From 78bb602d61f6577540807495f5aa72e61c0fb1e4 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 30 Jun 2026 14:33:37 +0200 Subject: [PATCH] cache: Relax chain_cache_dump filter application JIRA: https://issues.redhat.com/browse/RHEL-190549 Upstream Status: nftables commit 18cd6edf86139621dc6bfe0f17a391e46218c027 commit 18cd6edf86139621dc6bfe0f17a391e46218c027 Author: Phil Sutter Date: Fri Mar 6 17:02:17 2026 +0100 cache: Relax chain_cache_dump filter application While populating chain cache, a filter was only effective if it limited fetching to both a table and a chain. Make it apply to 'list chains' command as well which at most specifies a family and table. Since the code is OK with filter->list fields being NULL, merely check for filter to be non-NULL (which is the case if nft_cache_update() is called by nft_cmd_enoent_chain()). Fixes: 17297d1acbbf ("cache: Filter chain list on kernel side") Signed-off-by: Phil Sutter Reviewed-by: Pablo Neira Ayuso Tested-by: Eric Garver Signed-off-by: Phil Sutter --- src/cache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/cache.c b/src/cache.c index 40b6c01..b8c065d 100644 --- a/src/cache.c +++ b/src/cache.c @@ -559,7 +559,7 @@ chain_cache_dump(struct netlink_ctx *ctx, const char *chain = NULL; int family = NFPROTO_UNSPEC; - if (filter && filter->list.table && filter->list.chain) { + if (filter) { family = filter->list.family; table = filter->list.table; chain = filter->list.chain;