[nf PATCH RFC] net: nf_tables: Support auto-loading inet family nat chain

[nf PATCH RFC] net: nf_tables: Support auto-loading inet family nat chain

[Phil Sutter]

Trying to create an inet family nat chain would not cause
nft_chain_nat.ko module auto-load due to missing module alias.

The family is actually NFPROTO_INET which happens to be the same
numerical value as AF_UNIX.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
This is obviously a hack to illustrate the problem and show a working
solution. I'm not sure what a real fix would look like - maybe nf_tables
should internally use NFPROTO_* defines instead of AF_* ones? Maybe it
should translate NFPROTO_INET into AF_UNSPEC?
---
 net/netfilter/nft_chain_nat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/nft_chain_nat.c b/net/netfilter/nft_chain_nat.c
index 2f89bde3c61cb..d3bf4a297c655 100644
--- a/net/netfilter/nft_chain_nat.c
+++ b/net/netfilter/nft_chain_nat.c
@@ -142,3 +142,6 @@ MODULE_ALIAS_NFT_CHAIN(AF_INET, "nat");
 #ifdef CONFIG_NF_TABLES_IPV6
 MODULE_ALIAS_NFT_CHAIN(AF_INET6, "nat");
 #endif
+#ifdef CONFIG_NF_TABLES_INET
+MODULE_ALIAS_NFT_CHAIN(AF_UNIX, "nat");
+#endif
-- 
2.22.0

Re: [nf PATCH RFC] net: nf_tables: Support auto-loading inet family nat chain

[Pablo Neira Ayuso]

On Wed, Jul 17, 2019 at 07:17:43PM +0200, Phil Sutter wrote:
> Trying to create an inet family nat chain would not cause
> nft_chain_nat.ko module auto-load due to missing module alias.
> 
> The family is actually NFPROTO_INET which happens to be the same
> numerical value as AF_UNIX.
> 
> Signed-off-by: Phil Sutter <phil@nwl.cc>
> ---
> This is obviously a hack to illustrate the problem and show a working
> solution. I'm not sure what a real fix would look like - maybe nf_tables
> should internally use NFPROTO_* defines instead of AF_* ones? Maybe it
> should translate NFPROTO_INET into AF_UNSPEC?
> ---
>  net/netfilter/nft_chain_nat.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/netfilter/nft_chain_nat.c b/net/netfilter/nft_chain_nat.c
> index 2f89bde3c61cb..d3bf4a297c655 100644
> --- a/net/netfilter/nft_chain_nat.c
> +++ b/net/netfilter/nft_chain_nat.c
> @@ -142,3 +142,6 @@ MODULE_ALIAS_NFT_CHAIN(AF_INET, "nat");
>  #ifdef CONFIG_NF_TABLES_IPV6
>  MODULE_ALIAS_NFT_CHAIN(AF_INET6, "nat");
>  #endif
> +#ifdef CONFIG_NF_TABLES_INET
> +MODULE_ALIAS_NFT_CHAIN(AF_UNIX, "nat");

Please, use (2, "nat") instead like in other extensions.

        MODULE_ALIAS_NFT_CHAIN(2, "nat");        /* NFPROTO_INET */

Yes, it's not nice, but this is so far what we have.

I agree we should fix this, problem is that NFPROTO_* are enum, and
IIRC this doesn't mix well with the existing macros.

If you want to have a look, that would be great.

Thanks.

Re: [nf PATCH RFC] net: nf_tables: Support auto-loading inet family nat chain

[Phil Sutter]

Hi,

On Wed, Jul 17, 2019 at 08:35:15PM +0200, Pablo Neira Ayuso wrote:
[...]
> Please, use (2, "nat") instead like in other extensions.
> 
>         MODULE_ALIAS_NFT_CHAIN(2, "nat");        /* NFPROTO_INET */

I sent a non-RFC patch which uses fixed value 1. Thanks for the
suggestion!

> Yes, it's not nice, but this is so far what we have.
> 
> I agree we should fix this, problem is that NFPROTO_* are enum, and
> IIRC this doesn't mix well with the existing macros.

Ah, right. The __stringify() thing bites us then. In order to use
NFPROTO_* names, those would have to be redefined as macro. And not just
like netinet/in.h does for IPPROTO_* names but with actual value.

Cheers, Phil