nft: fix inversion of built-in selectors

(0ab045f xtables: fix missing ipt_entry for MASQUERADE target) broke
inversion of built-in selectors, such as -s, -d, etc.

We need to refresh the invflags if -p is used or set it for first
time if -p is not used, otherwise inversion is ignored.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 2ac823fcd5aaf4cb4a87001e483991ce2fa2f180..1afe8b663a7c75f0459765775d3f04ac7e5b9663 100644 (file)
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -343,6 +343,10 @@ static void nft_ipv4_post_parse(int command,
                                struct xtables_args *args)
 {
        cs->fw.ip.flags = args->flags;
+       /* We already set invflags in proto_parse, but we need to refresh it
+        * to include new parsed options.
+        */
+       cs->fw.ip.invflags = args->invflags;
 
        strncpy(cs->fw.ip.iniface, args->iniface, IFNAMSIZ);
        memcpy(cs->fw.ip.iniface_mask,

diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index b02d95266efd65e6fdf4bd4553b952be95e39f5a..f30cec61b3ae931a9f876fd434716128122c56fe 100644 (file)
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -264,6 +264,10 @@ static void nft_ipv6_post_parse(int command, struct iptables_command_state *cs,
                args->flags |= IP6T_F_PROTO;
 
        cs->fw6.ipv6.flags = args->flags;
+       /* We already set invflags in proto_parse, but we need to refresh it
+        * to include new parsed options.
+        */
+       cs->fw6.ipv6.invflags = args->invflags;
 
        strncpy(cs->fw6.ipv6.iniface, args->iniface, IFNAMSIZ);
        memcpy(cs->fw6.ipv6.iniface_mask,