* [PATCH v3 0/2] nfacct: add filter in to the list operation @ 2014-09-11 15:50 Alexey Perevalov 2014-09-11 15:50 ` [PATCH v3 1/2] nfacct: check cmd line argument for singleness Alexey Perevalov 2014-09-11 15:50 ` [PATCH v3 2/2] nfacct: add filter in to the list operation Alexey Perevalov 0 siblings, 2 replies; 6+ messages in thread From: Alexey Perevalov @ 2014-09-11 15:50 UTC (permalink / raw) To: pablo Cc: Alexey Perevalov, alexey.perevalov, netfilter-devel, kyungmin.park, hs81.go Hello Pablo, It's third version of patch for filtering, but also with fix for argument singleness. Changes since v2. selection enum/variable was removed according to comment I thought about singleness of one category's options. It's possibe to do without refactoring, but code looks like overloaded by lines, so I would prefer to use some general approach. Where we could use some special parser, but I feel you have one in nft. So this serie includes straightforward approach. Alexey Perevalov (2): nfacct: check cmd line argument for singleness nfacct: add filter in to the list operation include/linux/netfilter/nfnetlink_acct.h | 8 ++++ src/nfacct.c | 60 +++++++++++++++++++++++++++++- 2 files changed, 67 insertions(+), 1 deletion(-) -- 1.7.9.5 ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v3 1/2] nfacct: check cmd line argument for singleness 2014-09-11 15:50 [PATCH v3 0/2] nfacct: add filter in to the list operation Alexey Perevalov @ 2014-09-11 15:50 ` Alexey Perevalov 2014-09-11 16:55 ` Pablo Neira Ayuso 2014-09-11 15:50 ` [PATCH v3 2/2] nfacct: add filter in to the list operation Alexey Perevalov 1 sibling, 1 reply; 6+ messages in thread From: Alexey Perevalov @ 2014-09-11 15:50 UTC (permalink / raw) To: pablo Cc: Alexey Perevalov, alexey.perevalov, netfilter-devel, kyungmin.park, hs81.go It was possible to specify several equal options for list operation. Signed-off-by: Alexey Perevalov <a.perevalov@samsung.com> --- src/nfacct.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/src/nfacct.c b/src/nfacct.c index 091a5c9..d77a57e 100644 --- a/src/nfacct.c +++ b/src/nfacct.c @@ -25,6 +25,13 @@ #include <linux/netfilter/nfnetlink_acct.h> #include <linux/netfilter/nfnetlink.h> +#define CHECK_OPT_PLURARITY(opt_name, msg) \ + opt_name += 1; \ + if (opt_name > 1) { \ + nfacct_perror(msg); \ + return -1; \ + } + enum { NFACCT_CMD_NONE = 0, NFACCT_CMD_LIST, @@ -166,6 +173,8 @@ err: return MNL_CB_OK; } +#define NFACCT_F_QUOTAS (NFACCT_F_QUOTA_BYTES | NFACCT_F_QUOTA_PKTS) + static int nfacct_cmd_list(int argc, char *argv[]) { bool zeroctr = false, xml = false; @@ -177,8 +186,14 @@ static int nfacct_cmd_list(int argc, char *argv[]) for (i=2; i<argc; i++) { if (strncmp(argv[i], "reset", strlen(argv[i])) == 0) { + static int opt_reset; + CHECK_OPT_PLURARITY(opt_reset, "reset couldn't be " + "defined more than once"); zeroctr = true; } else if (strncmp(argv[i], "xml", strlen(argv[i])) == 0) { + static int opt_xml; + CHECK_OPT_PLURARITY(opt_xml, "xml couldn't be defined " + "more than once"); xml = true; } else { nfacct_perror("unknown argument"); @@ -191,7 +206,6 @@ static int nfacct_cmd_list(int argc, char *argv[]) NFNL_MSG_ACCT_GET_CTRZERO : NFNL_MSG_ACCT_GET, NLM_F_DUMP, seq); - nl = mnl_socket_open(NETLINK_NETFILTER); if (nl == NULL) { nfacct_perror("mnl_socket_open"); -- 1.7.9.5 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v3 