| /* |
| * Copyright (c) 2012, 2015, The Linux Foundation. All rights reserved. |
| * Permission to use, copy, modify, and/or distribute this software for |
| * any purpose with or without fee is hereby granted, provided that the |
| * above copyright notice and this permission notice appear in all copies. |
| * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
| * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
| * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT |
| * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
| */ |
| |
| |
| #ifdef KVER32 |
| #include <linux/kconfig.h> |
| #include <generated/autoconf.h> |
| #else |
| #include <linux/autoconf.h> |
| #endif |
| #include <linux/netfilter_ipv4/ip_tables.h> |
| #include <net/netfilter/nf_nat.h> |
| #include <linux/netfilter/nf_nat.h> |
| #include <linux/netfilter/xt_multiport.h> |
| #include <linux/netfilter/xt_tcpudp.h> |
| #include <linux/netfilter/x_tables.h> |
| #include "nat_helper.h" |
| |
| #include "lib/nat_helper_hsl.h" |
| #include "lib/nat_helper_dt.h" |
| |
| |
| #define nf_nat_ipv4_multi_range_compat \ |
| nf_nat_ipv4_multi_range_compat |
| #define nf_nat_range nf_nat_ipv4_range |
| #define ipt_entry_target xt_entry_target |
| #define ipt_entry_match xt_entry_match |
| |
| #define IPT_MATCH_ITERATE(e, fun, args...) \ |
| ({ \ |
| unsigned int i; \ |
| int ret = 0; \ |
| struct xt_entry_match *m; \ |
| \ |
| for (i = sizeof(struct ipt_entry); \ |
| i < (e)->target_offset; \ |
| i += m->u.match_size) { \ |
| m = (void *)e + i; \ |
| ret = fun(m , ##args); \ |
| if (ret != 0) \ |
| break; \ |
| } \ |
| ret; \ |
| }) |
| |
| #define IPT_ENTRY_ITERATE(entries, size, fun, args...) \ |
| ({ \ |
| unsigned int k, j; \ |
| int ret = 0; \ |
| struct ipt_entry *e; \ |
| \ |
| for (k = 0, j = 0; k < (size); \ |
| k += (e)->next_offset, j++) { \ |
| e = (void *)(entries) + k; \ |
| if (j < 0) \ |
| continue; \ |
| \ |
| ret = fun(e , ##args); \ |
| if (ret != 0) \ |
| break; \ |
| } \ |
| ret; \ |
| }) |
| |
| |
| #define IPT_BUFFER_INIT_LEN 1000 |
| #define NF_NAT_INIT_ENTRIES_NUM 5 |
| |
| static int |
| nat_ipt_set_ctl(struct sock *sk, int cmd, void __user * user, unsigned int len); |
| static int |
| nat_ipt_get_ctl(struct sock *sk, int cmd, void __user * user, int *len); |
| |
| int nat_sockopts_init = 0; |
| |
| /*those initial value will be overwrited by orignal iptables sockopts*/ |
| static struct nf_sockopt_ops orgi_ipt_sockopts; |
| static struct nf_sockopt_ops tmp_ipt_sockopts = |
| { |
| /*pls check linux/in.h*/ |
| #define IPT_TEMP_BASE_CTL 60 |
| #define IPT_TEMP_SET_MAX (IPT_TEMP_BASE_CTL+1) |
| #define IPT_TEMP_GET_MAX (IPT_TEMP_BASE_CTL+2) |
| .pf = PF_INET, |
| .set_optmin = IPT_TEMP_BASE_CTL, |
| .set_optmax = IPT_TEMP_SET_MAX, |
| .set = nat_ipt_set_ctl, |
| .get_optmin = IPT_TEMP_BASE_CTL, |
| .get_optmax = IPT_TEMP_GET_MAX, |
| .get = nat_ipt_get_ctl |
| }; |
| |
| static struct nf_sockopt_ops *ipt_sockopts = NULL; |
| static uint32_t snat_seq = 0; |
