Re: [nft PATCH v2] Implement 'reset rule' and 'reset rules' commands

[Phil Sutter <phil@nwl.cc>]

On Mon, Jan 16, 2023 at 01:30:42PM +0100, Pablo Neira Ayuso wrote:
> On Thu, Jan 12, 2023 at 05:23:42PM +0100, Phil Sutter wrote:
> > Reset rule counters and quotas in kernel, i.e. without having to reload
> > them. Requires respective kernel patch to support NFT_MSG_GETRULE_RESET
> > message type.
> 
> Only thing to mention: This adds a new rule_cache_dump() call, this
> was consolidated on top of the cache infrastructure, to have a single
> spot in the code to fetch kernel objects via netlink. This triggers to
> netlink dumps, one to populate the cache and another for the reset,
> right?

Well, rule_cache_dump() becomes dual-use, because the rule reset call is
so similar to the regular rule dump one.

I also changed it to allow turning the actual dump off (by sending
NLM_F_ACK instead of NLM_F_DUMP to kernel). This is used for resetting a
single rule (identified by rule-handle). Same functionality as with
resetting (a single) quota instead of "quotas".

If dump is active, the kernel returns the rules that have been reset to
user space, so users see the last state data. To correctly print this,
nft needs a table and chain cache. My v2 has this wrong, it needlessly
requests a rule cache also. Thanks for making me validate this aspect of
the implementation! :)

The only caveat I just noticed with reduced cache is that "whole ruleset
reset" does not print the rules because list_rule_cb() expects h->family
to be set. Making it accept NFPROTO_UNSPEC is trivial, though.

Cheers, Phil