rule: allow src/dstnat prios in input and output

commit 8beafab74c391130fbb9111bfccab8613644e3b9 upstream.

Dan Winship says:

The "dnat" command is usable from either "prerouting" or "output", but the
"dstnat" priority is only usable from "prerouting". (Likewise, "snat" is usable
from either "postrouting" or "input", but "srcnat" is only usable from
"postrouting".)

No need to restrict those priorities to pre/postrouting.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1694
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/src/rule.c b/src/rule.c
index 2fa36022b128569d539927273c32433c9a6af165..301e684667298b8ff20ff0c919176270f8c22a72 100644 (file)
--- a/src/rule.c
+++ b/src/rule.c
@@ -934,7 +934,8 @@ static bool std_prio_family_hook_compat(int prio, int family, int hook)
                case NFPROTO_INET:
                case NFPROTO_IPV4:
                case NFPROTO_IPV6:
-                       if (hook == NF_INET_PRE_ROUTING)
+                       if (hook == NF_INET_PRE_ROUTING ||
+                           hook == NF_INET_LOCAL_OUT)
                                return true;
                }
                break;
@@ -943,7 +944,8 @@ static bool std_prio_family_hook_compat(int prio, int family, int hook)
                case NFPROTO_INET:
                case NFPROTO_IPV4:
                case NFPROTO_IPV6:
-                       if (hook == NF_INET_POST_ROUTING)
+                       if (hook == NF_INET_LOCAL_IN ||
+                           hook == NF_INET_POST_ROUTING)
                                return true;
                }
        }