1/2] nfacct: check cmd line argument for singleness 2014-09-11 15:50 ` [PATCH v3 1/2] nfacct: check cmd line argument for singleness Alexey Perevalov @ 2014-09-11 16:55 ` Pablo Neira Ayuso 2014-09-12 8:24 ` Alexey Perevalov 0 siblings, 1 reply; 6+ messages in thread From: Pablo Neira Ayuso @ 2014-09-11 16:55 UTC (permalink / raw) To: Alexey Perevalov Cc: alexey.perevalov, netfilter-devel, kyungmin.park, hs81.go On Thu, Sep 11, 2014 at 07:50:39PM +0400, Alexey Perevalov wrote: > It was possible to specify several equal options for list operation. > > Signed-off-by: Alexey Perevalov <a.perevalov@samsung.com> > --- > src/nfacct.c | 16 +++++++++++++++- > 1 file changed, 15 insertions(+), 1 deletion(-) > > diff --git a/src/nfacct.c b/src/nfacct.c > index 091a5c9..d77a57e 100644 > --- a/src/nfacct.c > +++ b/src/nfacct.c > @@ -25,6 +25,13 @@ > #include <linux/netfilter/nfnetlink_acct.h> > #include <linux/netfilter/nfnetlink.h> > > +#define CHECK_OPT_PLURARITY(opt_name, msg) \ > + opt_name += 1; \ > + if (opt_name > 1) { \ > + nfacct_perror(msg); \ > + return -1; \ > + } > + > enum { > NFACCT_CMD_NONE = 0, > NFACCT_CMD_LIST, > @@ -166,6 +173,8 @@ err: > return MNL_CB_OK; > } > > +#define NFACCT_F_QUOTAS (NFACCT_F_QUOTA_BYTES | NFACCT_F_QUOTA_PKTS) > + > static int nfacct_cmd_list(int argc, char *argv[]) > { > bool zeroctr = false, xml = false; > @@ -177,8 +186,14 @@ static int nfacct_cmd_list(int argc, char *argv[]) > > for (i=2; i<argc; i++) { > if (strncmp(argv[i], "reset", strlen(argv[i])) == 0) { > + static int opt_reset; > + CHECK_OPT_PLURARITY(opt_reset, "reset couldn't be " > + "defined more than once"); I prefer if you add something similar to what iproute2 provides: void duparg2(const char *key, const char *arg) { fprintf(stderr, "Error: either \"%s\" is duplicate, or \"%s\" is a garbage.\n", key, arg); exit(-1); } You can probably check: if (zeroctr) duparg2("reset", argv[i]); > zeroctr = true; > } else if (strncmp(argv[i], "xml", strlen(argv[i])) == 0) { > + static int opt_xml; > + CHECK_OPT_PLURARITY(opt_xml, "xml couldn't be defined " > + "more than once"); Similar thing here. I always wanted to get this code more in line iproute2, but failed to find the time, later. So please, do it the way I'm proposing so we start looking into converging to iproute2. Thanks. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v3 1/2] nfacct: check cmd line argument for singleness 2014-09-11 16:55 ` Pablo Neira Ayuso @ 2014-09-12 8:24 ` Alexey Perevalov 2014-09-12 8:36 ` Pablo Neira Ayuso 0 siblings, 1 reply; 6+ messages in thread From: Alexey Perevalov @ 2014-09-12 8:24 UTC (permalink / raw) To: Pablo Neira Ayuso Cc: alexey.perevalov, netfilter-devel, kyungmin.park, hs81.go On 09/11/2014 08:55 PM, Pablo Neira Ayuso wrote: > On Thu, Sep 11, 2014 at 07:50:39PM +0400, Alexey Perevalov wrote: >> It was possible to specify several equal options for list operation. >> >> Signed-off-by: Alexey Perevalov <a.perevalov@samsung.com> >> --- >> src/nfacct.c | 16 +++++++++++++++- >> 1 file changed, 15 insertions(+), 1 deletion(-) >> >> diff --git a/src/nfacct.c b/src/nfacct.c >> index 091a5c9..d77a57e 100644 >> --- a/src/nfacct.c >> +++ b/src/nfacct.c >> @@ -25,6 +25,13 @@ >> #include <linux/netfilter/nfnetlink_acct.h> >> #include <linux/netfilter/nfnetlink.h> >> >> +#define