netfilter: add helper for adding nat extension

Reduce copy-past a bit by adding a common helper.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_nat.h b/include/net/netfilter/nf_nat.h
index 07eaaf60409215198961cea9834c2d770a90f02e..a71dd333ac6869fdce096dce3a26be133e4d4aae 100644 (file)
--- a/include/net/netfilter/nf_nat.h
+++ b/include/net/netfilter/nf_nat.h
@@ -48,6 +48,8 @@ unsigned int nf_nat_setup_info(struct nf_conn *ct,
 extern unsigned int nf_nat_alloc_null_binding(struct nf_conn *ct,
                                              unsigned int hooknum);
 
+struct nf_conn_nat *nf_ct_nat_ext_add(struct nf_conn *ct);
+
 /* Is this tuple already taken? (not by us)*/
 int nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,
                      const struct nf_conn *ignored_conntrack);

diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_nat.c
index ee2886126e3dfad44e7c801d82ad2ec4bad621d3..f1787c04a4ddfe06f70cd09c4b4c2573c434042d 100644 (file)
--- a/net/ipv4/netfilter/iptable_nat.c
+++ b/net/ipv4/netfilter/iptable_nat.c
@@ -91,17 +91,9 @@ nf_nat_ipv4_fn(const struct nf_hook_ops *ops,
        if (nf_ct_is_untracked(ct))
                return NF_ACCEPT;
 
-       nat = nfct_nat(ct);
-       if (!nat) {
-               /* NAT module was loaded late. */
-               if (nf_ct_is_confirmed(ct))
-                       return NF_ACCEPT;
-               nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
-               if (nat == NULL) {
-                       pr_debug("failed to add NAT extension\n");
-                       return NF_ACCEPT;
-               }
-       }
+       nat = nf_ct_nat_ext_add(ct);
+       if (nat == NULL)
+               return NF_ACCEPT;
 
        switch (ctinfo) {
        case IP_CT_RELATED:

diff --git a/net/ipv4/netfilter/nft_chain_nat_ipv4.c b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
index b5b256d45e67b7f2dd288017b9f728edf72d32c3..3964157d826c197e27ce0578c2da409bbc6e4dec 100644 (file)
--- a/net/ipv4/netfilter/nft_chain_nat_ipv4.c
+++ b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
@@ -48,15 +48,9 @@ static unsigned int nf_nat_fn(const struct nf_hook_ops *ops,
 
        NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)));
 
-       nat = nfct_nat(ct);
-       if (nat == NULL) {
-               /* Conntrack module was loaded late, can't add extension. */
-               if (nf_ct_is_confirmed(ct))
-                       return NF_ACCEPT;
-               nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
-               if (nat == NULL)
-                       return NF_ACCEPT;
-       }
+       nat = nf_ct_nat_ext_add(ct);
+       if (nat == NULL)
+               return NF_ACCEPT;
 
        switch (ctinfo) {
        case IP_CT_RELATED:

diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index 84c7f33d0cf858115abdb5f359a658b574637d57..387d8b8fc18db9744426e6f8c258a71d3f3d06fb 100644 (file)
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -90,17 +90,9 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops,
        if (nf_ct_is_untracked(ct))
                return NF_ACCEPT;
 
-       nat = nfct_nat(ct);
-       if (!nat) {
-               /* NAT module was loaded late. */
-               if (nf_ct_is_confirmed(ct))
-                       return NF_ACCEPT;
-               nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
-               if (nat == NULL) {
-                       pr_debug("failed to add NAT extension\n");
-                       return NF_ACCEPT;
-               }
-       }
+       nat = nf_ct_nat_ext_add(ct);
+       if (nat == NULL)
+               return NF_ACCEPT;
 
        switch (ctinfo) {
        case IP_CT_RELATED:

diff --git a/net/ipv6/netfilter/nft_chain_nat_ipv6.c b/net/ipv6/netfilter/nft_chain_nat_ipv6.c
index 9c3297a768fd1f0bb0aae5f784f2482b03a8ce15..d189fcb437feb9de2f43d5217389c90e029dbd21 100644 (file)
--- a/net/ipv6/netfilter/nft_chain_nat_ipv6.c
+++ b/net/ipv6/netfilter/nft_chain_nat_ipv6.c
@@ -47,15 +47,9 @@ static unsigned int nf_nat_ipv6_fn(const struct nf_hook_ops *ops,
        if (ct == NULL || nf_ct_is_untracked(ct))
                return NF_ACCEPT;
 
-       nat = nfct_nat(ct);
-       if (nat == NULL) {
-               /* Conntrack module was loaded late, can't add extension. */
-               if (nf_ct_is_confirmed(ct))
-                       return NF_ACCEPT;
-               nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
-               if (nat == NULL)
-                       return NF_ACCEPT;
-       }
+       nat = nf_ct_nat_ext_add(ct);
+       if (nat == NULL)
+               return NF_ACCEPT;
 
        switch (ctinfo) {
        case IP_CT_RELATED:

diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 52ca952b802c5e3ea41c83823b90f74365b8fc76..09096a670c45b6da72fcef70646f58139ce2af39 100644 (file)
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -358,6 +358,19 @@ out:
        rcu_read_unlock();
 }
 
+struct nf_conn_nat *nf_ct_nat_ext_add(struct nf_conn *ct)
+{
+       struct nf_conn_nat *nat = nfct_nat(ct);
+       if (nat)
+               return nat;
+
+       if (!nf_ct_is_confirmed(ct))
+               nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
+
+       return nat;
+}
+EXPORT_SYMBOL_GPL(nf_ct_nat_ext_add);
+
 unsigned int
 nf_nat_setup_info(struct nf_conn *ct,
                  const struct nf_nat_range *range,
@@ -368,14 +381,9 @@ nf_nat_setup_info(struct nf_conn *ct,
        struct nf_conn_nat *nat;
 
        /* nat helper or nfctnetlink also setup binding */
-       nat = nfct_nat(ct);
-       if (!nat) {
-               nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
-               if (nat == NULL) {
-                       pr_debug("failed to add NAT extension\n");
-                       return NF_ACCEPT;
-               }
-       }
+       nat = nf_ct_nat_ext_add(ct);
+       if (nat == NULL)
+               return NF_ACCEPT;
 
        NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||
                     maniptype == NF_NAT_MANIP_DST);