| static uint32_t hw_nat_ipt_seq[NAT_HW_NUM] = {0}; |
| static uint32_t hw_nat_pip_idx[NAT_HW_NUM] = {0}; |
| static uint8_t *gbuffer, *sbuffer; |
| static unsigned int glen, slen; |
| static struct ipt_replace old_replace; |
| |
| static void |
| nat_ipt_del(struct ipt_replace ireplace) |
| { |
| int i, j; |
| struct ipt_entry *gentry = NULL; |
| struct ipt_entry *sentry = NULL; |
| struct xt_entry_target *gtarget = NULL; |
| struct xt_entry_target *starget = NULL; |
| struct nf_nat_ipv4_multi_range_compat *grange = NULL; |
| struct nf_nat_ipv4_multi_range_compat *srange = NULL; |
| uint8_t *gptr, *sptr; |
| unsigned int oldnum = ireplace.num_counters; |
| unsigned int seq = 1; |
| gptr = gbuffer; |
| sptr = sbuffer; |
| |
| HNAT_PRINTK("into nat_ipt_del\n"); |
| for (i = oldnum; i >= 0; i--)//NF_NAT_INIT_ENTRIES_NUM; i--) |
| { |
| gentry = (struct ipt_entry *)gptr; |
| sentry = (struct ipt_entry *)sptr; |
| gtarget = (struct xt_entry_target *)((uint8_t *) gentry + gentry->target_offset); |
| starget = (struct xt_entry_target *)((uint8_t *) sentry + sentry->target_offset); |
| grange = (struct nf_nat_ipv4_multi_range_compat *)((uint8_t *) gtarget + sizeof (*gtarget)); |
| srange = (struct nf_nat_ipv4_multi_range_compat *)((uint8_t *) starget + sizeof (*starget)); |
| |
| HNAT_PRINTK("(%d)isis_nat_del name %s:%s#####(%x:%x %x)###\n", |
| i, gtarget->u.user.name, starget->u.user.name, |
| gentry->ip.src.s_addr, gentry->ip.dst.s_addr, |
| grange->range[0].min.all); |
| |
| if (strcmp(gtarget->u.user.name, starget->u.user.name)) |
| { |
| /*if (!strcmp(gtarget->u.user.name, "DNAT")) { |
| if (gentry->ip.src.s_addr || !gentry->ip.dst.s_addr |
| || grange->range[0].min.all) |
| return; |
| goto delete; |
| } else */ |
| if (!strcmp(gtarget->u.user.name, "SNAT")) |
| { |
| if (!gentry->ip.src.s_addr || gentry->ip.dst.s_addr |
| || grange->range[0].min.all) |
| return; |
| goto delete; |
| } |
| return; |
| } /*else if (!strcmp(gtarget->u.user.name, "DNAT")) { |
| if (memcmp(gentry, sentry, gentry->next_offset)) { |
| if (gentry->ip.src.s_addr || !gentry->ip.dst.s_addr |
| || grange->range[0].min.all) |
| return; |
| goto delete; |
| } |
| } */else if (!strcmp(gtarget->u.user.name, "SNAT")) |
| { |
| if (memcmp(gentry, sentry, gentry->next_offset)) |
| { |
| if (!gentry->ip.src.s_addr || gentry->ip.dst.s_addr |
| || grange->range[0].min.all) |
| return; |
| goto delete; |
| } |
| } |
| gptr += gentry->next_offset; |
| sptr += gentry->next_offset; |
| if(!strcmp(gtarget->u.user.name, "SNAT")) |
| { |
| seq++; |
| } |
| } |
| HNAT_PRINTK("NONE to delete\n"); |
| return; |
| |
| delete: |
| HNAT_PRINTK("READY to delete one\n"); |
| for (j = 0; j < NAT_HW_NUM; j++) |
| { |
| HNAT_PRINTK("ready [%d] (hw)%x:(sw)%x######\n", |
| j, hw_nat_ipt_seq[j], seq); |
| if (hw_nat_ipt_seq[j] == seq) |
| { |
| if(nat_hw_del_by_index(j) != 0) |
| { |
| return; |
| } |
| //public_ip_del(hw_nat_pip_idx[j]); |
| } |
| } |
| |
| for(i = 0; i < NAT_HW_NUM; i++) |
| { |
| if(hw_nat_ipt_seq[i] > seq) |
| { |
| hw_nat_ipt_seq[i]--; |
