|
 |
136e2c |
From ad3e325cc67120b3c159a17d7bba1b216251d30f Mon Sep 17 00:00:00 2001
|
|
|
136e2c |
From: Eric Garver <eric@garver.life>
|
|
|
136e2c |
Date: Thu, 8 Aug 2019 13:40:01 -0400
|
|
|
136e2c |
Subject: [PATCH 77/79] fix: nftables: fix zone dispatch using ipset sources in
|
|
|
136e2c |
nat chains
|
|
|
136e2c |
|
|
|
136e2c |
If using an ipset as a zone source the rules for doing a goto to the
|
|
|
136e2c |
zone's rules were omitted. This means the zone's rules for nat
|
|
|
136e2c |
postrouting/prerouting were not having any effect. Affected features;
|
|
|
136e2c |
masquerade, forward-ports
|
|
|
136e2c |
|
|
|
136e2c |
(cherry picked from commit b363548f2ab0983d7b88dd82620c0c545e2cef39)
|
|
|
136e2c |
(cherry picked from commit 25ca77a113d895dabd0bc81463fff2db5c749f85)
|
|
|
136e2c |
---
|
|
|
136e2c |
src/firewall/core/nftables.py | 9 +++++++--
|
|
|
136e2c |
1 file changed, 7 insertions(+), 2 deletions(-)
|
|
|
136e2c |
|
|
|
136e2c |
diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
|
|
|
136e2c |
index 05376fdd68d8..e6a4ec3518a8 100644
|
|
|
136e2c |
--- a/src/firewall/core/nftables.py
|
|
|
136e2c |
+++ b/src/firewall/core/nftables.py
|
|
|
136e2c |
@@ -542,10 +542,15 @@ class nftables(object):
|
|
|
136e2c |
# nat tables needs to use ip/ip6 family
|
|
|
136e2c |
if table == "nat" and family == "inet":
|
|
|
136e2c |
rules = []
|
|
|
136e2c |
- if check_address("ipv4", address) or check_mac(address):
|
|
|
136e2c |
+ if address.startswith("ipset:"):
|
|
|
136e2c |
+ ipset_family = self._set_get_family(address[len("ipset:"):])
|
|
|
136e2c |
+ else:
|
|
|
136e2c |
+ ipset_family = None
|
|
|
136e2c |
+
|
|
|
136e2c |
+ if check_address("ipv4", address) or check_mac(address) or ipset_family == "ip":
|
|
|
136e2c |
rules.extend(self.build_zone_source_address_rules(enable, zone,
|
|
|
136e2c |
address, table, chain, "ip"))
|
|
|
136e2c |
- if check_address("ipv6", address) or check_mac(address):
|
|
|
136e2c |
+ if check_address("ipv6", address) or check_mac(address) or ipset_family == "ip6":
|
|
|
136e2c |
rules.extend(self.build_zone_source_address_rules(enable, zone,
|
|
|
136e2c |
address, table, chain, "ip6"))
|
|
|
136e2c |
return rules
|
|
|
136e2c |
--
|
|
|
136e2c |
2.20.1
|
|
|
136e2c |
|