[deliverable/linux.git] / net / ipv4 / netfilter / nf_nat_standalone.c

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/types.h>
#include <linux/icmp.h>
#include <linux/gfp.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/proc_fs.h>
#include <net/ip.h>
#include <net/checksum.h>
#include <linux/spinlock.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_extend.h>
#include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_nat_rule.h>
#include <net/netfilter/nf_nat_protocol.h>
#include <net/netfilter/nf_nat_core.h>
#include <net/netfilter/nf_nat_helper.h>
#include <linux/netfilter_ipv4/ip_tables.h>

#ifdef CONFIG_XFRM
static void nat_decode_session(struct sk_buff *skb, struct flowi *fl)
{
	const struct nf_conn *ct;
	const struct nf_conntrack_tuple *t;
	enum ip_conntrack_info ctinfo;
	enum ip_conntrack_dir dir;
	unsigned long statusbit;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return;
	dir = CTINFO2DIR(ctinfo);
	t = &ct->tuplehash[dir].tuple;

	if (dir == IP_CT_DIR_ORIGINAL)
		statusbit = IPS_DST_NAT;
	else
		statusbit = IPS_SRC_NAT;

	if (ct->status & statusbit) {
		fl->fl4_dst = t->dst.u3.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP ||
		    t->dst.protonum == IPPROTO_UDPLITE ||
		    t->dst.protonum == IPPROTO_DCCP ||
		    t->dst.protonum == IPPROTO_SCTP)
			fl->fl4_dport = t->dst.u.tcp.port;
	}

	statusbit ^= IPS_NAT_MASK;

	if (ct->status & statusbit) {
		fl->fl4_src = t->src.u3.ip;
		if (t->dst.protonum == IPPROTO_TCP ||
		    t->dst.protonum == IPPROTO_UDP ||
		    t->dst.protonum == IPPROTO_UDPLITE ||
		    t->dst.protonum == IPPROTO_DCCP ||
		    t->dst.protonum == IPPROTO_SCTP)
			fl->fl4_sport = t->src.u.tcp.port;
	}
}
#endif

static unsigned int
nf_nat_fn(unsigned int hooknum,
	  struct sk_buff *skb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	struct nf_conn_nat *nat;
	/* maniptype == SRC for postrouting. */
	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);

	/* We never see fragments: conntrack defrags on pre-routing
	   and local-out, and nf_nat_out protects post-routing. */
	NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)));

	ct = nf_ct_get(skb, &ctinfo);
	/* Can't track?  It's not due to stress, or conntrack would
	   have dropped it.  Hence it's the user's responsibilty to
	   packet filter it out, or implement conntrack/NAT for that
	   protocol. 8) --RR */
	if (!ct)
		return NF_ACCEPT;

	/* Don't try to NAT if this packet is not conntracked */
	if (nf_ct_is_untracked(ct))
		return NF_ACCEPT;

	nat = nfct_nat(ct);
	if (!nat) {
		/* NAT module was loaded late. */
		if (nf_ct_is_confirmed(ct))
			return NF_ACCEPT;
		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
		if (nat == NULL) {
			pr_debug("failed to add NAT extension\n");
			return NF_ACCEPT;
		}
	}

	switch (ctinfo) {
	case IP_CT_RELATED:
	case IP_CT_RELATED+IP_CT_IS_REPLY:
		if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
			if (!nf_nat_icmp_reply_translation(ct, ctinfo,
							   hooknum, skb))
				return NF_DROP;
			else
				return NF_ACCEPT;
		}
		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	case IP_CT_NEW:

