[iptables PATCH] extensions: TPROXY: Fix for translation being non-terminal

[iptables PATCH] extensions: TPROXY: Fix for translation being non-terminal

[Phil Sutter]

nftables users have to explicitly add a verdict: xt_TPROXY's
tproxy_tg4() returns NF_ACCEPT if a socket was found and assigned,
NF_DROP otherwise.

Fixes: a62fe15abcc99 ("extensions: xt_TPROXY: add txlate support")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 extensions/libxt_TPROXY.c      |  2 ++
 extensions/libxt_TPROXY.txlate | 14 +++++++-------
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/extensions/libxt_TPROXY.c b/extensions/libxt_TPROXY.c
index ffc9da1383b8c..5bdefee0e33a4 100644
--- a/extensions/libxt_TPROXY.c
+++ b/extensions/libxt_TPROXY.c
@@ -178,6 +178,8 @@ static int tproxy_tg_xlate(struct xt_xlate *xl,
 		xt_xlate_add(xl, "meta mark set meta mark & 0x%x xor 0x%x",
 			     ~mask, info->mark_value);
 
+	/* unlike TPROXY target, tproxy statement is non-terminal */
+	xt_xlate_add(xl, "accept");
 	return 1;
 }
 
diff --git a/extensions/libxt_TPROXY.txlate b/extensions/libxt_TPROXY.txlate
index 239bbe0dc8f9f..f000baab50e03 100644
--- a/extensions/libxt_TPROXY.txlate
+++ b/extensions/libxt_TPROXY.txlate
@@ -1,20 +1,20 @@
 iptables-translate -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 12345 --on-ip 10.0.0.1 --tproxy-mark 0x23/0xff
-nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to 10.0.0.1:12345 meta mark set meta mark & 0xffffff00 xor 0x23'
+nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to 10.0.0.1:12345 meta mark set meta mark & 0xffffff00 xor 0x23 accept'
 
 iptables-translate -t mangle -A PREROUTING -p udp -j TPROXY --on-port 12345 --on-ip 10.0.0.1 --tproxy-mark 0x23
-nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1:12345 meta mark set 0x23'
+nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1:12345 meta mark set 0x23 accept'
 
 iptables-translate -t mangle -A PREROUTING -p udp -j TPROXY --on-port 12345 --on-ip 10.0.0.1
-nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1:12345'
+nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1:12345 accept'
 
 iptables-translate -t mangle -A PREROUTING -p udp -j TPROXY --on-ip 10.0.0.1 --on-port 0
-nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1'
+nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1 accept'
 
 iptables-translate -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 12345
-nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to :12345'
+nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to :12345 accept'
 
 iptables-translate -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 0
-nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to :0'
+nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to :0 accept'
 
 ip6tables-translate -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 12345 --on-ip dead::beef --tproxy-mark 0x23/0xffff
-nft 'add rule ip6 mangle PREROUTING meta l4proto tcp counter tproxy to [dead::beef]:12345 meta mark set meta mark & 0xffff0000 xor 0x23'
+nft 'add rule ip6 mangle PREROUTING meta l4proto tcp counter tproxy to [dead::beef]:12345 meta mark set meta mark & 0xffff0000 xor 0x23 accept'
-- 
2.43.0

Re: [iptables PATCH] extensions: TPROXY: Fix for translation being non-terminal

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> nftables users have to explicitly add a verdict: xt_TPROXY's
> tproxy_tg4() returns NF_ACCEPT if a socket was found and assigned,
> NF_DROP otherwise.

Thanks Phil, lgtm!