| /* |
| * (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org> |
| * |
| * This program is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License as published by |
| * the Free Software Foundation; either version 2 of the License, or |
| * (at your option) any later version. |
| * |
| * This code has been sponsored by Vyatta Inc. <http://www.vyatta.com> |
| */ |
| |
| #include "internal/internal.h" |
| #include <limits.h> |
| #include <libmnl/libmnl.h> |
| |
| static int |
| nfct_build_tuple_ip(struct nlmsghdr *nlh, const struct __nfct_tuple *t) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_TUPLE_IP); |
| if (nest == NULL) |
| return -1; |
| |
| switch(t->l3protonum) { |
| case AF_INET: |
| mnl_attr_put_u32(nlh, CTA_IP_V4_SRC, t->src.v4); |
| mnl_attr_put_u32(nlh, CTA_IP_V4_DST, t->dst.v4); |
| break; |
| case AF_INET6: |
| mnl_attr_put(nlh, CTA_IP_V6_SRC, sizeof(struct in6_addr), |
| &t->src.v6); |
| mnl_attr_put(nlh, CTA_IP_V6_DST, sizeof(struct in6_addr), |
| &t->dst.v6); |
| break; |
| default: |
| mnl_attr_nest_cancel(nlh, nest); |
| return -1; |
| } |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| static int |
| nfct_build_tuple_proto(struct nlmsghdr *nlh, const struct __nfct_tuple *t) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_TUPLE_PROTO); |
| if (nest == NULL) |
| return -1; |
| |
| mnl_attr_put_u8(nlh, CTA_PROTO_NUM, t->protonum); |
| |
| switch(t->protonum) { |
| case IPPROTO_UDP: |
| case IPPROTO_TCP: |
| case IPPROTO_SCTP: |
| case IPPROTO_DCCP: |
| case IPPROTO_GRE: |
| case IPPROTO_UDPLITE: |
| mnl_attr_put_u16(nlh, CTA_PROTO_SRC_PORT, t->l4src.tcp.port); |
| mnl_attr_put_u16(nlh, CTA_PROTO_DST_PORT, t->l4dst.tcp.port); |
| break; |
| case IPPROTO_ICMP: |
| mnl_attr_put_u8(nlh, CTA_PROTO_ICMP_CODE, t->l4dst.icmp.code); |
| mnl_attr_put_u8(nlh, CTA_PROTO_ICMP_TYPE, t->l4dst.icmp.type); |
| mnl_attr_put_u16(nlh, CTA_PROTO_ICMP_ID, t->l4src.icmp.id); |
| break; |
| case IPPROTO_ICMPV6: |
| mnl_attr_put_u8(nlh, CTA_PROTO_ICMPV6_CODE, t->l4dst.icmp.code); |
| mnl_attr_put_u8(nlh, CTA_PROTO_ICMPV6_TYPE, t->l4dst.icmp.type); |
| mnl_attr_put_u16(nlh, CTA_PROTO_ICMPV6_ID, t->l4src.icmp.id); |
| break; |
| default: |
| mnl_attr_nest_cancel(nlh, nest); |
| return -1; |
| } |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| int |
| nfct_build_tuple_raw(struct nlmsghdr *nlh, const struct __nfct_tuple *t) |
| { |
| if (nfct_build_tuple_ip(nlh, t) < 0) |
| return -1; |
| if (nfct_build_tuple_proto(nlh, t) < 0) |
| return -1; |
| |
| return 0; |
| } |
| |
| int |
| nfct_build_tuple(struct nlmsghdr *nlh, const struct __nfct_tuple *t, int type) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, type); |
| if (nest == NULL) |
| return -1; |
| |
| if (nfct_build_tuple_raw(nlh, t) < 0) |
| goto err; |
