diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-03-18 19:51:20 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-03-19 10:59:17 +0100 |
| commit | 6c84577b0d23d1f3fdafb4d74fd5868e891cc6af (patch) | |
| tree | 387096b0c69876937815dd016c9208fc5996c272 | |
| parent | 1fe6089ddd87ee7869d24c0f8849951220cc9b85 (diff) | |
evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED)
Sergey reports:
With nf_tables it is not possible to use port range for masquerading.
Masquerade statement has option "to [:port-port]" which give no effect
to translation behavior. But it must change source port of packet to
one from ":port-port" range.
My network:
+-----------------------------+
| ROUTER |
| |
| Masquerade|
| 10.0.0.1 1.1.1.1 |
| +------+ +------+ |
| | eth1 | | eth2 | |
+-+--^---+-----------+---^--+-+
| |
| |
+----v------+ +------v----+
| | | |
| 10.0.0.2 | | 1.1.1.2 |
| | | |
|PC1 | |PC2 |
+-----------+ +-----------+
For testing i used rule like this:
rule ip nat POSTROUTING oifname eth2 masquerade to :666
Run netcat for 1.1.1.2 667(UDP) and get dump from PC2:
15:22:25.591567 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, ethertype IPv4 (0x0800), length 60: 1.1.1.1.34466 > 1.1.1.2.667: UDP, length 1
Address translation works fine, but source port are not belongs to
specified range.
I see in similar source code (i.e. nft_redir.c, nft_nat.c) that
there is setting NF_NAT_RANGE_PROTO_SPECIFIED flag. After adding this,
repeat test for kernel with this patch, and get dump:
16:16:22.324710 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, ethertype IPv4 (0x0800), length 60: 1.1.1.1.666 > 1.1.1.2.667: UDP, length 1
Now it is works fine.
Reported-by: Sergey Marinkevich <s@marinkevich.ru>
Tested-by: Sergey Marinkevich <s@marinkevich.ru>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | src/evaluate.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 4a23b231..d0e712dc 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -18,6 +18,7 @@ #include <linux/netfilter_arp.h> #include <linux/netfilter/nf_tables.h> #include <linux/netfilter/nf_synproxy.h> +#include <linux/netfilter/nf_nat.h> #include <linux/netfilter_ipv4.h> #include <netinet/ip_icmp.h> #include <netinet/icmp6.h> @@ -2950,6 +2951,8 @@ static int stmt_evaluate_nat(struct eval_ctx *ctx, struct stmt *stmt) err = nat_evaluate_transport(ctx, stmt, &stmt->nat.proto); if (err < 0) return err; + + stmt->nat.flags |= NF_NAT_RANGE_PROTO_SPECIFIED; } stmt->flags |= STMT_F_TERMINAL; |