iptables: reset options at the start of each command

For each new command, iptables is supposed to start afresh with a
blank option set (opts) that only contains the program-specific
options (orig_opts), without any extension options. We failed to
restore this pointer (in function do_command) after the previous free
call in xtables_free_opts.

Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

diff --git a/ip6tables.c b/ip6tables.c
index 8318f910a9067a52bd856b9b761a6f829f490132..9b1629eefa78859524a6df25cf7881719d6a216d 100644 (file)
--- a/ip6tables.c
+++ b/ip6tables.c
@@ -147,7 +147,6 @@ void ip6tables_exit_error(enum xtables_exittype status, const char *msg, ...) __
 struct xtables_globals ip6tables_globals = {
        .option_offset = 0,
        .program_version = IPTABLES_VERSION,
-       .opts = original_opts,
        .orig_opts = original_opts,
        .exit_err = ip6tables_exit_error,
 };
@@ -1335,6 +1334,7 @@ int do_command6(int argc, char *argv[], char **table, struct ip6tc_handle **hand
            demand-load a protocol. */
        opterr = 0;
 
+       opts = xt_params->orig_opts;
        while ((c = getopt_long(argc, argv,
           "-A:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:g:",
                                           opts, NULL)) != -1) {

diff --git a/iptables.c b/iptables.c
index c800fffd1d200ff4f0005df2abf40cf18c8c64f6..1127bddc2e83a5630c56690a225bdf04b112854f 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -147,7 +147,6 @@ void iptables_exit_error(enum xtables_exittype status, const char *msg, ...) __a
 struct xtables_globals iptables_globals = {
        .option_offset = 0,
        .program_version = IPTABLES_VERSION,
-       .opts = original_opts,
        .orig_opts = original_opts,
        .exit_err = iptables_exit_error,
 };
@@ -1358,6 +1357,7 @@ int do_command(int argc, char *argv[], char **table, struct iptc_handle **handle
            demand-load a protocol. */
        opterr = 0;
 
+       opts = xt_params->orig_opts;
        while ((c = getopt_long(argc, argv,
           "-A:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvnt:m:xc:g:",
                                           opts, NULL)) != -1) {