From 109b8f2d637b5e4b1a6ff6994297203834e4e77a Mon Sep 17 00:00:00 2001

From: Phil Sutter <phil@nwl.cc>

Date: Thu, 20 Dec 2018 16:09:05 +0100

Subject: [PATCH] nft: Review is_*_compatible() routines

- Call to nft_table_builtin_find() in nft_is_table_compatible() is not

  needed, as it is repeated in the latter call to nft_chain_list_get()

  by nft_are_chains_compatible().

- Turn nft_is_chain_compatible(), nft_is_rule_compatible() and

  nft_is_expr_compatible() into callbacks for use with respective

  foreach functions.

- nft_are_chains_compatible() is not needed anymore due to foreach

  function use.

Signed-off-by: Phil Sutter <phil@nwl.cc>

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

(cherry picked from commit e774b15299c271a4c7570899591cf1b7960477ea)

Signed-off-by: Phil Sutter <psutter@redhat.com>

---

 iptables/nft.c | 153 ++++++++++++++++++-------------------------------

 1 file changed, 55 insertions(+), 98 deletions(-)

diff --git a/iptables/nft.c b/iptables/nft.c

index 1fca1f17147f6..5032c718b33a9 100644

--- a/iptables/nft.c

+++ b/iptables/nft.c

@@ -3115,7 +3115,7 @@ static const char *supported_exprs[NFT_COMPAT_EXPR_MAX] = {

 };

-static int nft_is_expr_compatible(const struct nftnl_expr *expr)

+static int nft_is_expr_compatible(struct nftnl_expr *expr, void *data)

 {

 	const char *name = nftnl_expr_get_str(expr, NFTNL_EXPR_NAME);

 	int i;

@@ -3130,138 +3130,95 @@ static int nft_is_expr_compatible(const struct nftnl_expr *expr)

 	    nftnl_expr_get_u32(expr, NFTNL_EXPR_LIMIT_FLAGS) == 0)

 		return 0;

-	return 1;

+	return -1;

 }

-static bool nft_is_rule_compatible(struct nftnl_rule *rule)

-{

-	struct nftnl_expr_iter *iter;

-	struct nftnl_expr *expr;

-	bool compatible = false;

-

-	iter = nftnl_expr_iter_create(rule);

-	if (iter == NULL)

-		return false;

+struct nft_is_rule_compatible_data {

+	const char *tablename;

+};

-	expr = nftnl_expr_iter_next(iter);

-	while (expr != NULL) {

-		if (nft_is_expr_compatible(expr) == 0) {

-			expr = nftnl_expr_iter_next(iter);

-			continue;

-		}

+static int nft_is_rule_compatible(struct nftnl_rule *rule, void *data)

+{

+	const char *table = nftnl_rule_get_str(rule, NFTNL_RULE_TABLE);

+	struct nft_is_rule_compatible_data *d = data;

-		compatible = true;

-		break;

-	}

+	/* ignore rules belonging to a different table */

+	if (strcmp(table, d->tablename))

+		return 0;

-	nftnl_expr_iter_destroy(iter);

-	return compatible;

+	return nftnl_expr_foreach(rule, nft_is_expr_compatible, NULL);

 }

-static int nft_is_chain_compatible(const struct nft_handle *h,

-				   const struct nftnl_chain *chain)

+static int nft_is_chain_compatible(struct nftnl_chain *c, void *data)

 {

-	const char *table, *name, *type, *cur_table;

-	const struct builtin_chain *chains;

-	int i, j, prio;

+	const struct builtin_chain *chains = NULL, *chain = NULL;

+	const char *table, *name, *type;

+	struct nft_handle *h = data;

 	enum nf_inet_hooks hook;

+	int i, prio;

-	table = nftnl_chain_get(chain, NFTNL_CHAIN_TABLE);

-	name = nftnl_chain_get(chain, NFTNL_CHAIN_NAME);

-	type = nftnl_chain_get(chain, NFTNL_CHAIN_TYPE);

-	prio = nftnl_chain_get_u32(chain, NFTNL_CHAIN_PRIO);

-	hook = nftnl_chain_get_u32(chain, NFTNL_CHAIN_HOOKNUM);

+	if (!nft_chain_builtin(c))

