nft_chain_set() is directly used in xtables-restore.c, however at that
point no builtin chains have been created yet thus the need to request
to build it relevantly.
Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@xxxxxxxxxxxxxxx>
---
iptables/nft.c | 1 +
iptables/nft.h | 1 +
iptables/xtables-restore.c | 1 +
3 files changed, 3 insertions(+)
diff --git a/iptables/nft.c b/iptables/nft.c
index 968fe8c..7031ede 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -744,6 +744,7 @@ __nft_chain_set(struct nft_handle *h, const char *table,
}
nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,
+ h->restore ? NLM_F_ACK|NLM_F_CREATE :
NLM_F_ACK, h->seq);
nft_chain_nlmsg_build_payload(nlh, c);
diff --git a/iptables/nft.h b/iptables/nft.h
index 22af66e..8b64f8b 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -34,6 +34,7 @@ struct nft_handle {
struct mnl_nlmsg_batch *batch;
struct nft_family_ops *ops;
struct builtin_table *tables;
+ bool restore;
};
extern struct builtin_table xtables_ipv4[TABLES_MAX];
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
index 50d2935..0498abc 100644
--- a/iptables/xtables-restore.c
+++ b/iptables/xtables-restore.c
@@ -170,6 +170,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
{
struct nft_handle h = {
.family = family,
+ .restore = true,
};
char buffer[10240];
int c;
--
1.8.3.2
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