| } |
| else if(hw_nat_ipt_seq[i] == seq) |
| { |
| hw_nat_ipt_seq[i]=0; |
| } |
| } |
| |
| return; |
| } |
| |
| static void |
| nat_ipt_to_hw_entry(struct ipt_entry *e, |
| nat_entry_t *nat) |
| { |
| #define P_ANY 0 |
| #define P_TCP 6 |
| #define P_UDP 17 |
| |
| struct ipt_entry_target *t = (struct ipt_entry_target *)ipt_get_target(e); |
| |
| const struct nf_nat_ipv4_multi_range_compat *mr = |
| (struct nf_nat_ipv4_multi_range_compat *)(t->data); |
| const struct nf_nat_range *range = &mr->range[0]; |
| |
| uint32_t sip = ntohl(e->ip.src.s_addr); |
| uint32_t pip = ntohl(range->min_ip); |
| uint16_t proto = e->ip.proto; |
| |
| memset((void *) nat, 0, sizeof (nat_entry_t)); |
| |
| nat->src_addr = sip; |
| nat->trans_addr = pip; |
| |
| if (proto == P_TCP) |
| { |
| nat->flags = FAL_NAT_ENTRY_PROTOCOL_TCP; |
| } |
| else if (proto == P_UDP) |
| { |
| nat->flags = FAL_NAT_ENTRY_PROTOCOL_UDP; |
| } |
| else if (proto == P_ANY) |
| { |
| nat->flags = FAL_NAT_ENTRY_PROTOCOL_ANY; |
| } |
| } |
| |
| static int |
| nat_ipt_hw_add(nat_entry_t *nat) |
| { |
| uint32_t index = 0; |
| if(nat_hw_add(nat) != 0) |
| { |
| return -1; |
| } |
| |
| hw_nat_ipt_seq[nat->entry_id] = snat_seq; |
| HNAT_PRINTK("###nat_ipt_hw_add hw_nat_ipt_seq[%d]:%d###\n", |
| nat->entry_id, snat_seq); |
| |
| hw_nat_pip_idx[nat->entry_id] = nat->trans_addr; |
| |
| if(nat_hw_prv_base_can_update()) |
| { |
| nat_hw_prv_base_set(nat->src_addr); |
| nat_hw_prv_base_update_disable(); |
| } |
| |
| if(nat_hw_pub_ip_add(nat->trans_addr, &index)!= 0) |
| { |
| return -1; |
| } |
| |
| return 0; |
| } |
| |
| static int |
| nat_ipt_hw_port_range_add(nat_entry_t *nat, |
| uint16_t port_start, uint16_t port_end, |
| struct xt_multiport *xport) |
| { |
| unsigned int i; |
| |
| nat->flags |= FAL_NAT_ENTRY_PORT_CHECK; |
| |
| if(xport) |
| { |
| //some discontinuous ports |
| for (i = 0; i < xport->count; i++) |
| { |
| |
| nat->port_num = xport->ports[i]; |
| nat->port_range = 1; |
| |
| if(nat_ipt_hw_add(nat)) |
| { |
| HNAT_PRINTK("isis_nat_add(xport:%d) fail!\n", nat->port_num); |
| return -1; |
| } |
| |
| HNAT_PRINTK("(1)isis_nat_add(xport:%d) success\n", nat->port_num); |
| } |
| } |
| else |
| { |
| //one port or port range |
| uint16_t port_min, port_max; |
| |
| for (i = port_start; i <= port_end; i+= NAT_HW_PORT_RANGE_MAX) |
| { |
| port_min = i; |
| if((port_end-port_min)>(NAT_HW_PORT_RANGE_MAX-1)) |
| { |
| port_max = port_min+(NAT_HW_PORT_RANGE_MAX-1); |
| } |
| else |
| { |
| port_max = port_end; |
| } |
| |
| nat->port_num = port_min; |
| nat->port_range = (port_max - port_min + 1); |
| |
| if(nat_ipt_hw_add(nat)) |
| { |
| HNAT_PRINTK("isis_nat_add(range port:%d~%d) fail!\n", |
| port_min, port_max); |
| return -1; |
| } |
| |
| HNAT_PRINTK("(2)isis_nat_add(range port:%d~%d) success\n", port_min, port_max); |
| } |
| } |
| |
| return 0; |
| } |
| |
| static int |
| nat_ipt_check_none_matches(struct ipt_entry *e) |
| { |
| nat_entry_t nat = {0}; |
| |
| nat_ipt_to_hw_entry(e, &nat); |
