netfilter: nf_tables: fix missing return trace at the end of non-base chain

Display "return" for implicit rule at the end of a non-base chain,
instead of when popping chain from the stack.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 3 insertions, 5 deletions

diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index be08a96b4f45..421c36ac5145 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -182,18 +182,16 @@ next_rule:
         case NFT_RETURN:
                 if (unlikely(pkt->skb->nf_trace))
                         nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RETURN);
-
-                /* fall through */
+                break;
         case NFT_CONTINUE:
+                if (unlikely(pkt->skb->nf_trace && !(chain->flags & NFT_BASE_CHAIN)))
+                        nft_trace_packet(pkt, chain, ++rulenum, NFT_TRACE_RETURN);
                 break;
         default:
                 WARN_ON(1);
         }
 
         if (stackptr > 0) {
-                if (unlikely(pkt->skb->nf_trace))
-                        nft_trace_packet(pkt, chain, ++rulenum, NFT_TRACE_RETURN);
-
                 stackptr--;
                 chain = jumpstack[stackptr].chain;
                 rule  = jumpstack[stackptr].rule;