| |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| err: |
| mnl_attr_nest_cancel(nlh, nest); |
| return -1; |
| } |
| |
| static int |
| nfct_build_protoinfo(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| struct nlattr *nest, *nest_proto; |
| |
| switch(ct->head.orig.protonum) { |
| case IPPROTO_TCP: |
| /* Preliminary attribute check to avoid sending an empty |
| * CTA_PROTOINFO_TCP nest, which results in EINVAL in |
| * Linux kernel <= 2.6.25. */ |
| if (!(test_bit(ATTR_TCP_STATE, ct->head.set) || |
| test_bit(ATTR_TCP_FLAGS_ORIG, ct->head.set) || |
| test_bit(ATTR_TCP_FLAGS_REPL, ct->head.set) || |
| test_bit(ATTR_TCP_MASK_ORIG, ct->head.set) || |
| test_bit(ATTR_TCP_MASK_REPL, ct->head.set) || |
| test_bit(ATTR_TCP_WSCALE_ORIG, ct->head.set) || |
| test_bit(ATTR_TCP_WSCALE_REPL, ct->head.set))) { |
| break; |
| } |
| nest = mnl_attr_nest_start(nlh, CTA_PROTOINFO); |
| nest_proto = mnl_attr_nest_start(nlh, CTA_PROTOINFO_TCP); |
| if (test_bit(ATTR_TCP_STATE, ct->head.set)) { |
| mnl_attr_put_u8(nlh, CTA_PROTOINFO_TCP_STATE, |
| ct->protoinfo.tcp.state); |
| } |
| if (test_bit(ATTR_TCP_FLAGS_ORIG, ct->head.set) && |
| test_bit(ATTR_TCP_MASK_ORIG, ct->head.set)) { |
| mnl_attr_put(nlh, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL, |
| sizeof(struct nf_ct_tcp_flags), |
| &ct->protoinfo.tcp.flags[0]); |
| } |
| if (test_bit(ATTR_TCP_FLAGS_REPL, ct->head.set) && |
| test_bit(ATTR_TCP_MASK_REPL, ct->head.set)) { |
| mnl_attr_put(nlh, CTA_PROTOINFO_TCP_FLAGS_REPLY, |
| sizeof(struct nf_ct_tcp_flags), |
| &ct->protoinfo.tcp.flags[1]); |
| } |
| if (test_bit(ATTR_TCP_WSCALE_ORIG, ct->head.set)) { |
| mnl_attr_put_u8(nlh, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL, |
| ct->protoinfo.tcp.wscale[__DIR_ORIG]); |
| } |
| if (test_bit(ATTR_TCP_WSCALE_REPL, ct->head.set)) { |
| mnl_attr_put_u8(nlh, CTA_PROTOINFO_TCP_WSCALE_REPLY, |
| ct->protoinfo.tcp.wscale[__DIR_REPL]); |
| } |
| mnl_attr_nest_end(nlh, nest_proto); |
| mnl_attr_nest_end(nlh, nest); |
| break; |
| case IPPROTO_SCTP: |
| /* See comment above on TCP. */ |
| if (!(test_bit(ATTR_SCTP_STATE, ct->head.set) || |
| test_bit(ATTR_SCTP_VTAG_ORIG, ct->head.set) || |
| test_bit(ATTR_SCTP_VTAG_REPL, ct->head.set))) { |
| break; |
| } |
| nest = mnl_attr_nest_start(nlh, CTA_PROTOINFO); |
| nest_proto = mnl_attr_nest_start(nlh, CTA_PROTOINFO_SCTP); |
| |
| if (test_bit(ATTR_SCTP_STATE, ct->head.set)) { |
| mnl_attr_put_u8(nlh, CTA_PROTOINFO_SCTP_STATE, |
| ct->protoinfo.sctp.state); |
| } |
| if (test_bit(ATTR_SCTP_VTAG_ORIG, ct->head.set)) { |
| mnl_attr_put_u32(nlh, CTA_PROTOINFO_SCTP_VTAG_ORIGINAL, |
| htonl(ct->protoinfo.sctp.vtag[__DIR_ORIG])); |
| } |
| if (test_bit(ATTR_SCTP_VTAG_REPL, ct->head.set)) { |
| mnl_attr_put_u32(nlh, CTA_PROTOINFO_SCTP_VTAG_REPLY, |
| htonl(ct->protoinfo.sctp.vtag[__DIR_REPL])); |
