Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0c4e966e authored by Davide Caratti's avatar Davide Caratti Committed by Pablo Neira Ayuso
Browse files

netfilter: built-in NAT support for DCCP 



CONFIG_NF_NAT_PROTO_DCCP is no more a tristate. When set to y, NAT
support for DCCP protocol is built-in into nf_nat.ko.

footprint test:

(nf_nat_proto_)           | dccp   || nf_nat
--------------------------+--------++--------
no builtin                | 409800 || 2241312
DCCP builtin              |   -    || 2578968

Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent cd727514

include/net/netfilter/nf_nat_l4proto.h

+3 −0
Original line number Original line Diff line number Diff line
@@ -54,6 +54,9 @@ extern const struct nf_nat_l4proto nf_nat_l4proto_udp; 
extern const struct nf_nat_l4proto nf_nat_l4proto_icmp;

extern const struct nf_nat_l4proto nf_nat_l4proto_icmp;

extern const struct nf_nat_l4proto nf_nat_l4proto_icmpv6;

extern const struct nf_nat_l4proto nf_nat_l4proto_icmpv6;

extern const struct nf_nat_l4proto nf_nat_l4proto_unknown;

extern const struct nf_nat_l4proto nf_nat_l4proto_unknown;

#ifdef CONFIG_NF_NAT_PROTO_DCCP

extern const struct nf_nat_l4proto nf_nat_l4proto_dccp;

#endif





bool nf_nat_l4proto_in_range(const struct nf_conntrack_tuple *tuple,

bool nf_nat_l4proto_in_range(const struct nf_conntrack_tuple *tuple,

			     enum nf_nat_manip_type maniptype,

			     enum nf_nat_manip_type maniptype,

net/netfilter/Kconfig

+1 −1
Original line number Original line Diff line number Diff line
@@ -384,7 +384,7 @@ config NF_NAT_NEEDED 
	default y

	default y





config NF_NAT_PROTO_DCCP

config NF_NAT_PROTO_DCCP

	tristate

	bool

	depends on NF_NAT && NF_CT_PROTO_DCCP

	depends on NF_NAT && NF_CT_PROTO_DCCP

	default NF_NAT && NF_CT_PROTO_DCCP

	default NF_NAT && NF_CT_PROTO_DCCP

net/netfilter/Makefile

+2 −1
Original line number Original line Diff line number Diff line
@@ -45,6 +45,8 @@ obj-$(CONFIG_NF_CONNTRACK_TFTP) += nf_conntrack_tftp.o 
nf_nat-y	:= nf_nat_core.o nf_nat_proto_unknown.o nf_nat_proto_common.o \

nf_nat-y	:= nf_nat_core.o nf_nat_proto_unknown.o nf_nat_proto_common.o \

		   nf_nat_proto_udp.o nf_nat_proto_tcp.o nf_nat_helper.o

		   nf_nat_proto_udp.o nf_nat_proto_tcp.o nf_nat_helper.o





nf_nat-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o



# generic transport layer logging

# generic transport layer logging

obj-$(CONFIG_NF_LOG_COMMON) += nf_log_common.o

obj-$(CONFIG_NF_LOG_COMMON) += nf_log_common.o
@@ -55,7 +57,6 @@ obj-$(CONFIG_NF_NAT) += nf_nat.o 
obj-$(CONFIG_NF_NAT_REDIRECT) += nf_nat_redirect.o

obj-$(CONFIG_NF_NAT_REDIRECT) += nf_nat_redirect.o





# NAT protocols (nf_nat)

# NAT protocols (nf_nat)

obj-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o

obj-$(CONFIG_NF_NAT_PROTO_UDPLITE) += nf_nat_proto_udplite.o

obj-$(CONFIG_NF_NAT_PROTO_UDPLITE) += nf_nat_proto_udplite.o

obj-$(CONFIG_NF_NAT_PROTO_SCTP) += nf_nat_proto_sctp.o

obj-$(CONFIG_NF_NAT_PROTO_SCTP) += nf_nat_proto_sctp.o

net/netfilter/nf_nat_core.c

+4 −0
Original line number Original line Diff line number Diff line
@@ -682,6 +682,10 @@ int nf_nat_l3proto_register(const struct nf_nat_l3proto *l3proto) 
			 &nf_nat_l4proto_tcp);

			 &nf_nat_l4proto_tcp);

	RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_UDP],

	RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_UDP],

			 &nf_nat_l4proto_udp);

			 &nf_nat_l4proto_udp);

#ifdef CONFIG_NF_NAT_PROTO_DCCP

	RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_DCCP],

			 &nf_nat_l4proto_dccp);

#endif

	mutex_unlock(&nf_nat_proto_mutex);

	mutex_unlock(&nf_nat_proto_mutex);





	RCU_INIT_POINTER(nf_nat_l3protos[l3proto->l3proto], l3proto);

	RCU_INIT_POINTER(nf_nat_l3protos[l3proto->l3proto], l3proto);

net/netfilter/nf_nat_proto_dccp.c

+1 −35
Original line number Original line Diff line number Diff line
@@ -10,8 +10,6 @@ 
 */

 */





#include <linux/kernel.h>

#include <linux/kernel.h>

#include <linux/module.h>

#include <linux/init.h>

#include <linux/skbuff.h>

#include <linux/skbuff.h>

#include <linux/dccp.h>

#include <linux/dccp.h>
@@ -73,7 +71,7 @@ dccp_manip_pkt(struct sk_buff *skb, 
	return true;

	return true;

}

}





static const struct nf_nat_l4proto nf_nat_l4proto_dccp = {

const struct nf_nat_l4proto nf_nat_l4proto_dccp = {

	.l4proto		= IPPROTO_DCCP,

	.l4proto		= IPPROTO_DCCP,

	.manip_pkt		= dccp_manip_pkt,

	.manip_pkt		= dccp_manip_pkt,

	.in_range		= nf_nat_l4proto_in_range,

	.in_range		= nf_nat_l4proto_in_range,
@@ -82,35 +80,3 @@ static const struct nf_nat_l4proto nf_nat_l4proto_dccp = { 
	.nlattr_to_range	= nf_nat_l4proto_nlattr_to_range,

	.nlattr_to_range	= nf_nat_l4proto_nlattr_to_range,

#endif

#endif

};
 
};
 


static int __init nf_nat_proto_dccp_init(void)

{

	int err;



	err = nf_nat_l4proto_register(NFPROTO_IPV4, &nf_nat_l4proto_dccp);

	if (err < 0)

		goto err1;

	err = nf_nat_l4proto_register(NFPROTO_IPV6, &nf_nat_l4proto_dccp);

	if (err < 0)

		goto err2;

	return 0;



err2:

	nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_dccp);

err1:

	return err;

}



static void __exit nf_nat_proto_dccp_fini(void)

{

	nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_dccp);

	nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_dccp);



}



module_init(nf_nat_proto_dccp_init);

module_exit(nf_nat_proto_dccp_fini);



MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");

MODULE_DESCRIPTION("DCCP NAT protocol helper");

MODULE_LICENSE("GPL");