From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [nf-next:nf_tables-experiments PATCH 3/4] nf_tables: Add support for IPv6 NAT expression
Date: Thu, 15 Nov 2012 13:29:08 +0100 [thread overview]
Message-ID: <20121115122908.GB2271@1984> (raw)
In-Reply-To: <1352970952-3447-4-git-send-email-tomasz.bursztyka@linux.intel.com>
Hi again Tomasz,
Comment below:
On Thu, Nov 15, 2012 at 11:15:51AM +0200, Tomasz Bursztyka wrote:
> Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
> ---
> include/linux/netfilter/nf_tables.h | 6 ++-
> net/netfilter/nft_nat.c | 100 +++++++++++++++++++++++++++---------
> 2 files changed, 79 insertions(+), 27 deletions(-)
>
> diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
> index f42cc9d..7ab2d65 100644
> --- a/include/linux/netfilter/nf_tables.h
> +++ b/include/linux/netfilter/nf_tables.h
> @@ -395,8 +395,10 @@ enum nft_nat_types {
> enum nft_nat_attributes {
> NFTA_NAT_UNSPEC,
> NFTA_NAT_TYPE,
> - NFTA_NAT_REG_ADDR_MIN,
> - NFTA_NAT_REG_ADDR_MAX,
> + NFTA_NAT_REG_ADDR_MIN_V4,
> + NFTA_NAT_REG_ADDR_MAX_V4,
> + NFTA_NAT_REG_ADDR_MIN_V6,
> + NFTA_NAT_REG_ADDR_MAX_V6,
> NFTA_NAT_REG_PROTO_MIN,
> NFTA_NAT_REG_PROTO_MAX,
> __NFTA_NAT_MAX
> diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
> index ea9854e..ca5b0da 100644
> --- a/net/netfilter/nft_nat.c
> +++ b/net/netfilter/nft_nat.c
> @@ -13,6 +13,7 @@
> #include <linux/init.h>
> #include <linux/skbuff.h>
> #include <linux/ip.h>
> +#include <linux/string.h>
> #include <linux/netlink.h>
> #include <linux/netfilter.h>
> #include <linux/netfilter_ipv4.h>
> @@ -26,8 +27,10 @@
> #include <net/ip.h>
>
> struct nft_nat {
> - enum nft_registers sreg_addr_min:8;
> - enum nft_registers sreg_addr_max:8;
> + enum nft_registers sreg_addr_min_v4:8;
> + enum nft_registers sreg_addr_max_v4:8;
> + enum nft_registers sreg_addr_min_v6:8;
> + enum nft_registers sreg_addr_max_v6:8;
Suggestion: Couldn't we get this patch a bit smaller by adding int
family and the NFTA_NAT_FAMILY attribute?
> enum nft_registers sreg_proto_min:8;
> enum nft_registers sreg_proto_max:8;
> enum nf_nat_manip_type type;
> @@ -43,9 +46,15 @@ static void nft_nat_eval(const struct nft_expr *expr,
> struct nf_nat_range range;
>
> memset(&range, 0, sizeof(range));
> - if (priv->sreg_addr_min) {
> - range.min_addr.ip = data[priv->sreg_addr_min].data[0];
> - range.max_addr.ip = data[priv->sreg_addr_max].data[0];
> + if (priv->sreg_addr_min_v4) {
> + range.min_addr.ip = data[priv->sreg_addr_min_v4].data[0];
> + range.max_addr.ip = data[priv->sreg_addr_max_v4].data[0];
> + range.flags |= NF_NAT_RANGE_MAP_IPS;
> + } else if (priv->sreg_addr_min_v6) {
> + memcpy(range.min_addr.ip6, data[priv->sreg_addr_min_v4].data,
> + sizeof(struct nft_data));
> + memcpy(range.max_addr.ip6, data[priv->sreg_addr_max_v6].data,
> + sizeof(struct nft_data));
> range.flags |= NF_NAT_RANGE_MAP_IPS;
> }
>
> @@ -60,11 +69,13 @@ static void nft_nat_eval(const struct nft_expr *expr,
> }
>
> static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = {
> - [NFTA_NAT_TYPE] = { .type = NLA_U32 },
> - [NFTA_NAT_REG_ADDR_MIN] = { .type = NLA_U32 },
> - [NFTA_NAT_REG_ADDR_MAX] = { .type = NLA_U32 },
> - [NFTA_NAT_REG_PROTO_MIN] = { .type = NLA_U32 },
> - [NFTA_NAT_REG_PROTO_MAX] = { .type = NLA_U32 },
> + [NFTA_NAT_TYPE] = { .type = NLA_U32 },
> + [NFTA_NAT_REG_ADDR_MIN_V4] = { .type = NLA_U32 },
> + [NFTA_NAT_REG_ADDR_MAX_V4] = { .type = NLA_U32 },
> + [NFTA_NAT_REG_ADDR_MIN_V6] = { .type = NLA_U32 },
> + [NFTA_NAT_REG_ADDR_MAX_V6] = { .type = NLA_U32 },
> + [NFTA_NAT_REG_PROTO_MIN] = { .type = NLA_U32 },
> + [NFTA_NAT_REG_PROTO_MAX] = { .type = NLA_U32 },
> };
>
> static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
> @@ -87,22 +98,45 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
> return -EINVAL;
> }
>
> - if (tb[NFTA_NAT_REG_ADDR_MIN]) {
> - priv->sreg_addr_min = ntohl(nla_get_be32(
