[PATCH] xtables-translate: Support setting standard chain policy

[PATCH] xtables-translate: Support setting standard chain policy

[Phil Sutter]

Looks like this bit was simply forgotten when implementing
xlate_chain_set() as everything needed was there to just print the
desired policy along with the chain definition.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables/xtables-translate.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
index 689533f3d4d85..0c706dcc2b9db 100644
--- a/iptables/xtables-translate.c
+++ b/iptables/xtables-translate.c
@@ -354,16 +354,22 @@ static int xlate_chain_set(struct nft_handle *h, const char *table,
 {
 	printf("add chain %s %s %s ", family2str[h->family], table, chain);
 	if (strcmp(chain, "PREROUTING") == 0)
-		printf("{ type filter hook prerouting priority 0; }\n");
+		printf("{ type filter hook prerouting priority 0; ");
 	else if (strcmp(chain, "INPUT") == 0)
-		printf("{ type filter hook input priority 0; }\n");
+		printf("{ type filter hook input priority 0; ");
 	else if (strcmp(chain, "FORWARD") == 0)
-		printf("{ type filter hook forward priority 0; }\n");
+		printf("{ type filter hook forward priority 0; ");
 	else if (strcmp(chain, "OUTPUT") == 0)
-		printf("{ type filter hook output priority 0; }\n");
+		printf("{ type filter hook output priority 0; ");
 	else if (strcmp(chain, "POSTROUTING") == 0)
-		printf("{ type filter hook postrouting priority 0; }\n");
+		printf("{ type filter hook postrouting priority 0; ");
 
+	if (strcmp(policy, "ACCEPT") == 0)
+		printf("policy accept; ");
+	else if (strcmp(policy, "DROP") == 0)
+		printf("policy drop; ");
+
+	printf("}\n");
 	return 1;
 }
 
-- 
2.10.0

Re: [PATCH] xtables-translate: Support setting standard chain policy

[Pablo Neira Ayuso]

On Fri, Nov 25, 2016 at 06:06:46PM +0100, Phil Sutter wrote:
> Looks like this bit was simply forgotten when implementing
> xlate_chain_set() as everything needed was there to just print the
> desired policy along with the chain definition.

Also applied, thanks.