Just like legacy iptables, iptables-nft should not treat the attempt to list a non-existing chain as OK. Signed-off-by: Phil Sutter <phil@xxxxxx> --- iptables/nft.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/iptables/nft.c b/iptables/nft.c index 6f1f5e05b7e82..c10737bb531b8 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -2298,18 +2298,21 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table, __nft_rule_list(h, chain_name, table, rulenum, format, ops->print_rule); + found = true; + /* we printed the chain we wanted, stop processing. */ if (chain) break; - found = true; - next: c = nftnl_chain_list_iter_next(iter); } nftnl_chain_list_iter_destroy(iter); err: + if (chain && !found) + return 0; + return 1; } -- 2.18.0 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
