github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netfilter: nft_ct: support expectation creation for natted flows

Browse Source 
This feature only works for connections originating from the host
and only if there no source address rewrite.

Add the needed nat glue to have the expectation follow the original
nat binding.

Signed-off-by: Florian Westphal <fw@strlen.de>
This commit is contained in:
Florian Westphal 2026-06-22 14:50:18 +02:00
parent 43ae85af15
commit d4beefc90a
1 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
net/netfilter/nft_ct.c
View File

@ -1297,6 +1297,17 @@ static int nft_ct_expect_obj_dump(struct sk_buff *skb,
return 0;
}
#if IS_ENABLED(CONFIG_NF_NAT)
static void nft_ct_nat_follow_master(struct nf_conn *ct, struct nf_conntrack_expect *this)
{
const struct nf_ct_helper_expectfn *expfn;
expfn = nf_ct_helper_expectfn_find_by_name("nat-follow-master");
if (expfn)
expfn->expectfn(ct, this);
}
#endif
static void nft_ct_expect_obj_eval(struct nft_object *obj,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
@ -1342,6 +1353,13 @@ static void nft_ct_expect_obj_eval(struct nft_object *obj,
priv->l4proto, NULL, &priv->dport);
exp->timeout += priv->timeout;
#if IS_ENABLED(CONFIG_NF_NAT)
if (ct->status & IPS_NAT_MASK) {
exp->saved_proto.tcp.port = priv->dport;
exp->dir = !dir;
exp->expectfn = nft_ct_nat_follow_master;
}
#endif
if (nf_ct_expect_related(exp, 0) != 0)
regs->verdict.code = NF_DROP;
@ -1375,6 +1393,13 @@ static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
.owner = THIS_MODULE,
};
#if IS_ENABLED(CONFIG_NF_NAT)
static struct nf_ct_helper_expectfn nft_ct_nat __read_mostly = {
.name = "nft_ct-follow-master",
.expectfn = nft_ct_nat_follow_master,
};
#endif
static int __init nft_ct_module_init(void)
{
int err;
@ -1400,6 +1425,9 @@ static int __init nft_ct_module_init(void)
err = nft_register_obj(&nft_ct_timeout_obj_type);
if (err < 0)
goto err4;
#endif
#if IS_ENABLED(CONFIG_NF_NAT)
nf_ct_helper_expectfn_register(&nft_ct_nat);
#endif
return 0;
@ -1425,6 +1453,13 @@ static void __exit nft_ct_module_exit(void)
nft_unregister_obj(&nft_ct_helper_obj_type);
nft_unregister_expr(&nft_notrack_type);
nft_unregister_expr(&nft_ct_type);
#if IS_ENABLED(CONFIG_NF_NAT)
nf_ct_helper_expectfn_unregister(&nft_ct_nat);
synchronize_rcu();
nf_ct_helper_expectfn_destroy(&nft_ct_nat);
synchronize_rcu();
#endif
}
module_init(nft_ct_module_init);