[iptables PATCH v2 10/24] nft: Support fetch_chain_cache() per chain

[Phil Sutter <phil@nwl.cc>]

Accept a specific chain's name to fetch from kernel. If given, prepare a
non-dump request with chain's table and name in payload. Kernel will
return only that chain (if it exists).

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables/nft.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/iptables/nft.c b/iptables/nft.c
index 6ed05e77008c4..f116b940b41fd 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1436,7 +1436,7 @@ static int fetch_table_cache(struct nft_handle *h)
 }
 
 static int fetch_chain_cache(struct nft_handle *h,
-			     const struct builtin_table *t)
+			     const struct builtin_table *t, const char *chain)
 {
 	struct nftnl_chain_list_cb_data d = {
 		.h = h,
@@ -1461,12 +1461,24 @@ static int fetch_chain_cache(struct nft_handle *h,
 		}
 	} else if (!h->cache->table[t->type].chains) {
 		h->cache->table[t->type].chains = nftnl_chain_list_alloc();
-	} else {
-		return 0;
 	}
 
-	nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, h->family,
-					NLM_F_DUMP, h->seq);
+	if (t && chain) {
+		struct nftnl_chain *c = nftnl_chain_alloc();
+
+		if (!c)
+			return -1;
+
+		nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, h->family,
+						  NLM_F_ACK, h->seq);
+		nftnl_chain_set_str(c, NFTNL_CHAIN_TABLE, t->name);
+		nftnl_chain_set_str(c, NFTNL_CHAIN_NAME, chain);
+		nftnl_chain_nlmsg_build_payload(nlh, c);
+		nftnl_chain_free(c);
+	} else {
+		nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, h->family,
+						NLM_F_DUMP, h->seq);
+	}
 
 	ret = mnl_talk(h, nlh, nftnl_chain_list_cb, &d);
 	if (ret < 0 && errno == EINTR)
@@ -1639,7 +1651,7 @@ static void __nft_build_cache(struct nft_handle *h)
 
 retry:
 	mnl_genid_get(h, &genid_start);
-	fetch_chain_cache(h, NULL);
+	fetch_chain_cache(h, NULL, NULL);
 	fetch_rule_cache(h, NULL);
 	h->have_cache = true;
 	mnl_genid_get(h, &genid_stop);
@@ -1709,7 +1721,7 @@ struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
 		return NULL;
 
 	if (!h->have_cache && !h->cache->table[t->type].chains)
-		fetch_chain_cache(h, t);
+		fetch_chain_cache(h, t, NULL);
 
 	return h->cache->table[t->type].chains;
 }
-- 
2.23.0