Skip to content

Commit db8ab38

Browse files
Florian Westphalummakynes
Florian Westphal
authored and
ummakynes
committed
netfilter: nf_tables: merge ipv4 and ipv6 nat chain types
Merge the ipv4 and ipv6 nat chain type. This is the last missing piece which allows to provide inet family support for nat in a follow patch. The kconfig knobs for ipv4/ipv6 nat chain are removed, the nat chain type will be built unconditionally if NFT_NAT expression is enabled. Before: text data bss dec hex filename 1576 896 0 2472 9a8 nft_chain_nat_ipv4.ko 1697 896 0 2593 a21 nft_chain_nat_ipv6.ko After: text data bss dec hex filename 1832 896 0 2728 aa8 nft_chain_nat.ko Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent a9ce849 commit db8ab38

File tree

9 files changed

+111
-194
lines changed

9 files changed

+111
-194
lines changed

‎net/ipv4/netfilter/Kconfig‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -95,19 +95,6 @@ config NF_REJECT_IPV4
9595
default m if NETFILTER_ADVANCED=n
9696

9797
if NF_NAT
98-
99-
if NF_TABLES
100-
config NFT_CHAIN_NAT_IPV4
101-
depends on NF_TABLES_IPV4
102-
tristate "IPv4 nf_tables nat chain support"
103-
help
104-
This option enables the "nat" chain for IPv4 in nf_tables. This
105-
chain type is used to perform Network Address Translation (NAT)
106-
packet transformations such as the source, destination address and
107-
source and destination ports.
108-
109-
endif # NF_TABLES
110-
11198
config NF_NAT_SNMP_BASIC
11299
tristate "Basic SNMP-ALG support"
113100
depends on NF_CONNTRACK_SNMP

‎net/ipv4/netfilter/Makefile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ $(obj)/nf_nat_snmp_basic_main.o: $(obj)/nf_nat_snmp_basic.asn1.h
2525
obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o
2626

2727
obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o
28-
obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o
2928
obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o
3029
obj-$(CONFIG_NFT_FIB_IPV4) += nft_fib_ipv4.o
3130
obj-$(CONFIG_NFT_DUP_IPV4) += nft_dup_ipv4.o

‎net/ipv4/netfilter/nft_chain_nat_ipv4.c‎

Lines changed: 0 additions & 85 deletions
This file was deleted.

‎net/ipv6/netfilter/Kconfig‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,6 @@ config NFT_CHAIN_ROUTE_IPV6
3131
fields such as the source, destination, flowlabel, hop-limit and
3232
the packet mark.
3333

34-
if NF_NAT
35-
36-
config NFT_CHAIN_NAT_IPV6
37-
tristate "IPv6 nf_tables nat chain support"
38-
help
39-
This option enables the "nat" chain for IPv6 in nf_tables. This
40-
chain type is used to perform Network Address Translation (NAT)
41-
packet transformations such as the source, destination address and
42-
source and destination ports.
43-
endif # NF_NAT
44-
4534
config NFT_REJECT_IPV6
4635
select NF_REJECT_IPV6
4736
default NFT_REJECT

‎net/ipv6/netfilter/Makefile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ obj-$(CONFIG_NF_DUP_IPV6) += nf_dup_ipv6.o
2828

2929
# nf_tables
3030
obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV6) += nft_chain_route_ipv6.o
31-
obj-$(CONFIG_NFT_CHAIN_NAT_IPV6) += nft_chain_nat_ipv6.o
3231
obj-$(CONFIG_NFT_REJECT_IPV6) += nft_reject_ipv6.o
3332
obj-$(CONFIG_NFT_DUP_IPV6) += nft_dup_ipv6.o
3433
obj-$(CONFIG_NFT_FIB_IPV6) += nft_fib_ipv6.o

‎net/ipv6/netfilter/nft_chain_nat_ipv6.c‎

Lines changed: 0 additions & 83 deletions
This file was deleted.

‎net/netfilter/Kconfig‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -550,6 +550,7 @@ config NFT_REDIR
550550
config NFT_NAT
551551
depends on NF_CONNTRACK
552552
select NF_NAT
553+
depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
553554
tristate "Netfilter nf_tables nat module"
554555
help
555556
This option adds the "nat" expression that you can use to perform

‎net/netfilter/Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,8 @@ obj-$(CONFIG_NFT_OSF) += nft_osf.o
110110
obj-$(CONFIG_NFT_TPROXY) += nft_tproxy.o
111111
obj-$(CONFIG_NFT_XFRM) += nft_xfrm.o
112112

113+
obj-$(CONFIG_NFT_NAT) += nft_chain_nat.o
114+
113115
# nf_tables netdev
114116
obj-$(CONFIG_NFT_DUP_NETDEV) += nft_dup_netdev.o
115117
obj-$(CONFIG_NFT_FWD_NETDEV) += nft_fwd_netdev.o

