xtables: add and use nft_build_cache

Will be used with the "generation id" infrastructure.
When we're told that the commit failed because someone else made
changes, we can use this to re-initialize the cache and then
revalidate the transaction list (e.g. to detect that we now have
to flush the user-defined chain 'foo' that we wanted to create, but
was added just now by someone else).

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft.c b/iptables/nft.c
index 1cef7a13c90dd72353eb503bf67b53b58c0934a7..4c9ce1a29383c98218bdab090ad92562062c8fcd 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1486,6 +1486,28 @@ static int fetch_rule_cache(struct nft_handle *h)
        return 0;
 }
 
+static void __nft_build_cache(struct nft_handle *h)
+{
+       fetch_chain_cache(h);
+       fetch_rule_cache(h);
+       h->have_cache = true;
+}
+
+
+void nft_build_cache(struct nft_handle *h)
+{
+       if (!h->have_cache)
+               __nft_build_cache(h);
+}
+
+void nft_rebuild_cache(struct nft_handle *h)
+{
+       if (!h->have_cache)
+               flush_chain_cache(h, NULL);
+
+       __nft_build_cache(h);
+}
+
 struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
                                            const char *table)
 {
@@ -1495,11 +1517,7 @@ struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
        if (!t)
                return NULL;
 
-       if (!h->have_cache) {
-               fetch_chain_cache(h);
-               fetch_rule_cache(h);
-               h->have_cache = true;
-       }
+       nft_build_cache(h);
 
        return h->table[t->type].chain_cache;
 }

diff --git a/iptables/nft.h b/iptables/nft.h
index d428287b46ffd4b4e7712c3c24464ad71b4ed0cc..97c28b356a46796f73ee7ac1da63b9d77771d8c2 100644 (file)
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -63,6 +63,8 @@ int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh,
             void *data);
 int nft_init(struct nft_handle *h, const struct builtin_table *t);
 void nft_fini(struct nft_handle *h);
+void nft_build_cache(struct nft_handle *h);
+void nft_rebuild_cache(struct nft_handle *h);
 
 /*
  * Operations with tables.

diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
index b12ab6a60b3a86480634c08ab66ce14ea5fcbfad..a6a331d398687959e3e65f2742da5861d826336f 100644 (file)
--- a/iptables/xtables-restore.c
+++ b/iptables/xtables-restore.c
@@ -145,10 +145,7 @@ void xtables_restore_parse(struct nft_handle *h,
                        if (p->tablename && (strcmp(p->tablename, table) != 0))
                                continue;
 
-                       /* Fixme: Needed to init chain cache.
-                        * Should create explicit function to do this.
-                        */
-                       nft_chain_list_get(h, table);
+                       nft_build_cache(h);
 
                        if (h->noflush == 0) {
                                DEBUGP("Cleaning all chains of table '%s'\n",