		/* Seen it before?  This can happen for loopback, retrans,
		   or local packets.. */
		if (!nf_nat_initialized(ct, maniptype)) {
			unsigned int ret;

			ret = nf_nat_rule_find(skb, hooknum, in, out, ct);
			if (ret != NF_ACCEPT)
				return ret;
		} else
			pr_debug("Already setup manip %s for ct %p\n",
				 maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
				 ct);
		break;

	default:
		/* ESTABLISHED */
		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
			     ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
	}

	return nf_nat_packet(ct, ctinfo, hooknum, skb);
}

static unsigned int
nf_nat_in(unsigned int hooknum,
	  struct sk_buff *skb,
	  const struct net_device *in,
	  const struct net_device *out,
	  int (*okfn)(struct sk_buff *))
{
	unsigned int ret;
	__be32 daddr = ip_hdr(skb)->daddr;

	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    daddr != ip_hdr(skb)->daddr)
		skb_dst_drop(skb);

	return ret;
}

static unsigned int
nf_nat_out(unsigned int hooknum,
	   struct sk_buff *skb,
	   const struct net_device *in,
	   const struct net_device *out,
	   int (*okfn)(struct sk_buff *))
{
#ifdef CONFIG_XFRM
	const struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
#endif
	unsigned int ret;

	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr) ||
	    ip_hdrlen(skb) < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
#ifdef CONFIG_XFRM
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if ((ct->tuplehash[dir].tuple.src.u3.ip !=
		     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
		    (ct->tuplehash[dir].tuple.src.u.all !=
		     ct->tuplehash[!dir].tuple.dst.u.all)
		   )
			return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
	}
#endif
	return ret;
}

static unsigned int
nf_nat_local_fn(unsigned int hooknum,
		struct sk_buff *skb,
		const struct net_device *in,
		const struct net_device *out,
		int (*okfn)(struct sk_buff *))
{
	const struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	unsigned int ret;

	/* root is playing with raw sockets. */
	if (skb->len < sizeof(struct iphdr) ||
	    ip_hdrlen(skb) < sizeof(struct iphdr))
		return NF_ACCEPT;

	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
	if (ret != NF_DROP && ret != NF_STOLEN &&
	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);

		if (ct->tuplehash[dir].tuple.dst.u3.ip !=
		    ct->tuplehash[!dir].tuple.src.u3.ip) {
			if (ip_route_me_harder(skb, RTN_UNSPEC))
				ret = NF_DROP;
		}
#ifdef CONFIG_XFRM
		else if (ct->tuplehash[dir].tuple.dst.u.all !=
			 ct->tuplehash[!dir].tuple.src.u.all)
			if (ip_xfrm_me_harder(skb))
				ret = NF_DROP;
#endif
	}
	return ret;
}

/* We must be after connection tracking and before packet filtering. */

static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
	/* Before packet filtering, change destination */
	{
		.hook		= nf_nat_in,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_PRE_ROUTING,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= nf_nat_out,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_POST_ROUTING,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
	/* Before packet filtering, change destination */
	{
		.hook		= nf_nat_local_fn,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_OUT,
		.priority	= NF_IP_PRI_NAT_DST,
	},
	/* After packet filtering, change source */
	{
		.hook		= nf_nat_fn,
		.owner		= THIS_MODULE,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_IN,
		.priority	= NF_IP_PRI_NAT_SRC,
	},
};

static int __init nf_nat_standalone_init(void)
{
	int ret = 0;

	need_ipv4_conntrack();

#ifdef CONFIG_XFRM
	BUG_ON(ip_nat_decode_session != NULL);
	rcu_assign_pointer(ip_nat_decode_session, nat_decode_session);
#endif
	ret = nf_nat_rule_init();
	if (ret < 0) {
		pr_err("nf_nat_init: can't setup rules.\n");
		goto cleanup_decode_session;
	}
	ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	if (ret < 0) {
		pr_err("nf_nat_init: can't register hooks.\n");
		goto cleanup_rule_init;
	}
	return ret;

 cleanup_rule_init:
	nf_nat_rule_cleanup();
 cleanup_decode_session:
#ifdef CONFIG_XFRM
	rcu_assign_pointer(ip_nat_decode_session, NULL);
	synchronize_net();
#endif
	return ret;
}

static void __exit nf_nat_standalone_fini(void)
{
	nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	nf_nat_rule_cleanup();
#ifdef CONFIG_XFRM
	rcu_assign_pointer(ip_nat_decode_session, NULL);
	synchronize_net();
#endif
	/* Conntrack caches are unregistered in nf_conntrack_cleanup */
}

module_init(nf_nat_standalone_init);
module_exit(nf_nat_standalone_fini);

