24 Apr, 2018

1 commit

• 2eb0f624b   netfilter: add NAT support for shifted portmap ranges ... Browse Code »

  This is a patch proposal to support shifted ranges in portmaps. (i.e. tcp/udp
  incoming port 5000-5100 on WAN redirected to LAN 192.168.1.5:2000-2100)

  Currently DNAT only works for single port or identical port ranges. (i.e.
  ports 5000-5100 on WAN interface redirected to a LAN host while original
  destination port is not altered) When different port ranges are configured,
  either 'random' mode should be used, or else all incoming connections are
  mapped onto the first port in the redirect range. (in described example
  WAN:5000-5100 will all be mapped to 192.168.1.5:2000)

  This patch introduces a new mode indicated by flag NF_NAT_RANGE_PROTO_OFFSET
  which uses a base port value to calculate an offset with the destination port
  present in the incoming stream. That offset is then applied as index within the
  redirect port range (index modulo rangewidth to handle range overflow).

  In described example the base port would be 5000. An incoming stream with
  destination port 5004 would result in an offset value 4 which means that the
  NAT'ed stream will be using destination port 2004.

  Other possibilities include deterministic mapping of larger or multiple ranges
  to a smaller range : WAN:5000-5999 -> LAN:5000-5099 (maps WAN port 5*xx to port
  51xx)

  This patch does not change any current behavior. It just adds new NAT proto
  range functionality which must be selected via the specific flag when intended
  to use.

  A patch for iptables (libipt_DNAT.c + libip6t_DNAT.c) will also be proposed
  which makes this functionality immediately available.

  Signed-off-by: Thierry Du Tre
  Signed-off-by: Pablo Neira Ayuso

  Thierry Du Tre

  2018-04-24 16:29:12 +0800  

05 Dec, 2016

1 commit

• 0c4e966ea   netfilter: built-in NAT support for DCCP ... Browse Code »

  CONFIG_NF_NAT_PROTO_DCCP is no more a tristate. When set to y, NAT
  support for DCCP protocol is built-in into nf_nat.ko.

  footprint test:

  (nf_nat_proto_) | dccp || nf_nat
  --------------------------+--------++--------
  no builtin | 409800 || 2241312
  DCCP builtin | - || 2578968

  Signed-off-by: Davide Caratti
  Signed-off-by: Pablo Neira Ayuso

  Davide Caratti

  2016-12-05 03:45:30 +0800  

18 Aug, 2015

1 commit

• 4b048d6d9   net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool ... Browse Code »

  inet_proto_csum_replace4,2,16 take a pseudohdr argument which indicates
  the checksum field carries a pseudo header. This argument should be a
  boolean instead of an int.

  Signed-off-by: Tom Herbert
  Signed-off-by: David S. Miller

  Tom Herbert

  2015-08-18 12:33:06 +0800  

30 Jun, 2014

1 commit

• 24de3d377   netfilter: use IS_ENABLED() macro ... Browse Code »

  replace:
  #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
  with
  #if IS_ENABLED(CONFIG_NF_CT_NETLINK)

  replace:
  #if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
  with
  #if !IS_ENABLED(CONFIG_NF_NAT)

  replace:
  #if !defined(CONFIG_NF_CONNTRACK) && !defined(CONFIG_NF_CONNTRACK_MODULE)
  with
  #if !IS_ENABLED(CONFIG_NF_CONNTRACK)

  And add missing:
  IS_ENABLED(CONFIG_NF_CT_NETLINK)

  in net/ipv{4,6}/netfilter/nf_nat_l3proto_ipv{4,6}.c

  Signed-off-by: Duan Jiong
  Signed-off-by: Pablo Neira Ayuso

  Duan Jiong

  2014-06-30 17:38:03 +0800  

30 Aug, 2012

1 commit

• c7232c997   netfilter: add protocol independent NAT core ... Browse Code »

  86

  Convert the IPv4 NAT implementation to a protocol independent core and
  address family specific modules.

  Signed-off-by: Patrick McHardy

  Patrick McHardy

  2012-08-30 09:00:14 +0800