From: Phil Sutter <phil@nwl.cc>
Date: Fri, 3 Aug 2018 13:55:55 +0000 (+0200)
Subject: xtables: Fix for no output on first iptables-nft invocation
X-Git-Tag: v1.8.1~93
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=206033ede9461e1fc57590c5c1cefdb75235d99d;p=thirdparty%2Fiptables.git

xtables: Fix for no output on first iptables-nft invocation

Fix the same issue commit a4e78370af849 ("iptables-compat: fix empty
chains after first invocation of iptables-compat -L") fixed back in
2014. Seems like some changes since then broke it again.

This time, existing cache not containing the added table/chains gets
into the way, so clear it if nft_commit() was called.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
---

diff --git a/iptables/nft.c b/iptables/nft.c
index 098b37ed..f9bd0ed2 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -2235,8 +2235,10 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
 		/* Force table and chain creation, otherwise first iptables -L
 		 * lists no table/chains.
 		 */
-		if (!list_empty(&h->obj_list))
+		if (!list_empty(&h->obj_list)) {
 			nft_commit(h);
+			flush_chain_cache(h, NULL);
+		}
 	}
 
 	ops = nft_family_ops_lookup(h->family);