netfilter: nft_nat: include a flag attribute

Both SNAT and DNAT (and the upcoming masquerade) can have additional configuration parameters, such as port randomization and NAT addressing persistence. We can cover these scenarios by simply adding a flag attribute for userspace to fill when needed. The flags to use are defined in include/uapi/linux/netfilter/nf_nat.h: NF_NAT_RANGE_MAP_IPS NF_NAT_RANGE_PROTO_SPECIFIED NF_NAT_RANGE_PROTO_RANDOM NF_NAT_RANGE_PERSISTENT NF_NAT_RANGE_PROTO_RANDOM_FULLY NF_NAT_RANGE_PROTO_RANDOM_ALL The caller must take care of not messing up with the flags, as they are added unconditionally to the final resulting nf_nat_range.

Arturo Borrero committed 12 years ago

Commit e42eff81 parent b9ac12e3 files · +23 −0Browse files

Showing the changes to include/uapi/linux (2 of 3 files). Show all

Unified · Split

2 files

include/uapi/linux/netfilter/nf_nat.h +5 −0
include/uapi/linux/netfilter/nf_tables.h +2 −0

include/uapi/linux/netfilter/nf_nat.h+5−0

@@ -13,6 +13,11 @@ · 12 unmodified lines
13	13	#define NF_NAT_RANGE_PROTO_RANDOM_ALL \
14	14	(NF_NAT_RANGE_PROTO_RANDOM \| NF_NAT_RANGE_PROTO_RANDOM_FULLY)
15	15
	16	+#define NF_NAT_RANGE_MASK \
	17	+ (NF_NAT_RANGE_MAP_IPS \| NF_NAT_RANGE_PROTO_SPECIFIED \| \
	18	+ NF_NAT_RANGE_PROTO_RANDOM \| NF_NAT_RANGE_PERSISTENT \| \
	19	+ NF_NAT_RANGE_PROTO_RANDOM_FULLY)
	20	+
16	21	struct nf_nat_ipv4_range {
17	22	unsigned int flags;
18	23	__be32 min_ip;

include/uapi/linux/netfilter/nf_tables.h+2−0

@@ -785,6 +785,7 @@ enum nft_nat_types { · 784 unmodified lines
785	785	* @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
786	786	* @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
787	787	* @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
	788	+ * @NFTA_NAT_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
788	789	*/
789	790	enum nft_nat_attributes {
790	791	NFTA_NAT_UNSPEC,
@@ -794,6 +795,7 @@ enum nft_nat_attributes { · 3 unmodified lines
794	795	NFTA_NAT_REG_ADDR_MAX,
795	796	NFTA_NAT_REG_PROTO_MIN,
796	797	NFTA_NAT_REG_PROTO_MAX,
	798	+ NFTA_NAT_FLAGS,
797	799	__NFTA_NAT_MAX
798	800	};
799	801	#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)