From fbe27464dee4588d90649274925145421c84b449 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Sat, 2 Feb 2019 00:36:51 +0100 Subject: src: add nat support for the inet family consider a simple ip6 nat table: table ip6 nat { chain output { type nat hook output priority 0; policy accept; dnat to dead:2::99 } Now consider same ruleset, but using 'table inet nat': nft now lacks context to determine address family to parse 'to $address'. This adds code to make the following work: table inet nat { [ .. ] # detect af from network protocol context: ip6 daddr dead::2::1 dnat to dead:2::99 # use new dnat ip6 keyword: dnat ip6 to dead:2::99 } On list side, the keyword is only shown in the inet family, else the short version (dnat to ...) is used as the family is redundant when the table already mandates the ip protocol version supported. Address mismatches such as table ip6 { .. dnat ip to 1.2.3.4 are detected/handled during the evaluation phase. Signed-off-by: Florian Westphal Acked-by: Pablo Neira Ayuso --- src/statement.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'src/statement.c') diff --git a/src/statement.c b/src/statement.c index 9b45b3c5..b2370f87 100644 --- a/src/statement.c +++ b/src/statement.c @@ -586,8 +586,18 @@ const char *nat_etype2str(enum nft_nat_etypes type) static void nat_stmt_print(const struct stmt *stmt, struct output_ctx *octx) { nft_print(octx, "%s", nat_etype2str(stmt->nat.type)); - if (stmt->nat.addr || stmt->nat.proto) + if (stmt->nat.addr || stmt->nat.proto) { + switch (stmt->nat.family) { + case NFPROTO_IPV4: + nft_print(octx, " ip"); + break; + case NFPROTO_IPV6: + nft_print(octx, " ip6"); + break; + } + nft_print(octx, " to"); + } if (stmt->nat.addr) { nft_print(octx, " "); -- cgit v1.2.3