diff options
| author | Phil Sutter <phil@nwl.cc> | 2016-11-25 18:06:46 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-11-29 23:03:50 +0100 |
| commit | 3531d7cc07d8121bcfd5379978d4d40c489c6dd5 (patch) | |
| tree | fb70d856c40690b33e4fd47925ada0aee93c6e1c /iptables/xtables-translate.c | |
| parent | bb498c8ba7bb3cba3678521d2d39fc0be28a7671 (diff) | |
xtables-translate: Support setting standard chain policy
Looks like this bit was simply forgotten when implementing
xlate_chain_set() as everything needed was there to just print the
desired policy along with the chain definition.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/xtables-translate.c')
| -rw-r--r-- | iptables/xtables-translate.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c index 689533f3..0c706dcc 100644 --- a/iptables/xtables-translate.c +++ b/iptables/xtables-translate.c @@ -354,16 +354,22 @@ static int xlate_chain_set(struct nft_handle *h, const char *table, { printf("add chain %s %s %s ", family2str[h->family], table, chain); if (strcmp(chain, "PREROUTING") == 0) - printf("{ type filter hook prerouting priority 0; }\n"); + printf("{ type filter hook prerouting priority 0; "); else if (strcmp(chain, "INPUT") == 0) - printf("{ type filter hook input priority 0; }\n"); + printf("{ type filter hook input priority 0; "); else if (strcmp(chain, "FORWARD") == 0) - printf("{ type filter hook forward priority 0; }\n"); + printf("{ type filter hook forward priority 0; "); else if (strcmp(chain, "OUTPUT") == 0) - printf("{ type filter hook output priority 0; }\n"); + printf("{ type filter hook output priority 0; "); else if (strcmp(chain, "POSTROUTING") == 0) - printf("{ type filter hook postrouting priority 0; }\n"); + printf("{ type filter hook postrouting priority 0; "); + if (strcmp(policy, "ACCEPT") == 0) + printf("policy accept; "); + else if (strcmp(policy, "DROP") == 0) + printf("policy drop; "); + + printf("}\n"); return 1; } |