path: root/iptables/nft.h
diff options
authorFlorian Westphal <>2018-06-27 10:21:15 +0200
committerFlorian Westphal <>2018-06-27 23:43:00 +0200
commitd49ba500efd4dc50eef10324f3c0b4f7ce5d6e3e (patch)
tree3a27dd405538f69e828a2f2d2a940d3383c984d7 /iptables/nft.h
parent344c6eb52f9189e70471d2f08b6514de0c390bc7 (diff)
xtables-restore: init table before processing policies
*filter :INPUT DROP [32:4052] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] -A OUTPUT COMMIT will be restored with ACCEPT policies. When -A OUTPUT is processed, the OUTPUT chain isn't found in the chain cache, so the table is re-created with ACCEPT policies, which overrides the earlier DROP policies. A better fix would be to add the policy setting to the chain cache but it seems we'll need a chain abstraction with refcounting first. Fixes: 01e25e264a4c4 ("xtables: add chain cache") Signed-off-by: Florian Westphal <>
Diffstat (limited to 'iptables/nft.h')
1 files changed, 1 insertions, 0 deletions
diff --git a/iptables/nft.h b/iptables/nft.h
index 72c2fdc5..ffae84f2 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -67,6 +67,7 @@ int nft_for_each_table(struct nft_handle *h, int (*func)(struct nft_handle *h, c
bool nft_table_find(struct nft_handle *h, const char *tablename);
int nft_table_purge_chains(struct nft_handle *h, const char *table, struct nftnl_chain_list *list);
int nft_table_flush(struct nft_handle *h, const char *table);
+void nft_table_new(struct nft_handle *h, const char *table);
* Operations with chains.