diff options
| author | Phil Sutter <phil@nwl.cc> | 2019-11-15 10:47:24 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2019-11-15 15:45:13 +0100 |
| commit | 7084d0b6c95b11f03b3ae979fe30b6918cb26542 (patch) | |
| tree | d9371aa2bfbb26f013c374d3fea95b822a143900 /iptables | |
| parent | bd2dc3e730669cc813cedfd0876f22f5083cae9a (diff) | |
nft: CMD_ZERO needs a rule cache
In order to zero rule counters, they have to be fetched from kernel. Fix
this for both standalone calls as well as xtables-restore --noflush.
Fixes: b5cb6e631c828 ("nft-cache: Fetch only chains in nft_chain_list_get()")
Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables')
| -rw-r--r-- | iptables/nft.c | 2 | ||||
| -rw-r--r-- | iptables/xtables-restore.c | 1 |
2 files changed, 3 insertions, 0 deletions
diff --git a/iptables/nft.c b/iptables/nft.c index 3c230c12..83cf5fb7 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -2922,6 +2922,8 @@ static int __nft_chain_zero_counters(struct nftnl_chain *c, void *data) return -1; } + nft_build_cache(h, c); + iter = nftnl_rule_iter_create(c); if (iter == NULL) return -1; diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c index 282aa153..2f0fe7d4 100644 --- a/iptables/xtables-restore.c +++ b/iptables/xtables-restore.c @@ -268,6 +268,7 @@ static bool cmd_needs_full_cache(char *cmd) case 'C': case 'S': case 'L': + case 'Z': return true; } |