| Message ID | 90185d38-8713-2a2a-6d47-c3db17f83dcb@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | xtables-compat-restore: fix translation of mangle's OUTPUT | expand |
On 10/09/17 02:39, Louis Sautier wrote: > Hello, > I noticed that the iptables-restore-translate tool does not properly > translate the OUTPUT chain from the mangle table. It creates a filter > chain when it should be creating a route chain. > Here is a rather simple patch that should fix the issue. > > Please CC me, I'm not subscribed. > > Kind regards, > > Louis I made a typo in the commit message, it is related to xtables-translate, not xtables-compat-restore. Here is the fixed patch. From d9f0f601e0a8be841650541382787cf80bd28e5f Mon Sep 17 00:00:00 2001 From: Louis Sautier <sautier.louis@gmail.com> Date: Sun, 10 Sep 2017 02:13:18 +0200 Subject: [PATCH] xtables-translate: fix translation of mangle's OUTPUT chain This chain should be translated as a route chain, not as a filter chain. --- iptables/xtables-translate.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c index 3e6c7051..4f6a9caf 100644 --- a/iptables/xtables-translate.c +++ b/iptables/xtables-translate.c @@ -357,6 +357,8 @@ static int xlate_chain_set(struct nft_handle *h, const char *table, if (strcmp(table, "nat") == 0) type = "nat"; + else if (strcmp(table, "mangle") == 0 && strcmp(chain, "OUTPUT") == 0) + type = "route"; printf("add chain %s %s %s { type %s ", family2str[h->family], table, chain, type);
On Sun, Sep 10, 2017 at 08:35:23PM +0200, Louis Sautier wrote: > On 10/09/17 02:39, Louis Sautier wrote: > > Hello, > > I noticed that the iptables-restore-translate tool does not properly > > translate the OUTPUT chain from the mangle table. It creates a filter > > chain when it should be creating a route chain. > > Here is a rather simple patch that should fix the issue. > > > > Please CC me, I'm not subscribed. Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From 4eb328c7756044279243419dd3f116754f924a3e Mon Sep 17 00:00:00 2001 From: Louis Sautier <sautier.louis@gmail.com> Date: Sun, 10 Sep 2017 02:13:18 +0200 Subject: [PATCH] xtables-compat-restore: fix translation of mangle's OUTPUT chain This chain should be translated as a route chain, not as a filter chain. --- iptables/xtables-translate.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c index 3e6c7051..4f6a9caf 100644 --- a/iptables/xtables-translate.c +++ b/iptables/xtables-translate.c @@ -357,6 +357,8 @@ static int xlate_chain_set(struct nft_handle *h, const char *table, if (strcmp(table, "nat") == 0) type = "nat"; + else if (strcmp(table, "mangle") == 0 && strcmp(chain, "OUTPUT") == 0) + type = "route"; printf("add chain %s %s %s { type %s ", family2str[h->family], table, chain, type); -- 2.14.1