evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED)

Sergey reports:

With nf_tables it is not possible to use port range for masquerading.
Masquerade statement has option "to [:port-port]" which give no effect
to translation behavior. But it must change source port of packet to
one from ":port-port" range.

My network:

        +-----------------------------+
        |   ROUTER                    |
        |                             |
        |                   Masquerade|
        | 10.0.0.1            1.1.1.1 |
        | +------+           +------+ |
        | | eth1 |           | eth2 | |
        +-+--^---+-----------+---^--+-+
             |                   |
             |                   |
        +----v------+     +------v----+
        |           |     |           |
        | 10.0.0.2  |     |  1.1.1.2  |
        |           |     |           |
        |PC1        |     |PC2        |
        +-----------+     +-----------+

For testing i used rule like this:

        rule ip nat POSTROUTING oifname eth2 masquerade to :666

Run netcat for 1.1.1.2 667(UDP) and get dump from PC2:

        15:22:25.591567 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, ethertype IPv4 (0x0800), length 60: 1.1.1.1.34466 > 1.1.1.2.667: UDP, length 1

Address translation works fine, but source port are not belongs to
specified range.

I see in similar source code (i.e. nft_redir.c, nft_nat.c) that
there is setting NF_NAT_RANGE_PROTO_SPECIFIED flag. After adding this,
repeat test for kernel with this patch, and get dump:

        16:16:22.324710 a8:f9:4b:aa:08:44 > a8:f9:4b:ac:e7:8f, ethertype IPv4 (0x0800), length 60: 1.1.1.1.666 > 1.1.1.2.667: UDP, length 1

Now it is works fine.

Reported-by: Sergey Marinkevich <s@marinkevich.ru>
Tested-by: Sergey Marinkevich <s@marinkevich.ru>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index 4a23b231c74d31746111f892d1a81f40356898f4..d0e712dc02f02bb42408a890d0dae9400763b3e7 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -18,6 +18,7 @@
 #include <linux/netfilter_arp.h>
 #include <linux/netfilter/nf_tables.h>
 #include <linux/netfilter/nf_synproxy.h>
+#include <linux/netfilter/nf_nat.h>
 #include <linux/netfilter_ipv4.h>
 #include <netinet/ip_icmp.h>
 #include <netinet/icmp6.h>
@@ -2950,6 +2951,8 @@ static int stmt_evaluate_nat(struct eval_ctx *ctx, struct stmt *stmt)
                err = nat_evaluate_transport(ctx, stmt, &stmt->nat.proto);
                if (err < 0)
                        return err;
+
+               stmt->nat.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
        }
 
        stmt->flags |= STMT_F_TERMINAL;