| } |
| mnl_attr_nest_end(nlh, nest_proto); |
| mnl_attr_nest_end(nlh, nest); |
| break; |
| case IPPROTO_DCCP: |
| /* See comment above on TCP. */ |
| if (!(test_bit(ATTR_DCCP_STATE, ct->head.set) || |
| test_bit(ATTR_DCCP_ROLE, ct->head.set) || |
| test_bit(ATTR_DCCP_HANDSHAKE_SEQ, ct->head.set))) { |
| break; |
| } |
| nest = mnl_attr_nest_start(nlh, CTA_PROTOINFO); |
| nest_proto = mnl_attr_nest_start(nlh, CTA_PROTOINFO_DCCP); |
| if (test_bit(ATTR_DCCP_STATE, ct->head.set)) { |
| mnl_attr_put_u8(nlh, CTA_PROTOINFO_DCCP_STATE, |
| ct->protoinfo.dccp.state); |
| } |
| if (test_bit(ATTR_DCCP_ROLE, ct->head.set)) { |
| mnl_attr_put_u8(nlh, CTA_PROTOINFO_DCCP_ROLE, |
| ct->protoinfo.dccp.role); |
| } |
| if (test_bit(ATTR_DCCP_HANDSHAKE_SEQ, ct->head.set)) { |
| uint64_t handshake_seq = |
| be64toh(ct->protoinfo.dccp.handshake_seq); |
| |
| mnl_attr_put_u64(nlh, CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ, |
| handshake_seq); |
| } |
| mnl_attr_nest_end(nlh, nest_proto); |
| mnl_attr_nest_end(nlh, nest); |
| default: |
| break; |
| } |
| return 0; |
| } |
| |
| static int |
| nfct_nat_seq_adj(struct nlmsghdr *nlh, const struct nf_conntrack *ct, int dir) |
| { |
| mnl_attr_put_u32(nlh, CTA_NAT_SEQ_CORRECTION_POS, |
| htonl(ct->natseq[dir].correction_pos)); |
| mnl_attr_put_u32(nlh, CTA_NAT_SEQ_OFFSET_BEFORE, |
| htonl(ct->natseq[dir].offset_before)); |
| mnl_attr_put_u32(nlh, CTA_NAT_SEQ_OFFSET_AFTER, |
| htonl(ct->natseq[dir].offset_after)); |
| return 0; |
| } |
| |
| static int |
| nfct_build_nat_seq_adj(struct nlmsghdr *nlh, const struct nf_conntrack *ct, |
| int dir) |
| { |
| int type = (dir == __DIR_ORIG) ? CTA_NAT_SEQ_ADJ_ORIG : |
| CTA_NAT_SEQ_ADJ_REPLY; |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, type); |
| nfct_nat_seq_adj(nlh, ct, dir); |
| mnl_attr_nest_end(nlh, nest); |
| |
| return 0; |
| } |
| |
| static int |
| nfct_build_protonat(struct nlmsghdr *nlh, const struct nf_conntrack *ct, |
| const struct __nfct_nat *nat) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_NAT_PROTO); |
| |
| switch (ct->head.orig.protonum) { |
| case IPPROTO_TCP: |
| case IPPROTO_UDP: |
| mnl_attr_put_u16(nlh, CTA_PROTONAT_PORT_MIN, |
| nat->l4min.tcp.port); |
| mnl_attr_put_u16(nlh, CTA_PROTONAT_PORT_MAX, |
| nat->l4max.tcp.port); |
| break; |
| } |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| static int |
| nfct_build_nat(struct nlmsghdr *nlh, const struct __nfct_nat *nat, |
| uint8_t l3protonum) |
| { |
| switch (l3protonum) { |
| case AF_INET: |
| mnl_attr_put_u32(nlh, CTA_NAT_MINIP, nat->min_ip.v4); |
| break; |
| case AF_INET6: |
| mnl_attr_put(nlh, CTA_NAT_V6_MINIP, sizeof(struct in6_addr), |
| &nat->min_ip.v6); |
| break; |
| default: |
| break; |
| } |
| return 0; |
| } |
| |
| static int |