> - tb[NFTA_NAT_REG_ADDR_MIN]));
> - err = nft_validate_input_register(priv->sreg_addr_min);
> + if ((tb[NFTA_NAT_REG_ADDR_MIN_V4] && tb[NFTA_NAT_REG_ADDR_MIN_V6]) ||
> + (tb[NFTA_NAT_REG_ADDR_MIN_V4] && tb[NFTA_NAT_REG_ADDR_MAX_V6]) ||
> + (tb[NFTA_NAT_REG_ADDR_MAX_V4] && tb[NFTA_NAT_REG_ADDR_MIN_V6]) ||
> + (tb[NFTA_NAT_REG_ADDR_MAX_V4] && tb[NFTA_NAT_REG_ADDR_MAX_V6]))
> + return -EINVAL;
> +
> + if (tb[NFTA_NAT_REG_ADDR_MIN_V4]) {
> + priv->sreg_addr_min_v4 = ntohl(nla_get_be32(
> + tb[NFTA_NAT_REG_ADDR_MIN_V4]));
> + err = nft_validate_input_register(priv->sreg_addr_min_v4);
> + if (err < 0)
> + return err;
> + }
> +
> + if (tb[NFTA_NAT_REG_ADDR_MAX_V4]) {
> + priv->sreg_addr_max_v4 = ntohl(nla_get_be32(
> + tb[NFTA_NAT_REG_ADDR_MAX_V4]));
> + err = nft_validate_input_register(priv->sreg_addr_max_v4);
> + if (err < 0)
> + return err;
> + } else
> + priv->sreg_addr_max_v4 = priv->sreg_addr_min_v4;
> +
> + if (tb[NFTA_NAT_REG_ADDR_MIN_V6]) {
> + priv->sreg_addr_min_v6 = ntohl(nla_get_be32(
> + tb[NFTA_NAT_REG_ADDR_MIN_V6]));
> + err = nft_validate_input_register(priv->sreg_addr_min_v6);
> if (err < 0)
> return err;
> }
>
> - if (tb[NFTA_NAT_REG_ADDR_MAX]) {
> - priv->sreg_addr_max = ntohl(nla_get_be32(
> - tb[NFTA_NAT_REG_ADDR_MAX]));
> - err = nft_validate_input_register(priv->sreg_addr_max);
> + if (tb[NFTA_NAT_REG_ADDR_MAX_V6]) {
> + priv->sreg_addr_max_v6 = ntohl(nla_get_be32(
> + tb[NFTA_NAT_REG_ADDR_MAX_V6]));
> + err = nft_validate_input_register(priv->sreg_addr_max_v4);
> if (err < 0)
> return err;
> } else
> - priv->sreg_addr_max = priv->sreg_addr_min;
> + priv->sreg_addr_max_v6 = priv->sreg_addr_min_v6;
>
> if (tb[NFTA_NAT_REG_PROTO_MIN]) {
> priv->sreg_proto_min = ntohl(nla_get_be32(
> @@ -139,12 +173,28 @@ static int nft_nat_dump(struct sk_buff *skb, const struct nft_expr *expr)
> break;
> }
>
> - if (nla_put_be32(skb,
> - NFTA_NAT_REG_ADDR_MIN, htonl(priv->sreg_addr_min)))
> - goto nla_put_failure;
> - if (nla_put_be32(skb,
> - NFTA_NAT_REG_ADDR_MAX, htonl(priv->sreg_addr_max)))
> - goto nla_put_failure;
> + if (priv->sreg_addr_min_v4) {
> + if (nla_put_be32(skb,
> + NFTA_NAT_REG_ADDR_MIN_V4,
> + htonl(priv->sreg_addr_min_v4)))
> + goto nla_put_failure;
> + if (nla_put_be32(skb,
> + NFTA_NAT_REG_ADDR_MAX_V4,
> + htonl(priv->sreg_addr_max_v4)))
> + goto nla_put_failure;
> + }
> +
> + if (priv->sreg_addr_min_v6) {
> + if (nla_put_be32(skb,
> + NFTA_NAT_REG_ADDR_MIN_V6,
> + htonl(priv->sreg_addr_min_v6)))
> + goto nla_put_failure;
> + if (nla_put_be32(skb,
> + NFTA_NAT_REG_ADDR_MAX_V6,
> + htonl(priv->sreg_addr_max_v6)))
> + goto nla_put_failure;
> + }
> +
> if (nla_put_be32(skb,
> NFTA_NAT_REG_PROTO_MIN, htonl(priv->sreg_proto_min)))
> goto nla_put_failure;
> --
> 1.8.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2012-11-15 12:29 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-15 9:15 [nf-next:nf_tables-experiments PATCH 0/4] NAT expression and IPv6 NAT support Tomasz Bursztyka
2012-11-15 9:15 ` [nf-next:nf_tables-experiments PATCH 1/4] nf_tables: Change NFTA_NAT_ attributes to better semantic significance Tomasz Bursztyka
2012-11-15 9:15 ` [nf-next:nf_tables-experiments PATCH 2/4] nf_tables: Split IPv4 NAT into NAT expression and NAT IPv4 chain Tomasz Bursztyka
2012-11-15 12:26 ` Pablo Neira Ayuso
2012-11-15 12:38 ` Tomasz Bursztyka
2012-11-15 9:15 ` [nf-next:nf_tables-experiments PATCH 3/4] nf_tables: Add support for IPv6 NAT expression Tomasz Bursztyka
2012-11-15 12:29 ` Pablo Neira Ayuso [this message]
2012-11-15 12:44 ` Tomasz Bursztyka
2012-11-15 12:47 ` Pablo Neira Ayuso
2012-11-15 9:15 ` [nf-next:nf_tables-experiments PATCH 4/4] nf_tables: Add support for IPv6 NAT chain Tomasz Bursztyka
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121115122908.GB2271@1984 \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=tomasz.bursztyka@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.