‎net/netfilter/nft_chain_nat.c‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
// SPDX-License-Identifier: GPL-2.0
2+
3+
#include <linux/module.h>
4+
#include <linux/netfilter/nf_tables.h>
5+
#include <net/netfilter/nf_nat.h>
6+
#include <net/netfilter/nf_tables.h>
7+
#include <net/netfilter/nf_tables_ipv4.h>
8+
#include <net/netfilter/nf_tables_ipv6.h>
9+
10+
static unsigned int nft_nat_do_chain(void *priv, struct sk_buff *skb,
11+
const struct nf_hook_state *state)
12+
{
13+
struct nft_pktinfo pkt;
14+
15+
nft_set_pktinfo(&pkt, skb, state);
16+
17+
switch (state->pf) {
18+
#ifdef CONFIG_NF_TABLES_IPV4
19+
case NFPROTO_IPV4:
20+
nft_set_pktinfo_ipv4(&pkt, skb);
21+
break;
22+
#endif
23+
#ifdef CONFIG_NF_TABLES_IPV6
24+
case NFPROTO_IPV6:
25+
nft_set_pktinfo_ipv6(&pkt, skb);
26+
break;
27+
#endif
28+
default:
29+
break;
30+
}
31+
32+
return nft_do_chain(&pkt, priv);
33+
}
34+
35+
#ifdef CONFIG_NF_TABLES_IPV4
36+
static const struct nft_chain_type nft_chain_nat_ipv4 = {
37+
.name = "nat",
38+
.type = NFT_CHAIN_T_NAT,
39+
.family = NFPROTO_IPV4,
40+
.owner = THIS_MODULE,
41+
.hook_mask = (1 << NF_INET_PRE_ROUTING) |
42+
(1 << NF_INET_POST_ROUTING) |
43+
(1 << NF_INET_LOCAL_OUT) |
44+
(1 << NF_INET_LOCAL_IN),
45+
.hooks = {
46+
[NF_INET_PRE_ROUTING] = nft_nat_do_chain,
47+
[NF_INET_POST_ROUTING] = nft_nat_do_chain,
48+
[NF_INET_LOCAL_OUT] = nft_nat_do_chain,
49+
[NF_INET_LOCAL_IN] = nft_nat_do_chain,
50+
},
51+
.ops_register = nf_nat_ipv4_register_fn,
52+
.ops_unregister = nf_nat_ipv4_unregister_fn,
53+
};
54+
#endif
55+
56+
#ifdef CONFIG_NF_TABLES_IPV6
57+
static const struct nft_chain_type nft_chain_nat_ipv6 = {
58+
.name = "nat",
59+
.type = NFT_CHAIN_T_NAT,
60+
.family = NFPROTO_IPV6,
61+
.owner = THIS_MODULE,
62+
.hook_mask = (1 << NF_INET_PRE_ROUTING) |
63+
(1 << NF_INET_POST_ROUTING) |
64+
(1 << NF_INET_LOCAL_OUT) |
65+
(1 << NF_INET_LOCAL_IN),
66+
.hooks = {
67+
[NF_INET_PRE_ROUTING] = nft_nat_do_chain,
68+
[NF_INET_POST_ROUTING] = nft_nat_do_chain,
69+
[NF_INET_LOCAL_OUT] = nft_nat_do_chain,
70+
[NF_INET_LOCAL_IN] = nft_nat_do_chain,
71+
},
72+
.ops_register = nf_nat_ipv6_register_fn,
73+
.ops_unregister = nf_nat_ipv6_unregister_fn,
74+
};
75+
#endif
76+
77+
static int __init nft_chain_nat_init(void)
78+
{
79+
#ifdef CONFIG_NF_TABLES_IPV6
80+
nft_register_chain_type(&nft_chain_nat_ipv6);
81+
#endif
82+
#ifdef CONFIG_NF_TABLES_IPV4
83+
nft_register_chain_type(&nft_chain_nat_ipv4);
84+
#endif
85+
86+
return 0;
87+
}
88+
89+
static void __exit nft_chain_nat_exit(void)
90+
{
91+
#ifdef CONFIG_NF_TABLES_IPV4
92+
nft_unregister_chain_type(&nft_chain_nat_ipv4);
93+
#endif
94+
#ifdef CONFIG_NF_TABLES_IPV6
95+
nft_unregister_chain_type(&nft_chain_nat_ipv6);
96+
#endif
97+
}
98+
99+
module_init(nft_chain_nat_init);
100+
module_exit(nft_chain_nat_exit);
101+
102+
MODULE_LICENSE("GPL");
103+
#ifdef CONFIG_NF_TABLES_IPV4
104+
MODULE_ALIAS_NFT_CHAIN(AF_INET, "nat");
105+
#endif
106+
#ifdef CONFIG_NF_TABLES_IPV6
107+
MODULE_ALIAS_NFT_CHAIN(AF_INET6, "nat");
108+
#endif

0 commit comments

Comments
 (0)