From patchwork Mon Sep 20 03:24:24 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cole Dishington X-Patchwork-Id: 1529929 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=alliedtelesis.co.nz header.i=@alliedtelesis.co.nz header.a=rsa-sha256 header.s=mail181024 header.b=RaOdt6v4; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4HCVL94qYxz9sW4 for ; Mon, 20 Sep 2021 13:25:05 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229567AbhITD0W (ORCPT ); Sun, 19 Sep 2021 23:26:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43044 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229517AbhITD0U (ORCPT ); Sun, 19 Sep 2021 23:26:20 -0400 Received: from gate2.alliedtelesis.co.nz (gate2.alliedtelesis.co.nz [IPv6:2001:df5:b000:5::4]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 603B2C061574 for ; Sun, 19 Sep 2021 20:24:50 -0700 (PDT) Received: from svr-chch-seg1.atlnz.lc (mmarshal3.atlnz.lc [10.32.18.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by gate2.alliedtelesis.co.nz (Postfix) with ESMTPS id 6F17183651; Mon, 20 Sep 2021 15:24:47 +1200 (NZST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alliedtelesis.co.nz; s=mail181024; t=1632108287; bh=/OjniidpIiX0e9LT0/AQFH9g1B9MEuYZIMSjAUQ1qLo=; h=From:To:Cc:Subject:Date; b=RaOdt6v4WBcM6aDbQfgiGv/yULRBG03xO7KTFay1yqn4RRbssAmkUfJYnx626IwNM c6RV8KEkBdM4CqEgDSbgs09KfhjwiV2qYabNg3tp752xtOWz2kRLaXpT+hSTXYbEyV xGMI/SdjWV6pPW5oDgTDxGZu1uK2pdFxPeezWrrP6hujBg+9rWyqcxS3rCDYxMs+0U vKSDdovQM7eVnXQURemLl63XEb/vYktJrotnzqmlt+N5gzQ5cEforEDFVRN6q+zBr5 bRUI0m+FcarKaZ1TsXy88/9G/iv57c+hVAYvRlxOLNb93h+i1jCb1ng2SVwcoKDVKF loxMlP3jh+k6g== Received: from pat.atlnz.lc (Not Verified[10.32.16.33]) by svr-chch-seg1.atlnz.lc with Trustwave SEG (v8,2,6,11305) id ; Mon, 20 Sep 2021 15:24:47 +1200 Received: from coled-dl.ws.atlnz.lc (coled-dl.ws.atlnz.lc [10.33.25.26]) by pat.atlnz.lc (Postfix) with ESMTP id 25F7313EE3F; Mon, 20 Sep 2021 15:24:47 +1200 (NZST) Received: by coled-dl.ws.atlnz.lc (Postfix, from userid 1801) id 1F65824285E; Mon, 20 Sep 2021 15:24:47 +1200 (NZST) From: Cole Dishington To: pablo@netfilter.org, fw@strlen.de Cc: netfilter-devel@vger.kernel.org, Cole Dishington Subject: [RESEND PATCH net-next v4] extensions: masquerade: Add RFC-7597 section 5.1 PSID support Date: Mon, 20 Sep 2021 15:24:24 +1200 Message-Id: <20210920032424.19544-1-Cole.Dishington@alliedtelesis.co.nz> X-Mailer: git-send-email 2.33.0 MIME-Version: 1.0 X-SEG-SpamProfiler-Analysis: v=2.3 cv=FtN7AFjq c=1 sm=1 tr=0 a=KLBiSEs5mFS1a/PbTCJxuA==:117 a=7QKq2e-ADPsA:10 a=BpS_kTOcS8gwb1b9KvQA:9 X-SEG-SpamProfiler-Score: 0 x-atlnz-ls: pat Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Added --psid option to masquerade extension to specify port ranges, as described in RFC-7597 section 5.1. The PSID option needs the base field in range2, so add version 1 of the masquerade extension. Signed-off-by: Cole Dishington --- Notes: Changes: - Added net-next to subject. - Added patch version to subect. extensions/libipt_MASQUERADE.c | 295 +++++++++++++++++++++++++------ extensions/libipt_MASQUERADE.t | 8 + extensions/libxt_MASQUERADE.man | 6 +- include/linux/netfilter/nf_nat.h | 5 +- 4 files changed, 259 insertions(+), 55 deletions(-) diff --git a/extensions/libipt_MASQUERADE.c b/extensions/libipt_MASQUERADE.c index 90bf6065..fe9e67af 100644 --- a/extensions/libipt_MASQUERADE.c +++ b/extensions/libipt_MASQUERADE.c @@ -12,9 +12,41 @@ enum { O_TO_PORTS = 0, O_RANDOM, O_RANDOM_FULLY, + O_PSID, }; -static void MASQUERADE_help(void) +static unsigned int _log2(unsigned int x) +{ + unsigned int y = 0; + + for (; x > 1; x >>= 1) + y++; + return y; +} + +static void cpy_ipv4_range_to_range2(struct nf_nat_range2 *dst, const struct nf_nat_ipv4_range *src) +{ + memset(&dst->min_addr, 0, sizeof(dst->min_addr)); + memset(&dst->max_addr, 0, sizeof(dst->max_addr)); + memset(&dst->base_proto, 0, sizeof(dst->base_proto)); + + dst->flags = src->flags; + dst->min_addr.ip = src->min_ip; + dst->max_addr.ip = src->max_ip; + dst->min_proto = src->min; + dst->max_proto = src->max; +} + +static void cpy_range2_to_ipv4_range(struct nf_nat_ipv4_range *dst, const struct nf_nat_range2 *src) +{ + dst->flags = src->flags; + dst->min_ip = src->min_addr.ip; + dst->max_ip = src->max_addr.ip; + dst->min = src->min_proto; + dst->max = src->max_proto; +} + +static void MASQUERADE_help_v0(void) { printf( "MASQUERADE target options:\n" @@ -26,14 +58,30 @@ static void MASQUERADE_help(void) " Fully randomize source port.\n"); } -static const struct xt_option_entry MASQUERADE_opts[] = { +static void MASQUERADE_help_v1(void) +{ + MASQUERADE_help_v0(); + printf( +" --psid ::\n" +" Run in PSID mode with this PSID\n"); +} + +static const struct xt_option_entry MASQUERADE_opts_v0[] = { {.name = "to-ports", .id = O_TO_PORTS, .type = XTTYPE_STRING}, {.name = "random", .id = O_RANDOM, .type = XTTYPE_NONE}, {.name = "random-fully", .id = O_RANDOM_FULLY, .type = XTTYPE_NONE}, XTOPT_TABLEEND, }; -static void MASQUERADE_init(struct xt_entry_target *t) +static const struct xt_option_entry MASQUERADE_opts_v1[] = { + {.name = "to-ports", .id = O_TO_PORTS, .type = XTTYPE_STRING}, + {.name = "random", .id = O_RANDOM, .type = XTTYPE_NONE}, + {.name = "random-fully", .id = O_RANDOM_FULLY, .type = XTTYPE_NONE}, + {.name = "psid", .id = O_PSID, .type = XTTYPE_STRING}, + XTOPT_TABLEEND, +}; + +static void MASQUERADE_init_v0(struct xt_entry_target *t) { struct nf_nat_ipv4_multi_range_compat *mr = (struct nf_nat_ipv4_multi_range_compat *)t->data; @@ -42,21 +90,20 @@ static void MASQUERADE_init(struct xt_entry_target *t) } /* Parses ports */ -static void -parse_ports(const char *arg, struct nf_nat_ipv4_multi_range_compat *mr) +static void parse_ports(const char *arg, struct nf_nat_range2 *r) { char *end; unsigned int port, maxport; - mr->range[0].flags |= NF_NAT_RANGE_PROTO_SPECIFIED; + r->flags |= NF_NAT_RANGE_PROTO_SPECIFIED; if (!xtables_strtoui(arg, &end, &port, 0, UINT16_MAX)) xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", "--to-ports", arg); switch (*end) { case '\0': - mr->range[0].min.tcp.port - = mr->range[0].max.tcp.port + r->min_proto.tcp.port + = r->max_proto.tcp.port = htons(port); return; case '-': @@ -66,8 +113,8 @@ parse_ports(const char *arg, struct nf_nat_ipv4_multi_range_compat *mr) if (maxport < port) break; - mr->range[0].min.tcp.port = htons(port); - mr->range[0].max.tcp.port = htons(maxport); + r->min_proto.tcp.port = htons(port); + r->max_proto.tcp.port = htons(maxport); return; default: break; @@ -75,11 +122,64 @@ parse_ports(const char *arg, struct nf_nat_ipv4_multi_range_compat *mr) xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", "--to-ports", arg); } -static void MASQUERADE_parse(struct xt_option_call *cb) +static void range_to_psid_args(const struct nf_nat_range2 *r, unsigned int *offset_len, + unsigned int *psid, unsigned int *psid_len) +{ + unsigned int offset, power_j, psid_mask; + + power_j = ntohs(r->max_proto.all) - ntohs(r->min_proto.all) + 1; + offset = ntohs(r->base_proto.all); + if (offset == 0) + offset = 1 << 16; + + *offset_len = 16 - _log2(offset); + *psid_len = _log2(offset / power_j); + psid_mask = ((1 << *psid_len) - 1) * power_j; + *psid = (ntohs(r->min_proto.all) & psid_mask) >> _log2(power_j); +} + +static void parse_psid(const char *arg, struct nf_nat_range2 *r) +{ + char *end; + unsigned int offset_len, psid, psid_len, min, offset; + + if (!xtables_strtoui(arg, &end, &offset_len, 0, 16) || *end != ':') + xtables_param_act(XTF_BAD_VALUE, + "MASQUERADE", "--psid invalid", arg); + + if (!xtables_strtoui(end + 1, &end, &psid, 0, UINT16_MAX) || *end != ':') + xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", "--psid invalid", arg); + + if (!xtables_strtoui(end + 1, &end, &psid_len, 0, 16) || *end != '\0') + xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", "--psid invalid", arg); + + if (psid >= (1 << psid_len)) + xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", + "--psid too large for ", arg); + + if (psid_len + offset_len >= 16) + xtables_param_act(XTF_BAD_VALUE, "MASQUERADE", + "--psid and/or are too large", arg); + + offset = (1 << (16 - offset_len)); + psid = psid << (16 - offset_len - psid_len); + + /* Handle the special case of no offset bits (a=0), so offset loops */ + min = psid; + if (offset) + min += offset; + + r->min_proto.all = htons(min); + r->max_proto.all = htons(min + ((1 << (16 - offset_len - psid_len)) - 1)); + r->base_proto.all = htons(offset); + r->flags |= NF_NAT_RANGE_PSID; + r->flags |= NF_NAT_RANGE_PROTO_SPECIFIED; +} + +static void _MASQUERADE_parse(struct xt_option_call *cb, struct nf_nat_range2 *r, int rev) { const struct ipt_entry *entry = cb->xt_entry; int portok; - struct nf_nat_ipv4_multi_range_compat *mr = cb->data; if (entry->ip.proto == IPPROTO_TCP || entry->ip.proto == IPPROTO_UDP @@ -96,29 +196,50 @@ static void MASQUERADE_parse(struct xt_option_call *cb) if (!portok) xtables_error(PARAMETER_PROBLEM, "Need TCP, UDP, SCTP or DCCP with port specification"); - parse_ports(cb->arg, mr); + parse_ports(cb->arg, r); break; case O_RANDOM: - mr->range[0].flags |= NF_NAT_RANGE_PROTO_RANDOM; + r->flags |= NF_NAT_RANGE_PROTO_RANDOM; break; case O_RANDOM_FULLY: - mr->range[0].flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY; + r->flags |= NF_NAT_RANGE_PROTO_RANDOM_FULLY; + break; + case O_PSID: + parse_psid(cb->arg, r); break; } } -static void -MASQUERADE_print(const void *ip, const struct xt_entry_target *target, - int numeric) +static void MASQUERADE_parse_v0(struct xt_option_call *cb) +{ + struct nf_nat_ipv4_multi_range_compat *mr = (void *)cb->data; + struct nf_nat_range2 r = {}; + + cpy_ipv4_range_to_range2(&r, &mr->range[0]); + _MASQUERADE_parse(cb, &r, 0); + cpy_range2_to_ipv4_range(&mr->range[0], &r); +} + +static void MASQUERADE_parse_v1(struct xt_option_call *cb) +{ + _MASQUERADE_parse(cb, (struct nf_nat_range2 *)cb->data, 1); +} + +static void _MASQUERADE_print(const struct nf_nat_range2 *r, int rev) { - const struct nf_nat_ipv4_multi_range_compat *mr = (const void *)target->data; - const struct nf_nat_ipv4_range *r = &mr->range[0]; if (r->flags & NF_NAT_RANGE_PROTO_SPECIFIED) { - printf(" masq ports: "); - printf("%hu", ntohs(r->min.tcp.port)); - if (r->max.tcp.port != r->min.tcp.port) - printf("-%hu", ntohs(r->max.tcp.port)); + if (r->flags & NF_NAT_RANGE_PSID) { + unsigned int offset, psid, psid_length; + + range_to_psid_args(r, &offset, &psid, &psid_length); + printf(" masq psid: %hu:%hu:%hu", offset, psid, psid_length); + } else { + printf(" masq ports: "); + printf("%hu", ntohs(r->min_proto.tcp.port)); + if (r->max_proto.tcp.port != r->min_proto.tcp.port) + printf("-%hu", ntohs(r->max_proto.tcp.port)); + } } if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) @@ -126,18 +247,37 @@ MASQUERADE_print(const void *ip, const struct xt_entry_target *target, if (r->flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY) printf(" random-fully"); + + } -static void -MASQUERADE_save(const void *ip, const struct xt_entry_target *target) +static void MASQUERADE_print_v0(const void *ip, const struct xt_entry_target *target, int numeric) { const struct nf_nat_ipv4_multi_range_compat *mr = (const void *)target->data; - const struct nf_nat_ipv4_range *r = &mr->range[0]; + struct nf_nat_range2 r = {}; + + cpy_ipv4_range_to_range2(&r, &mr->range[0]); + _MASQUERADE_print(&r, 0); +} + +static void MASQUERADE_print_v1(const void *ip, const struct xt_entry_target *target, int numeric) +{ + _MASQUERADE_print((const struct nf_nat_range2 *)target->data, 1); +} +static void _MASQUERADE_save(const struct nf_nat_range2 *r, int rev) +{ if (r->flags & NF_NAT_RANGE_PROTO_SPECIFIED) { - printf(" --to-ports %hu", ntohs(r->min.tcp.port)); - if (r->max.tcp.port != r->min.tcp.port) - printf("-%hu", ntohs(r->max.tcp.port)); + if (r->flags & NF_NAT_RANGE_PSID) { + unsigned int offset, psid, psid_length; + + range_to_psid_args(r, &offset, &psid, &psid_length); + printf(" --psid %hu:%hu:%hu", offset, psid, psid_length); + } else { + printf(" --to-ports %hu", ntohs(r->min_proto.tcp.port)); + if (r->max_proto.tcp.port != r->min_proto.tcp.port) + printf("-%hu", ntohs(r->max_proto.tcp.port)); + } } if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) @@ -147,44 +287,93 @@ MASQUERADE_save(const void *ip, const struct xt_entry_target *target) printf(" --random-fully"); } -static int MASQUERADE_xlate(struct xt_xlate *xl, - const struct xt_xlate_tg_params *params) +static void MASQUERADE_save_v0(const void *ip, const struct xt_entry_target *target) { - const struct nf_nat_ipv4_multi_range_compat *mr = - (const void *)params->target->data; - const struct nf_nat_ipv4_range *r = &mr->range[0]; + const struct nf_nat_ipv4_multi_range_compat *mr = (const void *)target->data; + struct nf_nat_range2 r = {}; + + cpy_ipv4_range_to_range2(&r, &mr->range[0]); + _MASQUERADE_save(&r, 0); +} + +static void MASQUERADE_save_v1(const void *ip, const struct xt_entry_target *target) +{ + _MASQUERADE_save((const struct nf_nat_range2 *)target->data, 1); +} +static void _MASQUERADE_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r, int rev) +{ xt_xlate_add(xl, "masquerade"); if (r->flags & NF_NAT_RANGE_PROTO_SPECIFIED) { - xt_xlate_add(xl, " to :%hu", ntohs(r->min.tcp.port)); - if (r->max.tcp.port != r->min.tcp.port) - xt_xlate_add(xl, "-%hu", ntohs(r->max.tcp.port)); - } + if (r->flags & NF_NAT_RANGE_PSID) { + unsigned int offset, psid, psid_length; + + range_to_psid_args(r, &offset, &psid, &psid_length); + xt_xlate_add(xl, " psid %hu:%hu:%hu", offset, psid, psid_length); + } else { + xt_xlate_add(xl, " to :%hu", ntohs(r->min_proto.tcp.port)); + if (r->max_proto.tcp.port != r->min_proto.tcp.port) + xt_xlate_add(xl, "-%hu", ntohs(r->max_proto.tcp.port)); + } + } xt_xlate_add(xl, " "); if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) xt_xlate_add(xl, "random "); +} +static int MASQUERADE_xlate_v0(struct xt_xlate *xl, const struct xt_xlate_tg_params *params) +{ + const struct nf_nat_ipv4_multi_range_compat *mr = + (const void *)params->target->data; + struct nf_nat_range2 r = {}; + + cpy_ipv4_range_to_range2(&r, &mr->range[0]); + _MASQUERADE_xlate(xl, &r, 0); + + return 1; +} + +static int MASQUERADE_xlate_v1(struct xt_xlate *xl, const struct xt_xlate_tg_params *params) +{ + _MASQUERADE_xlate(xl, (const struct nf_nat_range2 *)params->target->data, 1); return 1; } -static struct xtables_target masquerade_tg_reg = { - .name = "MASQUERADE", - .version = XTABLES_VERSION, - .family = NFPROTO_IPV4, - .size = XT_ALIGN(sizeof(struct nf_nat_ipv4_multi_range_compat)), - .userspacesize = XT_ALIGN(sizeof(struct nf_nat_ipv4_multi_range_compat)), - .help = MASQUERADE_help, - .init = MASQUERADE_init, - .x6_parse = MASQUERADE_parse, - .print = MASQUERADE_print, - .save = MASQUERADE_save, - .x6_options = MASQUERADE_opts, - .xlate = MASQUERADE_xlate, +static struct xtables_target masquerade_tg_reg[] = { + { + .name = "MASQUERADE", + .version = XTABLES_VERSION, + .family = NFPROTO_IPV4, + .revision = 0, + .size = XT_ALIGN(sizeof(struct nf_nat_ipv4_multi_range_compat)), + .userspacesize = XT_ALIGN(sizeof(struct nf_nat_ipv4_multi_range_compat)), + .help = MASQUERADE_help_v0, + .init = MASQUERADE_init_v0, + .x6_parse = MASQUERADE_parse_v0, + .print = MASQUERADE_print_v0, + .save = MASQUERADE_save_v0, + .x6_options = MASQUERADE_opts_v0, + .xlate = MASQUERADE_xlate_v0, + }, + { + .name = "MASQUERADE", + .version = XTABLES_VERSION, + .family = NFPROTO_IPV4, + .revision = 1, + .size = XT_ALIGN(sizeof(struct nf_nat_range2)), + .userspacesize = XT_ALIGN(sizeof(struct nf_nat_range2)), + .help = MASQUERADE_help_v1, + .x6_parse = MASQUERADE_parse_v1, + .print = MASQUERADE_print_v1, + .save = MASQUERADE_save_v1, + .x6_options = MASQUERADE_opts_v1, + .xlate = MASQUERADE_xlate_v1, + }, }; void _init(void) { - xtables_register_target(&masquerade_tg_reg); + xtables_register_targets(masquerade_tg_reg, ARRAY_SIZE(masquerade_tg_reg)); } diff --git a/extensions/libipt_MASQUERADE.t b/extensions/libipt_MASQUERADE.t index e25d2a04..3f096e31 100644 --- a/extensions/libipt_MASQUERADE.t +++ b/extensions/libipt_MASQUERADE.t @@ -7,3 +7,11 @@ -p udp -j MASQUERADE --to-ports 1024-65535;=;OK -p udp -j MASQUERADE --to-ports 1024-65536;;FAIL -p udp -j MASQUERADE --to-ports -1;;FAIL +-j MASQUERADE --psid 0:52:8;=;OK +-j MASQUERADE --psid 6;;FAIL +-j MASQUERADE --psid 6:0;;FAIL +-j MASQUERADE --psid 6:0:8;=;OK +-j MASQUERADE --psid -6:-52:-8;=;FAIL +-j MASQUERADE --psid 6:52:8;=;OK +-j MASQUERADE --psid 6:270:8;;FAIL +-j MASQUERADE --psid 6:270:8;;FAIL diff --git a/extensions/libxt_MASQUERADE.man b/extensions/libxt_MASQUERADE.man index 7746f473..026d0b18 100644 --- a/extensions/libxt_MASQUERADE.man +++ b/extensions/libxt_MASQUERADE.man @@ -32,4 +32,8 @@ If option \fB\-\-random-fully\fP is used then port mapping will be fully randomized (kernel >= 3.13). .TP -IPv6 support available since Linux kernels >= 3.7. +\fB\-\-psid\fP \fIoffset_length\fB:\fIpsid\fB:\fIpsid_length +This specifies a range of source ports to use based on RFC-7597 PSID (kernel >= 5.13), overriding the source ports. + \fIoffset_length\fP : Excluded ports (0 to 2^(16 - \fIoffset_length\fP) - 1). + \fIpsid\fP : Selects the port ranges used by this rule. + \fIpsid_length\fP : Bit-length of the \fIpsid\fP field. diff --git a/include/linux/netfilter/nf_nat.h b/include/linux/netfilter/nf_nat.h index b600000d..0f004765 100644 --- a/include/linux/netfilter/nf_nat.h +++ b/include/linux/netfilter/nf_nat.h @@ -10,6 +10,8 @@ #define NF_NAT_RANGE_PERSISTENT (1 << 3) #define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4) #define NF_NAT_RANGE_PROTO_OFFSET (1 << 5) +#define NF_NAT_RANGE_NETMAP (1 << 6) +#define NF_NAT_RANGE_PSID (1 << 7) #define NF_NAT_RANGE_PROTO_RANDOM_ALL \ (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY) @@ -17,7 +19,8 @@ #define NF_NAT_RANGE_MASK \ (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \ NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \ - NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET) + NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET | \ + NF_NAT_RANGE_NETMAP | NF_NAT_RANGE_PSID) struct nf_nat_ipv4_range { unsigned int flags;