Skip to content
  1. Mar 23, 2023
    • Madhu Koriginja's avatar
      netfilter: keep conntrack reference until IPsecv6 policy checks are done · b0e214d2
      Madhu Koriginja authored 
      Keep the conntrack reference until policy checks have been performed for
IPsec V6 NAT support, just like ipv4.

The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.

Fixes: 58a317f1

 ("netfilter: ipv6: add IPv6 NAT support")
Signed-off-by: default avatarMadhu Koriginja <madhu.koriginja@nxp.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      b0e214d2
    • Florian Westphal's avatar
      xtables: move icmp/icmpv6 logic to xt_tcpudp · 36ce9982
      Florian Westphal authored 
      

icmp/icmp6 matches are baked into ip(6)_tables.ko.

This means that even if iptables-nft is used, a rule like
"-p icmp --icmp-type 1" will load the ip(6)tables modules.

Move them to xt_tcpdudp.ko instead to avoid this.

This will also allow to eventually add kconfig knobs to build kernels
that support iptables-nft but not iptables-legacy (old set/getsockopt
interface).

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      36ce9982
    • Florian Westphal's avatar
      netfilter: xtables: disable 32bit compat interface by default · bde7170a
      Florian Westphal authored 
      

This defaulted to 'y' because before this knob existed the 32bit
compat layer was always compiled in if CONFIG_COMPAT was set.

32bit iptables on 64bit kernel isn't common anymore, so remove
the default-y now.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      bde7170a
    • Jeremy Sowden's avatar
      netfilter: nft_masq: deduplicate eval call-backs · f6ca5d5e
      Jeremy Sowden authored 
      

nft_masq has separate ipv4 and ipv6 call-backs which share much of their
code, and an inet one switch containing a switch that calls one of the
others based on the family of the packet.  Merge the ipv4 and ipv6 ones
into the inet one in order to get rid of the duplicate code.

Const-qualify the `priv` pointer since we don't need to write through it.

Signed-off-by: default avatarJeremy Sowden <jeremy@azazel.net>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      f6ca5d5e
    • Jeremy Sowden's avatar
      netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate eval call-backs · 6f56ad1b
      Jeremy Sowden authored 
      

`nf_nat_redirect_ipv4` takes a `struct nf_nat_ipv4_multi_range_compat`,
but converts it internally to a `struct nf_nat_range2`.  Change the
function to take the latter, factor out the code now shared with
`nf_nat_redirect_ipv6`, move the conversion to the xt_REDIRECT module,
and update the ipv4 range initialization in the nft_redir module.

Replace a bare hex constant for 127.0.0.1 with a macro.

Remove `WARN_ON`.  `nf_nat_setup_info` calls `nf_ct_is_confirmed`:

	/* Can't setup nat info for confirmed ct. */
	if (nf_ct_is_confirmed(ct))
		return NF_ACCEPT;

This means that `ct` cannot be null or the kernel will crash, and
implies that `ctinfo` is `IP_CT_NEW` or `IP_CT_RELATED`.

nft_redir has separate ipv4 and ipv6 call-backs which share much of
their code, and an inet one switch containing a switch that calls one of
the others based on the family of the packet.  Merge the ipv4 and ipv6
ones into the inet one in order to get rid of the duplicate code.

Const-qualify the `priv` pointer since we don't need to write through
it.

Assign `priv->flags` to the range instead of OR-ing it in.

Set the `NF_NAT_RANGE_PROTO_SPECIFIED` flag once during init, rather
than on every eval.

Signed-off-by: default avatarJeremy Sowden <jeremy@azazel.net>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      6f56ad1b
  3. Mar 22, 2023
  5. Mar 21, 2023
  7. Mar 20, 2023