nft: Simplify per table chain cache update

Previously, each table's chain cache was potentially unallocated until
nftnl_chain_list_cb() saw a chain for it. This means such callback had to
check the chain_cache pointer for each chain belonging to that table.

In addition to the above, nft_chain_list_get() had to cover for the
possibility that a given table didn't have any chains at all in kernel,
so check requested table's chain cache once more and allocate it if
NULL.

Instead, simply iterate over all tables and preallocate their chain
caches prior to requesting the chain list from kernel. The only caveat
is to flush the chain cache completely before retrying in case of EINTR.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft.c b/iptables/nft.c
index 997d7bc58fd001c60a5fb1caa18a85c1ea340fdd..7d08a0884adde344d244c4b40686ebff96c10e2c 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1286,12 +1286,6 @@ static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
        if (!t)
                goto out;
 
-       if (!h->table[t->type].chain_cache) {
-               h->table[t->type].chain_cache = nftnl_chain_list_alloc();
-               if (!h->table[t->type].chain_cache)
-                       goto out;
-       }
-
        nftnl_chain_list_add_tail(c, h->table[t->type].chain_cache);
 
        return MNL_CB_OK;
@@ -1307,7 +1301,7 @@ struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
        char buf[16536];
        struct nlmsghdr *nlh;
        const struct builtin_table *t;
-       int ret;
+       int i, ret;
 
        t = nft_table_builtin_find(h, table);
        if (!t)
@@ -1316,18 +1310,27 @@ struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
        if (h->table[t->type].chain_cache)
                return h->table[t->type].chain_cache;
 retry:
+       for (i = 0; i < NFT_TABLE_MAX; i++) {
+               enum nft_table_type type = h->tables[i].type;
+
+               if (!h->tables[i].name)
+                       continue;
+
+               h->table[type].chain_cache = nftnl_chain_list_alloc();
+               if (!h->table[type].chain_cache)
+                       return NULL;
+       }
+
        nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, h->family,
                                        NLM_F_DUMP, h->seq);
 
        ret = mnl_talk(h, nlh, nftnl_chain_list_cb, h);
        if (ret < 0 && errno == EINTR) {
                assert(nft_restart(h) >= 0);
+               flush_chain_cache(h, NULL);
                goto retry;
        }
 
-       if (!h->table[t->type].chain_cache)
-               h->table[t->type].chain_cache = nftnl_chain_list_alloc();
-
        return h->table[t->type].chain_cache;
 }