diff options
| author | Phil Sutter <phil@nwl.cc> | 2024-09-13 16:57:48 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2024-09-15 17:17:34 +0200 |
| commit | 38fde6a6d9959fe8d0bb25e1800ae996becf0621 (patch) | |
| tree | e15d8844b5acaf223fb58f321adc4321a08ef165 /extensions/libxt_TPROXY.c | |
| parent | 76fce22826f8e860b5eb5b5a2463040c17ff85da (diff) | |
extensions: TPROXY: Fix for translation being non-terminal
nftables users have to explicitly add a verdict: xt_TPROXY's
tproxy_tg4() returns NF_ACCEPT if a socket was found and assigned,
NF_DROP otherwise.
Fixes: a62fe15abcc99 ("extensions: xt_TPROXY: add txlate support")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'extensions/libxt_TPROXY.c')
| -rw-r--r-- | extensions/libxt_TPROXY.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/extensions/libxt_TPROXY.c b/extensions/libxt_TPROXY.c index ffc9da13..5bdefee0 100644 --- a/extensions/libxt_TPROXY.c +++ b/extensions/libxt_TPROXY.c @@ -178,6 +178,8 @@ static int tproxy_tg_xlate(struct xt_xlate *xl, xt_xlate_add(xl, "meta mark set meta mark & 0x%x xor 0x%x", ~mask, info->mark_value); + /* unlike TPROXY target, tproxy statement is non-terminal */ + xt_xlate_add(xl, "accept"); return 1; } |