diff options
| author | Phil Sutter <phil@nwl.cc> | 2021-09-14 12:15:29 +0200 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2021-09-27 13:29:53 +0200 |
| commit | 45d8f7690eb449fb8cc8191025d93f73cfc7f498 (patch) | |
| tree | e0780f5f7e220c465537e62f85459126950f0422 /iptables/nft-cmd.c | |
| parent | e865a853d7afcff4b2d4279ef843cd13fa6defa1 (diff) | |
nft: Delete builtin chains compatibly
Attempting to delete all chains if --delete-chain is called without
argument has unwanted side-effects especially legacy iptables users are
not aware of and won't expect:
* Non-default policies are ignored, a previously dropping firewall may
start accepting traffic.
* The kernel refuses to remove non-empty chains, causing program abort
even if no user-defined chain exists.
Fix this by requiring a rule cache in that situation and make builtin
chain deletion depend on its policy and number of rules. Since this may
change concurrently, check again when having to refresh the transaction.
Also, hide builtin chains from verbose output - their creation is
implicit, so treat their removal as implicit, too.
When deleting a specific chain, do not allow to skip the job though.
Otherwise deleting a builtin chain which is still in use will succeed
although not executed.
Fixes: 61e85e3192dea ("iptables-nft: allow removal of empty builtin chains")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'iptables/nft-cmd.c')
| -rw-r--r-- | iptables/nft-cmd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c index 2d874bd4..fcd01bd0 100644 --- a/iptables/nft-cmd.c +++ b/iptables/nft-cmd.c @@ -220,7 +220,7 @@ int nft_cmd_chain_del(struct nft_handle *h, const char *chain, /* This triggers nft_bridge_chain_postprocess() when fetching the * rule cache. */ - if (h->family == NFPROTO_BRIDGE) + if (h->family == NFPROTO_BRIDGE || !chain) nft_cache_level_set(h, NFT_CL_RULES, cmd); else nft_cache_level_set(h, NFT_CL_CHAINS, cmd); |