conn *ct;
5b1158e9 JK	219	enum ip_conntrack_info ctinfo;
	220	unsigned int ret;
	221
	222	/* root is playing with raw sockets. */
3db05fea HX	223	if (skb->len < sizeof(struct iphdr) \|\|
3db05fea HX	224	ip_hdrlen(skb) < sizeof(struct iphdr))
5b1158e9 JK	225	return NF_ACCEPT;
5b1158e9 JK	226
3db05fea	227	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
5b1158e9	228	if (ret != NF_DROP && ret != NF_STOLEN &&
3db05fea	229	(ct = nf_ct_get(skb, &ctinfo)) != NULL) {
5b1158e9 JK	230	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	231
	232	if (ct->tuplehash[dir].tuple.dst.u3.ip !=
848c29fd	233	ct->tuplehash[!dir].tuple.src.u3.ip) {
3db05fea	234	if (ip_route_me_harder(skb, RTN_UNSPEC))
5b1158e9	235	ret = NF_DROP;
848c29fd PM	236	}
	237	#ifdef CONFIG_XFRM
	238	else if (ct->tuplehash[dir].tuple.dst.u.all !=
	239	ct->tuplehash[!dir].tuple.src.u.all)
3db05fea	240	if (ip_xfrm_me_harder(skb))
848c29fd PM	241	ret = NF_DROP;
848c29fd PM	242	#endif
5b1158e9 JK	243	}
	244	return ret;
	245	}
	246
5b1158e9 JK	247	/* We must be after connection tracking and before packet filtering. */
5b1158e9 JK	248
1999414a	249	static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
5b1158e9 JK	250	/* Before packet filtering, change destination */
	251	{
	252	.hook = nf_nat_in,
	253	.owner = THIS_MODULE,
24c232d8	254	.pf = NFPROTO_IPV4,
6e23ae2a	255	.hooknum = NF_INET_PRE_ROUTING,
5b1158e9 JK	256	.priority = NF_IP_PRI_NAT_DST,
	257	},
	258	/* After packet filtering, change source */
	259	{
	260	.hook = nf_nat_out,
	261	.owner = THIS_MODULE,
24c232d8	262	.pf = NFPROTO_IPV4,
6e23ae2a	263	.hooknum = NF_INET_POST_ROUTING,
5b1158e9 JK	264	.priority = NF_IP_PRI_NAT_SRC,
5b1158e9 JK	265	},
5b1158e9 JK	266	/* Before packet filtering, change destination */
	267	{
	268	.hook = nf_nat_local_fn,
	269	.owner = THIS_MODULE,
24c232d8	270	.pf = NFPROTO_IPV4,
6e23ae2a	271	.hooknum = NF_INET_LOCAL_OUT,
5b1158e9 JK	272	.priority = NF_IP_PRI_NAT_DST,
	273	},
	274	/* After packet filtering, change source */
	275	{
	276	.hook = nf_nat_fn,
	277	.owner = THIS_MODULE,
24c232d8	278	.pf = NFPROTO_IPV4,
6e23ae2a	279	.hooknum = NF_INET_LOCAL_IN,
5b1158e9 JK	280	.priority = NF_IP_PRI_NAT_SRC,
5b1158e9 JK	281	},
5b1158e9 JK	282	};
	283
	284	static int __init nf_nat_standalone_init(void)
	285	{
2d59e5ca	286	int ret = 0;
5b1158e9	287
591e6206	288	need_ipv4_conntrack();
5b1158e9	289
5b1158e9 JK	290	#ifdef CONFIG_XFRM
5b1158e9 JK	291	BUG_ON(ip_nat_decode_session != NULL);
051578cc	292	rcu_assign_pointer(ip_nat_decode_session, nat_decode_session);
5b1158e9 JK	293	#endif
	294	ret = nf_nat_rule_init();
	295	if (ret < 0) {
654d0fbd	296	pr_err("nf_nat_init: can't setup rules.\n");
5b1158e9 JK	297	goto cleanup_decode_session;
	298	}
	299	ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	300	if (ret < 0) {
654d0fbd	301	pr_err("nf_nat_init: can't register hooks.\n");
5b1158e9 JK	302	goto cleanup_rule_init;
5b1158e9 JK	303	}
5b1158e9 JK	304	return ret;
	305
	306	cleanup_rule_init:
	307	nf_nat_rule_cleanup();
	308	cleanup_decode_session:
	309	#ifdef CONFIG_XFRM
051578cc	310	rcu_assign_pointer(ip_nat_decode_session, NULL);
5b1158e9 JK	311	synchronize_net();
5b1158e9 JK	312	#endif
5b1158e9 JK	313	return ret;
	314	}
	315
	316	static void __exit nf_nat_standalone_fini(void)
	317	{
	318	nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	319	nf_nat_rule_cleanup();
5b1158e9	320	#ifdef CONFIG_XFRM
051578cc	321	rcu_assign_pointer(ip_nat_decode_session, NULL);
5b1158e9 JK	322	synchronize_net();
	323	#endif
	324	/* Conntrack caches are unregistered in nf_conntrack_cleanup */
	325	}
	326
	327	module_init(nf_nat_standalone_init);
	328	module_exit(nf_nat_standalone_fini);
	329
	330	MODULE_LICENSE("GPL");
	331	MODULE_ALIAS("ip_nat");