MODULE_LICENSE("GPL");
MODULE_ALIAS("ip_nat");
Commit	Line	Data
5b1158e9 JK	1	/* (C) 1999-2001 Paul `Rusty' Russell
	2	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8	#include <linux/types.h>
	9	#include <linux/icmp.h>
5a0e3ad6	10	#include <linux/gfp.h>
5b1158e9 JK	11	#include <linux/ip.h>
	12	#include <linux/netfilter.h>
	13	#include <linux/netfilter_ipv4.h>
	14	#include <linux/module.h>
	15	#include <linux/skbuff.h>
	16	#include <linux/proc_fs.h>
	17	#include <net/ip.h>
	18	#include <net/checksum.h>
	19	#include <linux/spinlock.h>
	20
	21	#include <net/netfilter/nf_conntrack.h>
	22	#include <net/netfilter/nf_conntrack_core.h>
2d59e5ca	23	#include <net/netfilter/nf_conntrack_extend.h>
5b1158e9 JK	24	#include <net/netfilter/nf_nat.h>
	25	#include <net/netfilter/nf_nat_rule.h>
	26	#include <net/netfilter/nf_nat_protocol.h>
	27	#include <net/netfilter/nf_nat_core.h>
	28	#include <net/netfilter/nf_nat_helper.h>
	29	#include <linux/netfilter_ipv4/ip_tables.h>
	30
5b1158e9 JK	31	#ifdef CONFIG_XFRM
	32	static void nat_decode_session(struct sk_buff skb, struct flowi fl)
	33	{
72b72949 JE	34	const struct nf_conn *ct;
72b72949 JE	35	const struct nf_conntrack_tuple *t;
5b1158e9 JK	36	enum ip_conntrack_info ctinfo;
	37	enum ip_conntrack_dir dir;
	38	unsigned long statusbit;
	39
	40	ct = nf_ct_get(skb, &ctinfo);
	41	if (ct == NULL)
	42	return;
	43	dir = CTINFO2DIR(ctinfo);
	44	t = &ct->tuplehash[dir].tuple;
	45
	46	if (dir == IP_CT_DIR_ORIGINAL)
	47	statusbit = IPS_DST_NAT;
	48	else
	49	statusbit = IPS_SRC_NAT;
	50
	51	if (ct->status & statusbit) {
	52	fl->fl4_dst = t->dst.u3.ip;
	53	if (t->dst.protonum == IPPROTO_TCP \|\|
6185f870	54	t->dst.protonum == IPPROTO_UDP \|\|
4910a087	55	t->dst.protonum == IPPROTO_UDPLITE \|\|
9d908a69 PM	56	t->dst.protonum == IPPROTO_DCCP \|\|
9d908a69 PM	57	t->dst.protonum == IPPROTO_SCTP)
6281dcc9	58	fl->fl4_dport = t->dst.u.tcp.port;
5b1158e9 JK	59	}
	60
	61	statusbit ^= IPS_NAT_MASK;
	62
	63	if (ct->status & statusbit) {
	64	fl->fl4_src = t->src.u3.ip;
	65	if (t->dst.protonum == IPPROTO_TCP \|\|
6185f870	66	t->dst.protonum == IPPROTO_UDP \|\|
4910a087	67	t->dst.protonum == IPPROTO_UDPLITE \|\|
9d908a69 PM	68	t->dst.protonum == IPPROTO_DCCP \|\|
9d908a69 PM	69	t->dst.protonum == IPPROTO_SCTP)
6281dcc9	70	fl->fl4_sport = t->src.u.tcp.port;
5b1158e9 JK	71	}
	72	}
	73	#endif
	74
	75	static unsigned int
	76	nf_nat_fn(unsigned int hooknum,
3db05fea	77	struct sk_buff *skb,
5b1158e9 JK	78	const struct net_device *in,
	79	const struct net_device *out,
	80	int (okfn)(struct sk_buff ))
	81	{
	82	struct nf_conn *ct;
	83	enum ip_conntrack_info ctinfo;
	84	struct nf_conn_nat *nat;
5b1158e9 JK	85	/* maniptype == SRC for postrouting. */
