]> git.ipfire.org Git - thirdparty/iptables.git/commit
nft: Fix for zeroing existent builtin chains
authorPhil Sutter <phil@nwl.cc>
Sat, 27 Jul 2024 14:04:31 +0000 (16:04 +0200)
committerPhil Sutter <phil@nwl.cc>
Sat, 27 Jul 2024 17:28:52 +0000 (19:28 +0200)
commit6a2aeda7585e07c0fcccb0c788299ab5a6a85881
treee759532c057a2f9f85ea246514e28ed7e5e7deab
parentf65d1e9a216468d5287fa05894a08e29c0fc8278
nft: Fix for zeroing existent builtin chains

Previous attempt at fixing for non-existent chains actually broke
functionality by adding a check for NFTNL_CHAIN_HANDLE right after
unsetting the attribute.

The approach was flawed for another reason, too: Base chains added in
the same batch (cf. iptables-restore) have no handle either but zeroing
them may still be sensible.

Instead, make use of the new fake chain annotation which identifies
fakes more reliably.

Fixes: f462975fb8049 ("nft: Fix for zeroing non-existent builtin chains")
Signed-off-by: Phil Sutter <phil@nwl.cc>
iptables/nft.c