lkml.org 
[lkml]   [2022]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 132/247] netfilter: nat: really support inet nat without l3 address
    Date
    From: Florian Westphal <fw@strlen.de>

    [ Upstream commit 282e5f8fe907dc3f2fbf9f2103b0e62ffc3a68a5 ]

    When no l3 address is given, priv->family is set to NFPROTO_INET and
    the evaluation function isn't called.

    Call it too so l4-only rewrite can work.
    Also add a test case for this.

    Fixes: a33f387ecd5aa ("netfilter: nft_nat: allow to specify layer 4 protocol NAT only")
    Reported-by: Yi Chen <yiche@redhat.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nft_nat.c | 3 +-
    tools/testing/selftests/netfilter/nft_nat.sh | 43 ++++++++++++++++++++
    2 files changed, 45 insertions(+), 1 deletion(-)

    diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
    index be1595d6979d..db8f9116eeb4 100644
    --- a/net/netfilter/nft_nat.c
    +++ b/net/netfilter/nft_nat.c
    @@ -334,7 +334,8 @@ static void nft_nat_inet_eval(const struct nft_expr *expr,
    {
    const struct nft_nat *priv = nft_expr_priv(expr);

    - if (priv->family == nft_pf(pkt))
    + if (priv->family == nft_pf(pkt) ||
    + priv->family == NFPROTO_INET)
    nft_nat_eval(expr, regs, pkt);
    }

    diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
    index 781fa2d9ea9d..032f2de6e14e 100755
    --- a/tools/testing/selftests/netfilter/nft_nat.sh
    +++ b/tools/testing/selftests/netfilter/nft_nat.sh
    @@ -374,6 +374,45 @@ EOF
    return $lret
    }

    +test_local_dnat_portonly()
    +{
    + local family=$1
    + local daddr=$2
    + local lret=0
    + local sr_s
    + local sr_r
    +
    +ip netns exec "$ns0" nft -f /dev/stdin <<EOF
    +table $family nat {
    + chain output {
    + type nat hook output priority 0; policy accept;
    + meta l4proto tcp dnat to :2000
    +
    + }
    +}
    +EOF
    + if [ $? -ne 0 ]; then
    + if [ $family = "inet" ];then
    + echo "SKIP: inet port test"
    + test_inet_nat=false
    + return
    + fi
    + echo "SKIP: Could not add $family dnat hook"
    + return
    + fi
    +
    + echo SERVER-$family | ip netns exec "$ns1" timeout 5 socat -u STDIN TCP-LISTEN:2000 &
    + sc_s=$!
    +
    + result=$(ip netns exec "$ns0" timeout 1 socat TCP:$daddr:2000 STDOUT)
    +
    + if [ "$result" = "SERVER-inet" ];then
    + echo "PASS: inet port rewrite without l3 address"
    + else
    + echo "ERROR: inet port rewrite"
    + ret=1
    + fi
    +}

    test_masquerade6()
    {
    @@ -1135,6 +1174,10 @@ fi
    reset_counters
    test_local_dnat ip
    test_local_dnat6 ip6
    +
    +reset_counters
    +test_local_dnat_portonly inet 10.0.1.99
    +
    reset_counters
    $test_inet_nat && test_local_dnat inet
    $test_inet_nat && test_local_dnat6 inet
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-13 15:12    [W:3.369 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site