diff options
| author | Florian Westphal <fw@strlen.de> | 2018-06-27 10:21:15 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2018-06-27 23:43:00 +0200 |
| commit | d49ba500efd4dc50eef10324f3c0b4f7ce5d6e3e (patch) | |
| tree | 3a27dd405538f69e828a2f2d2a940d3383c984d7 /iptables | |
| parent | 344c6eb52f9189e70471d2f08b6514de0c390bc7 (diff) | |
xtables-restore: init table before processing policies
*filter
:INPUT DROP [32:4052]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT
COMMIT
will be restored with ACCEPT policies. When
-A OUTPUT is processed, the OUTPUT chain isn't found in the chain cache,
so the table is re-created with ACCEPT policies, which overrides the
earlier DROP policies.
A better fix would be to add the policy setting to the chain cache
but it seems we'll need a chain abstraction with refcounting first.
Fixes: 01e25e264a4c4 ("xtables: add chain cache")
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'iptables')
| -rw-r--r-- | iptables/nft.c | 6 | ||||
| -rw-r--r-- | iptables/nft.h | 1 | ||||
| -rw-r--r-- | iptables/xtables-restore.c | 1 |
3 files changed, 8 insertions, 0 deletions
diff --git a/iptables/nft.c b/iptables/nft.c index 64307375..b7ee8352 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1891,6 +1891,12 @@ err_out: return ret == 0 ? 1 : 0; } +void nft_table_new(struct nft_handle *h, const char *table) +{ + if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0) + nft_xt_builtin_init(h, table); +} + static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule_list *list, struct nftnl_rule *r) { diff --git a/iptables/nft.h b/iptables/nft.h index 72c2fdc5..ffae84f2 100644 --- a/iptables/nft.h +++ b/iptables/nft.h @@ -67,6 +67,7 @@ int nft_for_each_table(struct nft_handle *h, int (*func)(struct nft_handle *h, c bool nft_table_find(struct nft_handle *h, const char *tablename); int nft_table_purge_chains(struct nft_handle *h, const char *table, struct nftnl_chain_list *list); int nft_table_flush(struct nft_handle *h, const char *table); +void nft_table_new(struct nft_handle *h, const char *table); /* * Operations with chains. diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c index 4a768535..f127093d 100644 --- a/iptables/xtables-restore.c +++ b/iptables/xtables-restore.c @@ -195,6 +195,7 @@ struct nft_xt_restore_cb restore_cb = { .chain_list = get_chain_list, .commit = nft_commit, .abort = nft_abort, + .table_new = nft_table_new, .table_flush = nft_table_flush, .chain_user_flush = nft_chain_user_flush, .chain_del = chain_delete, |