diff mbox

Unable to get NPTv6 to work with kernel 3.8.2

Message ID 20130312061101.GB7938@breakpoint.cc
State Accepted
Headers show

Commit Message

Florian Westphal March 12, 2013, 6:11 a.m. UTC 
Matthias Schiffer <mschiffer@universe-factory.net> wrote:
> ip6tables -t nat -A OUTPUT -d fd00:0:0:3::/64 -j DNPT --src-pfx
> fd00:0:0:3::/64 --dst-pfx fd00:0:0:1::/64
[..]

This won't work, DNPT is stateless, the nat table is only consulted
for the first packet of a connection.

Use mangle instead, this should also take care of possible new
route due to changed dst address.

Any objections wrt. restricting NPT to mangle?

From: Florian Westphal <fw@strlen.de>
Subject: [PATCH] netfilter: ip6t_NPT: restrict to mangle table

As the translation is stateless, using it in nat table
doesn't work (only initial packet is translated).
filter table OUTPUT works but won't re-route the packet after translation.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
not even compile tested.

Comments

Matthias Schiffer March 12, 2013, 8:34 a.m. UTC | #1 
On 03/12/2013 07:11 AM, Florian Westphal wrote:
> Matthias Schiffer <mschiffer@universe-factory.net> wrote:
>> ip6tables -t nat -A OUTPUT -d fd00:0:0:3::/64 -j DNPT --src-pfx
>> fd00:0:0:3::/64 --dst-pfx fd00:0:0:1::/64
> [..]
> 
> This won't work, DNPT is stateless, the nat table is only consulted
> for the first packet of a connection.
> 
> Use mangle instead, this should also take care of possible new
> route due to changed dst address.
> 

Ah, thanks for your pointer. Everything seems to work correctly now :)

Best regards,
Matthias Schiffer
Pablo Neira Ayuso March 15, 2013, 12:02 p.m. UTC | #2 
On Tue, Mar 12, 2013 at 07:11:01AM +0100, Florian Westphal wrote:
> Matthias Schiffer <mschiffer@universe-factory.net> wrote:
> > ip6tables -t nat -A OUTPUT -d fd00:0:0:3::/64 -j DNPT --src-pfx
> > fd00:0:0:3::/64 --dst-pfx fd00:0:0:1::/64
> [..]
> 
> This won't work, DNPT is stateless, the nat table is only consulted
> for the first packet of a connection.
> 
> Use mangle instead, this should also take care of possible new
> route due to changed dst address.
> 
> Any objections wrt. restricting NPT to mangle?

No. People are getting confused with this, so let's get this into the
nf tree to hit mainstream as soon as possible.

Applied, thanks Florian.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index 83acc14..33608c6 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -114,6 +114,7 @@  ip6t_dnpt_tg(struct sk_buff *skb, const struct xt_action_param *par)
 static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
 	{
 		.name		= "SNPT",
+		.table		= "mangle",
 		.target		= ip6t_snpt_tg,
 		.targetsize	= sizeof(struct ip6t_npt_tginfo),
 		.checkentry	= ip6t_npt_checkentry,
@@ -124,6 +125,7 @@  static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
 	},
 	{
 		.name		= "DNPT",
+		.table		= "mangle",
 		.target		= ip6t_dnpt_tg,
 		.targetsize	= sizeof(struct ip6t_npt_tginfo),
 		.checkentry	= ip6t_npt_checkentry,