[PATCH nft] doc: remove references to timeout in reset command

[PATCH nft] doc: remove references to timeout in reset command

[Pablo Neira Ayuso]

After Linux kernel's patch ("netfilter: nf_tables: do not refresh
timeout when resetting element") timers are not reset anymore, update
documentation to keep this in sync.

Fixes: 83e0f4402fb7 ("Implement 'reset {set,map,element}' commands")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 doc/nft.txt | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/doc/nft.txt b/doc/nft.txt
index 7e47ca39aa93..5e6a2bb7b0b4 100644
--- a/doc/nft.txt
+++ b/doc/nft.txt
@@ -524,7 +524,7 @@ beginning of the chain or before the specified rule.
 *replace*:: Similar to *add*, but the rule replaces the specified rule.
 *delete*:: Delete the specified rule.
 *destroy*:: Delete the specified rule, it does not fail if it does not exist.
-*reset*:: Reset rule-contained state, i.e. counter and quota statement values.
+*reset*:: Reset rule-contained state, i.e. counter, limit and quota statement values.
 
 .*add a rule to ip table output chain*
 -------------
@@ -590,7 +590,7 @@ be tuned with the flags that can be specified at set creation time.
 *destroy*:: Delete the specified set, it does not fail if it does not exist.
 *list*:: Display the elements in the specified set.
 *flush*:: Remove all elements from the specified set.
-*reset*:: Reset timeout and other state in all contained elements.
+*reset*:: Reset state in all contained elements, eg. counter, limit and quota statement values.
 
 .Set specifications
 [options="header"]
@@ -640,7 +640,7 @@ Maps store data based on some specific key used as input. They are uniquely iden
 *destroy*:: Delete the specified map, it does not fail if it does not exist.
 *list*:: Display the elements in the specified map.
 *flush*:: Remove all elements from the specified map.
-*reset*:: Reset timeout and other state in all contained elements.
+*reset*:: Reset state in all contained elements, eg. counter, limit and quota statement values.
 
 .Map specifications
 [options="header"]
@@ -707,8 +707,8 @@ listed elements may already exist.
 be non-trivial in very large and/or interval sets. In the latter case, the
 containing interval is returned instead of just the element itself.
 
-*reset* command resets timeout or other state attached to the given
-element(s).
+*reset* command resets state attached to the given element(s), i.e. counter,
+limit and quota statement values.
 
 .Element options
 [options="header"]
-- 
2.30.2

Re: [PATCH nft] doc: remove references to timeout in reset command

[Phil Sutter]

On Tue, Oct 10, 2023 at 04:27:04PM +0200, Pablo Neira Ayuso wrote:
> After Linux kernel's patch ("netfilter: nf_tables: do not refresh
> timeout when resetting element") timers are not reset anymore, update
> documentation to keep this in sync.

How is limit statement being reset? The dump callbacks in nft_limit.c
ignore the 'bool reset' parameter.

Cheers, Phil

Re: [PATCH nft] doc: remove references to timeout in reset command

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> On Tue, Oct 10, 2023 at 04:27:04PM +0200, Pablo Neira Ayuso wrote:
> > After Linux kernel's patch ("netfilter: nf_tables: do not refresh
> > timeout when resetting element") timers are not reset anymore, update
> > documentation to keep this in sync.
> 
> How is limit statement being reset? The dump callbacks in nft_limit.c
> ignore the 'bool reset' parameter.

Was that deliberate?  I don't see why it would be exempt?

Re: [PATCH nft] doc: remove references to timeout in reset command

[Phil Sutter]

On Tue, Oct 10, 2023 at 04:48:13PM +0200, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > On Tue, Oct 10, 2023 at 04:27:04PM +0200, Pablo Neira Ayuso wrote:
> > > After Linux kernel's patch ("netfilter: nf_tables: do not refresh
> > > timeout when resetting element") timers are not reset anymore, update
> > > documentation to keep this in sync.
> > 
> > How is limit statement being reset? The dump callbacks in nft_limit.c
> > ignore the 'bool reset' parameter.
> 
> Was that deliberate?  I don't see why it would be exempt?

One could reset internal tokens and last values, indeed. I don't see a
patch pending to do that, though.

BTW: nft also does not support for 'reset limit(s)'.

Cheers, Phil

Re: [PATCH nft] doc: remove references to timeout in reset command

[Pablo Neira Ayuso]

On Tue, Oct 10, 2023 at 04:58:20PM +0200, Phil Sutter wrote:
> On Tue, Oct 10, 2023 at 04:48:13PM +0200, Florian Westphal wrote:
> > Phil Sutter <phil@nwl.cc> wrote:
> > > On Tue, Oct 10, 2023 at 04:27:04PM +0200, Pablo Neira Ayuso wrote:
> > > > After Linux kernel's patch ("netfilter: nf_tables: do not refresh
> > > > timeout when resetting element") timers are not reset anymore, update
> > > > documentation to keep this in sync.
> > > 
> > > How is limit statement being reset? The dump callbacks in nft_limit.c
> > > ignore the 'bool reset' parameter.
> > 
> > Was that deliberate?  I don't see why it would be exempt?
> 
> One could reset internal tokens and last values, indeed. I don't see a
> patch pending to do that, though.

It should be easy to fix from kernel side, right? I can step so
remaining NFT_EXPR_STATEFUL also implement this. I mean, otherwise we
might have to document that some kernels do not support reset, some
kernel support reset of counter and quota only and some kernels fully
support all of the stateful objects :)

> BTW: nft also does not support for 'reset limit(s)'.

This can be done later from userspace. The reset for limit is a bit
special, because it currently does not exposed state information from
the listing side.