From d49ba500efd4dc50eef10324f3c0b4f7ce5d6e3e Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Wed, 27 Jun 2018 10:21:15 +0200 Subject: xtables-restore: init table before processing policies *filter :INPUT DROP [32:4052] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] -A OUTPUT COMMIT will be restored with ACCEPT policies. When -A OUTPUT is processed, the OUTPUT chain isn't found in the chain cache, so the table is re-created with ACCEPT policies, which overrides the earlier DROP policies. A better fix would be to add the policy setting to the chain cache but it seems we'll need a chain abstraction with refcounting first. Fixes: 01e25e264a4c4 ("xtables: add chain cache") Signed-off-by: Florian Westphal --- iptables/xtables-restore.c | 1 + 1 file changed, 1 insertion(+) (limited to 'iptables/xtables-restore.c') diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c index 4a768535..f127093d 100644 --- a/iptables/xtables-restore.c +++ b/iptables/xtables-restore.c @@ -195,6 +195,7 @@ struct nft_xt_restore_cb restore_cb = { .chain_list = get_chain_list, .commit = nft_commit, .abort = nft_abort, + .table_new = nft_table_new, .table_flush = nft_table_flush, .chain_user_flush = nft_chain_user_flush, .chain_del = chain_delete, -- cgit v1.2.3