Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 96058728 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nat: remove module dependency on ipv6 core 



nf_nat_ipv6 calls two ipv6 core functions, so add those to v6ops to avoid
the module dependency.

This is a prerequisite for merging ipv4 and ipv6 nat implementations.

Add wrappers to avoid the indirection if ipv6 is builtin.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent a46c52d9

include/linux/netfilter_ipv6.h

+6 −0
Original line number Diff line number Diff line
@@ -33,6 +33,12 @@ struct nf_ipv6_ops { 
	int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,

		     bool strict);

	int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry);

#if IS_MODULE(CONFIG_IPV6)

	int (*route_me_harder)(struct net *net, struct sk_buff *skb);

	int (*dev_get_saddr)(struct net *net, const struct net_device *dev,

		       const struct in6_addr *daddr, unsigned int srcprefs,

		       struct in6_addr *saddr);

#endif

};



#ifdef CONFIG_NETFILTER

net/ipv6/netfilter.c

+4 −0
Original line number Diff line number Diff line
@@ -112,6 +112,10 @@ static const struct nf_ipv6_ops ipv6ops = { 
	.fragment		= ip6_fragment,

	.route			= nf_ip6_route,

	.reroute		= nf_ip6_reroute,

#if IS_MODULE(CONFIG_IPV6)

	.route_me_harder	= ip6_route_me_harder,

	.dev_get_saddr		= ipv6_dev_get_saddr,

#endif

};



int __init ipv6_netfilter_init(void)

net/ipv6/netfilter/nf_nat_l3proto_ipv6.c

+16 −1
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 
#include <net/checksum.h>

#include <net/ip6_checksum.h>

#include <net/ip6_route.h>

#include <net/xfrm.h>

#include <net/ipv6.h>



#include <net/netfilter/nf_conntrack_core.h>
@@ -317,6 +318,20 @@ nf_nat_ipv6_out(void *priv, struct sk_buff *skb, 
	return ret;

}



static int nat_route_me_harder(struct net *net, struct sk_buff *skb)

{

#ifdef CONFIG_IPV6_MODULE

	const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();



	if (!v6_ops)

		return -EHOSTUNREACH;



	return v6_ops->route_me_harder(net, skb);

#else

	return ip6_route_me_harder(net, skb);

#endif

}



static unsigned int

nf_nat_ipv6_local_fn(void *priv, struct sk_buff *skb,

		     const struct nf_hook_state *state)
@@ -333,7 +348,7 @@ nf_nat_ipv6_local_fn(void *priv, struct sk_buff *skb, 


		if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3,

				      &ct->tuplehash[!dir].tuple.src.u3)) {

			err = ip6_route_me_harder(state->net, skb);

			err = nat_route_me_harder(state->net, skb);

			if (err < 0)

				ret = NF_DROP_ERR(err);

		}

net/ipv6/netfilter/nf_nat_masquerade_ipv6.c

+19 −2
Original line number Diff line number Diff line
@@ -24,6 +24,23 @@ 


static atomic_t v6_worker_count;



static int

nat_ipv6_dev_get_saddr(struct net *net, const struct net_device *dev,

		       const struct in6_addr *daddr, unsigned int srcprefs,

		       struct in6_addr *saddr)

{

#ifdef CONFIG_IPV6_MODULE

	const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();



	if (!v6_ops)

		return -EHOSTUNREACH;



	return v6_ops->dev_get_saddr(net, dev, daddr, srcprefs, saddr);

#else

	return ipv6_dev_get_saddr(net, dev, daddr, srcprefs, saddr);

#endif

}



unsigned int

nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,

		       const struct net_device *out)
@@ -38,7 +55,7 @@ nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range, 
	WARN_ON(!(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||

			 ctinfo == IP_CT_RELATED_REPLY)));



	if (ipv6_dev_get_saddr(nf_ct_net(ct), out,

	if (nat_ipv6_dev_get_saddr(nf_ct_net(ct), out,

				   &ipv6_hdr(skb)->daddr, 0, &src) < 0)

		return NF_DROP;