iptables: refactor to make targets extendable

Like matchers, targets should use a module-like register/lookup system. This
replaces the brittle switch statements we had before.

The only behavior change is supporing IPT_GET_REVISION_TARGET. This makes it
much easier to add IPv6 redirect in the next change.

Updates #3549.

PiperOrigin-RevId: 334469418

1 files changed, 3 insertions, 3 deletions

diff --git a/pkg/tcpip/network/ipv4/ipv4_test.go b/pkg/tcpip/network/ipv4/ipv4_test.go
index 0b3ed9483..277560e35 100644
--- a/pkg/tcpip/network/ipv4/ipv4_test.go
+++ b/pkg/tcpip/network/ipv4/ipv4_test.go
@@ -1040,7 +1040,7 @@ func TestWriteStats(t *testing.T) {
 					t.Fatalf("failed to find filter table")
 				}
 				ruleIdx := filter.BuiltinChains[stack.Output]
-				filter.Rules[ruleIdx].Target = stack.DropTarget{}
+				filter.Rules[ruleIdx].Target = &stack.DropTarget{}
 				if err := ipt.ReplaceTable(stack.FilterTable, filter, false /* ipv6 */); err != nil {
 					t.Fatalf("failed to replace table: %s", err)
 				}
@@ -1062,10 +1062,10 @@ func TestWriteStats(t *testing.T) {
 				}
 				// We'll match and DROP the last packet.
 				ruleIdx := filter.BuiltinChains[stack.Output]
-				filter.Rules[ruleIdx].Target = stack.DropTarget{}
+				filter.Rules[ruleIdx].Target = &stack.DropTarget{}
 				filter.Rules[ruleIdx].Matchers = []stack.Matcher{&limitedMatcher{nPackets - 1}}
 				// Make sure the next rule is ACCEPT.
-				filter.Rules[ruleIdx+1].Target = stack.AcceptTarget{}
+				filter.Rules[ruleIdx+1].Target = &stack.AcceptTarget{}
 				if err := ipt.ReplaceTable(stack.FilterTable, filter, false /* ipv6 */); err != nil {
 					t.Fatalf("failed to replace table: %s", err)
 				}