Skip to content

Commit

Permalink
netfilter: nf_tables: return immediately on empty commit
Browse files Browse the repository at this point in the history
When running 'nft flush ruleset' while no rules exist, we will increment
the generation counter and announce a new genid to userspace, yet
nothing had changed in the first place.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Florian Westphal authored and Pablo Neira Ayuso committed Mar 11, 2019
1 parent 3f3a390 commit b8b2749
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions net/netfilter/nf_tables_api.c
Original file line number Diff line number Diff line change
Expand Up @@ -6564,6 +6564,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
struct nft_chain *chain;
struct nft_table *table;

if (list_empty(&net->nft.commit_list)) {
mutex_unlock(&net->nft.commit_mutex);
return 0;
}

/* 0. Validate ruleset, otherwise roll back for error reporting. */
if (nf_tables_validate(net) < 0)
return -EAGAIN;
Expand Down

0 comments on commit b8b2749

Please sign in to comment.