cache: reset filter for each command

commit 29cb49d0ca92b840938823dec697d8c5488d7253 upstream.

Inconditionally reset filter for each command in the batch, this is safer.

Fixes: 3f1d3912c3a6 ("cache: filter out tables that are not requested")
Tested-by: Eric Garver <eric@garver.life>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/cache.c b/src/cache.c
index 9cbf8286f2a4f1e9696c3a32f9b81b7d1ecea069..c21f6008e61c16d3697c98ad9ddd8c1b60591d64 100644 (file)
--- a/src/cache.c
+++ b/src/cache.c
@@ -360,6 +360,11 @@ err_name_too_long:
        return -1;
 }
 
+static void reset_filter(struct nft_cache_filter *filter)
+{
+       memset(&filter->list, 0, sizeof(filter->list));
+}
+
 int nft_cache_evaluate(struct nft_ctx *nft, struct list_head *cmds,
                       struct list_head *msgs, struct nft_cache_filter *filter,
                       unsigned int *pflags)
@@ -371,8 +376,7 @@ int nft_cache_evaluate(struct nft_ctx *nft, struct list_head *cmds,
                if (nft_handle_validate(cmd, msgs) < 0)
                        return -1;
 
-               if (filter->list.table && cmd->op != CMD_LIST)
-                       memset(&filter->list, 0, sizeof(filter->list));
+               reset_filter(filter);
 
                switch (cmd->op) {
                case CMD_ADD: