diff options
| author | Arturo Borrero <arturo.borrero.glez@gmail.com> | 2016-05-18 19:05:12 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-05-20 11:36:45 +0200 |
| commit | 367ebb13c9a21d59633d307fafc12337b46888eb (patch) | |
| tree | 81a0d59dc1ef038b68b22b55274dbb86a41c8382 /src/build.c | |
| parent | 5b76aa21481d5895cd8e301dc554c42f02c1374a (diff) | |
conntrackd: add support for NTA_(S|D)NAT_IPV6
So we can properly sync NATed IPv6 connections.
Thanks to Florian Westphal for originally ponting me to this lack of
support in conntrackd, which saved me a lot of time.
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/build.c')
| -rw-r--r-- | src/build.c | 33 |
1 files changed, 28 insertions, 5 deletions
diff --git a/src/build.c b/src/build.c index 9ba8b57..5403300 100644 --- a/src/build.c +++ b/src/build.c @@ -66,9 +66,16 @@ ct_build_u32(const struct nf_conntrack *ct, int a, struct nethdr *n, int b) } static inline void -ct_build_str(const struct nf_conntrack *ct, int a, struct nethdr *n, int b) +ct_build_u128(const struct nf_conntrack *ct, int a, struct nethdr *n, int b) { const char *data = nfct_get_attr(ct, a); + addattr(n, b, data, sizeof(uint32_t) * 4); +} + +static inline void +ct_build_str(const struct nf_conntrack *ct, int a, struct nethdr *n, int b) +{ + const void *data = nfct_get_attr(ct, a); addattr(n, b, data, strlen(data)+1); } @@ -258,10 +265,26 @@ void ct2msg(const struct nf_conntrack *ct, struct nethdr *n) } /* NAT */ - if (nfct_getobjopt(ct, NFCT_GOPT_IS_SNAT)) - ct_build_u32(ct, ATTR_REPL_IPV4_DST, n, NTA_SNAT_IPV4); - if (nfct_getobjopt(ct, NFCT_GOPT_IS_DNAT)) - ct_build_u32(ct, ATTR_REPL_IPV4_SRC, n, NTA_DNAT_IPV4); + switch (nfct_get_attr_u8(ct, ATTR_ORIG_L3PROTO)) { + case AF_INET: + if (nfct_getobjopt(ct, NFCT_GOPT_IS_SNAT)) + ct_build_u32(ct, ATTR_REPL_IPV4_DST, n, NTA_SNAT_IPV4); + if (nfct_getobjopt(ct, NFCT_GOPT_IS_DNAT)) + ct_build_u32(ct, ATTR_REPL_IPV4_SRC, n, NTA_DNAT_IPV4); + break; + case AF_INET6: + if (nfct_getobjopt(ct, NFCT_GOPT_IS_SNAT)) { + ct_build_u128(ct, ATTR_REPL_IPV6_DST, n, + NTA_SNAT_IPV6); + } + if (nfct_getobjopt(ct, NFCT_GOPT_IS_DNAT)) { + ct_build_u128(ct, ATTR_REPL_IPV6_SRC, n, + NTA_DNAT_IPV6); + } + break; + default: + break; + } if (nfct_getobjopt(ct, NFCT_GOPT_IS_SPAT)) ct_build_u16(ct, ATTR_REPL_PORT_DST, n, NTA_SPAT_PORT); if (nfct_getobjopt(ct, NFCT_GOPT_IS_DPAT)) |