History

netfilter: nft_nat: include a flag attribute

Both SNAT and DNAT (and the upcoming masquerade) can have additional configuration parameters, such as port randomization and NAT addressing persistence. We can cover these scenarios by simply adding a flag attribute for userspace to fill when needed. The flags to use are defined in include/uapi/linux/netfilter/nf_nat.h: NF_NAT_RANGE_MAP_IPS NF_NAT_RANGE_PROTO_SPECIFIED NF_NAT_RANGE_PROTO_RANDOM NF_NAT_RANGE_PERSISTENT NF_NAT_RANGE_PROTO_RANDOM_FULLY NF_NAT_RANGE_PROTO_RANDOM_ALL The caller must take care of not messing up with the flags, as they are added unconditionally to the final resulting nf_nat_range.

Arturo Borrero committed 12 years ago

Commit e42eff81 parent b9ac12e3 files · +23 −0Browse files

Showing the changes to include/uapi/linux (2 of 3 files). Show all

Unified · Split

2 files
  1. include/uapi/linux/netfilter/nf_nat.h +5 −0
  2. include/uapi/linux/netfilter/nf_tables.h +2 −0
include/uapi/linux/netfilter/nf_nat.h+5−0
@@ -13,6 +13,11 @@ · 12 unmodified lines
13#define NF_NAT_RANGE_PROTO_RANDOM_ALL \13#define NF_NAT_RANGE_PROTO_RANDOM_ALL \
14 (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)14 (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
15 15
16#define NF_NAT_RANGE_MASK \
17 (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \
18 NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \
19 NF_NAT_RANGE_PROTO_RANDOM_FULLY)
20
16struct nf_nat_ipv4_range {21struct nf_nat_ipv4_range {
17 unsigned int flags;22 unsigned int flags;
18 __be32 min_ip;23 __be32 min_ip;
include/uapi/linux/netfilter/nf_tables.h+2−0
@@ -785,6 +785,7 @@ enum nft_nat_types { · 784 unmodified lines
785 * @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)785 * @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
786 * @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)786 * @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
787 * @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)787 * @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
788 * @NFTA_NAT_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
788 */789 */
789enum nft_nat_attributes {790enum nft_nat_attributes {
790 NFTA_NAT_UNSPEC,791 NFTA_NAT_UNSPEC,
@@ -794,6 +795,7 @@ enum nft_nat_attributes { · 3 unmodified lines
794 NFTA_NAT_REG_ADDR_MAX,795 NFTA_NAT_REG_ADDR_MAX,
795 NFTA_NAT_REG_PROTO_MIN,796 NFTA_NAT_REG_PROTO_MIN,
796 NFTA_NAT_REG_PROTO_MAX,797 NFTA_NAT_REG_PROTO_MAX,
798 NFTA_NAT_FLAGS,
797 __NFTA_NAT_MAX799 __NFTA_NAT_MAX
798};800};
799#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)801#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)