From b010e2a4a9ac2bcd0db2c3a41877d59d827a8a80 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 20 Mar 2026 16:19:39 +0100 Subject: netfilter: nfnetlink_hook: Dump nat type chains These chains are indirectly attached to the hook since they are not called for packets belonging to an established connection. Introduce NF_HOOK_OP_NAT to identify the container and dump attached entries instead of the container itself. Dump these entries with the dispatcher's priority value since their own priority merely defines ordering within the dispatcher's list. Signed-off-by: Phil Sutter Signed-off-by: Florian Westphal --- include/linux/netfilter.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include/linux') diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index efbbfa770d66..e99afc1414cd 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -93,6 +93,7 @@ enum nf_hook_ops_type { NF_HOOK_OP_NF_TABLES, NF_HOOK_OP_BPF, NF_HOOK_OP_NFT_FT, + NF_HOOK_OP_NAT, }; struct nf_hook_ops { @@ -140,6 +141,12 @@ struct nf_hook_entries { */ }; +struct nf_nat_lookup_hook_priv { + struct nf_hook_entries __rcu *entries; + + struct rcu_head rcu_head; +}; + #ifdef CONFIG_NETFILTER static inline struct nf_hook_ops **nf_hook_entries_get_hook_ops(const struct nf_hook_entries *e) { -- cgit v1.2.3