	86	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
	87
	88	/* We never see fragments: conntrack defrags on pre-routing
	89	and local-out, and nf_nat_out protects post-routing. */
3db05fea	90	NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF \| IP_OFFSET)));
5b1158e9	91
3db05fea	92	ct = nf_ct_get(skb, &ctinfo);
5b1158e9 JK	93	/* Can't track? It's not due to stress, or conntrack would
	94	have dropped it. Hence it's the user's responsibilty to
	95	packet filter it out, or implement conntrack/NAT for that
	96	protocol. 8) --RR */
42cf800c	97	if (!ct)
5b1158e9	98	return NF_ACCEPT;
5b1158e9 JK	99
5b1158e9 JK	100	/* Don't try to NAT if this packet is not conntracked */
5bfddbd4	101	if (nf_ct_is_untracked(ct))
5b1158e9 JK	102	return NF_ACCEPT;
	103
	104	nat = nfct_nat(ct);
2d59e5ca	105	if (!nat) {
8c87238b PM	106	/* NAT module was loaded late. */
	107	if (nf_ct_is_confirmed(ct))
	108	return NF_ACCEPT;
2d59e5ca YK	109	nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
2d59e5ca YK	110	if (nat == NULL) {
0d53778e	111	pr_debug("failed to add NAT extension\n");
2d59e5ca YK	112	return NF_ACCEPT;
	113	}
	114	}
5b1158e9 JK	115
	116	switch (ctinfo) {
	117	case IP_CT_RELATED:
	118	case IP_CT_RELATED+IP_CT_IS_REPLY:
3db05fea	119	if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
5b1158e9	120	if (!nf_nat_icmp_reply_translation(ct, ctinfo,
3db05fea	121	hooknum, skb))
5b1158e9 JK	122	return NF_DROP;
	123	else
	124	return NF_ACCEPT;
	125	}
	126	/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
	127	case IP_CT_NEW:
5b1158e9 JK	128
	129	/* Seen it before? This can happen for loopback, retrans,
	130	or local packets.. */
	131	if (!nf_nat_initialized(ct, maniptype)) {
	132	unsigned int ret;
	133
c68cd6cc	134	ret = nf_nat_rule_find(skb, hooknum, in, out, ct);
22068311	135	if (ret != NF_ACCEPT)
5b1158e9	136	return ret;
5b1158e9	137	} else
0d53778e PM	138	pr_debug("Already setup manip %s for ct %p\n",
	139	maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
	140	ct);
5b1158e9 JK	141	break;
	142
	143	default:
	144	/* ESTABLISHED */
	145	NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED \|\|
	146	ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
5b1158e9 JK	147	}
5b1158e9 JK	148
3db05fea	149	return nf_nat_packet(ct, ctinfo, hooknum, skb);
5b1158e9 JK	150	}
	151
	152	static unsigned int
	153	nf_nat_in(unsigned int hooknum,
3db05fea	154	struct sk_buff *skb,
e905a9ed YH	155	const struct net_device *in,
	156	const struct net_device *out,
	157	int (okfn)(struct sk_buff ))
5b1158e9 JK	158	{
5b1158e9 JK	159	unsigned int ret;
3db05fea	160	__be32 daddr = ip_hdr(skb)->daddr;
5b1158e9	161
3db05fea	162	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
