mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 21:57:43 +00:00
netfilter: netns ebtables: ebtable_nat in netns
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
parent
4aad10938d
commit
b71b30a626
2 changed files with 33 additions and 15 deletions
|
@ -10,5 +10,6 @@ struct netns_xt {
|
||||||
struct list_head tables[NFPROTO_NUMPROTO];
|
struct list_head tables[NFPROTO_NUMPROTO];
|
||||||
struct ebt_table *broute_table;
|
struct ebt_table *broute_table;
|
||||||
struct ebt_table *frame_filter;
|
struct ebt_table *frame_filter;
|
||||||
|
struct ebt_table *frame_nat;
|
||||||
};
|
};
|
||||||
#endif
|
#endif
|
||||||
|
|
|
@ -50,48 +50,47 @@ static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
static struct ebt_table __frame_nat =
|
static struct ebt_table frame_nat =
|
||||||
{
|
{
|
||||||
.name = "nat",
|
.name = "nat",
|
||||||
.table = &initial_table,
|
.table = &initial_table,
|
||||||
.valid_hooks = NAT_VALID_HOOKS,
|
.valid_hooks = NAT_VALID_HOOKS,
|
||||||
.lock = __RW_LOCK_UNLOCKED(__frame_nat.lock),
|
.lock = __RW_LOCK_UNLOCKED(frame_nat.lock),
|
||||||
.check = check,
|
.check = check,
|
||||||
.me = THIS_MODULE,
|
.me = THIS_MODULE,
|
||||||
};
|
};
|
||||||
static struct ebt_table *frame_nat;
|
|
||||||
|
|
||||||
static unsigned int
|
static unsigned int
|
||||||
ebt_nat_dst(unsigned int hook, struct sk_buff *skb, const struct net_device *in
|
ebt_nat_in(unsigned int hook, struct sk_buff *skb, const struct net_device *in
|
||||||
, const struct net_device *out, int (*okfn)(struct sk_buff *))
|
, const struct net_device *out, int (*okfn)(struct sk_buff *))
|
||||||
{
|
{
|
||||||
return ebt_do_table(hook, skb, in, out, frame_nat);
|
return ebt_do_table(hook, skb, in, out, dev_net(in)->xt.frame_nat);
|
||||||
}
|
}
|
||||||
|
|
||||||
static unsigned int
|
static unsigned int
|
||||||
ebt_nat_src(unsigned int hook, struct sk_buff *skb, const struct net_device *in
|
ebt_nat_out(unsigned int hook, struct sk_buff *skb, const struct net_device *in
|
||||||
, const struct net_device *out, int (*okfn)(struct sk_buff *))
|
, const struct net_device *out, int (*okfn)(struct sk_buff *))
|
||||||
{
|
{
|
||||||
return ebt_do_table(hook, skb, in, out, frame_nat);
|
return ebt_do_table(hook, skb, in, out, dev_net(out)->xt.frame_nat);
|
||||||
}
|
}
|
||||||
|
|
||||||
static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
|
static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
|
||||||
{
|
{
|
||||||
.hook = ebt_nat_dst,
|
.hook = ebt_nat_out,
|
||||||
.owner = THIS_MODULE,
|
.owner = THIS_MODULE,
|
||||||
.pf = PF_BRIDGE,
|
.pf = PF_BRIDGE,
|
||||||
.hooknum = NF_BR_LOCAL_OUT,
|
.hooknum = NF_BR_LOCAL_OUT,
|
||||||
.priority = NF_BR_PRI_NAT_DST_OTHER,
|
.priority = NF_BR_PRI_NAT_DST_OTHER,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ebt_nat_src,
|
.hook = ebt_nat_out,
|
||||||
.owner = THIS_MODULE,
|
.owner = THIS_MODULE,
|
||||||
.pf = PF_BRIDGE,
|
.pf = PF_BRIDGE,
|
||||||
.hooknum = NF_BR_POST_ROUTING,
|
.hooknum = NF_BR_POST_ROUTING,
|
||||||
.priority = NF_BR_PRI_NAT_SRC,
|
.priority = NF_BR_PRI_NAT_SRC,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.hook = ebt_nat_dst,
|
.hook = ebt_nat_in,
|
||||||
.owner = THIS_MODULE,
|
.owner = THIS_MODULE,
|
||||||
.pf = PF_BRIDGE,
|
.pf = PF_BRIDGE,
|
||||||
.hooknum = NF_BR_PRE_ROUTING,
|
.hooknum = NF_BR_PRE_ROUTING,
|
||||||
|
@ -99,23 +98,41 @@ static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
|
||||||
},
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
|
static int __net_init frame_nat_net_init(struct net *net)
|
||||||
|
{
|
||||||
|
net->xt.frame_nat = ebt_register_table(net, &frame_nat);
|
||||||
|
if (IS_ERR(net->xt.frame_nat))
|
||||||
|
return PTR_ERR(net->xt.frame_nat);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
static void __net_exit frame_nat_net_exit(struct net *net)
|
||||||
|
{
|
||||||
|
ebt_unregister_table(net->xt.frame_nat);
|
||||||
|
}
|
||||||
|
|
||||||
|
static struct pernet_operations frame_nat_net_ops = {
|
||||||
|
.init = frame_nat_net_init,
|
||||||
|
.exit = frame_nat_net_exit,
|
||||||
|
};
|
||||||
|
|
||||||
static int __init ebtable_nat_init(void)
|
static int __init ebtable_nat_init(void)
|
||||||
{
|
{
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
frame_nat = ebt_register_table(&init_net, &__frame_nat);
|
ret = register_pernet_subsys(&frame_nat_net_ops);
|
||||||
if (IS_ERR(frame_nat))
|
if (ret < 0)
|
||||||
return PTR_ERR(frame_nat);
|
return ret;
|
||||||
ret = nf_register_hooks(ebt_ops_nat, ARRAY_SIZE(ebt_ops_nat));
|
ret = nf_register_hooks(ebt_ops_nat, ARRAY_SIZE(ebt_ops_nat));
|
||||||
if (ret < 0)
|
if (ret < 0)
|
||||||
ebt_unregister_table(frame_nat);
|
unregister_pernet_subsys(&frame_nat_net_ops);
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void __exit ebtable_nat_fini(void)
|
static void __exit ebtable_nat_fini(void)
|
||||||
{
|
{
|
||||||
nf_unregister_hooks(ebt_ops_nat, ARRAY_SIZE(ebt_ops_nat));
|
nf_unregister_hooks(ebt_ops_nat, ARRAY_SIZE(ebt_ops_nat));
|
||||||
ebt_unregister_table(frame_nat);
|
unregister_pernet_subsys(&frame_nat_net_ops);
|
||||||
}
|
}
|
||||||
|
|
||||||
module_init(ebtable_nat_init);
|
module_init(ebtable_nat_init);
|
||||||
|
|
Loading…
Reference in a new issue