On 10/09/17 02:39, Louis Sautier wrote: > Hello, > I noticed that the iptables-restore-translate tool does not properly > translate the OUTPUT chain from the mangle table. It creates a filter > chain when it should be creating a route chain. > Here is a rather simple patch that should fix the issue. > > Please CC me, I'm not subscribed. > > Kind regards, > > Louis I made a typo in the commit message, it is related to xtables-translate, not xtables-compat-restore. Here is the fixed patch.
From d9f0f601e0a8be841650541382787cf80bd28e5f Mon Sep 17 00:00:00 2001
From: Louis Sautier <sautier.louis@xxxxxxxxx>
Date: Sun, 10 Sep 2017 02:13:18 +0200
Subject: [PATCH] xtables-translate: fix translation of mangle's OUTPUT chain
This chain should be translated as a route chain, not as a filter chain.
---
iptables/xtables-translate.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
index 3e6c7051..4f6a9caf 100644
--- a/iptables/xtables-translate.c
+++ b/iptables/xtables-translate.c
@@ -357,6 +357,8 @@ static int xlate_chain_set(struct nft_handle *h, const char *table,
if (strcmp(table, "nat") == 0)
type = "nat";
+ else if (strcmp(table, "mangle") == 0 && strcmp(chain, "OUTPUT") == 0)
+ type = "route";
printf("add chain %s %s %s { type %s ",
family2str[h->family], table, chain, type);
--
2.14.1
Attachment:
signature.asc
Description: OpenPGP digital signature
