nft: don't care about previous state in ERESTART

We need to re-evalute based on the existing cache generation.

Fixes: 58d7de0181f6 ("xtables: handle concurrent ruleset modifications")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft.c b/iptables/nft.c
index 43b9153c2d58abbcb332a0ce956b169672fe9105..f6d4070298921aa6a379c9edfe335e12bb93420d 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -2789,9 +2789,9 @@ static void nft_refresh_transaction(struct nft_handle *h)
                        if (!tablename)
                                continue;
                        exists = nft_table_find(h, tablename);
-                       if (n->skip && exists)
+                       if (exists)
                                n->skip = 0;
-                       else if (!n->skip && !exists)
+                       else
                                n->skip = 1;
                        break;
                case NFT_COMPAT_CHAIN_USER_ADD:
@@ -2803,13 +2803,16 @@ static void nft_refresh_transaction(struct nft_handle *h)
                        if (!chainname)
                                continue;
 
+                       if (!h->noflush)
+                               break;
+
                        c = nft_chain_find(h, tablename, chainname);
-                       if (c && !n->skip) {
+                       if (c) {
                                /* -restore -n flushes existing rules from redefined user-chain */
-                               if (h->noflush)
-                                       __nft_rule_flush(h, tablename,
-                                                        chainname, false, true);
-                       } else if (!c && n->skip) {
+                               __nft_rule_flush(h, tablename,
+                                                chainname, false, true);
+                               n->skip = 1;
+                       } else if (!c) {
                                n->skip = 0;
                        }
                        break;