Unable to get NPTv6 to work with kernel 3.8.2

Submitted by Florian Westphal on March 12, 2013, 6:11 a.m.

Details

Message ID 20130312061101.GB7938@breakpoint.cc
State Accepted
Headers show

Commit Message

Florian Westphal March 12, 2013, 6:11 a.m.
Matthias Schiffer <mschiffer@universe-factory.net> wrote:
> ip6tables -t nat -A OUTPUT -d fd00:0:0:3::/64 -j DNPT --src-pfx
> fd00:0:0:3::/64 --dst-pfx fd00:0:0:1::/64
[..]

This won't work, DNPT is stateless, the nat table is only consulted
for the first packet of a connection.

Use mangle instead, this should also take care of possible new
route due to changed dst address.

Any objections wrt. restricting NPT to mangle?

From: Florian Westphal <fw@strlen.de>
Subject: [PATCH] netfilter: ip6t_NPT: restrict to mangle table

As the translation is stateless, using it in nat table
doesn't work (only initial packet is translated).
filter table OUTPUT works but won't re-route the packet after translation.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
not even compile tested.

Comments

Matthias Schiffer March 12, 2013, 8:34 a.m.
On 03/12/2013 07:11 AM, Florian Westphal wrote:
> Matthias Schiffer <mschiffer@universe-factory.net> wrote:
>> ip6tables -t nat -A OUTPUT -d fd00:0:0:3::/64 -j DNPT --src-pfx
>> fd00:0:0:3::/64 --dst-pfx fd00:0:0:1::/64
> [..]
> 
> This won't work, DNPT is stateless, the nat table is only consulted
> for the first packet of a connection.
> 
> Use mangle instead, this should also take care of possible new
> route due to changed dst address.
> 

Ah, thanks for your pointer. Everything seems to work correctly now :)

Best regards,
Matthias Schiffer
Pablo Neira March 15, 2013, 12:02 p.m.
On Tue, Mar 12, 2013 at 07:11:01AM +0100, Florian Westphal wrote:
> Matthias Schiffer <mschiffer@universe-factory.net> wrote:
> > ip6tables -t nat -A OUTPUT -d fd00:0:0:3::/64 -j DNPT --src-pfx
> > fd00:0:0:3::/64 --dst-pfx fd00:0:0:1::/64
> [..]
> 
> This won't work, DNPT is stateless, the nat table is only consulted
> for the first packet of a connection.
> 
> Use mangle instead, this should also take care of possible new
> route due to changed dst address.
> 
> Any objections wrt. restricting NPT to mangle?

No. People are getting confused with this, so let's get this into the
nf tree to hit mainstream as soon as possible.

Applied, thanks Florian.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch hide | download patch | download mbox

diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index 83acc14..33608c6 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -114,6 +114,7 @@  ip6t_dnpt_tg(struct sk_buff *skb, const struct xt_action_param *par)
 static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
 	{
 		.name		= "SNPT",
+		.table		= "mangle",
 		.target		= ip6t_snpt_tg,
 		.targetsize	= sizeof(struct ip6t_npt_tginfo),
 		.checkentry	= ip6t_npt_checkentry,
@@ -124,6 +125,7 @@  static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
 	},
 	{
 		.name		= "DNPT",
+		.table		= "mangle",
 		.target		= ip6t_dnpt_tg,
 		.targetsize	= sizeof(struct ip6t_npt_tginfo),
 		.checkentry	= ip6t_npt_checkentry,