Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-07 13:43:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

netfilter: replace NF_NAT_NEEDED with IS_ENABLED(CONFIG_NF_NAT)

Browse Source 
NF_NAT_NEEDED is true whenever nat support for either ipv4 or ipv6 is
enabled.  Now that the af-specific nat configuration switches have been
removed, IS_ENABLED(CONFIG_NF_NAT) has the same effect.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2019-03-27 09:22:26 +01:00 committed by Pablo Neira Ayuso
parent c1deb065cf
commit 4806e97572
7 changed files with 21 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/linux/netfilter.h
View File

@ -367,7 +367,7 @@ extern struct nf_nat_hook __rcu *nf_nat_hook;
static inline void static inline void
nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
{ {
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
struct nf_nat_hook *nat_hook; struct nf_nat_hook *nat_hook;
rcu_read_lock(); rcu_read_lock();

2
include/net/netfilter/nf_conntrack_expect.h
View File

@ -48,7 +48,7 @@ struct nf_conntrack_expect {
/* Expectation class */ /* Expectation class */
unsigned int class; unsigned int class;
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
union nf_inet_addr saved_addr; union nf_inet_addr saved_addr;
/* This is the original per-proto part, used to map the /* This is the original per-proto part, used to map the
* expected connection the way the recipient expects. */ * expected connection the way the recipient expects. */

5
net/netfilter/Kconfig
View File

@ -404,11 +404,6 @@ config NF_NAT
forms of full Network Address Port Translation. This can be forms of full Network Address Port Translation. This can be
controlled by iptables, ip6tables or nft. controlled by iptables, ip6tables or nft.
config NF_NAT_NEEDED
bool
depends on NF_NAT
default y
config NF_NAT_AMANDA config NF_NAT_AMANDA
tristate tristate
depends on NF_CONNTRACK && NF_NAT depends on NF_CONNTRACK && NF_NAT

2
net/netfilter/nf_conntrack_expect.c
View File

@ -336,7 +336,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
exp->tuple.dst.u.all = *dst; exp->tuple.dst.u.all = *dst;
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
memset(&exp->saved_addr, 0, sizeof(exp->saved_addr)); memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
memset(&exp->saved_proto, 0, sizeof(exp->saved_proto)); memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
#endif #endif

16
net/netfilter/nf_conntrack_netlink.c
View File

@ -45,7 +45,7 @@
#include <net/netfilter/nf_conntrack_timestamp.h> #include <net/netfilter/nf_conntrack_timestamp.h>
#include <net/netfilter/nf_conntrack_labels.h> #include <net/netfilter/nf_conntrack_labels.h>
#include <net/netfilter/nf_conntrack_synproxy.h> #include <net/netfilter/nf_conntrack_synproxy.h>
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
#include <net/netfilter/nf_nat.h> #include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_nat_helper.h> #include <net/netfilter/nf_nat_helper.h>
#endif #endif
@ -655,7 +655,7 @@ static size_t ctnetlink_nlmsg_size(const struct nf_conn *ct)
+ nla_total_size(0) /* CTA_HELP */ + nla_total_size(0) /* CTA_HELP */
+ nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */ + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
+ ctnetlink_secctx_size(ct) + ctnetlink_secctx_size(ct)
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
+ 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */ + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
+ 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */ + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */
#endif #endif
@ -1494,7 +1494,7 @@ static int ctnetlink_get_ct_unconfirmed(struct net *net, struct sock *ctnl,
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
static int static int
ctnetlink_parse_nat_setup(struct nf_conn *ct, ctnetlink_parse_nat_setup(struct nf_conn *ct,
enum nf_nat_manip_type manip, enum nf_nat_manip_type manip,
@ -1586,7 +1586,7 @@ ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cda[])
static int static int
ctnetlink_setup_nat(struct nf_conn *ct, const struct nlattr * const cda[]) ctnetlink_setup_nat(struct nf_conn *ct, const struct nlattr * const cda[])
{ {
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
int ret; int ret;
if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC]) if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC])
@ -2369,7 +2369,7 @@ ctnetlink_glue_build_size(const struct nf_conn *ct)
+ nla_total_size(0) /* CTA_HELP */ + nla_total_size(0) /* CTA_HELP */
+ nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */ + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
+ ctnetlink_secctx_size(ct) + ctnetlink_secctx_size(ct)
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
+ 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */ + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
+ 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */ + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */
#endif #endif
@ -2699,7 +2699,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
struct nf_conn *master = exp->master; struct nf_conn *master = exp->master;
long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ; long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
struct nf_conn_help *help; struct nf_conn_help *help;
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
struct nlattr *nest_parms; struct nlattr *nest_parms;
struct nf_conntrack_tuple nat_tuple = {}; struct nf_conntrack_tuple nat_tuple = {};
#endif #endif
@ -2717,7 +2717,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
CTA_EXPECT_MASTER) < 0) CTA_EXPECT_MASTER) < 0)
goto nla_put_failure; goto nla_put_failure;
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
if (!nf_inet_addr_cmp(&exp->saved_addr, &any_addr) || if (!nf_inet_addr_cmp(&exp->saved_addr, &any_addr) ||
exp->saved_proto.all) { exp->saved_proto.all) {
nest_parms = nla_nest_start(skb, CTA_EXPECT_NAT | NLA_F_NESTED); nest_parms = nla_nest_start(skb, CTA_EXPECT_NAT | NLA_F_NESTED);
@ -3180,7 +3180,7 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr,
struct nf_conntrack_expect *exp, struct nf_conntrack_expect *exp,
u_int8_t u3) u_int8_t u3)
{ {
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
struct nlattr *tb[CTA_EXPECT_NAT_MAX+1]; struct nlattr *tb[CTA_EXPECT_NAT_MAX+1];
struct nf_conntrack_tuple nat_tuple = {}; struct nf_conntrack_tuple nat_tuple = {};
int err; int err;