| |
| if(nat_ipt_hw_add(&nat) != 0) |
| { |
| HNAT_PRINTK("(1)isis_nat_add(none port)fail!\n"); |
| return -1; |
| } |
| |
| HNAT_PRINTK("(1)isis_nat_add(none port) success\n"); |
| |
| return 0; |
| } |
| static int |
| nat_ipt_check_matches(struct ipt_entry_match *m, |
| struct ipt_entry *e, |
| unsigned int *j) |
| { |
| int ret = 0; |
| |
| nat_entry_t nat = {0}; |
| uint16_t port_start = 0, port_end = 0; |
| struct xt_multiport *xport = NULL; |
| |
| if(strcmp(m->u.user.name, "udp") == 0) |
| { |
| struct xt_udp *udpinfo = (struct xt_udp *)m->data; |
| port_start = udpinfo->spts[0]; |
| port_end = udpinfo->spts[1]; |
| |
| } |
| else if(strcmp(m->u.user.name, "tcp") == 0) |
| { |
| struct xt_tcp *tcpinfo = (struct xt_tcp *)m->data; |
| port_start = tcpinfo->spts[0]; |
| port_end = tcpinfo->spts[1]; |
| |
| } |
| else if(strcmp(m->u.user.name, "multiport") == 0) |
| { |
| struct xt_multiport xport_data = {0}; |
| struct ipt_entry_target *t = ipt_get_target(e); |
| xport = &xport_data; |
| |
| if(t->u.user.revision == 0) |
| { |
| xport = (struct xt_multiport *)m->data; |
| |
| } |
| else if(t->u.user.revision == 1) |
| { |
| const struct xt_multiport_v1 *xportv1 = |
| (struct xt_multiport_v1 *)m->data; |
| memcpy(xport->ports, xportv1->ports, sizeof(xportv1->ports)); |
| xport->count = xportv1->count; |
| } |
| |
| if(xport->flags != XT_MULTIPORT_SOURCE) |
| { |
| memset(xport->ports, 0, sizeof(xport->ports)); |
| } |
| |
| } |
| else |
| { |
| (*j)++ ; |
| HNAT_PRINTK("###no support matches m->u.user.name:%s\n", |
| m->u.user.name); |
| return -1; |
| } |
| |
| nat_ipt_to_hw_entry(e, &nat); |
| ret = nat_ipt_hw_port_range_add(&nat, port_start, port_end, xport); |
| |
| (*j)++ ; |
| |
| return ret; |
| } |
| |
| //check netmask !=32 |
| #define NAT_IPT_RULE_IS_FOR_NAPT(e) (((e)->ip.smsk.s_addr) != 0xffffffff) |
| #define NAT_IPT_RULE_IS_NONE_MATCHES(e) (((e)->target_offset) == \ |
| (sizeof(struct ipt_entry))) |
| |
| static int |
| nat_ipt_find_check_entry(struct ipt_entry *e, unsigned int underflow, |
| unsigned int *i) |
| { |
| int ret = 0; |
| static uint16_t next_offset = 0; |
| struct ipt_entry_target *t = ipt_get_target(e); |
| |
| if(*i == 0) |
| { |
| snat_seq = 0; |
| next_offset = e->next_offset; |
| } |
| else |
| { |
| next_offset += e->next_offset; |
| } |
| |
| if (!strcmp(t->u.user.name, "SNAT")) |
| { |
| ++snat_seq; |
| |
| if(NAT_IPT_RULE_IS_FOR_NAPT(e)) |
| { |
| HNAT_PRINTK("this ipt rule only for HW napt offload\n"); |
| |
| } |
| else |
| { |
| /*for basic nat offload*/ |
| HNAT_PRINTK("[%d]next_offset:%d underflow:%d\n", |
| *i, next_offset, underflow); |
| |
| if(next_offset == underflow) //new one |
| { |
| |
| if(NAT_IPT_RULE_IS_NONE_MATCHES(e)) |
| { |
| /*none matches*/ |
| ret = nat_ipt_check_none_matches(e); |
| |
| } |
| else |
| { |
| unsigned int j = 0; |
| /*iterate matches*/ |
| ret = IPT_MATCH_ITERATE(e, nat_ipt_check_matches, e, &j); |
| } |
| } |
| } |
| } |
| |
| (*i)++ ; |
| |
| return ret; |
| } |
| |
| static void |
