diff mbox series

[iptables,1/8] xtables-monitor: Proper re-init for rule's family

Message ID 20240716122805.22331-2-phil@nwl.cc
State Accepted
Headers show
Series Fix xtables-monitor rule printing, partially RFC | expand

Commit Message

Phil Sutter July 16, 2024, 12:27 p.m. UTC 
When not running for a specific family only (via -4/-6 flags),
xtables-monitor potentially sees events/traces for all families. To
correctly parse rules when printing for NEWRULE, DELRULE or TRACE
messages, nft_handle has to be reinitialized for the rule's family.

It is not sufficient to reset nft_handle::ops: Some expression parsers
rely upon nft_handle::family to be properly set, too (cf. references to
'ctx->h->family in nft-ruleparse.c). Adjusting the 'afinfo' pointer
provided by libxtables is even more crucial, as e.g. do_parse() in
xshared.c relies upon it for the proper optstring.

This is actually a day-1 bug in xtables-monitor which surfaced due to
commit 9075c3aa983d9 ("nft: Increase rule parser strictness"). Therefore
make this fix the commit it is following-up.

Fixes: ca69b0290dc50 ("xtables-monitor: Fix ip6tables rule printing")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables/xtables-monitor.c | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
index cf2729d87968b..cf92355f76f8a 100644
--- a/iptables/xtables-monitor.c
+++ b/iptables/xtables-monitor.c
@@ -92,7 +92,9 @@  static int rule_cb(const struct nlmsghdr *nlh, void *data)
 	if (arg->nfproto && arg->nfproto != family)
 		goto err_free;
 
+	xtables_set_nfproto(family);
 	arg->h->ops = nft_family_ops_lookup(family);
+	arg->h->family = family;
 
 	if (arg->is_event)
 		printf(" EVENT: ");