2
net/netfilter/nf_conntrack_sip.c
View File

@ -928,7 +928,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,
nfct_help(exp->master)->helper != nfct_help(ct)->helper || nfct_help(exp->master)->helper != nfct_help(ct)->helper ||
exp->class != class) exp->class != class)
break; break;
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
if (!direct_rtp && if (!direct_rtp &&
(!nf_inet_addr_cmp(&exp->saved_addr, &exp->tuple.dst.u3) || (!nf_inet_addr_cmp(&exp->saved_addr, &exp->tuple.dst.u3) ||
exp->saved_proto.udp.port != exp->tuple.dst.u.udp.port) && exp->saved_proto.udp.port != exp->tuple.dst.u.udp.port) &&

18
net/openvswitch/conntrack.c
View File

@ -29,7 +29,7 @@
#include <net/netfilter/ipv6/nf_defrag_ipv6.h> #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
#include <net/ipv6_frag.h> #include <net/ipv6_frag.h>
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
#include <net/netfilter/nf_nat.h> #include <net/netfilter/nf_nat.h>
#endif #endif
@ -75,7 +75,7 @@ struct ovs_conntrack_info {
struct md_mark mark; struct md_mark mark;
struct md_labels labels; struct md_labels labels;
char timeout[CTNL_TIMEOUT_NAME_MAX]; char timeout[CTNL_TIMEOUT_NAME_MAX];
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */ struct nf_nat_range2 range; /* Only present for SRC NAT and DST NAT. */
#endif #endif
}; };
@ -721,7 +721,7 @@ static bool skb_nfct_cached(struct net *net,
return ct_executed; return ct_executed;
} }
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
/* Modelled after nf_nat_ipv[46]_fn(). /* Modelled after nf_nat_ipv[46]_fn().
* range is only used for new, uninitialized NAT state. * range is only used for new, uninitialized NAT state.
* Returns either NF_ACCEPT or NF_DROP. * Returns either NF_ACCEPT or NF_DROP.
@ -903,7 +903,7 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
return err; return err;
} }
#else /* !CONFIG_NF_NAT_NEEDED */ #else /* !CONFIG_NF_NAT */
static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
const struct ovs_conntrack_info *info, const struct ovs_conntrack_info *info,
struct sk_buff *skb, struct nf_conn *ct, struct sk_buff *skb, struct nf_conn *ct,
@ -1330,7 +1330,7 @@ static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
return 0; return 0;
} }
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
static int parse_nat(const struct nlattr *attr, static int parse_nat(const struct nlattr *attr,
struct ovs_conntrack_info *info, bool log) struct ovs_conntrack_info *info, bool log)
{ {
@ -1467,7 +1467,7 @@ static const struct ovs_ct_len_tbl ovs_ct_attr_lens[OVS_CT_ATTR_MAX + 1] = {
.maxlen = sizeof(struct md_labels) }, .maxlen = sizeof(struct md_labels) },
[OVS_CT_ATTR_HELPER] = { .minlen = 1, [OVS_CT_ATTR_HELPER] = { .minlen = 1,
.maxlen = NF_CT_HELPER_NAME_LEN }, .maxlen = NF_CT_HELPER_NAME_LEN },
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
/* NAT length is checked when parsing the nested attributes. */ /* NAT length is checked when parsing the nested attributes. */
[OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX }, [OVS_CT_ATTR_NAT] = { .minlen = 0, .maxlen = INT_MAX },
#endif #endif
@ -1547,7 +1547,7 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
return -EINVAL; return -EINVAL;
} }
break; break;
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
case OVS_CT_ATTR_NAT: { case OVS_CT_ATTR_NAT: {
int err = parse_nat(a, info, log); int err = parse_nat(a, info, log);
@ -1677,7 +1677,7 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
return err; return err;
} }
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info, static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
struct sk_buff *skb) struct sk_buff *skb)
{ {
@ -1783,7 +1783,7 @@ int ovs_ct_action_to_attr(const struct ovs_conntrack_info *ct_info,
return -EMSGSIZE; return -EMSGSIZE;
} }
#ifdef CONFIG_NF_NAT_NEEDED #if IS_ENABLED(CONFIG_NF_NAT)
if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb)) if (ct_info->nat && !ovs_ct_nat_to_attr(ct_info, skb))
return -EMSGSIZE; return -EMSGSIZE;
#endif #endif