diff mbox

[nft] rule: fix object ordering via nft -f

Message ID 1424230752-4040-1-git-send-email-pablo@netfilter.org
State Accepted
Delegated to: Pablo Neira
Headers show

Commit Message

Pablo Neira Ayuso Feb. 18, 2015, 3:39 a.m. UTC 
The objects need to be loaded in the following ordering:

	#1 tables
	#2 chains
	#3 sets
	#4 rules

We have to make sure that chains are in place by when we add rules with
jumps/gotos. Similarly, we have to make sure that the sets are in place
by when rules reference them.

Without this patch, you may hit ENOENT errors depending on your ruleset
configuration.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/rule.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
diff mbox

Patch

diff --git a/src/rule.c b/src/rule.c
index feafe26..8d76fd0 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -658,14 +658,19 @@  static int do_add_table(struct netlink_ctx *ctx, const struct handle *h,
 	if (netlink_add_table(ctx, h, loc, table, excl) < 0)
 		return -1;
 	if (table != NULL) {
+		list_for_each_entry(chain, &table->chains, list) {
+			if (netlink_add_chain(ctx, &chain->handle,
+					      &chain->location, chain,
+					      excl) < 0)
+				return -1;
+		}
 		list_for_each_entry(set, &table->sets, list) {
 			handle_merge(&set->handle, &table->handle);
 			if (do_add_set(ctx, &set->handle, set) < 0)
 				return -1;
 		}
 		list_for_each_entry(chain, &table->chains, list) {
-			if (do_add_chain(ctx, &chain->handle, &chain->location,
-					 chain, excl) < 0)
+			if (netlink_add_rule_list(ctx, h, &chain->rules) < 0)
 				return -1;
 		}
 	}