| nat_ipt_data_cleanup(void) |
| { |
| if (gbuffer) |
| kfree(gbuffer); |
| |
| gbuffer = NULL; |
| |
| if (sbuffer) |
| kfree(sbuffer); |
| |
| sbuffer = NULL; |
| } |
| |
| static void |
| nat_ipt_data_init(void) |
| { |
| /*alloc initial set buffer*/ |
| sbuffer = kmalloc(IPT_BUFFER_INIT_LEN, GFP_ATOMIC); |
| |
| if(sbuffer) |
| { |
| memset(sbuffer, 0, IPT_BUFFER_INIT_LEN); |
| slen = IPT_BUFFER_INIT_LEN; |
| } |
| else |
| { |
| HNAT_PRINTK("%s sbuffer memory allocate fail\n", __func__); |
| } |
| |
| /*alloc initial get buffer*/ |
| gbuffer = kmalloc(IPT_BUFFER_INIT_LEN, GFP_ATOMIC); |
| |
| if(gbuffer) |
| { |
| memset(gbuffer, 0, IPT_BUFFER_INIT_LEN); |
| glen = IPT_BUFFER_INIT_LEN; |
| } |
| else |
| { |
| HNAT_PRINTK("%s gbuffer memory allocate fail\n", __func__); |
| } |
| |
| |
| /*set initial underflow: nf_nat_rule.c*/ |
| memset(&old_replace, 0, sizeof (old_replace)); |
| |
| /*record ipt rule(SNAT) sequence for hw nat*/ |
| memset(hw_nat_ipt_seq, 0, NAT_HW_NUM); |
| |
| /*record ipt rule(SNAT) pubip index for hw nat*/ |
| memset(hw_nat_pip_idx, 0, NAT_HW_NUM); |
| } |
| |
| static void |
| nat_ipt_flush(void) |
| { |
| napt_hw_flush(); |
| |
| nat_hw_flush(); |
| |
| nat_ipt_data_cleanup(); |
| nat_ipt_data_init(); |
| |
| HNAT_PRINTK("------(nat flush done)------\n"); |
| } |
| |
| static void |
| nat_ipt_add(struct ipt_replace ireplace) |
| { |
| unsigned int i = 0; |
| |
| IPT_ENTRY_ITERATE(sbuffer, |
| ireplace.size, |
| nat_ipt_find_check_entry, |
| ireplace.underflow[NF_INET_POST_ROUTING], |
| &i); |
| } |
| |
| static int |
| nat_ipt_hook_type_check(struct ipt_replace ireplace) |
| { |
| int ret = -1; |
| |
| HNAT_PRINTK("------we only support SNAT-----\n"); |
| |
| if((old_replace.underflow[NF_INET_POST_ROUTING]- |
| old_replace.hook_entry[NF_INET_POST_ROUTING]) != |
| (ireplace.underflow[NF_INET_POST_ROUTING]- |
| ireplace.hook_entry[NF_INET_POST_ROUTING])) |
| { |
| HNAT_PRINTK("------this is POSTROUTING(SNAT):yes!------\n"); |
| ret = 0; |
| |
| } |
| else if ((old_replace.underflow[NF_INET_PRE_ROUTING]- |
| old_replace.hook_entry[NF_INET_PRE_ROUTING]) != |
| (ireplace.underflow[NF_INET_PRE_ROUTING]- |
| ireplace.hook_entry[NF_INET_PRE_ROUTING])) |
| { |
| HNAT_PRINTK("------this is PREROUTING(DNAT):no!------\n"); |
| |
| } |
| else if((old_replace.underflow[NF_INET_LOCAL_OUT]- |
| old_replace.hook_entry[NF_INET_LOCAL_OUT]) != |
| (ireplace.underflow[NF_INET_LOCAL_OUT]- |
| ireplace.hook_entry[NF_INET_LOCAL_OUT])) |
| { |
| HNAT_PRINTK("------this is OUTPUT:no!------\n"); |
| |
| } |
| else |
| { |
| HNAT_PRINTK("------this is UNKNOW:no!------\n"); |
| |
| } |
| |
| return ret; |
| } |
| |
| static void |
| nat_ipt_rules_cp_from_user(void **buf, unsigned int *buf_len, |
| void __user *user, unsigned int user_len) |
| { |
| if((*buf == 0) || (user == 0)) |
| { |
| return; |
| } |
| |
| if (*buf_len < user_len) |
| { |
| if(*buf) |
| { |
| kfree(*buf); |
| *buf = kmalloc(user_len, GFP_ATOMIC); |
| if(*buf == NULL) |
| { |