| nfct_build_snat(struct nlmsghdr *nlh, const struct nf_conntrack *ct, |
| uint8_t l3protonum) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_NAT_SRC); |
| nfct_build_nat(nlh, &ct->snat, l3protonum); |
| nfct_build_protonat(nlh, ct, &ct->snat); |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| static int |
| nfct_build_snat_ipv4(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_NAT_SRC); |
| nfct_build_nat(nlh, &ct->snat, AF_INET); |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| static int |
| nfct_build_snat_ipv6(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_NAT_SRC); |
| nfct_build_nat(nlh, &ct->snat, AF_INET6); |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| static int |
| nfct_build_snat_port(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_NAT_SRC); |
| nfct_build_protonat(nlh, ct, &ct->snat); |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| static int |
| nfct_build_dnat(struct nlmsghdr *nlh, const struct nf_conntrack *ct, |
| uint8_t l3protonum) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_NAT_DST); |
| nfct_build_nat(nlh, &ct->dnat, l3protonum); |
| nfct_build_protonat(nlh, ct, &ct->dnat); |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| static int |
| nfct_build_dnat_ipv4(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_NAT_DST); |
| nfct_build_nat(nlh, &ct->dnat, AF_INET); |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| static int |
| nfct_build_dnat_ipv6(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_NAT_DST); |
| nfct_build_nat(nlh, &ct->dnat, AF_INET6); |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| static int |
| nfct_build_dnat_port(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_NAT_DST); |
| nfct_build_protonat(nlh, ct, &ct->dnat); |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| static int |
| nfct_build_status(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| mnl_attr_put_u32(nlh, CTA_STATUS, htonl(ct->status | IPS_CONFIRMED)); |
| return 0; |
| } |
| |
| static int |
| nfct_build_timeout(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| mnl_attr_put_u32(nlh, CTA_TIMEOUT, htonl(ct->timeout)); |
| return 0; |
| } |
| |
| static int |
| nfct_build_mark(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| mnl_attr_put_u32(nlh, CTA_MARK, htonl(ct->mark)); |
| return 0; |
| } |
| |
| static int |
| nfct_build_secmark(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| mnl_attr_put_u32(nlh, CTA_SECMARK, htonl(ct->secmark)); |
| return 0; |
| } |
| |
| static int |
| nfct_build_helper_name(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_HELP); |
| mnl_attr_put_strz(nlh, CTA_HELP_NAME, ct->helper_name); |
| |
| if (ct->helper_info != NULL) { |
| mnl_attr_put(nlh, CTA_HELP_INFO, ct->helper_info_len, |
| ct->helper_info); |
| } |
