netfilter: nft_masq: support port range

Complete masquerading support by allowing port range selection.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 40 insertions, 11 deletions

diff --git a/net/netfilter/nft_masq.c b/net/netfilter/nft_masq.c
index 9aea747b43ea..81b5ad6165ac 100644
--- a/net/netfilter/nft_masq.c
+++ b/net/netfilter/nft_masq.c
@@ -17,7 +17,9 @@
 #include <net/netfilter/nft_masq.h>
 
 const struct nla_policy nft_masq_policy[NFTA_MASQ_MAX + 1] = {
-        [NFTA_MASQ_FLAGS]       = { .type = NLA_U32 },
+        [NFTA_MASQ_FLAGS]               = { .type = NLA_U32 },
+        [NFTA_MASQ_REG_PROTO_MIN]       = { .type = NLA_U32 },
+        [NFTA_MASQ_REG_PROTO_MAX]       = { .type = NLA_U32 },
 };
 EXPORT_SYMBOL_GPL(nft_masq_policy);
 
@@ -40,6 +42,7 @@ int nft_masq_init(const struct nft_ctx *ctx,
                   const struct nft_expr *expr,
                   const struct nlattr * const tb[])
 {
+        u32 plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all);
         struct nft_masq *priv = nft_expr_priv(expr);
         int err;
 
@@ -47,12 +50,32 @@ int nft_masq_init(const struct nft_ctx *ctx,
         if (err)
                 return err;
 
-        if (tb[NFTA_MASQ_FLAGS] == NULL)
-                return 0;
-
-        priv->flags = ntohl(nla_get_be32(tb[NFTA_MASQ_FLAGS]));
-        if (priv->flags & ~NF_NAT_RANGE_MASK)
-                return -EINVAL;
+        if (tb[NFTA_MASQ_FLAGS]) {
+                priv->flags = ntohl(nla_get_be32(tb[NFTA_MASQ_FLAGS]));
+                if (priv->flags & ~NF_NAT_RANGE_MASK)
+                        return -EINVAL;
+        }
+
+        if (tb[NFTA_MASQ_REG_PROTO_MIN]) {
+                priv->sreg_proto_min =
+                        nft_parse_register(tb[NFTA_MASQ_REG_PROTO_MIN]);
+
+                err = nft_validate_register_load(priv->sreg_proto_min, plen);
+                if (err < 0)
+                        return err;
+
+                if (tb[NFTA_MASQ_REG_PROTO_MAX]) {
+                        priv->sreg_proto_max =
+                                nft_parse_register(tb[NFTA_MASQ_REG_PROTO_MAX]);
+
+                        err = nft_validate_register_load(priv->sreg_proto_max,
+                                                         plen);
+                        if (err < 0)
+                                return err;
+                } else {
+                        priv->sreg_proto_max = priv->sreg_proto_min;
+                }
+        }
 
         return 0;
 }
@@ -62,12 +85,18 @@ int nft_masq_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
         const struct nft_masq *priv = nft_expr_priv(expr);
 
-        if (priv->flags == 0)
-                return 0;
-
-        if (nla_put_be32(skb, NFTA_MASQ_FLAGS, htonl(priv->flags)))
+        if (priv->flags != 0 &&
+            nla_put_be32(skb, NFTA_MASQ_FLAGS, htonl(priv->flags)))
                 goto nla_put_failure;
 
+        if (priv->sreg_proto_min) {
+                if (nft_dump_register(skb, NFTA_MASQ_REG_PROTO_MIN,
+                                      priv->sreg_proto_min) ||
+                    nft_dump_register(skb, NFTA_MASQ_REG_PROTO_MAX,
+                                      priv->sreg_proto_max))
+                        goto nla_put_failure;
+        }
+
         return 0;
 
 nla_put_failure: