From 38fde6a6d9959fe8d0bb25e1800ae996becf0621 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 13 Sep 2024 16:57:48 +0200 Subject: extensions: TPROXY: Fix for translation being non-terminal nftables users have to explicitly add a verdict: xt_TPROXY's tproxy_tg4() returns NF_ACCEPT if a socket was found and assigned, NF_DROP otherwise. Fixes: a62fe15abcc99 ("extensions: xt_TPROXY: add txlate support") Signed-off-by: Phil Sutter Signed-off-by: Florian Westphal --- extensions/libxt_TPROXY.c | 2 ++ extensions/libxt_TPROXY.txlate | 14 +++++++------- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/extensions/libxt_TPROXY.c b/extensions/libxt_TPROXY.c index ffc9da13..5bdefee0 100644 --- a/extensions/libxt_TPROXY.c +++ b/extensions/libxt_TPROXY.c @@ -178,6 +178,8 @@ static int tproxy_tg_xlate(struct xt_xlate *xl, xt_xlate_add(xl, "meta mark set meta mark & 0x%x xor 0x%x", ~mask, info->mark_value); + /* unlike TPROXY target, tproxy statement is non-terminal */ + xt_xlate_add(xl, "accept"); return 1; } diff --git a/extensions/libxt_TPROXY.txlate b/extensions/libxt_TPROXY.txlate index 239bbe0d..f000baab 100644 --- a/extensions/libxt_TPROXY.txlate +++ b/extensions/libxt_TPROXY.txlate @@ -1,20 +1,20 @@ iptables-translate -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 12345 --on-ip 10.0.0.1 --tproxy-mark 0x23/0xff -nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to 10.0.0.1:12345 meta mark set meta mark & 0xffffff00 xor 0x23' +nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to 10.0.0.1:12345 meta mark set meta mark & 0xffffff00 xor 0x23 accept' iptables-translate -t mangle -A PREROUTING -p udp -j TPROXY --on-port 12345 --on-ip 10.0.0.1 --tproxy-mark 0x23 -nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1:12345 meta mark set 0x23' +nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1:12345 meta mark set 0x23 accept' iptables-translate -t mangle -A PREROUTING -p udp -j TPROXY --on-port 12345 --on-ip 10.0.0.1 -nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1:12345' +nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1:12345 accept' iptables-translate -t mangle -A PREROUTING -p udp -j TPROXY --on-ip 10.0.0.1 --on-port 0 -nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1' +nft 'add rule ip mangle PREROUTING ip protocol udp counter tproxy to 10.0.0.1 accept' iptables-translate -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 12345 -nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to :12345' +nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to :12345 accept' iptables-translate -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 0 -nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to :0' +nft 'add rule ip mangle PREROUTING ip protocol tcp counter tproxy to :0 accept' ip6tables-translate -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 12345 --on-ip dead::beef --tproxy-mark 0x23/0xffff -nft 'add rule ip6 mangle PREROUTING meta l4proto tcp counter tproxy to [dead::beef]:12345 meta mark set meta mark & 0xffff0000 xor 0x23' +nft 'add rule ip6 mangle PREROUTING meta l4proto tcp counter tproxy to [dead::beef]:12345 meta mark set meta mark & 0xffff0000 xor 0x23 accept' -- cgit v1.2.3