Patchwork Unable to get NPTv6 to work with kernel 3.8.2

login
register
mail settings
Submitter Florian Westphal
Date March 12, 2013, 6:11 a.m.
Message ID <20130312061101.GB7938@breakpoint.cc>
Download mbox | patch
Permalink /patch/226782/
State Accepted
Headers show

Comments

Florian Westphal - March 12, 2013, 6:11 a.m.
Matthias Schiffer <mschiffer@universe-factory.net> wrote:
> ip6tables -t nat -A OUTPUT -d fd00:0:0:3::/64 -j DNPT --src-pfx
> fd00:0:0:3::/64 --dst-pfx fd00:0:0:1::/64
[..]

This won't work, DNPT is stateless, the nat table is only consulted
for the first packet of a connection.

Use mangle instead, this should also take care of possible new
route due to changed dst address.

Any objections wrt. restricting NPT to mangle?

From: Florian Westphal <fw@strlen.de>
Subject: [PATCH] netfilter: ip6t_NPT: restrict to mangle table

As the translation is stateless, using it in nat table
doesn't work (only initial packet is translated).
filter table OUTPUT works but won't re-route the packet after translation.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
not even compile tested.
Matthias Schiffer - March 12, 2013, 8:34 a.m.
On 03/12/2013 07:11 AM, Florian Westphal wrote:
> Matthias Schiffer <mschiffer@universe-factory.net> wrote:
>> ip6tables -t nat -A OUTPUT -d fd00:0:0:3::/64 -j DNPT --src-pfx
>> fd00:0:0:3::/64 --dst-pfx fd00:0:0:1::/64
> [..]
> 
> This won't work, DNPT is stateless, the nat table is only consulted
> for the first packet of a connection.
> 
> Use mangle instead, this should also take care of possible new
> route due to changed dst address.
> 

Ah, thanks for your pointer. Everything seems to work correctly now :)

Best regards,
Matthias Schiffer
Pablo Neira - March 15, 2013, 12:02 p.m.
On Tue, Mar 12, 2013 at 07:11:01AM +0100, Florian Westphal wrote:
> Matthias Schiffer <mschiffer@universe-factory.net> wrote:
> > ip6tables -t nat -A OUTPUT -d fd00:0:0:3::/64 -j DNPT --src-pfx
> > fd00:0:0:3::/64 --dst-pfx fd00:0:0:1::/64
> [..]
> 
> This won't work, DNPT is stateless, the nat table is only consulted
> for the first packet of a connection.
> 
> Use mangle instead, this should also take care of possible new
> route due to changed dst address.
> 
> Any objections wrt. restricting NPT to mangle?

No. People are getting confused with this, so let's get this into the
nf tree to hit mainstream as soon as possible.

Applied, thanks Florian.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index 83acc14..33608c6 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -114,6 +114,7 @@  ip6t_dnpt_tg(struct sk_buff *skb, const struct xt_action_param *par)
 static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
 	{
 		.name		= "SNPT",
+		.table		= "mangle",
 		.target		= ip6t_snpt_tg,
 		.targetsize	= sizeof(struct ip6t_npt_tginfo),
 		.checkentry	= ip6t_npt_checkentry,
@@ -124,6 +125,7 @@  static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
 	},
 	{
 		.name		= "DNPT",
+		.table		= "mangle",
 		.target		= ip6t_dnpt_tg,
 		.targetsize	= sizeof(struct ip6t_npt_tginfo),
 		.checkentry	= ip6t_npt_checkentry,