Use ct_extend for masquerade

PATCH New Rusty Russell 1 participant 1 message Dec 29, 2004

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Rusty Russell

author

2004-12-29 06:45 UTC #0 lore raw

PATCH 2/2 Use ct_extend for masquerade

Name: Use ct_extend for MASQUERADE
Status: Tested lightly under nfsim

Signed-off-by Rusty Russell <[email protected]>

The MASQUERADE target use to destroy connections when an interface went down. We changed this to merely remove the ASSURED bit, and destroy them if the same interface came up with a different IP address. Unfortunately, as Phil Oester pointed out, that code was crap for PPP connections, since we (1) compared ifa_address instead of ifa_local, (2) identified interfaces by ifindex, which increments as a PPP device downs and ups, and (3) caused all connections to be flushed when we added an IP address.

So that code was reverted after 2.6.10-rc2.

This code stores the interface name, rather than trying to use the ifindex, and only deletes connections if *no* ifa_local on the interface matches the connection, so simply adding a new IP address is a NOOP. We use the new ct_extend functions to avoid bloating the conntrack struct.

include/linux/netfilter_ipv4/ip_conntrack.h +3 -4

Index: linux-2.6.10-bk1-Netfilter/include/linux/netfilter_ipv4/ip_conntrack.h
===================================================================
@@ -201,14 +201,13 @@
 
 	union ip_conntrack_help help;
 
+	/* Use for masqueraded connections. */
+	struct ct_extend *ext;
+
 #ifdef CONFIG_IP_NF_NAT_NEEDED
 	struct {
 		struct ip_nat_info info;
 		union ip_conntrack_nat_help help;
-#if defined(CONFIG_IP_NF_TARGET_MASQUERADE) || \
-	defined(CONFIG_IP_NF_TARGET_MASQUERADE_MODULE)
-		int masq_index;
-#endif
 	} nat;
 #endif /* CONFIG_IP_NF_NAT_NEEDED */

net/ipv4/netfilter/ipt_MASQUERADE.c +68 ~~-43~~

175 lines not on this page · raw message

include/linux/netfilter_ipv4/ct_extend.h +1 -0

Index: linux-2.6.10-bk1-Netfilter/include/linux/netfilter_ipv4/ct_extend.h
===================================================================
@@ -4,6 +4,7 @@
 
 enum ct_ext_type
 {
+	CTE_MASQ,
 	CTE_MAX,
 } __attribute__((packed));

net/ipv4/netfilter/ip_conntrack_core.c +4 -0

Index: linux-2.6.10-bk1-Netfilter/net/ipv4/netfilter/ip_conntrack_core.c
===================================================================
@@ -47,6 +47,7 @@
 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
+#include <linux/netfilter_ipv4/ct_extend.h>
 #include <linux/netfilter_ipv4/listhelp.h>
 
 #define IP_CONNTRACK_VERSION	"2.1"

@@ -328,6 +329,9 @@
 	if (master)
 		ip_conntrack_put(master);
 
+	if (ct->ext)
+		ct_extend_free(ct->ext);
+
 	DEBUGP("destroy_conntrack: returning ct=%p to slab\n", ct);
 	kmem_cache_free(ip_conntrack_cachep, ct);
 	atomic_dec(&ip_conntrack_count);

Signature · 1 line

A bad analogy is like a leaky screwdriver -- Richard Braakman