| mnl_attr_nest_end(nlh, nest); |
| return 0; |
| } |
| |
| static int |
| nfct_build_zone(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| mnl_attr_put_u16(nlh, CTA_ZONE, htons(ct->zone)); |
| return 0; |
| } |
| |
| static void |
| nfct_build_labels(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| struct nfct_bitmask *b = ct->connlabels; |
| unsigned int size = b->words * sizeof(b->bits[0]); |
| mnl_attr_put(nlh, CTA_LABELS, size, b->bits); |
| |
| if (test_bit(ATTR_CONNLABELS_MASK, ct->head.set)) { |
| b = ct->connlabels_mask; |
| if (size == (b->words * sizeof(b->bits[0]))) |
| mnl_attr_put(nlh, CTA_LABELS_MASK, size, b->bits); |
| } |
| } |
| |
| int |
| nfct_nlmsg_build(struct nlmsghdr *nlh, const struct nf_conntrack *ct) |
| { |
| if (!test_bit(ATTR_ORIG_L3PROTO, ct->head.set)) { |
| errno = EINVAL; |
| return -1; |
| } |
| |
| if (test_bit(ATTR_ORIG_IPV4_SRC, ct->head.set) || |
| test_bit(ATTR_ORIG_IPV4_DST, ct->head.set) || |
| test_bit(ATTR_ORIG_IPV6_SRC, ct->head.set) || |
| test_bit(ATTR_ORIG_IPV6_DST, ct->head.set) || |
| test_bit(ATTR_ORIG_PORT_SRC, ct->head.set) || |
| test_bit(ATTR_ORIG_PORT_DST, ct->head.set) || |
| test_bit(ATTR_ORIG_L3PROTO, ct->head.set) || |
| test_bit(ATTR_ORIG_L4PROTO, ct->head.set) || |
| test_bit(ATTR_ORIG_ZONE, ct->head.set) || |
| test_bit(ATTR_ICMP_TYPE, ct->head.set) || |
| test_bit(ATTR_ICMP_CODE, ct->head.set) || |
| test_bit(ATTR_ICMP_ID, ct->head.set)) { |
| const struct __nfct_tuple *t = &ct->head.orig; |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_TUPLE_ORIG); |
| if (nest == NULL) |
| return -1; |
| |
| if (nfct_build_tuple_raw(nlh, t) < 0) { |
| mnl_attr_nest_cancel(nlh, nest); |
| return -1; |
| } |
| |
| if (test_bit(ATTR_ORIG_ZONE, ct->head.set)) |
| mnl_attr_put_u16(nlh, CTA_TUPLE_ZONE, htons(t->zone)); |
| |
| mnl_attr_nest_end(nlh, nest); |
| } |
| |
| if (test_bit(ATTR_REPL_IPV4_SRC, ct->head.set) || |
| test_bit(ATTR_REPL_IPV4_DST, ct->head.set) || |
| test_bit(ATTR_REPL_IPV6_SRC, ct->head.set) || |
| test_bit(ATTR_REPL_IPV6_DST, ct->head.set) || |
| test_bit(ATTR_REPL_PORT_SRC, ct->head.set) || |
| test_bit(ATTR_REPL_PORT_DST, ct->head.set) || |
| test_bit(ATTR_REPL_L3PROTO, ct->head.set) || |
| test_bit(ATTR_REPL_L4PROTO, ct->head.set) || |
| test_bit(ATTR_REPL_ZONE, ct->head.set) || |
| test_bit(ATTR_ICMP_TYPE, ct->head.set) || |
| test_bit(ATTR_ICMP_CODE, ct->head.set) || |
| test_bit(ATTR_ICMP_ID, ct->head.set)) { |
| const struct __nfct_tuple *t = &ct->repl; |
| struct nlattr *nest; |
| |
| nest = mnl_attr_nest_start(nlh, CTA_TUPLE_REPLY); |
| if (nest == NULL) |
| return -1; |
| |
| if (nfct_build_tuple_raw(nlh, t) < 0) { |
| mnl_attr_nest_cancel(nlh, nest); |
| return -1; |
| } |
| |
| if (test_bit(ATTR_REPL_ZONE, ct->head.set)) |
| mnl_attr_put_u16(nlh, CTA_TUPLE_ZONE, htons(t->zone)); |
