|
 |
8cce6c |
From 598f69c07427a1457c3ac7da766d1c07d64b63ce Mon Sep 17 00:00:00 2001
|
|
|
8cce6c |
From: Phil Sutter <phil@nwl.cc>
|
|
|
8cce6c |
Date: Tue, 15 Jan 2019 23:23:03 +0100
|
|
|
8cce6c |
Subject: [PATCH] nft: Add new builtin chains to cache immediately
|
|
|
8cce6c |
|
|
|
8cce6c |
Newly created builtin chains missing from cache was the sole reason for
|
|
|
8cce6c |
the immediate calls to nft_commit(). With nft_chain_builtin_add()
|
|
|
8cce6c |
inserting the new chain into the table's chain list, this is not needed
|
|
|
8cce6c |
anymore. Just make sure batch_obj_del() doesn't free the payload of
|
|
|
8cce6c |
NFT_COMPAT_CHAIN_ADD jobs since it contains the new chain which has
|
|
|
8cce6c |
been added to cache.
|
|
|
8cce6c |
|
|
|
8cce6c |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
8cce6c |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
8cce6c |
(cherry picked from commit 2b801fc515ae094d04207e840ed191196292b968)
|
|
|
8cce6c |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
8cce6c |
---
|
|
|
8cce6c |
iptables/nft.c | 30 +++++++++---------------------
|
|
|
8cce6c |
1 file changed, 9 insertions(+), 21 deletions(-)
|
|
|
8cce6c |
|
|
|
8cce6c |
diff --git a/iptables/nft.c b/iptables/nft.c
|
|
|
8cce6c |
index 9c0ad9a2d054f..c2af1a6fd0985 100644
|
|
|
8cce6c |
--- a/iptables/nft.c
|
|
|
8cce6c |
+++ b/iptables/nft.c
|
|
|
8cce6c |
@@ -644,6 +644,7 @@ static void nft_chain_builtin_add(struct nft_handle *h,
|
|
|
8cce6c |
return;
|
|
|
8cce6c |
|
|
|
8cce6c |
batch_chain_add(h, NFT_COMPAT_CHAIN_ADD, c);
|
|
|
8cce6c |
+ nftnl_chain_list_add_tail(c, h->table[table->type].chain_cache);
|
|
|
8cce6c |
}
|
|
|
8cce6c |
|
|
|
8cce6c |
/* find if built-in table already exists */
|
|
|
8cce6c |
@@ -1216,8 +1217,11 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
|
|
|
8cce6c |
h->ops->print_rule(r, 0, FMT_PRINT_RULE);
|
|
|
8cce6c |
|
|
|
8cce6c |
c = nft_chain_find(h, table, chain);
|
|
|
8cce6c |
- if (c)
|
|
|
8cce6c |
- nftnl_chain_rule_add_tail(r, c);
|
|
|
8cce6c |
+ if (!c) {
|
|
|
8cce6c |
+ errno = ENOENT;
|
|
|
8cce6c |
+ return 0;
|
|
|
8cce6c |
+ }
|
|
|
8cce6c |
+ nftnl_chain_rule_add_tail(r, c);
|
|
|
8cce6c |
|
|
|
8cce6c |
return 1;
|
|
|
8cce6c |
}
|
|
|
8cce6c |
@@ -2282,16 +2286,8 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
|
|
8cce6c |
bool found = false;
|
|
|
8cce6c |
|
|
|
8cce6c |
/* If built-in chains don't exist for this table, create them */
|
|
|
8cce6c |
- if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0) {
|
|
|
8cce6c |
+ if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
|
|
|
8cce6c |
nft_xt_builtin_init(h, table);
|
|
|
8cce6c |
- /* Force table and chain creation, otherwise first iptables -L
|
|
|
8cce6c |
- * lists no table/chains.
|
|
|
8cce6c |
- */
|
|
|
8cce6c |
- if (!list_empty(&h->obj_list)) {
|
|
|
8cce6c |
- nft_commit(h);
|
|
|
8cce6c |
- flush_chain_cache(h, NULL);
|
|
|
8cce6c |
- }
|
|
|
8cce6c |
- }
|
|
|
8cce6c |
|
|
|
8cce6c |
ops = nft_family_ops_lookup(h->family);
|
|
|
8cce6c |
|
|
|
8cce6c |
@@ -2397,16 +2393,8 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain,
|
|
|
8cce6c |
int ret = 0;
|
|
|
8cce6c |
|
|
|
8cce6c |
/* If built-in chains don't exist for this table, create them */
|
|
|
8cce6c |
- if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0) {
|
|
|
8cce6c |
+ if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
|
|
|
8cce6c |
nft_xt_builtin_init(h, table);
|
|
|
8cce6c |
- /* Force table and chain creation, otherwise first iptables -L
|
|
|
8cce6c |
- * lists no table/chains.
|
|
|
8cce6c |
- */
|
|
|
8cce6c |
- if (!list_empty(&h->obj_list)) {
|
|
|
8cce6c |
- nft_commit(h);
|
|
|
8cce6c |
- flush_chain_cache(h, NULL);
|
|
|
8cce6c |
- }
|
|
|
8cce6c |
- }
|
|
|
8cce6c |
|
|
|
8cce6c |
if (!nft_is_table_compatible(h, table)) {
|
|
|
8cce6c |
xtables_error(OTHER_PROBLEM, "table `%s' is incompatible, use 'nft' tool.\n", table);
|
|
|
8cce6c |
@@ -2525,8 +2513,8 @@ static void batch_obj_del(struct nft_handle *h, struct obj_update *o)
|
|
|
8cce6c |
break;
|
|
|
8cce6c |
case NFT_COMPAT_CHAIN_ZERO:
|
|
|
8cce6c |
case NFT_COMPAT_CHAIN_USER_ADD:
|
|
|
8cce6c |
- break;
|
|
|
8cce6c |
case NFT_COMPAT_CHAIN_ADD:
|
|
|
8cce6c |
+ break;
|
|
|
8cce6c |
case NFT_COMPAT_CHAIN_USER_DEL:
|
|
|
8cce6c |
case NFT_COMPAT_CHAIN_USER_FLUSH:
|
|
|
8cce6c |
case NFT_COMPAT_CHAIN_UPDATE:
|
|
|
8cce6c |
--
|
|
|
8cce6c |
2.20.1
|
|
|
8cce6c |
|