*filter
:INPUT DROP [32:4052]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT
COMMIT
will be restored with ACCEPT policies. When
-A OUTPUT is processed, the OUTPUT chain isn't found in the chain cache,
so the table is re-created with ACCEPT policies, which overrides the
earlier DROP policies.
A better fix would be to add the policy setting to the chain cache
but it seems we'll need a chain abstraction with refcounting first.
Fixes: 01e25e264a4c4 ("xtables: add chain cache")
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
iptables/nft.c | 6 ++++++
iptables/nft.h | 1 +
iptables/xtables-restore.c | 1 +
3 files changed, 8 insertions(+)
diff --git a/iptables/nft.c b/iptables/nft.c
index 64307375f99b..b7ee83522fb0 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1891,6 +1891,12 @@ err_out:
return ret == 0 ? 1 : 0;
}
+void nft_table_new(struct nft_handle *h, const char *table)
+{
+ if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
+ nft_xt_builtin_init(h, table);
+}
+
static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule_list *list,
struct nftnl_rule *r)
{
diff --git a/iptables/nft.h b/iptables/nft.h
index 72c2fdc59105..ffae84f22008 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -67,6 +67,7 @@ int nft_for_each_table(struct nft_handle *h, int (*func)(struct nft_handle *h, c
bool nft_table_find(struct nft_handle *h, const char *tablename);
int nft_table_purge_chains(struct nft_handle *h, const char *table, struct nftnl_chain_list *list);
int nft_table_flush(struct nft_handle *h, const char *table);
+void nft_table_new(struct nft_handle *h, const char *table);
/*
* Operations with chains.
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
index 4a7685356095..f127093d1665 100644
--- a/iptables/xtables-restore.c
+++ b/iptables/xtables-restore.c
@@ -195,6 +195,7 @@ struct nft_xt_restore_cb restore_cb = {
.chain_list = get_chain_list,
.commit = nft_commit,
.abort = nft_abort,
+ .table_new = nft_table_new,
.table_flush = nft_table_flush,
.chain_user_flush = nft_chain_user_flush,
.chain_del = chain_delete,
--
2.16.4
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
