path: root/include
diff options
authorFlorian Westphal <>2020-02-24 01:03:23 +0100
committerPablo Neira Ayuso <>2020-02-24 10:58:04 +0100
commit99bd13bbe8b53556e333c572a53dde1bc0265b0d (patch)
tree8b21ef93cc27f4c3ff725764cc136989ac653fe8 /include
parent222441d31dc4d75e9168948b3547a0babe8d865d (diff)
src: allow nat maps containing both ip(6) address and port
nft will now be able to handle map destinations { type ipv4_addr . inet_service : ipv4_addr . inet_service } chain f { dnat to ip daddr . tcp dport map @destinations } Something like this won't work though: meta l4proto tcp dnat ip6 to numgen inc mod 4 map { 0 : dead::f001 . 8080, .. as we lack the type info to properly dissect "dead::f001" as an ipv6 address. For the named map case, this info is available in the map definition, but for the anon case we'd need to resort to guesswork. Support is added by peeking into the map definition when evaluating a nat statement with a map. Right now, when a map is provided as address, we will only check that the mapped-to data type matches the expected size (of an ipv4 or ipv6 address). After this patch, if the mapped-to type is a concatenation, it will take a peek at the individual concat expressions. If its a combination of address and service, nft will translate this so that the kernel nat expression looks at the returned register that would store the inet_service part of the octet soup returned from the lookup expression. Signed-off-by: Florian Westphal <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'include')
1 files changed, 1 insertions, 0 deletions
diff --git a/include/statement.h b/include/statement.h
index 585908de..8fb459ca 100644
--- a/include/statement.h
+++ b/include/statement.h
@@ -125,6 +125,7 @@ struct nat_stmt {
struct expr *proto;
uint32_t flags;
uint8_t family;
+ bool ipportmap;
extern struct stmt *nat_stmt_alloc(const struct location *loc,