+		return 0;

+	/* find chain's table in builtin tables */

+	table = nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);

 	for (i = 0; i < NFT_TABLE_MAX; i++) {

-		cur_table = h->tables[i].name;

-		chains = h->tables[i].chains;

+		const char *cur_table = h->tables[i].name;

-		if (!cur_table || strcmp(table, cur_table) != 0)

+		if (!cur_table || strcmp(cur_table, table))

 			continue;

-		for (j = 0; j < NF_INET_NUMHOOKS && chains[j].name; j++) {

-			if (strcmp(name, chains[j].name) != 0)

-				continue;

-

-			if (strcmp(type, chains[j].type) == 0 &&

-			    prio == chains[j].prio &&

-			    hook == chains[j].hook)

-				return 0;

-			break;

-		}

+		chains = h->tables[i].chains;

+		break;

 	}

-

-	return 1;

-}

-

-static int nft_are_chains_compatible(struct nft_handle *h, const char *tablename)

-{

-	struct nftnl_chain_list *list;

-	struct nftnl_chain_list_iter *iter;

-	struct nftnl_chain *chain;

-	int ret = 0;

-

-	list = nft_chain_list_get(h, tablename);

-	if (list == NULL)

-		return -1;

-

-	iter = nftnl_chain_list_iter_create(list);

-	if (iter == NULL)

+	if (!chains)

 		return -1;

-	chain = nftnl_chain_list_iter_next(iter);

-	while (chain != NULL) {

-		if (!nft_chain_builtin(chain))

-			goto next;

+	/* find chain in builtin chain list */

+	name = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);

+	for (i = 0; i < NF_INET_NUMHOOKS && chains[i].name; i++) {

+		if (strcmp(name, chains[i].name))

+			continue;

-		ret = nft_is_chain_compatible(h, chain);

-		if (ret != 0)

-			break;

-next:

-		chain = nftnl_chain_list_iter_next(iter);

+		chain = &chains[i];

+		break;

 	}

+	if (!chain)

+		return -1;

-	nftnl_chain_list_iter_destroy(iter);

+	/* compare properties */

+	type = nftnl_chain_get_str(c, NFTNL_CHAIN_TYPE);

+	prio = nftnl_chain_get_u32(c, NFTNL_CHAIN_PRIO);

+	hook = nftnl_chain_get_u32(c, NFTNL_CHAIN_HOOKNUM);

+	if (strcmp(type, chain->type) ||

+	    prio != chain->prio ||

+	    hook != chain->hook)

+		return -1;

-	return ret;

+	return 0;

 }

 bool nft_is_table_compatible(struct nft_handle *h, const char *tablename)

 {

+	struct nft_is_rule_compatible_data rcd = {

+		.tablename = tablename

+	};

+	struct nftnl_chain_list *clist;

 	struct nftnl_rule_list *list;

-	struct nftnl_rule_list_iter *iter;

-	struct nftnl_rule *rule;

-	int ret = 0;

-	if (!nft_table_builtin_find(h, tablename))

+	clist = nft_chain_list_get(h, tablename);

+	if (clist == NULL)

 		return false;

-	ret = nft_are_chains_compatible(h, tablename);

-	if (ret != 0)

+	if (nftnl_chain_list_foreach(clist, nft_is_chain_compatible, h))

 		return false;

 	list = nft_rule_list_get(h);

 	if (list == NULL)

 		return true;

-	iter = nftnl_rule_list_iter_create(list);

-	if (iter == NULL)

-		return true;

-

-	rule = nftnl_rule_list_iter_next(iter);

-	while (rule != NULL) {

-		const char *table = nftnl_rule_get_str(rule, NFTNL_RULE_TABLE);

-

-		if (strcmp(table, tablename))

-			goto next_rule;

-

-		ret = nft_is_rule_compatible(rule);

-		if (ret != 0)

-			break;

-next_rule:

-		rule = nftnl_rule_list_iter_next(iter);

-	}

+	if (nftnl_rule_list_foreach(list, nft_is_rule_compatible, &rcd))

+		return false;

-	nftnl_rule_list_iter_destroy(iter);

-	return ret == 0;

+	return true;

 }

-- 

2.21.0