Hello, I noticed that the iptables-restore-translate tool does not properly translate the OUTPUT chain from the mangle table. It creates a filter chain when it should be creating a route chain. Here is a rather simple patch that should fix the issue. Please CC me, I'm not subscribed. Kind regards, Louis
From 4eb328c7756044279243419dd3f116754f924a3e Mon Sep 17 00:00:00 2001
From: Louis Sautier <sautier.louis@xxxxxxxxx>
Date: Sun, 10 Sep 2017 02:13:18 +0200
Subject: [PATCH] xtables-compat-restore: fix translation of mangle's OUTPUT
chain
This chain should be translated as a route chain, not as a filter chain.
---
iptables/xtables-translate.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
index 3e6c7051..4f6a9caf 100644
--- a/iptables/xtables-translate.c
+++ b/iptables/xtables-translate.c
@@ -357,6 +357,8 @@ static int xlate_chain_set(struct nft_handle *h, const char *table,
if (strcmp(table, "nat") == 0)
type = "nat";
+ else if (strcmp(table, "mangle") == 0 && strcmp(chain, "OUTPUT") == 0)
+ type = "route";
printf("add chain %s %s %s { type %s ",
family2str[h->family], table, chain, type);
--
2.14.1
Attachment:
signature.asc
Description: OpenPGP digital signature
