diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-11-18 13:50:21 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-12-30 23:50:53 +0100 |
| commit | ee595bc702ca80f72c522406f6a06ba7c31eb8df (patch) | |
| tree | 9c20cb433358f68cdff0abd555d502cc70c86650 | |
| parent | 009bb1ae47f76fc538e0d6365448687f27d0f015 (diff) | |
nft: fix inversion of built-in selectors
(0ab045f xtables: fix missing ipt_entry for MASQUERADE target) broke
inversion of built-in selectors, such as -s, -d, etc.
We need to refresh the invflags if -p is used or set it for first
time if -p is not used, otherwise inversion is ignored.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | iptables/nft-ipv4.c | 4 | ||||
| -rw-r--r-- | iptables/nft-ipv6.c | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 2ac823fc..1afe8b66 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -343,6 +343,10 @@ static void nft_ipv4_post_parse(int command, struct xtables_args *args) { cs->fw.ip.flags = args->flags; + /* We already set invflags in proto_parse, but we need to refresh it + * to include new parsed options. + */ + cs->fw.ip.invflags = args->invflags; strncpy(cs->fw.ip.iniface, args->iniface, IFNAMSIZ); memcpy(cs->fw.ip.iniface_mask, diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index b02d9526..f30cec61 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -264,6 +264,10 @@ static void nft_ipv6_post_parse(int command, struct iptables_command_state *cs, args->flags |= IP6T_F_PROTO; cs->fw6.ipv6.flags = args->flags; + /* We already set invflags in proto_parse, but we need to refresh it + * to include new parsed options. + */ + cs->fw6.ipv6.invflags = args->invflags; strncpy(cs->fw6.ipv6.iniface, args->iniface, IFNAMSIZ); memcpy(cs->fw6.ipv6.iniface_mask, |