Re: [PATCH] netfilter: install nf_nat.h and nf_conntrack_tuple.h to INSTALL_HDR_PATH

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Sep 20, 2011 at 11:33:39AM -0400, Anthony G. Basile wrote:
> Sorry for the delay in responding, real life.
> 
> What I did in that last patch was just grab nf_nat.h and
> nf_contrack_tupple.h from iptables source tree at include/net/netfilter
> plus minor changes.  I didn't look for the minimum of what iptables and
> miniupnpd need.
> 
> Here's a possibility that works, move nf_conntrack_man_proto to nf_nat.h
> and only export that header with:

I guess, you mean the new include/linux/netfilter/nf_nat.h file, right?

>     #define IP_NAT_RANGE_MAP_IPS 1
>     ...
> 
>     union nf_conntrack_man_proto {
>         __be16 all;
>         struct { __be16 port } tcp;
>         ...
>     }

If you want to keep the "port" field, I'd prefer something like:

union nf_conntrack_man_proto {
        __be16 port;
        __be16 icmp_id;
        __be16 gre_key;
};

And propagate the changes to the corresponding .c files.

>     struct nf_nat_range {
>         ...
>         union nf_conntrack_man_proto min, max;
>     };
> 
>     struct nf_nat_multi_range_compat { ... }
> 
>     #define nf_nat_multi_range nf_nat_multi_range_compat
> 
> This is the minimum that iptables and miniupnpd need to compile.
> 
> Does this look like a workable solution?

Close to it, but please change union nf_conntrack_man_proto to what I
suggested.

Thanks!