Skip to content

netfilter: autoload NAT support for non-builtin L4 protocols

Davide Caratti netfilter-devel 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest2 patches 9 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/2netfilter: persistent aliases for l4 nat protocolsinclude/net/netfilter/nf_nat_l4proto.h net/netfilter/nf_nat_proto_dccp.c net/netfilter/nf_nat_proto_sctp.c +1 more+6 -00 replies
2/2xt_nat: probe module for non-builtin L4 protocolsnet/netfilter/xt_nat.c+47 -00 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH nf-next 0/2] netfilter: autoload NAT support for non-builtin L4 protocols

this series fixes SNAT/DNAT rules where port number translation is explicitly configured, but only the L3 address is translated:

# iptables -t nat -A POSTROUTING -o eth1 -p stcp -j SNAT --to-source 10.0.0.1:61000
# tcpdump -s46 -tni eth1 sctp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 46 bytes
IP 10.0.0.1.37788 > 10.0.0.2.2000: sctp
            ^^^^^
IP 10.0.0.2.2000 > 10.0.0.1.37788: sctp
IP 10.0.0.1.37788 > 10.0.0.2.2000: sctp
IP 10.0.0.2.2000 > 10.0.0.1.37788: sctp
IP 10.0.0.2.2000 > 10.0.0.1.37788: sctp
IP 10.0.0.1.37788 > 10.0.0.2.2000: sctp
IP 10.0.0.2.2000 > 10.0.0.1.37788: sctp

This happens for all protocols that don't have L4 NAT support built into nf_nat.ko, such as DCCP, SCTP and UDPLite: unless the user modprobes nf_nat_proto_{dccp,sctp,udplite}.ko, port translation as specified in the above rule will not be done.
The first patch provides persistent and generic aliases for the above modules; the second patch autoloads nf_nat_proto_{dccp,sctp,udplite} when a SNAT/DNAT rule matching one of the above protocols is created.

Davide Caratti (2):
netfilter: persistent aliases for l4 nat protocols
xt_nat: probe module for non-builtin L4 protocols

 include/net/netfilter/nf_nat_l4proto.h |  3 +++
 net/netfilter/nf_nat_proto_dccp.c      |  1 +
 net/netfilter/nf_nat_proto_sctp.c      |  1 +
 net/netfilter/nf_nat_proto_udplite.c   |  1 +
 net/netfilter/xt_nat.c                 | 47 ++++++++++++++++++++++++++++++++++
 5 files changed, 53 insertions(+)
Signature · 1 line
2.5.5