From b06fcdb858deefe35baaaf2f2f912616fb38644b Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 23 Oct 2014 12:42:11 +0200 Subject: iptables-compat: fix chain policy reset with iptables -L -n Initialize built-in tables/chains if they don't exists, otherwise simply skip. This avoids the chain policy reset to NF_ACCEPT by when you call iptables -L -n. Reported-by: Ana Rey Signed-off-by: Pablo Neira Ayuso Tested-by: Ana Rey --- iptables/nft.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'iptables') diff --git a/iptables/nft.c b/iptables/nft.c index ca199cd2..b68b2754 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -620,11 +620,17 @@ __nft_chain_builtin_init(struct nft_handle *h, int policy) { int i, default_policy; + struct nft_chain_list *list = nft_chain_dump(h); + struct nft_chain *c; - /* Initialize all built-in chains. Exception, for e one received as - * parameter, set the default policy as requested. - */ + /* Initialize built-in chains if they don't exist yet */ for (i=0; ichains[i].name != NULL; i++) { + + c = nft_chain_list_find(list, table->name, + table->chains[i].name); + if (c != NULL) + continue; + if (chain && strcmp(table->chains[i].name, chain) == 0) default_policy = policy; else @@ -633,6 +639,8 @@ __nft_chain_builtin_init(struct nft_handle *h, nft_chain_builtin_add(h, table, &table->chains[i], default_policy); } + + nft_chain_list_free(list); } int -- cgit v1.2.3