4.19-iptables-raw-POSTROUTING.patch

--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -9,7 +9,7 @@
 #include <linux/slab.h>
 #include <net/ip.h>
 
-#define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
+#define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_LOCAL_OUT))
 
 static int __net_init iptable_raw_table_init(struct net *net);
 
@@ -22,16 +22,6 @@ static const struct xt_table packet_raw
 	.valid_hooks =  RAW_VALID_HOOKS,
 	.me = THIS_MODULE,
 	.af = NFPROTO_IPV4,
-	.priority = NF_IP_PRI_RAW,
-	.table_init = iptable_raw_table_init,
-};
-
-static const struct xt_table packet_raw_before_defrag = {
-	.name = "raw",
-	.valid_hooks =  RAW_VALID_HOOKS,
-	.me = THIS_MODULE,
-	.af = NFPROTO_IPV4,
-	.priority = NF_IP_PRI_RAW_BEFORE_DEFRAG,
 	.table_init = iptable_raw_table_init,
 };
 
@@ -43,16 +33,38 @@ iptable_raw_hook(void *priv, struct sk_b
 	return ipt_do_table(skb, state, state->net->ipv4.iptable_raw);
 }
 
-static struct nf_hook_ops *rawtable_ops __read_mostly;
+static struct nf_hook_ops rawtable_ops[] = {
+	{
+		.hook		= iptable_raw_hook,
+		.pf		= NFPROTO_IPV4,
+		.hooknum	= NF_INET_PRE_ROUTING,
+		.priority	= NF_IP_PRI_RAW,
+	},
+	{
+		.hook		= iptable_raw_hook,
+		.pf		= NFPROTO_IPV4,
+		.hooknum	= NF_INET_POST_ROUTING,
+		.priority	= NF_IP_PRI_NAT_SRC + 1,
+	},
+	{
+		.hook		= iptable_raw_hook,
+		.pf		= NFPROTO_IPV4,
+		.hooknum	= NF_INET_LOCAL_OUT,
+		.priority	= NF_IP_PRI_RAW,
+	},
+};
 
 static int __net_init iptable_raw_table_init(struct net *net)
 {
 	struct ipt_replace *repl;
 	const struct xt_table *table = &packet_raw;
 	int ret;
+	int i;
 
 	if (raw_before_defrag)
-		table = &packet_raw_before_defrag;
+		for (i = 0; i < ARRAY_SIZE(rawtable_ops); i++)
+			if (rawtable_ops[i].priority == NF_IP_PRI_RAW)
+				rawtable_ops[i].priority = NF_IP_PRI_RAW_BEFORE_DEFRAG;
 
 	if (net->ipv4.iptable_raw)
 		return 0;
@@ -84,25 +96,17 @@ static int __init iptable_raw_init(void)
 	const struct xt_table *table = &packet_raw;
 
 	if (raw_before_defrag) {
-		table = &packet_raw_before_defrag;
-
 		pr_info("Enabling raw table before defrag\n");
 	}
 
-	rawtable_ops = xt_hook_ops_alloc(table, iptable_raw_hook);
-	if (IS_ERR(rawtable_ops))
-		return PTR_ERR(rawtable_ops);
-
 	ret = register_pernet_subsys(&iptable_raw_net_ops);
 	if (ret < 0) {
-		kfree(rawtable_ops);
 		return ret;
 	}
 
 	ret = iptable_raw_table_init(&init_net);
 	if (ret) {
 		unregister_pernet_subsys(&iptable_raw_net_ops);
-		kfree(rawtable_ops);
 	}
 
 	return ret;
@@ -111,7 +115,6 @@ static int __init iptable_raw_init(void)
 static void __exit iptable_raw_fini(void)
 {
 	unregister_pernet_subsys(&iptable_raw_net_ops);
-	kfree(rawtable_ops);
 }
 
 module_init(iptable_raw_init);
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -8,7 +8,7 @@
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/slab.h>
 
-#define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
+#define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_LOCAL_OUT))
 
 static int __net_init ip6table_raw_table_init(struct net *net);
 
@@ -21,16 +21,6 @@ static const struct xt_table packet_raw
 	.valid_hooks = RAW_VALID_HOOKS,
 	.me = THIS_MODULE,
 	.af = NFPROTO_IPV6,
-	.priority = NF_IP6_PRI_RAW,
-	.table_init = ip6table_raw_table_init,
-};
-
-static const struct xt_table packet_raw_before_defrag = {
-	.name = "raw",
-	.valid_hooks = RAW_VALID_HOOKS,
-	.me = THIS_MODULE,
-	.af = NFPROTO_IPV6,
-	.priority = NF_IP6_PRI_RAW_BEFORE_DEFRAG,
 	.table_init = ip6table_raw_table_init,
 };
 
@@ -42,16 +32,38 @@ ip6table_raw_hook(void *priv, struct sk_
 	return ip6t_do_table(skb, state, state->net->ipv6.ip6table_raw);
 }
 
-static struct nf_hook_ops *rawtable_ops __read_mostly;
+static struct nf_hook_ops rawtable_ops[] = {
+	{
+		.hook		= ip6table_raw_hook,
+		.pf		= NFPROTO_IPV6,
+		.hooknum	= NF_INET_PRE_ROUTING,
+		.priority	= NF_IP6_PRI_RAW,
+	},
+	{
+		.hook		= ip6table_raw_hook,
+		.pf		= NFPROTO_IPV6,
+		.hooknum	= NF_INET_POST_ROUTING,
+		.priority	= NF_IP6_PRI_NAT_SRC + 1,
+	},
+	{
+		.hook		= ip6table_raw_hook,
+		.pf		= NFPROTO_IPV6,
+		.hooknum	= NF_INET_LOCAL_OUT,
+		.priority	= NF_IP6_PRI_RAW,
+	},
+};
 
 static int __net_init ip6table_raw_table_init(struct net *net)
 {
 	struct ip6t_replace *repl;
 	const struct xt_table *table = &packet_raw;
 	int ret;
+	int i;
 
 	if (raw_before_defrag)
-		table = &packet_raw_before_defrag;
+		for (i = 0; i < ARRAY_SIZE(rawtable_ops); i++)
+			if (rawtable_ops[i].priority == NF_IP6_PRI_RAW)
+				rawtable_ops[i].priority = NF_IP6_PRI_RAW_BEFORE_DEFRAG;
 
 	if (net->ipv6.ip6table_raw)
 		return 0;
@@ -83,26 +95,17 @@ static int __init ip6table_raw_init(void
 	const struct xt_table *table = &packet_raw;
 
 	if (raw_before_defrag) {
-		table = &packet_raw_before_defrag;
-
 		pr_info("Enabling raw table before defrag\n");
 	}
 
-	/* Register hooks */
-	rawtable_ops = xt_hook_ops_alloc(table, ip6table_raw_hook);
-	if (IS_ERR(rawtable_ops))
-		return PTR_ERR(rawtable_ops);
-
 	ret = register_pernet_subsys(&ip6table_raw_net_ops);
 	if (ret < 0) {
-		kfree(rawtable_ops);
 		return ret;
 	}
 
 	ret = ip6table_raw_table_init(&init_net);
 	if (ret) {
 		unregister_pernet_subsys(&ip6table_raw_net_ops);
-		kfree(rawtable_ops);
 	}
 	return ret;
 }
@@ -110,7 +113,6 @@ static int __init ip6table_raw_init(void
 static void __exit ip6table_raw_fini(void)
 {
 	unregister_pernet_subsys(&ip6table_raw_net_ops);
-	kfree(rawtable_ops);
 }
 
 module_init(ip6table_raw_init);