5b1158e9	163	if (ret != NF_DROP && ret != NF_STOLEN &&
adf30907 ED	164	daddr != ip_hdr(skb)->daddr)
	165	skb_dst_drop(skb);
	166
5b1158e9 JK	167	return ret;
	168	}
	169
	170	static unsigned int
	171	nf_nat_out(unsigned int hooknum,
3db05fea	172	struct sk_buff *skb,
5b1158e9 JK	173	const struct net_device *in,
	174	const struct net_device *out,
	175	int (okfn)(struct sk_buff ))
	176	{
	177	#ifdef CONFIG_XFRM
72b72949	178	const struct nf_conn *ct;
5b1158e9 JK	179	enum ip_conntrack_info ctinfo;
	180	#endif
	181	unsigned int ret;
	182
	183	/* root is playing with raw sockets. */
3db05fea HX	184	if (skb->len < sizeof(struct iphdr) \|\|
3db05fea HX	185	ip_hdrlen(skb) < sizeof(struct iphdr))
5b1158e9 JK	186	return NF_ACCEPT;
5b1158e9 JK	187
3db05fea	188	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
5b1158e9 JK	189	#ifdef CONFIG_XFRM
5b1158e9 JK	190	if (ret != NF_DROP && ret != NF_STOLEN &&
3db05fea	191	(ct = nf_ct_get(skb, &ctinfo)) != NULL) {
5b1158e9 JK	192	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
5b1158e9 JK	193
3666ed1c JP	194	if ((ct->tuplehash[dir].tuple.src.u3.ip !=
	195	ct->tuplehash[!dir].tuple.dst.u3.ip) \|\|
	196	(ct->tuplehash[dir].tuple.src.u.all !=
	197	ct->tuplehash[!dir].tuple.dst.u.all)
	198	)
3db05fea	199	return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
5b1158e9 JK	200	}
	201	#endif
	202	return ret;
	203	}
	204
	205	static unsigned int
	206	nf_nat_local_fn(unsigned int hooknum,
3db05fea	207	struct sk_buff *skb,
5b1158e9 JK	208	const struct net_device *in,
	209	const struct net_device *out,
	210	int (okfn)(struct sk_buff ))
	211	{
72b72949	212	const struct nf_conn *ct;
5b1158e9 JK	213	enum ip_conntrack_info ctinfo;
	214	unsigned int ret;
	215
	216	/* root is playing with raw sockets. */
3db05fea HX	217	if (skb->len < sizeof(struct iphdr) \|\|
3db05fea HX	218	ip_hdrlen(skb) < sizeof(struct iphdr))
5b1158e9 JK	219	return NF_ACCEPT;
5b1158e9 JK	220
3db05fea	221	ret = nf_nat_fn(hooknum, skb, in, out, okfn);
5b1158e9	222	if (ret != NF_DROP && ret != NF_STOLEN &&
3db05fea	223	(ct = nf_ct_get(skb, &ctinfo)) != NULL) {
5b1158e9 JK	224	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	225
	226	if (ct->tuplehash[dir].tuple.dst.u3.ip !=
848c29fd	227	ct->tuplehash[!dir].tuple.src.u3.ip) {
3db05fea	228	if (ip_route_me_harder(skb, RTN_UNSPEC))
5b1158e9	229	ret = NF_DROP;
848c29fd PM	230	}
	231	#ifdef CONFIG_XFRM
	232	else if (ct->tuplehash[dir].tuple.dst.u.all !=
	233	ct->tuplehash[!dir].tuple.src.u.all)
3db05fea	234	if (ip_xfrm_me_harder(skb))
848c29fd PM	235	ret = NF_DROP;
848c29fd PM	236	#endif
5b1158e9 JK	237	}
	238	return ret;
	239	}
	240
5b1158e9 JK	241	/* We must be after connection tracking and before packet filtering. */
