Fix the same issue commit a4e78370af849 ("iptables-compat: fix empty
chains after first invocation of iptables-compat -L") fixed back in
2014. Seems like some changes since then broke it again.
This time, existing cache not containing the added table/chains gets
into the way, so clear it if nft_commit() was called.
Signed-off-by: Phil Sutter <phil@xxxxxx>
---
iptables/nft.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/iptables/nft.c b/iptables/nft.c
index 1085faeab66fd..6f1f5e05b7e82 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -2235,8 +2235,10 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
/* Force table and chain creation, otherwise first iptables -L
* lists no table/chains.
*/
- if (!list_empty(&h->obj_list))
+ if (!list_empty(&h->obj_list)) {
nft_commit(h);
+ flush_chain_cache(h, NULL);
+ }
}
ops = nft_family_ops_lookup(h->family);
--
2.18.0
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
