summaryrefslogtreecommitdiffstats
path: root/iptables/nft.c
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2019-05-20 16:10:06 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2019-05-20 20:58:57 +0200
commit7e042a86353f89d0bb8f8292c0a3fbb5cf13cb0a (patch)
treee98a6e25b6a99309470f087d4420dd6442132dc6 /iptables/nft.c
parentce0f774d3e781a6b3b7f9f7af0e2d87149d57780 (diff)
nft: don't care about previous state in ERESTART
We need to re-evalute based on the existing cache generation. Fixes: 58d7de0181f6 ("xtables: handle concurrent ruleset modifications") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/nft.c')
-rw-r--r--iptables/nft.c17
1 files changed, 10 insertions, 7 deletions
diff --git a/iptables/nft.c b/iptables/nft.c
index 43b9153c..f6d40702 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -2789,9 +2789,9 @@ static void nft_refresh_transaction(struct nft_handle *h)
if (!tablename)
continue;
exists = nft_table_find(h, tablename);
- if (n->skip && exists)
+ if (exists)
n->skip = 0;
- else if (!n->skip && !exists)
+ else
n->skip = 1;
break;
case NFT_COMPAT_CHAIN_USER_ADD:
@@ -2803,13 +2803,16 @@ static void nft_refresh_transaction(struct nft_handle *h)
if (!chainname)
continue;
+ if (!h->noflush)
+ break;
+
c = nft_chain_find(h, tablename, chainname);
- if (c && !n->skip) {
+ if (c) {
/* -restore -n flushes existing rules from redefined user-chain */
- if (h->noflush)
- __nft_rule_flush(h, tablename,
- chainname, false, true);
- } else if (!c && n->skip) {
+ __nft_rule_flush(h, tablename,
+ chainname, false, true);
+ n->skip = 1;
+ } else if (!c) {
n->skip = 0;
}
break;