diff --git a/daemon/nftables.c b/daemon/nftables.c index eb55171dd..34b1e74c8 100644 --- a/daemon/nftables.c +++ b/daemon/nftables.c @@ -85,7 +85,7 @@ static void table_free(struct nftnl_table **t) { } -static int match_immediate_rtpe(struct nftnl_expr *e, void *data) { +static int match_immediate(struct nftnl_expr *e, void *data) { struct iterate_callbacks *callbacks = data; uint32_t len; @@ -96,8 +96,16 @@ static int match_immediate_rtpe(struct nftnl_expr *e, void *data) { if (n && !strcmp(n, callbacks->chain)) callbacks->rule_scratch.match_immediate = true; } - // and also match top-level targets - else if (!strcmp(n, "target")) { + return 0; +} + +static int match_rtpe(struct nftnl_expr *e, void *data) { + struct iterate_callbacks *callbacks = data; + + uint32_t len; + const char *n = nftnl_expr_get(e, NFTNL_EXPR_NAME, &len); + // match top-level targets + if (!strcmp(n, "target")) { n = nftnl_expr_get(e, NFTNL_EXPR_TG_NAME, &len); if (n && !strcmp(n, "RTPENGINE")) callbacks->rule_scratch.match_immediate = true; @@ -105,6 +113,12 @@ static int match_immediate_rtpe(struct nftnl_expr *e, void *data) { return 0; } +static int match_immediate_rtpe(struct nftnl_expr *e, void *data) { + match_immediate(e, data); + match_rtpe(e, data); + return 0; +} + static void check_immediate(struct nftnl_rule *r, struct iterate_callbacks *callbacks) { if (!callbacks->rule_scratch.match_immediate)