CHECK_OPT_PLURARITY(opt_name, msg) \ >> + opt_name += 1; \ >> + if (opt_name > 1) { \ >> + nfacct_perror(msg); \ >> + return -1; \ >> + } >> + >> enum { >> NFACCT_CMD_NONE = 0, >> NFACCT_CMD_LIST, >> @@ -166,6 +173,8 @@ err: >> return MNL_CB_OK; >> } >> >> +#define NFACCT_F_QUOTAS (NFACCT_F_QUOTA_BYTES | NFACCT_F_QUOTA_PKTS) >> + >> static int nfacct_cmd_list(int argc, char *argv[]) >> { >> bool zeroctr = false, xml = false; >> @@ -177,8 +186,14 @@ static int nfacct_cmd_list(int argc, char *argv[]) >> >> for (i=2; i<argc; i++) { >> if (strncmp(argv[i], "reset", strlen(argv[i])) == 0) { >> + static int opt_reset; >> + CHECK_OPT_PLURARITY(opt_reset, "reset couldn't be " >> + "defined more than once"); > I prefer if you add something similar to what iproute2 provides: > > void duparg2(const char *key, const char *arg) > { > fprintf(stderr, "Error: either \"%s\" is duplicate, or \"%s\" is a garbage.\n", key, arg); > exit(-1); > } > > You can probably check: > > if (zeroctr) > duparg2("reset", argv[i]); > >> zeroctr = true; >> } else if (strncmp(argv[i], "xml", strlen(argv[i])) == 0) { >> + static int opt_xml; >> + CHECK_OPT_PLURARITY(opt_xml, "xml couldn't be defined " >> + "more than once"); > Similar thing here. > > I always wanted to get this code more in line iproute2, but failed to > find the time, later. > > So please, do it the way I'm proposing so we start looking into > converging to iproute2. ok, but now nfacct doesn't use iprout2, so suggested function should by copy-pasted, maybe with modification, because "is a garbage" I think no necessary. Do you want to make nfacct code more similar with iproute2 code, to merge it in future? > > Thanks. > -- Best regards, Alexey Perevalov, Tizen Developer, phone: +7 (495) 797 25 00 ext 3969 e-mail: a.perevalov@samsung.com <mailto:a.perevalov@samsumng.com> Mobile group, Samsung R&D Institute Rus 12 Dvintsev street, building 1 127018, Moscow, Russian Federation ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v3 1/2] nfacct: check cmd line argument for singleness 2014-09-12 8:24 ` Alexey Perevalov @ 2014-09-12 8:36 ` Pablo Neira Ayuso 0 siblings, 0 replies; 6+ messages in thread From: Pablo Neira Ayuso @ 2014-09-12 8:36 UTC (permalink / raw) To: Alexey Perevalov Cc: alexey.perevalov, netfilter-devel, kyungmin.park, hs81.go On Fri, Sep 12, 2014 at 12:24:51PM +0400, Alexey Perevalov wrote: > On 09/11/2014 08:55 PM, Pablo Neira Ayuso wrote: > >On Thu, Sep 11, 2014 at 07:50:39PM +0400, Alexey Perevalov wrote: > >>It was possible to specify several equal options for list operation. > >> > >>Signed-off-by: Alexey Perevalov <a.perevalov@samsung.com> > >>--- > >> src/nfacct.c | 16 +++++++++++++++- > >> 1 file changed, 15 insertions(+), 1 deletion(-) > >> > >>diff --git a/src/nfacct.c b/src/nfacct.c > >>index 091a5c9..d77a57e 100644 > >>--- a/src/nfacct.c > >>+++ b/src/nfacct.c > >>@@ -25,6 +25,13 @@ > >> #include <linux/netfilter/nfnetlink_acct.h> > >> #include <linux/netfilter/nfnetlink.h> > >>+#define CHECK_OPT_PLURARITY(opt_name, msg) \ > >>+ opt_name += 1; \ > >>+ if (opt_name > 1) { \ > >>+ nfacct_perror(msg); \ > >>+ return -1; \ > >>+ } > >>+ > >> enum { > >> NFACCT_CMD_NONE = 0, > >> NFACCT_CMD_LIST, > >>@@ -166,6 +173,8 @@ err: > >> return MNL_CB_OK; > >> } > >>+#define NFACCT_F_QUOTAS (NFACCT_F_QUOTA_BYTES | NFACCT_F_QUOTA_PKTS) > >>+ > >> static