Commit 282e5f8f authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: nat: really support inet nat without l3 address

When no l3 address is given, priv->family is set to NFPROTO_INET and
the evaluation function isn't called.

Call it too so l4-only rewrite can work.
Also add a test case for this.

Fixes: a33f387e ("netfilter: nft_nat: allow to specify layer 4 protocol NAT only")
Reported-by: default avatarYi Chen <yiche@redhat.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0a375c82
...@@ -335,7 +335,8 @@ static void nft_nat_inet_eval(const struct nft_expr *expr, ...@@ -335,7 +335,8 @@ static void nft_nat_inet_eval(const struct nft_expr *expr,
{ {
const struct nft_nat *priv = nft_expr_priv(expr); const struct nft_nat *priv = nft_expr_priv(expr);
if (priv->family == nft_pf(pkt)) if (priv->family == nft_pf(pkt) ||
priv->family == NFPROTO_INET)
nft_nat_eval(expr, regs, pkt); nft_nat_eval(expr, regs, pkt);
} }
......
...@@ -374,6 +374,45 @@ EOF ...@@ -374,6 +374,45 @@ EOF
return $lret return $lret
} }
test_local_dnat_portonly()
{
local family=$1
local daddr=$2
local lret=0
local sr_s
local sr_r
ip netns exec "$ns0" nft -f /dev/stdin <<EOF
table $family nat {
chain output {
type nat hook output priority 0; policy accept;
meta l4proto tcp dnat to :2000
}
}
EOF
if [ $? -ne 0 ]; then
if [ $family = "inet" ];then
echo "SKIP: inet port test"
test_inet_nat=false
return
fi
echo "SKIP: Could not add $family dnat hook"
return
fi
echo SERVER-$family | ip netns exec "$ns1" timeout 5 socat -u STDIN TCP-LISTEN:2000 &
sc_s=$!
result=$(ip netns exec "$ns0" timeout 1 socat TCP:$daddr:2000 STDOUT)
if [ "$result" = "SERVER-inet" ];then
echo "PASS: inet port rewrite without l3 address"
else
echo "ERROR: inet port rewrite"
ret=1
fi
}
test_masquerade6() test_masquerade6()
{ {
...@@ -1148,6 +1187,10 @@ fi ...@@ -1148,6 +1187,10 @@ fi
reset_counters reset_counters
test_local_dnat ip test_local_dnat ip
test_local_dnat6 ip6 test_local_dnat6 ip6
reset_counters
test_local_dnat_portonly inet 10.0.1.99
reset_counters reset_counters
$test_inet_nat && test_local_dnat inet $test_inet_nat && test_local_dnat inet
$test_inet_nat && test_local_dnat6 inet $test_inet_nat && test_local_dnat6 inet
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment