Commit 2cbc78a2 authored by Jan Engelhardt's avatar Jan Engelhardt Committed by Pablo Neira Ayuso
Browse files

netfilter: combine ipt_REDIRECT and ip6t_REDIRECT 



Combine more modules since the actual code is so small anyway that the
kmod metadata and the module in its loaded state totally outweighs the
combined actual code size.

IP_NF_TARGET_REDIRECT becomes a compat option; IP6_NF_TARGET_REDIRECT
is completely eliminated since it has not see a release yet.

Signed-off-by: default avatarJan Engelhardt <jengelh@inai.de>
Acked-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b3d54b3e

net/ipv4/netfilter/Kconfig

+5 −7
Original line number Diff line number Diff line
@@ -181,13 +181,11 @@ config IP_NF_TARGET_NETMAP 
config IP_NF_TARGET_REDIRECT

	tristate "REDIRECT target support"

	depends on NETFILTER_ADVANCED

	help

	  REDIRECT is a special case of NAT: all incoming connections are

	  mapped onto the incoming interface's address, causing the packets to

	  come to the local machine instead of passing through.  This is

	  useful for transparent proxies.



	  To compile it as a module, choose M here.  If unsure, say N.

	select NETFILTER_XT_TARGET_REDIRECT

	---help---

	This is a backwards-compat option for the user's convenience

	(e.g. when running oldconfig). It selects

	CONFIG_NETFILTER_XT_TARGET_REDIRECT.



endif

net/ipv4/netfilter/Makefile

+0 −1
Original line number Diff line number Diff line
@@ -45,7 +45,6 @@ obj-$(CONFIG_IP_NF_MATCH_RPFILTER) += ipt_rpfilter.o 
obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o

obj-$(CONFIG_IP_NF_TARGET_ECN) += ipt_ECN.o

obj-$(CONFIG_IP_NF_TARGET_MASQUERADE) += ipt_MASQUERADE.o

obj-$(CONFIG_IP_NF_TARGET_REDIRECT) += ipt_REDIRECT.o

obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o

obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o

net/ipv6/netfilter/Kconfig

+0 −10
Original line number Diff line number Diff line
@@ -209,16 +209,6 @@ config IP6_NF_TARGET_MASQUERADE 


	  To compile it as a module, choose M here.  If unsure, say N.



config IP6_NF_TARGET_REDIRECT

	tristate "REDIRECT target support"

	help

	  REDIRECT is a special case of NAT: all incoming connections are

	  mapped onto the incoming interface's address, causing the packets to

	  come to the local machine instead of passing through.  This is

	  useful for transparent proxies.



	  To compile it as a module, choose M here.  If unsure, say N.



config IP6_NF_TARGET_NPT

	tristate "NPT (Network Prefix translation) target support"

	help

net/ipv6/netfilter/Makefile

+0 −1
Original line number Diff line number Diff line
@@ -36,5 +36,4 @@ obj-$(CONFIG_IP6_NF_MATCH_RT) += ip6t_rt.o 
# targets

obj-$(CONFIG_IP6_NF_TARGET_MASQUERADE) += ip6t_MASQUERADE.o

obj-$(CONFIG_IP6_NF_TARGET_NPT) += ip6t_NPT.o

obj-$(CONFIG_IP6_NF_TARGET_REDIRECT) += ip6t_REDIRECT.o

obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o

net/ipv6/netfilter/ip6t_REDIRECT.c

deleted100644 → 0
+0 −98
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as

 * published by the Free Software Foundation.

 *

 * Based on Rusty Russell's IPv4 REDIRECT target. Development of IPv6

 * NAT funded by Astaro.

 */



#include <linux/kernel.h>

#include <linux/module.h>

#include <linux/netfilter.h>

#include <linux/netfilter_ipv6.h>

#include <linux/netfilter/x_tables.h>

#include <net/addrconf.h>

#include <net/netfilter/nf_nat.h>



static const struct in6_addr loopback_addr = IN6ADDR_LOOPBACK_INIT;



static unsigned int

redirect_tg6(struct sk_buff *skb, const struct xt_action_param *par)

{

	const struct nf_nat_range *range = par->targinfo;

	struct nf_nat_range newrange;

	struct in6_addr newdst;

	enum ip_conntrack_info ctinfo;

	struct nf_conn *ct;



	ct = nf_ct_get(skb, &ctinfo);

	if (par->hooknum == NF_INET_LOCAL_OUT)

		newdst = loopback_addr;

	else {

		struct inet6_dev *idev;

		struct inet6_ifaddr *ifa;

		bool addr = false;



		rcu_read_lock();

		idev = __in6_dev_get(skb->dev);

		if (idev != NULL) {

			list_for_each_entry(ifa, &idev->addr_list, if_list) {

				newdst = ifa->addr;

				addr = true;

				break;

			}

		}

		rcu_read_unlock();



		if (!addr)

			return NF_DROP;

	}



	newrange.flags		= range->flags | NF_NAT_RANGE_MAP_IPS;

	newrange.min_addr.in6	= newdst;

	newrange.max_addr.in6	= newdst;

	newrange.min_proto	= range->min_proto;

	newrange.max_proto	= range->max_proto;



	return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);

}



static int redirect_tg6_checkentry(const struct xt_tgchk_param *par)

{

	const struct nf_nat_range *range = par->targinfo;



	if (range->flags & NF_NAT_RANGE_MAP_IPS)

		return -EINVAL;

	return 0;

}



static struct xt_target redirect_tg6_reg __read_mostly = {

	.name		= "REDIRECT",

	.family		= NFPROTO_IPV6,

	.checkentry	= redirect_tg6_checkentry,

	.target		= redirect_tg6,

	.targetsize	= sizeof(struct nf_nat_range),

	.table		= "nat",

	.hooks		= (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT),

	.me		= THIS_MODULE,

};



static int __init redirect_tg6_init(void)

{

	return xt_register_target(&redirect_tg6_reg);

}



static void __exit redirect_tg6_exit(void)

{

	xt_unregister_target(&redirect_tg6_reg);

}



module_init(redirect_tg6_init);

module_exit(redirect_tg6_exit);



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");

MODULE_DESCRIPTION("Xtables: Connection redirection to localhost");

CRA Git | Maintained and supported by SUSTech CRA and CCSE