Skip to contentSkip to conversation

Add support for masq port selection

PATCH Superseded Shivani Bhardwaj 2 participants 2 messages Jan 22, 2016 netfilter

v2 of 3 Superseded Latest is v3 →

lore
Share & tools
lore

Shivani Bhardwaj

author
#0 lore raw

PATCH v2 1/1 Add support for masq port selection

Complete masquerading support by allowing port range selection.

Signed-off-by Shivani Bhardwaj <[email protected]>

---
Changes in v2:
Add test file and keep switch cases in incremental order

 include/libnftnl/expr.h             |  4 ++-
 include/linux/netfilter/nf_tables.h |  2 ++
 src/expr/masq.c                     | 60 +++++++++++++++++++++++++++++++++++--
 tests/nft-expr_masq-test.c          |  8 +++++
 4 files changed, 71 insertions(+), 3 deletions(-)
include/libnftnl/expr.h +3 -1
index 4a37581..13c2ff5 100644
@@ -166,7 +166,9 @@ enum {
 };
 
 enum {
-	NFTNL_EXPR_MASQ_FLAGS	= NFTNL_EXPR_BASE,
+	NFTNL_EXPR_MASQ_FLAGS		= NFTNL_EXPR_BASE,
+	NFTNL_EXPR_MASQ_REG_PROTO_MIN,
+	NFTNL_EXPR_MASQ_REG_PROTO_MAX,
 };
 
 enum {
include/linux/netfilter/nf_tables.h +2 -0
index 9796d82..c17615a 100644
@@ -924,6 +924,8 @@ enum nft_nat_attributes {
 enum nft_masq_attributes {
 	NFTA_MASQ_UNSPEC,
 	NFTA_MASQ_FLAGS,
+	NFTA_MASQ_REG_PROTO_MIN,
+	NFTA_MASQ_REG_PROTO_MAX,
 	__NFTA_MASQ_MAX
 };
 #define NFTA_MASQ_MAX		(__NFTA_MASQ_MAX - 1)
src/expr/masq.c +58 -2

128 lines not on this page · raw message

tests/nft-expr_masq-test.c +8 -0
index 51d4dc7..9945316 100644
@@ -31,6 +31,12 @@ static void cmp_nftnl_expr(struct nftnl_expr *rule_a,
 	if (nftnl_expr_get_u32(rule_a, NFTNL_EXPR_MASQ_FLAGS) !=
 	    nftnl_expr_get_u32(rule_b, NFTNL_EXPR_MASQ_FLAGS))
 		print_err("Expr NFTNL_EXPR_MASQ_FLAGS mismatches");
+	if (nftnl_expr_get_u32(rule_a, NFTNL_EXPR_MASQ_REG_PROTO_MIN) !=
+	    nftnl_expr_get_u32(rule_b, NFTNL_EXPR_MASQ_REG_PROTO_MIN))
+		print_err("Expr NFTNL_EXPR_MASQ_REG_PROTO_MIN mismatches");
+	if (nftnl_expr_get_u32(rule_a, NFTNL_EXPR_MASQ_REG_PROTO_MAX) !=
+	    nftnl_expr_get_u32(rule_b, NFTNL_EXPR_MASQ_REG_PROTO_MAX))
+		print_err("Expr NFTNL_EXPR_MASQ_REG_PROTO_MAX mismatches");
 }
 
 int main(int argc, char *argv[])

@@ -51,6 +57,8 @@ int main(int argc, char *argv[])
 		print_err("OOM");
 
 	nftnl_expr_set_u32(ex, NFTNL_EXPR_MASQ_FLAGS, 0x1234568);
+	nftnl_expr_set_u32(ex, NFTNL_EXPR_MASQ_REG_PROTO_MIN, 0x1234568);
+	nftnl_expr_set_u32(ex, NFTNL_EXPR_MASQ_REG_PROTO_MAX, 0x1234568);
 
 	nftnl_rule_add_expr(a, ex);
Signature · 1 line
1.9.1
maintainer
#1 lore raw

Shivani, this looks good, only one comment below.

tests/nft-expr_masq-test.c int main(int argc, char *argv[]) · line 61

Quoted 6 lines · Shivani Bhardwaj
tests/nft-expr_masq-test.c +2 -0
@@ -51,6 +57,8 @@ int main(int argc, char *argv[])
 		print_err("OOM");
 
 	nftnl_expr_set_u32(ex, NFTNL_EXPR_MASQ_FLAGS, 0x1234568);
+	nftnl_expr_set_u32(ex, NFTNL_EXPR_MASQ_REG_PROTO_MIN, 0x1234568);
+	nftnl_expr_set_u32(ex, NFTNL_EXPR_MASQ_REG_PROTO_MAX, 0x1234568);

I think the tests are more effective if you set different values, ie.

        nftnl_expr_set_u32(ex, NFTNL_EXPR_MASQ_FLAGS, 0x12345678);
        nftnl_expr_set_u32(ex, NFTNL_EXPR_MASQ_REG_PROTO_MIN, 0x45671234);
        nftnl_expr_set_u32(ex, NFTNL_EXPR_MASQ_REG_PROTO_MAX, 0x87654321);

Beware that my kernel patch is only compile tested.

And please follow up with the nftables patch, let me know if you have questions with it.

Thanks.