Re: [PATCH 1/2] updates for [nf|ct]netlink and event API

[Pablo Neira <pablo@eurodev.net>]

Patrick McHardy wrote:
> Pablo Neira wrote:
> 
> I haven't looked at the patch for a long time, and it removes
> and adds the whole file, so not sure if it is new ..

Yes, that's new. Ick, it seems I didn't express fine myself. Together 
with the big and confusing patch I uploaded a splitted version that 
makes easier the review as well:

http://people.netfilter.org/~pablo/ctnetlink-2.6.12/2.6.11-vs-2.6.12/

> +		/* This is tricky but it works. ip_nat_setup_info needs the
> +		 * hook number as parameter, so let's do the correct
> +		 * conversion and run away */
> +		if (*status & IPS_SRC_NAT_DONE)
> +			hooknum = NF_IP_POST_ROUTING; /* IP_NAT_MANIP_SRC */
> +		else if (*status & IPS_DST_NAT_DONE)
> +			hooknum = NF_IP_PRE_ROUTING;  /* IP_NAT_MANIP_DST */
> +		else
> +			return -EINVAL; /* Missing NAT flags */
> 
> This doesn't work reliably, locally generated packets never enter
> PRE_ROUTING but can be DNATed. I think the hook should be supplied
> by the user.

The macro HOOK2MANIP used is ip_nat_setup_info returns the same value 
(maniptype) for NF_IP_PRE_ROUTING and NF_IP_LOCAL_IN, so the same 
manipulation (DNAT) will be applied to such conntrack. Since we works 
with conntracks, I don't mind where the packets came from, just want to 
apply the NAT handling that the user has requested.

--
Pablo