The next patch requires iptablesSpawn() higher up in the file. This patch just moves the code around; there is no functional change. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com&gt; Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 11:55:21.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 11:55:21.000000000 +0000 @@ -89,6 +89,49 @@ struct _iptablesContext iptRules *nat_postrouting; }; +static int +iptablesSpawn(int errors, char * const *argv) +{ + pid_t pid, ret; + int status; + int null = -1; + + if (errors == NO_ERRORS && (null = open(_PATH_DEVNULL, O_RDONLY)) < 0) + return errno; + + pid = fork(); + if (pid == -1) { + if (errors == NO_ERRORS) + close(null); + return errno; + } + + if (pid == 0) { /* child */ + if (errors == NO_ERRORS) { + dup2(null, STDIN_FILENO); + dup2(null, STDOUT_FILENO); + dup2(null, STDERR_FILENO); + close(null); + } + + execvp(argv[0], argv); + + _exit (1); + } + + if (errors == NO_ERRORS) + close(null); + + while ((ret = waitpid(pid, &status, 0) == -1) && errno == EINTR); + if (ret == -1) + return errno; + + if (errors == NO_ERRORS) + return 0; + else + return (WIFEXITED(status) && WEXITSTATUS(status) == 0) ? 0 : EINVAL; +} + #ifdef IPTABLES_DIR static int writeRules(const char *path, @@ -294,49 +337,6 @@ iptRulesNew(const char *table, } static int -iptablesSpawn(int errors, char * const *argv) -{ - pid_t pid, ret; - int status; - int null = -1; - - if (errors == NO_ERRORS && (null = open(_PATH_DEVNULL, O_RDONLY)) < 0) - return errno; - - pid = fork(); - if (pid == -1) { - if (errors == NO_ERRORS) - close(null); - return errno; - } - - if (pid == 0) { /* child */ - if (errors == NO_ERRORS) { - dup2(null, STDIN_FILENO); - dup2(null, STDOUT_FILENO); - dup2(null, STDERR_FILENO); - close(null); - } - - execvp(argv[0], argv); - - _exit (1); - } - - if (errors == NO_ERRORS) - close(null); - - while ((ret = waitpid(pid, &status, 0) == -1) && errno == EINTR); - if (ret == -1) - return errno; - - if (errors == NO_ERRORS) - return 0; - else - return (WIFEXITED(status) && WEXITSTATUS(status) == 0) ? 0 : EINVAL; -} - -static int iptablesAddRemoveChain(iptRules *rules, int action) { char **argv; --