int nfacct_cmd_list(int argc, char *argv[]) > >> { > >> bool zeroctr = false, xml = false; > >>@@ -177,8 +186,14 @@ static int nfacct_cmd_list(int argc, char *argv[]) > >> for (i=2; i<argc; i++) { > >> if (strncmp(argv[i], "reset", strlen(argv[i])) == 0) { > >>+ static int opt_reset; > >>+ CHECK_OPT_PLURARITY(opt_reset, "reset couldn't be " > >>+ "defined more than once"); > >I prefer if you add something similar to what iproute2 provides: > > > >void duparg2(const char *key, const char *arg) > >{ > > fprintf(stderr, "Error: either \"%s\" is duplicate, or \"%s\" is a garbage.\n", key, arg); > > exit(-1); > >} > > > >You can probably check: > > > > if (zeroctr) > > duparg2("reset", argv[i]); > > > >> zeroctr = true; > >> } else if (strncmp(argv[i], "xml", strlen(argv[i])) == 0) { > >>+ static int opt_xml; > >>+ CHECK_OPT_PLURARITY(opt_xml, "xml couldn't be defined " > >>+ "more than once"); > >Similar thing here. > > > >I always wanted to get this code more in line iproute2, but failed to > >find the time, later. > > > >So please, do it the way I'm proposing so we start looking into > >converging to iproute2. > ok, but now nfacct doesn't use iprout2, so suggested function should > by copy-pasted, maybe with modification, > because "is a garbage" I think no necessary. Right, that was just an example. Actually, duparg (instead of duparg2) should better fit that. > Do you want to make nfacct code more similar with iproute2 code, to > merge it in future? No for merge, I'm just pointing to it as a coding style reference. The parser is very simple, error reporting and so on is rather simple, and it matches with what we have in nfacct. ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v3 2/2] nfacct: add filter in to the list operation 2014-09-11 15:50 [PATCH v3 0/2] nfacct: add filter in to the list operation Alexey Perevalov 2014-09-11 15:50 ` [PATCH v3 1/2] nfacct: check cmd line argument for singleness Alexey Perevalov @ 2014-09-11 15:50 ` Alexey Perevalov 1 sibling, 0 replies; 6+ messages in thread From: Alexey Perevalov @ 2014-09-11 15:50 UTC (permalink / raw) To: pablo Cc: Alexey Perevalov, alexey.perevalov, netfilter-devel, kyungmin.park, hs81.go Filter feature is working through NFACCT_FILTER netlink attribute. If kernel doesn't support it, client will not get an error and silently will work as before. This patch adds following command line arguments: counters, overquota, quota-byte, quota-packet. Which could be used with list operation. Combination of these command line options isn't allowed. For example. will show counters without byte/packet based quota will reset value for overquoted counters only Signed-off-by: Alexey Perevalov <a.perevalov@samsung.com> --- include/linux/netfilter/nfnetlink_acct.h | 8 ++++++ src/nfacct.c | 44 ++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+) diff --git a/include/linux/netfilter/nfnetlink_acct.h b/include/linux/netfilter/nfnetlink_acct.h index 44dcd17..6c99213 100644 --- a/include/linux/netfilter/nfnetlink_acct.h +++ b/include/linux/netfilter/nfnetlink_acct.h @@ -28,10 +28,18 @@ enum nfnl_acct_type { NFACCT_USE, NFACCT_FLAGS, NFACCT_QUOTA, + NFACCT_FILTER, __NFACCT_MAX }; #define NFACCT_MAX (__NFACCT_MAX - 1) +enum nfnl_attr_filter_type { + NFACCT_FILTER_UNSPEC, + NFACCT_FILTER_MASK, + NFACCT_FILTER_VALUE, + __NFACCT_FILTER_MAX +}; + #ifdef __KERNEL__ struct nf_acct; diff --git a/src/nfacct.c b/src/nfacct.c index d77a57e..fbbd189 100644 --- a/src/nfacct.c +++ b/src/nfacct.c @@ -19,6 +19,7 @@ #include <unistd.h> #include <time.h> #include <errno.h> +#include <arpa/inet.h> #include <libmnl/libmnl.h> #include <libnetfilter_acct/libnetfilter_acct.h> @@ -183,6 +184,8 @@ static int nfacct_cmd_list(int argc, char *argv[]) struct nlmsghdr *nlh; unsigned int seq, portid; int ret, i; + uint32_t mask = 0, value = 0; + int opt_quota_cat = 0; for (i=2; i<argc; i++) { if (strncmp(argv[i], "reset", strlen(argv[i])) == 0) { @@ -195,6 +198,41 @@ static int nfacct_cmd_list(int argc, char *argv[]) CHECK_OPT_PLURARITY(opt_xml, "xml couldn't be defined " "more than once"); xml = true; + } else if (strncmp(argv[i], "counters", strlen(argv[i])) == 0) { + static int opt_counters; + CHECK_OPT_PLURARITY(opt_counters, "counters couldn't be" + " defined more than once"); + CHECK_OPT_PLURARITY(opt_quota_cat, "only one option is" + " allowed: counters, quota-byte, quota-packet, overquota"); + mask = NFACCT_F_QUOTAS; + value = 0; /* counters isn't quotas */ + } else if (strncmp(argv[i], "quota-byte", strlen(argv[i])) + == 0) { + static int opt_quota_byte; + CHECK_OPT_PLURARITY(opt_quota_byte, "quota-byte " + " couldn't be defined more than once"); + CHECK_OPT_PLURARITY(opt_quota_cat, "only one option is" + " allowed: counters, quota-byte, quota-packet, overquota"); + mask = NFACCT_F_QUOTA_BYTES; + value = NFACCT_F_QUOTA_BYTES; + } else if (strncmp(argv[i], "quota-packet", strlen(argv[i])) + == 0) { + static int opt_quota_packet; + CHECK_OPT_PLURARITY(opt_quota_packet, "quota-packet " + " couldn't be defined more than once"); + CHECK_OPT_PLURARITY(opt_quota_cat, "only one option is" + " allowed: counters, quota-byte, quota-packet, overquota"); + mask = NFACCT_F_QUOTA_PKTS; + value = NFACCT_F_QUOTA_PKTS; + } else if (strncmp(argv[i], "overquota", strlen(argv[i])) + == 0) { + static int opt_overquota; + CHECK_OPT_PLURARITY(opt_overquota, "overquota couldn't" + " be defined more than once"); + CHECK_OPT_PLURARITY(opt_quota_cat, "only one option is" + " allowed: counters, quota-byte, quota-packet, overquota"); + mask = NFACCT_F_OVERQUOTA; + value = NFACCT_F_OVERQUOTA; } else { nfacct_perror("unknown argument"); return -1; @@ -206,6 +244,12 @@ static int nfacct_cmd_list(int argc, char *argv[]) NFNL_MSG_ACCT_GET_CTRZERO : NFNL_MSG_ACCT_GET, NLM_F_DUMP, seq); + if (mask || value) { + struct nlattr *nest = mnl_attr_nest_start(nlh, NFACCT_FILTER); + mnl_attr_put_u32(nlh, NFACCT_FILTER_MASK, htonl(mask)); + mnl_attr_put_u32(nlh, NFACCT_FILTER_VALUE, htonl(value)); + mnl_attr_nest_end(nlh, nest); + } nl = mnl_socket_open(NETLINK_NETFILTER); if (nl == NULL) { nfacct_perror("mnl_socket_open"); -- 1.7.9.5 ^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-09-12 8:35 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2014-09-11 15:50 [PATCH v3 0/2] nfacct: add filter in to the list operation Alexey Perevalov 2014-09-11 15:50 ` [PATCH v3 1/2] nfacct: check cmd line argument for singleness Alexey Perevalov 2014-09-11 16:55 ` Pablo Neira Ayuso 2014-09-12 8:24 ` Alexey Perevalov 2014-09-12 8:36 ` Pablo Neira Ayuso 2014-09-11 15:50 ` [PATCH v3 2/2] nfacct: add filter in to the list operation Alexey Perevalov
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.