| |
| mnl_attr_nest_end(nlh, nest); |
| } |
| |
| if (test_bit(ATTR_MASTER_IPV4_SRC, ct->head.set) || |
| test_bit(ATTR_MASTER_IPV4_DST, ct->head.set) || |
| test_bit(ATTR_MASTER_IPV6_SRC, ct->head.set) || |
| test_bit(ATTR_MASTER_IPV6_DST, ct->head.set) || |
| test_bit(ATTR_MASTER_PORT_SRC, ct->head.set) || |
| test_bit(ATTR_MASTER_PORT_DST, ct->head.set) || |
| test_bit(ATTR_MASTER_L3PROTO, ct->head.set) || |
| test_bit(ATTR_MASTER_L4PROTO, ct->head.set)) { |
| nfct_build_tuple(nlh, &ct->master, CTA_TUPLE_MASTER); |
| } |
| |
| if (test_bit(ATTR_STATUS, ct->head.set)) |
| nfct_build_status(nlh, ct); |
| |
| if (test_bit(ATTR_TIMEOUT, ct->head.set)) |
| nfct_build_timeout(nlh, ct); |
| |
| if (test_bit(ATTR_MARK, ct->head.set)) |
| nfct_build_mark(nlh, ct); |
| |
| if (test_bit(ATTR_SECMARK, ct->head.set)) |
| nfct_build_secmark(nlh, ct); |
| |
| nfct_build_protoinfo(nlh, ct); |
| |
| if (test_bit(ATTR_SNAT_IPV4, ct->head.set) && |
| test_bit(ATTR_SNAT_PORT, ct->head.set)) { |
| nfct_build_snat(nlh, ct, AF_INET); |
| } else if (test_bit(ATTR_SNAT_IPV6, ct->head.set) && |
| test_bit(ATTR_SNAT_PORT, ct->head.set)) { |
| nfct_build_snat(nlh, ct, AF_INET6); |
| } else if (test_bit(ATTR_SNAT_IPV4, ct->head.set)) { |
| nfct_build_snat_ipv4(nlh, ct); |
| } else if (test_bit(ATTR_SNAT_IPV6, ct->head.set)) { |
| nfct_build_snat_ipv6(nlh, ct); |
| } else if (test_bit(ATTR_SNAT_PORT, ct->head.set)) { |
| nfct_build_snat_port(nlh, ct); |
| } |
| |
| if (test_bit(ATTR_DNAT_IPV4, ct->head.set) && |
| test_bit(ATTR_DNAT_PORT, ct->head.set)) { |
| nfct_build_dnat(nlh, ct, AF_INET); |
| } else if (test_bit(ATTR_DNAT_IPV6, ct->head.set) && |
| test_bit(ATTR_DNAT_PORT, ct->head.set)) { |
| nfct_build_dnat(nlh, ct, AF_INET6); |
| } else if (test_bit(ATTR_DNAT_IPV4, ct->head.set)) { |
| nfct_build_dnat_ipv4(nlh, ct); |
| } else if (test_bit(ATTR_DNAT_IPV6, ct->head.set)) { |
| nfct_build_dnat_ipv6(nlh, ct); |
| } else if (test_bit(ATTR_DNAT_PORT, ct->head.set)) { |
| nfct_build_dnat_port(nlh, ct); |
| } |
| |
| if (test_bit(ATTR_ORIG_NAT_SEQ_CORRECTION_POS, ct->head.set) && |
| test_bit(ATTR_ORIG_NAT_SEQ_OFFSET_BEFORE, ct->head.set) && |
| test_bit(ATTR_ORIG_NAT_SEQ_OFFSET_AFTER, ct->head.set)) { |
| nfct_build_nat_seq_adj(nlh, ct, __DIR_ORIG); |
| } |
| if (test_bit(ATTR_REPL_NAT_SEQ_CORRECTION_POS, ct->head.set) && |
| test_bit(ATTR_REPL_NAT_SEQ_OFFSET_BEFORE, ct->head.set) && |
| test_bit(ATTR_REPL_NAT_SEQ_OFFSET_AFTER, ct->head.set)) { |
| nfct_build_nat_seq_adj(nlh, ct, __DIR_REPL); |
| } |
| |
| if (test_bit(ATTR_HELPER_NAME, ct->head.set)) |
| nfct_build_helper_name(nlh, ct); |
| |
| if (test_bit(ATTR_ZONE, ct->head.set)) |
| nfct_build_zone(nlh, ct); |
| |
| if (test_bit(ATTR_CONNLABELS, ct->head.set)) |
| nfct_build_labels(nlh, ct); |
| |
| return 0; |
| } |