5b1158e9 JK	242
1999414a	243	static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
5b1158e9 JK	244	/* Before packet filtering, change destination */
	245	{
	246	.hook = nf_nat_in,
	247	.owner = THIS_MODULE,
24c232d8	248	.pf = NFPROTO_IPV4,
6e23ae2a	249	.hooknum = NF_INET_PRE_ROUTING,
5b1158e9 JK	250	.priority = NF_IP_PRI_NAT_DST,
	251	},
	252	/* After packet filtering, change source */
	253	{
	254	.hook = nf_nat_out,
	255	.owner = THIS_MODULE,
24c232d8	256	.pf = NFPROTO_IPV4,
6e23ae2a	257	.hooknum = NF_INET_POST_ROUTING,
5b1158e9 JK	258	.priority = NF_IP_PRI_NAT_SRC,
5b1158e9 JK	259	},
5b1158e9 JK	260	/* Before packet filtering, change destination */
	261	{
	262	.hook = nf_nat_local_fn,
	263	.owner = THIS_MODULE,
24c232d8	264	.pf = NFPROTO_IPV4,
6e23ae2a	265	.hooknum = NF_INET_LOCAL_OUT,
5b1158e9 JK	266	.priority = NF_IP_PRI_NAT_DST,
	267	},
	268	/* After packet filtering, change source */
	269	{
	270	.hook = nf_nat_fn,
	271	.owner = THIS_MODULE,
24c232d8	272	.pf = NFPROTO_IPV4,
6e23ae2a	273	.hooknum = NF_INET_LOCAL_IN,
5b1158e9 JK	274	.priority = NF_IP_PRI_NAT_SRC,
5b1158e9 JK	275	},
5b1158e9 JK	276	};
	277
	278	static int __init nf_nat_standalone_init(void)
	279	{
2d59e5ca	280	int ret = 0;
5b1158e9	281
591e6206	282	need_ipv4_conntrack();
5b1158e9	283
5b1158e9 JK	284	#ifdef CONFIG_XFRM
5b1158e9 JK	285	BUG_ON(ip_nat_decode_session != NULL);
051578cc	286	rcu_assign_pointer(ip_nat_decode_session, nat_decode_session);
5b1158e9 JK	287	#endif
	288	ret = nf_nat_rule_init();
	289	if (ret < 0) {
654d0fbd	290	pr_err("nf_nat_init: can't setup rules.\n");
5b1158e9 JK	291	goto cleanup_decode_session;
	292	}
	293	ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	294	if (ret < 0) {
654d0fbd	295	pr_err("nf_nat_init: can't register hooks.\n");
5b1158e9 JK	296	goto cleanup_rule_init;
5b1158e9 JK	297	}
5b1158e9 JK	298	return ret;
	299
	300	cleanup_rule_init:
	301	nf_nat_rule_cleanup();
	302	cleanup_decode_session:
	303	#ifdef CONFIG_XFRM
051578cc	304	rcu_assign_pointer(ip_nat_decode_session, NULL);
5b1158e9 JK	305	synchronize_net();
5b1158e9 JK	306	#endif
5b1158e9 JK	307	return ret;
	308	}
	309
	310	static void __exit nf_nat_standalone_fini(void)
	311	{
	312	nf_unregister_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
	313	nf_nat_rule_cleanup();
5b1158e9	314	#ifdef CONFIG_XFRM
051578cc	315	rcu_assign_pointer(ip_nat_decode_session, NULL);
5b1158e9 JK	316	synchronize_net();
	317	#endif
	318	/* Conntrack caches are unregistered in nf_conntrack_cleanup */
	319	}
	320
	321	module_init(nf_nat_standalone_init);
	322	module_exit(nf_nat_standalone_fini);
	323
	324	MODULE_LICENSE("GPL");
	325	MODULE_ALIAS("ip_nat");