Re: [nft PATCH v2] src: add redirect support

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Nov 03, 2014 at 08:42:13PM +0100, Arturo Borrero Gonzalez wrote:
> On 30 October 2014 17:25, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Thu, Oct 16, 2014 at 12:41:19PM +0200, Arturo Borrero Gonzalez wrote:
> >> This patch adds redirect support for nft.
> >>
> >> The syntax is:
> >>
> >>  % nft add rule nat prerouting redirect [port|nat_flags]
> >
> > I prefer if you add a couple of valid examples to the patch
> > description. This won't work as the protocol is not specified.
> >
> > There's also some minor issues with this patch:
> >
> > % nft add rule nat prerouting redirect
> > Memory allocation failure
> >
> > Please, address and resubmit, thanks Arturo.
> 
> Hi Pablo,
> 
> I've take further look at this patch. I don't see any issue.
>
> As masquerade, I think redirect without protocol should work. I just
> tested again the patch with ICMP packets and the redirection simply
> works. I used tcpdump for the checks. The rule I used is the same as
> in the patch description.

I think this needs to be:

% nft add rule nat prerouting redirect [port] [nat_flags]

And, I think it doesn't make any bad if you extend the description
with some examples as I requested.

Or update the documentation in the same patch including the new
redirect expression.

I'm going to apply this now, but next time please address my requests.

> Regarding the memory allocation failure, I'm unable to find the issue.

My fault, the "memory allocation failure" happens when you use an old
libnftnl with no redirect support, which was the case in my testbed. I
just fixed it here.