[iptables PATCH] xtables-monitor: Fix ip6tables rule printing

[iptables PATCH] xtables-monitor: Fix ip6tables rule printing

[Phil Sutter]

When printing an ip6tables rule event, false family ops are used as they
are initially looked up for AF_INET and reused no matter the current
rule's family. In practice, this means that nft_rule_print_save() calls
the wrong rule_to_cs, save_rule and clear_cs callbacks. Therefore, if a
rule specifies a source or destination address, the address is not
printed.

Fix this by performing a family lookup each time rule_cb is called.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables/xtables-monitor.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
index 57def83e2eea0..4008cc00d4694 100644
--- a/iptables/xtables-monitor.c
+++ b/iptables/xtables-monitor.c
@@ -93,6 +93,8 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
 	if (arg->nfproto && arg->nfproto != family)
 		goto err_free;
 
+	arg->h->ops = nft_family_ops_lookup(family);
+
 	if (arg->is_event)
 		printf(" EVENT: ");
 	switch (family) {
-- 
2.27.0

Re: [iptables PATCH] xtables-monitor: Fix ip6tables rule printing

[Pablo Neira Ayuso]

On Fri, Aug 07, 2020 at 04:51:00PM +0200, Phil Sutter wrote:
> When printing an ip6tables rule event, false family ops are used as they
> are initially looked up for AF_INET and reused no matter the current
> rule's family. In practice, this means that nft_rule_print_save() calls
> the wrong rule_to_cs, save_rule and clear_cs callbacks. Therefore, if a
> rule specifies a source or destination address, the address is not
> printed.
> 
> Fix this by performing a family lookup each time rule_cb is called.
> 
> Signed-off-by: Phil Sutter <phil@nwl.cc>

Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>