Commit db8ab388 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: merge ipv4 and ipv6 nat chain types 



Merge the ipv4 and ipv6 nat chain type. This is the last
missing piece which allows to provide inet family support
for nat in a follow patch.

The kconfig knobs for ipv4/ipv6 nat chain are removed, the
nat chain type will be built unconditionally if NFT_NAT
expression is enabled.

Before:
   text	   data	    bss	    dec	    hex	filename
   1576     896       0    2472     9a8 nft_chain_nat_ipv4.ko
   1697     896       0    2593     a21 nft_chain_nat_ipv6.ko

After:
   text	   data	    bss	    dec	    hex	filename
   1832     896       0    2728     aa8 nft_chain_nat.ko

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent a9ce849e

net/ipv4/netfilter/Kconfig

+0 −13
Original line number Diff line number Diff line
@@ -95,19 +95,6 @@ config NF_REJECT_IPV4 
	default m if NETFILTER_ADVANCED=n



if NF_NAT



if NF_TABLES

config NFT_CHAIN_NAT_IPV4

	depends on NF_TABLES_IPV4

	tristate "IPv4 nf_tables nat chain support"

	help

	  This option enables the "nat" chain for IPv4 in nf_tables. This

	  chain type is used to perform Network Address Translation (NAT)

	  packet transformations such as the source, destination address and

	  source and destination ports.



endif # NF_TABLES



config NF_NAT_SNMP_BASIC

	tristate "Basic SNMP-ALG support"

	depends on NF_CONNTRACK_SNMP

net/ipv4/netfilter/Makefile

+0 −1
Original line number Diff line number Diff line
@@ -25,7 +25,6 @@ $(obj)/nf_nat_snmp_basic_main.o: $(obj)/nf_nat_snmp_basic.asn1.h 
obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o



obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o

obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o

obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o

obj-$(CONFIG_NFT_FIB_IPV4) += nft_fib_ipv4.o

obj-$(CONFIG_NFT_DUP_IPV4) += nft_dup_ipv4.o

net/ipv6/netfilter/Kconfig

+0 −11
Original line number Diff line number Diff line
@@ -31,17 +31,6 @@ config NFT_CHAIN_ROUTE_IPV6 
	  fields such as the source, destination, flowlabel, hop-limit and

	  the packet mark.



if NF_NAT



config NFT_CHAIN_NAT_IPV6

	tristate "IPv6 nf_tables nat chain support"

	help

	  This option enables the "nat" chain for IPv6 in nf_tables. This

	  chain type is used to perform Network Address Translation (NAT)

	  packet transformations such as the source, destination address and

	  source and destination ports.

endif # NF_NAT



config NFT_REJECT_IPV6

	select NF_REJECT_IPV6

	default NFT_REJECT

net/ipv6/netfilter/Makefile

+0 −1
Original line number Diff line number Diff line
@@ -28,7 +28,6 @@ obj-$(CONFIG_NF_DUP_IPV6) += nf_dup_ipv6.o 


# nf_tables

obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV6) += nft_chain_route_ipv6.o

obj-$(CONFIG_NFT_CHAIN_NAT_IPV6) += nft_chain_nat_ipv6.o

obj-$(CONFIG_NFT_REJECT_IPV6) += nft_reject_ipv6.o

obj-$(CONFIG_NFT_DUP_IPV6) += nft_dup_ipv6.o

obj-$(CONFIG_NFT_FIB_IPV6) += nft_fib_ipv6.o

net/ipv6/netfilter/nft_chain_nat_ipv6.c

deleted100644 → 0
+0 −83
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>

 * Copyright (c) 2012 Intel Corporation

 *

 * This program is free software; you can redistribute it and/or modify it

 * under the terms and conditions of the GNU General Public License,

 * version 2, as published by the Free Software Foundation.

 *

 */



#include <linux/module.h>

#include <linux/init.h>

#include <linux/list.h>

#include <linux/skbuff.h>

#include <linux/ip.h>

#include <linux/netfilter.h>

#include <linux/netfilter_ipv6.h>

#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_conntrack.h>

#include <net/netfilter/nf_nat.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables_ipv6.h>

#include <net/ipv6.h>



static unsigned int nft_nat_do_chain(void *priv,

				     struct sk_buff *skb,

				     const struct nf_hook_state *state)

{

	struct nft_pktinfo pkt;



	nft_set_pktinfo(&pkt, skb, state);

	nft_set_pktinfo_ipv6(&pkt, skb);



	return nft_do_chain(&pkt, priv);

}



static int nft_nat_ipv6_reg(struct net *net, const struct nf_hook_ops *ops)

{

	return nf_nat_ipv6_register_fn(net, ops);

}



static void nft_nat_ipv6_unreg(struct net *net, const struct nf_hook_ops *ops)

{

	nf_nat_ipv6_unregister_fn(net, ops);

}



static const struct nft_chain_type nft_chain_nat_ipv6 = {

	.name		= "nat",

	.type		= NFT_CHAIN_T_NAT,

	.family		= NFPROTO_IPV6,

	.owner		= THIS_MODULE,

	.hook_mask	= (1 << NF_INET_PRE_ROUTING) |

			  (1 << NF_INET_POST_ROUTING) |

			  (1 << NF_INET_LOCAL_OUT) |

			  (1 << NF_INET_LOCAL_IN),

	.hooks		= {

		[NF_INET_PRE_ROUTING]	= nft_nat_do_chain,

		[NF_INET_POST_ROUTING]	= nft_nat_do_chain,

		[NF_INET_LOCAL_OUT]	= nft_nat_do_chain,

		[NF_INET_LOCAL_IN]	= nft_nat_do_chain,

	},

	.ops_register		= nft_nat_ipv6_reg,

	.ops_unregister		= nft_nat_ipv6_unreg,

};



static int __init nft_chain_nat_ipv6_init(void)

{

	nft_register_chain_type(&nft_chain_nat_ipv6);



	return 0;

}



static void __exit nft_chain_nat_ipv6_exit(void)

{

	nft_unregister_chain_type(&nft_chain_nat_ipv6);

}



module_init(nft_chain_nat_ipv6_init);

module_exit(nft_chain_nat_ipv6_exit);



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>");

MODULE_ALIAS_NFT_CHAIN(AF_INET6, "nat");

CRA Git | Maintained and supported by SUSTech CRA and CCSE