path: root/iptables/nft-ipv6.c
diff options
authorPablo Neira Ayuso <>2013-11-18 13:50:21 +0100
committerPablo Neira Ayuso <>2013-12-30 23:50:53 +0100
commitee595bc702ca80f72c522406f6a06ba7c31eb8df (patch)
tree9c20cb433358f68cdff0abd555d502cc70c86650 /iptables/nft-ipv6.c
parent009bb1ae47f76fc538e0d6365448687f27d0f015 (diff)
nft: fix inversion of built-in selectors
(0ab045f xtables: fix missing ipt_entry for MASQUERADE target) broke inversion of built-in selectors, such as -s, -d, etc. We need to refresh the invflags if -p is used or set it for first time if -p is not used, otherwise inversion is ignored. Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'iptables/nft-ipv6.c')
1 files changed, 4 insertions, 0 deletions
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index b02d9526..f30cec61 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -264,6 +264,10 @@ static void nft_ipv6_post_parse(int command, struct iptables_command_state *cs,
args->flags |= IP6T_F_PROTO;
cs->fw6.ipv6.flags = args->flags;
+ /* We already set invflags in proto_parse, but we need to refresh it
+ * to include new parsed options.
+ */
+ cs->fw6.ipv6.invflags = args->invflags;
strncpy(cs->fw6.ipv6.iniface, args->iniface, IFNAMSIZ);