* [nf PATCH] netfilter: nft_nat: Fix inet l4-only NAT
@ 2022-06-01 13:19 Phil Sutter
2022-06-01 13:26 ` Phil Sutter
2022-06-01 13:27 ` Pablo Neira Ayuso
0 siblings, 2 replies; 3+ messages in thread
From: Phil Sutter @ 2022-06-01 13:19 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
If nat expression does not specify an address, its family value is
NFPROTO_INET. Disable the check against the packet's family in that
case.
Fixes: a33f387ecd5aa ("netfilter: nft_nat: allow to specify layer 4 protocol NAT only")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
net/netfilter/nft_nat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index 4394df4bc99b4..4ee690bdbf392 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -335,7 +335,7 @@ static void nft_nat_inet_eval(const struct nft_expr *expr,
{
const struct nft_nat *priv = nft_expr_priv(expr);
- if (priv->family == nft_pf(pkt))
+ if (priv->family == NFPROTO_INET || priv->family == nft_pf(pkt))
nft_nat_eval(expr, regs, pkt);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [nf PATCH] netfilter: nft_nat: Fix inet l4-only NAT
2022-06-01 13:19 [nf PATCH] netfilter: nft_nat: Fix inet l4-only NAT Phil Sutter
@ 2022-06-01 13:26 ` Phil Sutter
2022-06-01 13:27 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Phil Sutter @ 2022-06-01 13:26 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
On Wed, Jun 01, 2022 at 03:19:14PM +0200, Phil Sutter wrote:
> If nat expression does not specify an address, its family value is
> NFPROTO_INET. Disable the check against the packet's family in that
> case.
>
> Fixes: a33f387ecd5aa ("netfilter: nft_nat: allow to specify layer 4 protocol NAT only")
> Signed-off-by: Phil Sutter <phil@nwl.cc>
Argh. Duplicate work with Florian (message-ID
20220601084735.79090-1-fw@strlen.de), please use his patch - it adds a
test as well.
Sorry for the noise!
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [nf PATCH] netfilter: nft_nat: Fix inet l4-only NAT
2022-06-01 13:19 [nf PATCH] netfilter: nft_nat: Fix inet l4-only NAT Phil Sutter
2022-06-01 13:26 ` Phil Sutter
@ 2022-06-01 13:27 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2022-06-01 13:27 UTC (permalink / raw)
To: Phil Sutter; +Cc: netfilter-devel
On Wed, Jun 01, 2022 at 03:19:14PM +0200, Phil Sutter wrote:
> If nat expression does not specify an address, its family value is
> NFPROTO_INET. Disable the check against the packet's family in that
> case.
>
> Fixes: a33f387ecd5aa ("netfilter: nft_nat: allow to specify layer 4 protocol NAT only")
> Signed-off-by: Phil Sutter <phil@nwl.cc>
Florian posted this:
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20220601084735.79090-1-fw@strlen.de/
> ---
> net/netfilter/nft_nat.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
> index 4394df4bc99b4..4ee690bdbf392 100644
> --- a/net/netfilter/nft_nat.c
> +++ b/net/netfilter/nft_nat.c
> @@ -335,7 +335,7 @@ static void nft_nat_inet_eval(const struct nft_expr *expr,
> {
> const struct nft_nat *priv = nft_expr_priv(expr);
>
> - if (priv->family == nft_pf(pkt))
> + if (priv->family == NFPROTO_INET || priv->family == nft_pf(pkt))
> nft_nat_eval(expr, regs, pkt);
> }
>
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-06-01 13:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-06-01 13:19 [nf PATCH] netfilter: nft_nat: Fix inet l4-only NAT Phil Sutter
2022-06-01 13:26 ` Phil Sutter
2022-06-01 13:27 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).