| HNAT_PRINTK("%s memory allocate fail\n", __func__); |
| return; |
| } |
| *buf_len = user_len; |
| } |
| } |
| HNAT_PRINTK("(2)nat_ipt_rules_cp_from_user *buf:%x user:%x user_len:%d\n", |
| (unsigned int)(uintptr_t)*buf, (unsigned int)(uintptr_t)user, user_len); |
| copy_from_user(*buf, user, user_len); |
| |
| return; |
| } |
| |
| static int |
| nat_ipt_set_ctl(struct sock *sk, int cmd, void __user * user, unsigned int len) |
| { |
| struct ipt_replace ireplace; |
| |
| memset(&ireplace, 0, sizeof(ireplace)); |
| |
| HNAT_PRINTK("NAT set hook\n"); |
| |
| if (cmd != IPT_SO_SET_REPLACE) |
| goto normal; |
| |
| copy_from_user(&ireplace, user, sizeof (ireplace)); |
| |
| if (strcmp(ireplace.name, "nat") |
| || (ireplace.num_entries == ireplace.num_counters)) |
| { |
| HNAT_PRINTK("none NAT or no new entry %d", ireplace.num_entries); |
| goto normal; |
| } |
| |
| |
| if (ireplace.num_entries == NF_NAT_INIT_ENTRIES_NUM) |
| { |
| nat_ipt_flush(); |
| goto normal; |
| } |
| |
| if (nat_ipt_hook_type_check(ireplace) != 0) |
| { |
| goto normal; |
| } |
| |
| nat_ipt_rules_cp_from_user((void **)&sbuffer, &slen, |
| (user + sizeof (ireplace)), |
| ireplace.size); |
| |
| if (ireplace.num_entries > ireplace.num_counters) |
| { |
| nat_ipt_add(ireplace); |
| } |
| else |
| { |
| nat_ipt_del(ireplace); |
| } |
| |
| normal: |
| /*save old_replace for next hook type check*/ |
| old_replace = ireplace; |
| |
| return orgi_ipt_sockopts.set(sk, cmd, user, len); |
| } |
| |
| static int |
| nat_ipt_get_ctl(struct sock *sk, int cmd, void __user * user, int *len) |
| { |
| int k = orgi_ipt_sockopts.get(sk, cmd, user, len); |
| |
| if (cmd == IPT_SO_GET_ENTRIES) |
| { |
| |
| struct ipt_get_entries entries; |
| |
| copy_from_user(&entries, user, sizeof (entries)); |
| |
| nat_ipt_rules_cp_from_user((void **)&gbuffer, &glen, |
| (user + sizeof (struct ipt_get_entries)), |
| (*len - sizeof (entries))); |
| } |
| return k; |
| } |
| |
| |
| void |
| nat_ipt_sockopts_replace(void) |
| { |
| int ret = 0; |
| /*register an temp sockopts to find ipt_sockopts*/ |
| if((ret = nf_register_sockopt(&tmp_ipt_sockopts)) < 0) { |
| return; |
| } |
| list_for_each_entry(ipt_sockopts, tmp_ipt_sockopts.list.next, list) |
| { |
| if (ipt_sockopts->set_optmin == IPT_BASE_CTL) |
| { |
| nat_sockopts_init = 1; |
| break; |
| } |
| } |
| nf_unregister_sockopt(&tmp_ipt_sockopts); |
| if(!nat_sockopts_init) |
| return; |
| |
| /*save orginal ipt_sockopts*/ |
| orgi_ipt_sockopts = *ipt_sockopts; |
| |
| /*replace ipt_sockopts with our opts*/ |
| ipt_sockopts->set = nat_ipt_set_ctl; |
| ipt_sockopts->get = nat_ipt_get_ctl; |
| } |
| |
| static void |
| nat_ipt_sockopts_restore(void) |
| { |
| ipt_sockopts->set = orgi_ipt_sockopts.set; |
| ipt_sockopts->get = orgi_ipt_sockopts.get; |
| } |
| |
| void |
| nat_ipt_helper_init(void) |
| { |
| nat_ipt_sockopts_replace(); |
| nat_ipt_data_init(); |
| } |
| |
| void |
| nat_ipt_helper_exit(void) |
| { |
| nat_ipt_sockopts_restore(); |
| nat_ipt_data_cleanup(); |
| nat_hw_flush(); |
| } |
| |
