Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f768e5bd authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: add helper for adding nat extension 



Reduce copy-past a bit by adding a common helper.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 683399ed

include/net/netfilter/nf_nat.h

+2 −0
Original line number Diff line number Diff line
@@ -48,6 +48,8 @@ unsigned int nf_nat_setup_info(struct nf_conn *ct, 
extern unsigned int nf_nat_alloc_null_binding(struct nf_conn *ct,

					      unsigned int hooknum);



struct nf_conn_nat *nf_ct_nat_ext_add(struct nf_conn *ct);



/* Is this tuple already taken? (not by us)*/

int nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,

		      const struct nf_conn *ignored_conntrack);

net/ipv4/netfilter/iptable_nat.c

+3 −11
Original line number Diff line number Diff line
@@ -91,17 +91,9 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops, 
	if (nf_ct_is_untracked(ct))

		return NF_ACCEPT;



	nat = nfct_nat(ct);

	if (!nat) {

		/* NAT module was loaded late. */

		if (nf_ct_is_confirmed(ct))

	nat = nf_ct_nat_ext_add(ct);

	if (nat == NULL)

		return NF_ACCEPT;

		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);

		if (nat == NULL) {

			pr_debug("failed to add NAT extension\n");

			return NF_ACCEPT;

		}

	}



	switch (ctinfo) {

	case IP_CT_RELATED:

net/ipv4/netfilter/nft_chain_nat_ipv4.c

+3 −9
Original line number Diff line number Diff line
@@ -48,15 +48,9 @@ static unsigned int nf_nat_fn(const struct nf_hook_ops *ops, 


	NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)));



	nat = nfct_nat(ct);

	if (nat == NULL) {

		/* Conntrack module was loaded late, can't add extension. */

		if (nf_ct_is_confirmed(ct))

			return NF_ACCEPT;

		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);

	nat = nf_ct_nat_ext_add(ct);

	if (nat == NULL)

		return NF_ACCEPT;

	}



	switch (ctinfo) {

	case IP_CT_RELATED:

net/ipv6/netfilter/ip6table_nat.c

+3 −11
Original line number Diff line number Diff line
@@ -90,17 +90,9 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops, 
	if (nf_ct_is_untracked(ct))

		return NF_ACCEPT;



	nat = nfct_nat(ct);

	if (!nat) {

		/* NAT module was loaded late. */

		if (nf_ct_is_confirmed(ct))

	nat = nf_ct_nat_ext_add(ct);

	if (nat == NULL)

		return NF_ACCEPT;

		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);

		if (nat == NULL) {

			pr_debug("failed to add NAT extension\n");

			return NF_ACCEPT;

		}

	}



	switch (ctinfo) {

	case IP_CT_RELATED:

net/ipv6/netfilter/nft_chain_nat_ipv6.c

+3 −9
Original line number Diff line number Diff line
@@ -47,15 +47,9 @@ static unsigned int nf_nat_ipv6_fn(const struct nf_hook_ops *ops, 
	if (ct == NULL || nf_ct_is_untracked(ct))

		return NF_ACCEPT;



	nat = nfct_nat(ct);

	if (nat == NULL) {

		/* Conntrack module was loaded late, can't add extension. */

		if (nf_ct_is_confirmed(ct))

			return NF_ACCEPT;

		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);

	nat = nf_ct_nat_ext_add(ct);

	if (nat == NULL)

		return NF_ACCEPT;

	}



	switch (ctinfo) {

	case IP_CT_RELATED: