[PATCH] xtables-compat-restore: fix translation of mangle's OUTPUT

[PATCH] xtables-compat-restore: fix translation of mangle's OUTPUT

[Louis Sautier]

[-- Attachment #1.1.1: Type: text/plain, Size: 319 bytes --]

Hello,
I noticed that the iptables-restore-translate tool does not properly
translate the OUTPUT chain from the mangle table. It creates a filter
chain when it should be creating a route chain.
Here is a rather simple patch that should fix the issue.

Please CC me, I'm not subscribed.

Kind regards,

Louis

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.1.2: 0001-xtables-compat-restore-fix-translation-of-mangle-s-O.patch --]
[-- Type: text/x-patch; name="0001-xtables-compat-restore-fix-translation-of-mangle-s-O.patch", Size: 930 bytes --]

From 4eb328c7756044279243419dd3f116754f924a3e Mon Sep 17 00:00:00 2001
From: Louis Sautier <sautier.louis@gmail.com>
Date: Sun, 10 Sep 2017 02:13:18 +0200
Subject: [PATCH] xtables-compat-restore: fix translation of mangle's OUTPUT
 chain

This chain should be translated as a route chain, not as a filter chain.
---
 iptables/xtables-translate.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
index 3e6c7051..4f6a9caf 100644
--- a/iptables/xtables-translate.c
+++ b/iptables/xtables-translate.c
@@ -357,6 +357,8 @@ static int xlate_chain_set(struct nft_handle *h, const char *table,
 
 	if (strcmp(table, "nat") == 0)
 		type = "nat";
+	else if (strcmp(table, "mangle") == 0 && strcmp(chain, "OUTPUT") == 0)
+		type = "route";
 
 	printf("add chain %s %s %s { type %s ",
 	       family2str[h->family], table, chain, type);
-- 
2.14.1


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH] xtables-compat-restore: fix translation of mangle's OUTPUT

[Louis Sautier]

[-- Attachment #1.1.1: Type: text/plain, Size: 511 bytes --]

On 10/09/17 02:39, Louis Sautier wrote:
> Hello,
> I noticed that the iptables-restore-translate tool does not properly
> translate the OUTPUT chain from the mangle table. It creates a filter
> chain when it should be creating a route chain.
> Here is a rather simple patch that should fix the issue.
>
> Please CC me, I'm not subscribed.
>
> Kind regards,
>
> Louis

I made a typo in the commit message, it is related to xtables-translate,
not xtables-compat-restore. Here is the fixed patch.


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.1.2: 0001-xtables-translate-fix-translation-of-mangle-s-OUTPUT.patch --]
[-- Type: text/x-patch; name="0001-xtables-translate-fix-translation-of-mangle-s-OUTPUT.patch", Size: 923 bytes --]

From d9f0f601e0a8be841650541382787cf80bd28e5f Mon Sep 17 00:00:00 2001
From: Louis Sautier <sautier.louis@gmail.com>
Date: Sun, 10 Sep 2017 02:13:18 +0200
Subject: [PATCH] xtables-translate: fix translation of mangle's OUTPUT chain

This chain should be translated as a route chain, not as a filter chain.
---
 iptables/xtables-translate.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
index 3e6c7051..4f6a9caf 100644
--- a/iptables/xtables-translate.c
+++ b/iptables/xtables-translate.c
@@ -357,6 +357,8 @@ static int xlate_chain_set(struct nft_handle *h, const char *table,
 
 	if (strcmp(table, "nat") == 0)
 		type = "nat";
+	else if (strcmp(table, "mangle") == 0 && strcmp(chain, "OUTPUT") == 0)
+		type = "route";
 
 	printf("add chain %s %s %s { type %s ",
 	       family2str[h->family], table, chain, type);
-- 
2.14.1


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH] xtables-compat-restore: fix translation of mangle's OUTPUT

[Pablo Neira Ayuso]

On Sun, Sep 10, 2017 at 08:35:23PM +0200, Louis Sautier wrote:
> On 10/09/17 02:39, Louis Sautier wrote:
> > Hello,
> > I noticed that the iptables-restore-translate tool does not properly
> > translate the OUTPUT chain from the mangle table. It creates a filter
> > chain when it should be creating a route chain.
> > Here is a rather simple patch that should fix the issue.
> >
> > Please CC me, I'm not subscribed.

Applied, thanks.