netfilter: masquerade: attach nat extension if not present

Currently the nat extension is always attached as soon as nat module is
loaded.  However, most NAT uses do not need the nat extension anymore.

Prepare to remove the add-nat-by-default by making those places that need
it attach it if its not present yet.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
index ea91058b5f6f4245a84179f81a8641756f60efff..dc1dea15c1b4fb0d7ad3ad02779cde147e52c2cf 100644 (file)
--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
@@ -37,7 +37,6 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
        NF_CT_ASSERT(hooknum == NF_INET_POST_ROUTING);
 
        ct = nf_ct_get(skb, &ctinfo);
-       nat = nfct_nat(ct);
 
        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
                            ctinfo == IP_CT_RELATED_REPLY));
@@ -56,7 +55,9 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
                return NF_DROP;
        }
 
-       nat->masq_index = out->ifindex;
+       nat = nf_ct_nat_ext_add(ct);
+       if (nat)
+               nat->masq_index = out->ifindex;
 
        /* Transfer from original range. */
        memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));

diff --git a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
index 051b6a6bfff6ca7c0dd42ceb43a417260a11bd23..2297c9f073bac63c90ed0578b474fd53b556a6e2 100644 (file)
--- a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
@@ -30,6 +30,7 @@ nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
                       const struct net_device *out)
 {
        enum ip_conntrack_info ctinfo;
+       struct nf_conn_nat *nat;
        struct in6_addr src;
        struct nf_conn *ct;
        struct nf_nat_range newrange;
@@ -42,7 +43,9 @@ nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
                               &ipv6_hdr(skb)->daddr, 0, &src) < 0)
                return NF_DROP;
 
-       nfct_nat(ct)->masq_index = out->ifindex;
+       nat = nf_ct_nat_ext_add(ct);
+       if (nat)
+               nat->masq_index = out->ifindex;
 
        newrange.flags          = range->flags | NF_NAT_RANGE_MAP_IPS;
        newrange.min_addr.in6   = src;