diff mbox series

[OpenWrt-Devel] firewall3: link zone_loopback_helper chain through an OUTPUT rule

Message ID 1544107497-27803-1-git-send-email-alin.nastac@technicolor.com
State Superseded
Headers show
Series [OpenWrt-Devel] firewall3: link zone_loopback_helper chain through an OUTPUT rule | expand

Commit Message

Alin Năstac Dec. 6, 2018, 2:44 p.m. UTC 
From: Alin Nastac <alin.nastac@gmail.com>

Locally-generated packets are passing through OUTPUT chain, not
PREROUTING.

Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
---
 zones.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/zones.c b/zones.c
index 505ab20..8c3daef 100644
--- a/zones.c
+++ b/zones.c
@@ -557,22 +557,24 @@  print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 	}
 	else if (handle->table == FW3_TABLE_RAW)
 	{
+		bool loopback_dev = (dev != NULL && !dev->any && !dev->invert && strcmp(dev->name, "lo") == 0);
+
 		if (has(zone->flags, handle->family, FW3_FLAG_HELPER))
 		{
-			r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
+			r = fw3_ipt_rule_create(handle, NULL, loopback_dev ? NULL : dev, NULL, sub, NULL);
 			fw3_ipt_rule_comment(r, "%s CT helper assignment", zone->name);
 			fw3_ipt_rule_target(r, "zone_%s_helper", zone->name);
 			fw3_ipt_rule_extra(r, zone->extra_src);
-			fw3_ipt_rule_replace(r, "PREROUTING");
+			fw3_ipt_rule_replace(r, loopback_dev ? "OUTPUT" : "PREROUTING");
 		}
 
 		if (has(zone->flags, handle->family, FW3_FLAG_NOTRACK))
 		{
-			r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
+			r = fw3_ipt_rule_create(handle, NULL, loopback_dev ? NULL : dev, NULL, sub, NULL);
 			fw3_ipt_rule_comment(r, "%s CT bypass", zone->name);
 			fw3_ipt_rule_target(r, "zone_%s_notrack", zone->name);
 			fw3_ipt_rule_extra(r, zone->extra_src);
-			fw3_ipt_rule_replace(r, "PREROUTING");
+			fw3_ipt_rule_replace(r, loopback_dev ? "OUTPUT" : "PREROUTING");
 		}
 	}
 }