diff options
| author | Phil Sutter <phil@nwl.cc> | 2022-11-02 21:54:41 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2022-11-11 19:13:10 +0100 |
| commit | 7dbd1b1dd95449b1ab8c35cd35fe904eb35db374 (patch) | |
| tree | 313c8e4c25e596d9a7e5150e4be5ecf56e3d8e4c /extensions/libipt_SNAT.c | |
| parent | c3432977d9a5e6c5d8e835094dc8c466a5d64f03 (diff) | |
extensions: *NAT: Drop NF_NAT_RANGE_PROTO_RANDOM* flag checks
SNAT, DNAT and REDIRECT extensions tried to prevent
NF_NAT_RANGE_PROTO_RANDOM flag from being set if no port or address was
also given.
With SNAT and DNAT, this is not possible as the respective
--to-destination or --to-source parameters are mandatory anyway.
Looking at the kernel code, doing so with REDIRECT seems harmless.
Moreover, nftables supports 'redirect random' without specifying a
port-range.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions/libipt_SNAT.c')
| -rw-r--r-- | extensions/libipt_SNAT.c | 16 |
1 files changed, 6 insertions, 10 deletions
diff --git a/extensions/libipt_SNAT.c b/extensions/libipt_SNAT.c index 211a20bc..9c8cdb46 100644 --- a/extensions/libipt_SNAT.c +++ b/extensions/libipt_SNAT.c @@ -13,9 +13,6 @@ enum { O_RANDOM, O_RANDOM_FULLY, O_PERSISTENT, - F_TO_SRC = 1 << O_TO_SRC, - F_RANDOM = 1 << O_RANDOM, - F_RANDOM_FULLY = 1 << O_RANDOM_FULLY, }; static void SNAT_help(void) @@ -141,20 +138,19 @@ static void SNAT_parse(struct xt_option_call *cb) case O_PERSISTENT: mr->range->flags |= NF_NAT_RANGE_PERSISTENT; break; + case O_RANDOM: + mr->range->flags |= NF_NAT_RANGE_PROTO_RANDOM; + break; + case O_RANDOM_FULLY: + mr->range->flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY; + break; } } static void SNAT_fcheck(struct xt_fcheck_call *cb) { - static const unsigned int f = F_TO_SRC | F_RANDOM; - static const unsigned int r = F_TO_SRC | F_RANDOM_FULLY; struct nf_nat_ipv4_multi_range_compat *mr = cb->data; - if ((cb->xflags & f) == f) - mr->range->flags |= NF_NAT_RANGE_PROTO_RANDOM; - if ((cb->xflags & r) == r) - mr->range->flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY; - mr->rangesize = 1; } |