rule: allow src/dstnat prios in input and output

Dan Winship says:

The "dnat" command is usable from either "prerouting" or "output", but the
"dstnat" priority is only usable from "prerouting". (Likewise, "snat" is usable
from either "postrouting" or "input", but "srcnat" is only usable from
"postrouting".)

No need to restrict those priorities to pre/postrouting.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1694
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/src/rule.c b/src/rule.c
index 533161d3c23e031ea3d4e7c4aea4b5695669b255..f4d00a8d340f0071ce444297520b9375aae220c5 100644 (file)
--- a/src/rule.c
+++ b/src/rule.c
@@ -927,7 +927,8 @@ static bool std_prio_family_hook_compat(int prio, int family, int hook)
                case NFPROTO_INET:
                case NFPROTO_IPV4:
                case NFPROTO_IPV6:
-                       if (hook == NF_INET_PRE_ROUTING)
+                       if (hook == NF_INET_PRE_ROUTING ||
+                           hook == NF_INET_LOCAL_OUT)
                                return true;
                }
                break;
@@ -936,7 +937,8 @@ static bool std_prio_family_hook_compat(int prio, int family, int hook)
                case NFPROTO_INET:
                case NFPROTO_IPV4:
                case NFPROTO_IPV6:
-                       if (hook == NF_INET_POST_ROUTING)
+                       if (hook == NF_INET_LOCAL_IN ||
+                           hook == NF_INET_POST_ROUTING)
                                return true;
                }
        }