From ee595bc702ca80f72c522406f6a06ba7c31eb8df Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 18 Nov 2013 13:50:21 +0100 Subject: nft: fix inversion of built-in selectors (0ab045f xtables: fix missing ipt_entry for MASQUERADE target) broke inversion of built-in selectors, such as -s, -d, etc. We need to refresh the invflags if -p is used or set it for first time if -p is not used, otherwise inversion is ignored. Signed-off-by: Pablo Neira Ayuso --- iptables/nft-ipv4.c | 4 ++++ iptables/nft-ipv6.c | 4 ++++ 2 files changed, 8 insertions(+) (limited to 'iptables') diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 2ac823fc..1afe8b66 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -343,6 +343,10 @@ static void nft_ipv4_post_parse(int command, struct xtables_args *args) { cs->fw.ip.flags = args->flags; + /* We already set invflags in proto_parse, but we need to refresh it + * to include new parsed options. + */ + cs->fw.ip.invflags = args->invflags; strncpy(cs->fw.ip.iniface, args->iniface, IFNAMSIZ); memcpy(cs->fw.ip.iniface_mask, diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index b02d9526..f30cec61 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -264,6 +264,10 @@ static void nft_ipv6_post_parse(int command, struct iptables_command_state *cs, args->flags |= IP6T_F_PROTO; cs->fw6.ipv6.flags = args->flags; + /* We already set invflags in proto_parse, but we need to refresh it + * to include new parsed options. + */ + cs->fw6.ipv6.invflags = args->invflags; strncpy(cs->fw6.ipv6.iniface, args->iniface, IFNAMSIZ); memcpy(cs->fw6.ipv6.iniface_mask, -- cgit v1.2.3