From ec38f84551e7488ca42ce06d028138d40539e47c Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Thu, 8 Aug 2019 13:40:01 -0400
Subject: [PATCH 27/28] fix: nftables: fix zone dispatch using ipset sources in
 nat chains

If using an ipset as a zone source the rules for doing a goto to the
zone's rules were omitted. This means the zone's rules for nat
postrouting/prerouting were not having any effect. Affected features;
masquerade, forward-ports

(cherry picked from commit b363548f2ab0983d7b88dd82620c0c545e2cef39)
---
 src/firewall/core/nftables.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
index c0b48f1501fd..33a170a76a98 100644
--- a/src/firewall/core/nftables.py
+++ b/src/firewall/core/nftables.py
@@ -610,10 +610,15 @@ class nftables(object):
         # nat tables needs to use ip/ip6 family
         if table == "nat" and family == "inet":
             rules = []
-            if check_address("ipv4", address) or check_mac(address):
+            if address.startswith("ipset:"):
+                ipset_family = self._set_get_family(address[len("ipset:"):])
+            else:
+                ipset_family = None
+
+            if check_address("ipv4", address) or check_mac(address) or ipset_family == "ip":
                 rules.extend(self.build_zone_source_address_rules(enable, zone,
                                     address, table, chain, "ip"))
-            if check_address("ipv6", address) or check_mac(address):
+            if check_address("ipv6", address) or check_mac(address) or ipset_family == "ip6":
                 rules.extend(self.build_zone_source_address_rules(enable, zone,
                                     address, table, chain, "ip6"))
             return rules
-- 
2.20.1