Hi. As you might know its currently not possible to use iptables and nft nat at the same time. I had a look at this and think we should fix this as follows: 1. decouple nat rewrite from nat chain/iptable_nat iteration. Currently we do this from nf_nat_ipv4/6_fn, so first call (be it nft nat or ip(6)table_nat) attaches nat translation or a null binding which makes 2nd invocation a no-op. 2. place a l3 protocol independent function that does null binding and rewrite in nf_nat_core. It can be independent because nf_nat_info has the l3 information and we don't need to deal with anything special except hooking at either NFPROTO_IPV4 or V6. 3. make all the nat expressions/targets call a helper function at init/destroy time so we can register the new rewrite hooks. This is easy, all these currently call nf_ct_netns_get/put so we only need to add nf_nat_netns_get/put which calls nf_ct_netns_get and registers a nat null-bind/rewrite hook. The downside is that we need one more hook function at priority NF_IP_PRI_NAT_SRC/DST + 1 in all places except forward. Another side effect is that this avoids the need to add (in nft case) the 'empty' nat base chains to take care of reply translation. Thoughts? Otherwise I'll have a go at this. This would also possibly allow us to add nat hooks in the INET family. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
