From 8beafab74c391130fbb9111bfccab8613644e3b9 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 28 Jul 2023 19:43:16 +0200 Subject: rule: allow src/dstnat prios in input and output Dan Winship says: The "dnat" command is usable from either "prerouting" or "output", but the "dstnat" priority is only usable from "prerouting". (Likewise, "snat" is usable from either "postrouting" or "input", but "srcnat" is only usable from "postrouting".) No need to restrict those priorities to pre/postrouting. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1694 Signed-off-by: Florian Westphal --- src/rule.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/rule.c') diff --git a/src/rule.c b/src/rule.c index 533161d3..f4d00a8d 100644 --- a/src/rule.c +++ b/src/rule.c @@ -927,7 +927,8 @@ static bool std_prio_family_hook_compat(int prio, int family, int hook) case NFPROTO_INET: case NFPROTO_IPV4: case NFPROTO_IPV6: - if (hook == NF_INET_PRE_ROUTING) + if (hook == NF_INET_PRE_ROUTING || + hook == NF_INET_LOCAL_OUT) return true; } break; @@ -936,7 +937,8 @@ static bool std_prio_family_hook_compat(int prio, int family, int hook) case NFPROTO_INET: case NFPROTO_IPV4: case NFPROTO_IPV6: - if (hook == NF_INET_POST_ROUTING) + if (hook == NF_INET_LOCAL_IN || + hook == NF_INET_POST_ROUTING) return true; } } -- cgit v1.2.3