[OpenWrt-Devel] [PATCH] firewall3: link zone_loopback_helper chain through an OUTPUT rule

[Alin Nastac]

From: Alin Nastac <alin.nastac at gmail.com>

Locally-generated packets are passing through OUTPUT chain, not
PREROUTING.

Signed-off-by: Alin Nastac <alin.nastac at gmail.com>
---
 zones.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/zones.c b/zones.c
index 505ab20..8c3daef 100644
--- a/zones.c
+++ b/zones.c
@@ -557,22 +557,24 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 	}
 	else if (handle->table == FW3_TABLE_RAW)
 	{
+		bool loopback_dev = (dev != NULL && !dev->any && !dev->invert && strcmp(dev->name, "lo") == 0);
+
 		if (has(zone->flags, handle->family, FW3_FLAG_HELPER))
 		{
-			r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
+			r = fw3_ipt_rule_create(handle, NULL, loopback_dev ? NULL : dev, NULL, sub, NULL);
 			fw3_ipt_rule_comment(r, "%s CT helper assignment", zone->name);
 			fw3_ipt_rule_target(r, "zone_%s_helper", zone->name);
 			fw3_ipt_rule_extra(r, zone->extra_src);
-			fw3_ipt_rule_replace(r, "PREROUTING");
+			fw3_ipt_rule_replace(r, loopback_dev ? "OUTPUT" : "PREROUTING");
 		}
 
 		if (has(zone->flags, handle->family, FW3_FLAG_NOTRACK))
 		{
-			r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
+			r = fw3_ipt_rule_create(handle, NULL, loopback_dev ? NULL : dev, NULL, sub, NULL);
 			fw3_ipt_rule_comment(r, "%s CT bypass", zone->name);
 			fw3_ipt_rule_target(r, "zone_%s_notrack", zone->name);
 			fw3_ipt_rule_extra(r, zone->extra_src);
-			fw3_ipt_rule_replace(r, "PREROUTING");
+			fw3_ipt_rule_replace(r, loopback_dev ? "OUTPUT" : "PREROUTING");
 		}
 	}
 }
-- 
2.7.4


_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel