[PATCH 1/3 nft] src: get rid of EINTR handling in nft_netlink()

[PATCH 1/3 nft] src: get rid of EINTR handling in nft_netlink()

[Pablo Neira Ayuso]

The only remaining caller that needs this is netlink_dump_ruleset(), that is
used to export the ruleset using markup representation. We can remove it and
handle this from do_command_export() now that we have a centralized point to
build up the object cache.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/main.c |    7 -------
 src/rule.c |   10 ++++++----
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/src/main.c b/src/main.c
index a069f63..52c1597 100644
--- a/src/main.c
+++ b/src/main.c
@@ -254,14 +254,7 @@ replay:
 	if (ret != 0 || state->nerrs > 0)
 		goto err1;
 
-retry:
 	ret = nft_netlink(state, msgs);
-	if (ret < 0 && errno == EINTR) {
-		nft_cache_fini();
-		netlink_restart();
-		goto retry;
-	}
-
 err1:
 	list_for_each_entry_safe(cmd, next, &state->cmds, list) {
 		list_del(&cmd->list);
diff --git a/src/rule.c b/src/rule.c
index 86e77b6..f806db6 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -899,11 +899,13 @@ static int do_command_delete(struct netlink_ctx *ctx, struct cmd *cmd)
 
 static int do_command_export(struct netlink_ctx *ctx, struct cmd *cmd)
 {
-	struct nft_ruleset *rs = netlink_dump_ruleset(ctx, &cmd->handle,
-						      &cmd->location);
+	struct nft_ruleset *rs;
 
-	if (rs == NULL)
-		return -1;
+	do {
+		rs = netlink_dump_ruleset(ctx, &cmd->handle, &cmd->location);
+		if (rs == NULL && errno != EINTR)
+			return -1;
+	} while (rs == NULL);
 
 	nft_ruleset_fprintf(stdout, rs, cmd->export->format, 0);
 	fprintf(stdout, "\n");
-- 
1.7.10.4

[PATCH 2/3 nft] src: fix do_list_tables() with family filtering

[Pablo Neira Ayuso]

Use the ruleset_spec production so default is NFPROTO_UNSPEC as in 'list
ruleset'.

 # nft list tables
 table ip nat
 table ip test
 table inet filter

 # nft list tables ip
 table ip nat
 table ip test

 # nft list tables inet
 table inet filter

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/parser_bison.y |    2 +-
 src/rule.c         |   11 ++++++++---
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/parser_bison.y b/src/parser_bison.y
index 5c4e272..772cd65 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -764,7 +764,7 @@ list_cmd		:	TABLE		table_spec
 			{
 				$$ = cmd_alloc(CMD_LIST, CMD_OBJ_TABLE, &$2, &@$, NULL);
 			}
-			|	TABLES		tables_spec
+			|	TABLES		ruleset_spec
 			{
 				$$ = cmd_alloc(CMD_LIST, CMD_OBJ_TABLE, &$2, &@$, NULL);
 			}
diff --git a/src/rule.c b/src/rule.c
index f806db6..65b31e7 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -953,14 +953,19 @@ static int do_list_ruleset(struct netlink_ctx *ctx, struct cmd *cmd)
 	return 0;
 }
 
-static int do_list_tables(void)
+static int do_list_tables(struct netlink_ctx *ctx, struct cmd *cmd)
 {
 	struct table *table;
 
-	list_for_each_entry(table, &table_list, list)
+	list_for_each_entry(table, &table_list, list) {
+		if (cmd->handle.family != NFPROTO_UNSPEC &&
+		    table->handle.family != cmd->handle.family)
+			continue;
+
 		printf("table %s %s\n",
 		       family2str(table->handle.family),
 		       table->handle.table);
+	}
 
 	return 0;
 }
@@ -988,7 +993,7 @@ static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd)
 	switch (cmd->obj) {
 	case CMD_OBJ_TABLE:
 		if (!cmd->handle.table)
-			return do_list_tables();
+			return do_list_tables(ctx, cmd);
 		return do_list_table(ctx, cmd, table);
 	case CMD_OBJ_CHAIN:
 		return do_list_table(ctx, cmd, table);
-- 
1.7.10.4

[PATCH 3/3 nft] configure: fix --enable-debug

[Pablo Neira Ayuso]

As the documentation indicates "The most common mistake for this macro is to
consider the two actions as action-if-enabled and action-if-disabled."

Use AS_IF in the action-if-present to check the real argument that we're
getting from the user.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 configure.ac |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/configure.ac b/configure.ac
index d8f949a..931dbe1 100644
--- a/configure.ac
+++ b/configure.ac
@@ -23,8 +23,8 @@ AC_DEFINE([_GNU_SOURCE], [], [Enable various GNU extensions])
 AC_DEFINE([_STDC_FORMAT_MACROS], [], [printf-style format macros])
 
 AC_ARG_ENABLE([debug],
-	      AS_HELP_STRING([--enable-debug], [Enable debugging]),
-	      [with_debug=no],
+	      AS_HELP_STRING([--enable-debug], [Disable debugging]),
+	      AS_IF([test "x$enable_debug" = "xno"], [with_debug=no], [with_debug=yes]),
 	      [with_debug=yes])
 AC_SUBST(with_debug)
 AM_CONDITIONAL([BUILD_DEBUG], [test "x$with_debug" != xno])
-- 
1.7.10.4