xtables-restore: init table before processing policies

*filter
 :INPUT DROP [32:4052]
 :FORWARD DROP [0:0]
 :OUTPUT ACCEPT [0:0]
 -A OUTPUT
 COMMIT

will be restored with ACCEPT policies.  When
-A OUTPUT is processed, the OUTPUT chain isn't found in the chain cache,
so the table is re-created with ACCEPT policies, which overrides the
earlier DROP policies.

A better fix would be to add the policy setting to the chain cache
but it seems we'll need a chain abstraction with refcounting first.

Fixes: 01e25e264a4c4 ("xtables: add chain cache")
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/iptables/nft.c b/iptables/nft.c
index 64307375f99ba76078d6f97cb159830119f0312a..b7ee83522fb0abf954dbd9b1fab2730b159c4c3d 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1891,6 +1891,12 @@ err_out:
        return ret == 0 ? 1 : 0;
 }
 
+void nft_table_new(struct nft_handle *h, const char *table)
+{
+       if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
+               nft_xt_builtin_init(h, table);
+}
+
 static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule_list *list,
                          struct nftnl_rule *r)
 {

diff --git a/iptables/nft.h b/iptables/nft.h
index 72c2fdc5910503d39e0aad004539057277234666..ffae84f22008f8c70576637ea2ea6a68f4f9d791 100644 (file)
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -67,6 +67,7 @@ int nft_for_each_table(struct nft_handle *h, int (*func)(struct nft_handle *h, c
 bool nft_table_find(struct nft_handle *h, const char *tablename);
 int nft_table_purge_chains(struct nft_handle *h, const char *table, struct nftnl_chain_list *list);
 int nft_table_flush(struct nft_handle *h, const char *table);
+void nft_table_new(struct nft_handle *h, const char *table);
 
 /*
  * Operations with chains.

diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
index 4a7685356095419674dbebcd73f297cca24b589e..f127093d16657b7b29addbd5a41b339e05248920 100644 (file)
--- a/iptables/xtables-restore.c
+++ b/iptables/xtables-restore.c
@@ -195,6 +195,7 @@ struct nft_xt_restore_cb restore_cb = {
        .chain_list     = get_chain_list,
        .commit         = nft_commit,
        .abort          = nft_abort,
+       .table_new      = nft_table_new,
        .table_flush    = nft_table_flush,
        .chain_user_flush = nft_chain_user_flush,
        .chain_del      = chain_delete,