* [nftables PATCH] Expose tables's chain usage and handle it.
@ 2013-12-12 13:00 Tomasz Bursztyka
2013-12-12 13:00 ` [nftables-kernel PATCH] netfilter: nf_tables: Expose the table's chain usage to the netlink API Tomasz Bursztyka
` (2 more replies)
0 siblings, 3 replies; 11+ messages in thread
From: Tomasz Bursztyka @ 2013-12-12 13:00 UTC (permalink / raw)
To: netfilter-devel; +Cc: Tomasz Bursztyka
Hi,
Patch 1 adds the feature in the kernel,
Patch 2 is just an intermediate patch for libnftables to be up-to-date on header's documentation
Patch 3 is the actual patch in libnftables that handles properly the new attribute
Tomasz Burszsyka
--
1.8.4.4
^ permalink raw reply [flat|nested] 11+ messages in thread* [nftables-kernel PATCH] netfilter: nf_tables: Expose the table's chain usage to the netlink API 2013-12-12 13:00 [nftables PATCH] Expose tables's chain usage and handle it Tomasz Bursztyka @ 2013-12-12 13:00 ` Tomasz Bursztyka 2013-12-17 13:30 ` Pablo Neira Ayuso 2013-12-17 13:53 ` Pablo Neira Ayuso 2013-12-12 13:00 ` [libnftables PATCH 1/2] include: Update API documentation in sync with kernel's one Tomasz Bursztyka 2013-12-12 13:00 ` [libnftables PATCH 2/2] table: Add support for NFTA_TABLE_USE nftables attribute Tomasz Bursztyka 2 siblings, 2 replies; 11+ messages in thread From: Tomasz Bursztyka @ 2013-12-12 13:00 UTC (permalink / raw) To: netfilter-devel; +Cc: Tomasz Bursztyka User space can therefore know whether a table is in use or not, and by how many chains. Suggested by Pablo Neira Ayuso. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> --- include/uapi/linux/netfilter/nf_tables.h | 2 ++ net/netfilter/nf_tables_api.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h index 256d36b..b25481e 100644 --- a/include/uapi/linux/netfilter/nf_tables.h +++ b/include/uapi/linux/netfilter/nf_tables.h @@ -110,11 +110,13 @@ enum nft_table_flags { * * @NFTA_TABLE_NAME: name of the table (NLA_STRING) * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32) + * @NFTA_TABLE_USE: number of chains in this table (NLA_U32) */ enum nft_table_attributes { NFTA_TABLE_UNSPEC, NFTA_TABLE_NAME, NFTA_TABLE_FLAGS, + NFTA_TABLE_USE, __NFTA_TABLE_MAX }; #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index dcddc49..604512d 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -180,7 +180,8 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, u32 portid, u32 seq, nfmsg->res_id = 0; if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || - nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags))) + nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) || + nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use))) goto nla_put_failure; return nlmsg_end(skb, nlh); -- 1.8.4.4 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [nftables-kernel PATCH] netfilter: nf_tables: Expose the table's chain usage to the netlink API 2013-12-12 13:00 ` [nftables-kernel PATCH] netfilter: nf_tables: Expose the table's chain usage to the netlink API Tomasz Bursztyka @ 2013-12-17 13:30 ` Pablo Neira Ayuso 2013-12-17 13:53 ` Pablo Neira Ayuso 1 sibling, 0 replies; 11+ messages in thread From: Pablo Neira Ayuso @ 2013-12-17 13:30 UTC (permalink / raw) To: Tomasz Bursztyka; +Cc: netfilter-devel On Thu, Dec 12, 2013 at 03:00:42PM +0200, Tomasz Bursztyka wrote: > User space can therefore know whether a table is in use or not, and by > how many chains. > > Suggested by Pablo Neira Ayuso. Enqueue to the nftables tree, thanks. ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [nftables-kernel PATCH] netfilter: nf_tables: Expose the table's chain usage to the netlink API 2013-12-12 13:00 ` [nftables-kernel PATCH] netfilter: nf_tables: Expose the table's chain usage to the netlink API Tomasz Bursztyka 2013-12-17 13:30 ` Pablo Neira Ayuso @ 2013-12-17 13:53 ` Pablo Neira Ayuso 1 sibling, 0 replies; 11+ messages in thread From: Pablo Neira Ayuso @ 2013-12-17 13:53 UTC (permalink / raw) To: Tomasz Bursztyka; +Cc: netfilter-devel On Thu, Dec 12, 2013 at 03:00:42PM +0200, Tomasz Bursztyka wrote: > User space can therefore know whether a table is in use or not, and by > how many chains. Applied to libnftables's next-3.14 branch, thanks. ^ permalink raw reply [flat|nested] 11+ messages in thread
* [libnftables PATCH 1/2] include: Update API documentation in sync with kernel's one 2013-12-12 13:00 [nftables PATCH] Expose tables's chain usage and handle it Tomasz Bursztyka 2013-12-12 13:00 ` [nftables-kernel PATCH] netfilter: nf_tables: Expose the table's chain usage to the netlink API Tomasz Bursztyka @ 2013-12-12 13:00 ` Tomasz Bursztyka 2013-12-12 18:01 ` Pablo Neira Ayuso 2013-12-12 13:00 ` [libnftables PATCH 2/2] table: Add support for NFTA_TABLE_USE nftables attribute Tomasz Bursztyka 2 siblings, 1 reply; 11+ messages in thread From: Tomasz Bursztyka @ 2013-12-12 13:00 UTC (permalink / raw) To: netfilter-devel; +Cc: Tomasz Bursztyka Adding or modifying API's documentation on nf_tables.h. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> --- include/linux/netfilter/nf_tables.h | 89 ++++++++++++++++++++++++++++++++++--- 1 file changed, 84 insertions(+), 5 deletions(-) diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index b58990e..256d36b 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -32,6 +32,25 @@ enum nft_verdicts { NFT_RETURN = -5, }; +/** + * enum nf_tables_msg_types - nf_tables netlink message types + * + * @NFT_MSG_NEWTABLE: create a new table (enum nft_table_attributes) + * @NFT_MSG_GETTABLE: get a table (enum nft_table_attributes) + * @NFT_MSG_DELTABLE: delete a table (enum nft_table_attributes) + * @NFT_MSG_NEWCHAIN: create a new chain (enum nft_chain_attributes) + * @NFT_MSG_GETCHAIN: get a chain (enum nft_chain_attributes) + * @NFT_MSG_DELCHAIN: delete a chain (enum nft_chain_attributes) + * @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes) + * @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes) + * @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes) + * @NFT_MSG_NEWSET: create a new set (enum nft_set_attributes) + * @NFT_MSG_GETSET: get a set (enum nft_set_attributes) + * @NFT_MSG_DELSET: delete a set (enum nft_set_attributes) + * @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes) + * @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes) + * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes) + */ enum nf_tables_msg_types { NFT_MSG_NEWTABLE, NFT_MSG_GETTABLE, @@ -90,6 +109,7 @@ enum nft_table_flags { * enum nft_table_attributes - nf_tables table netlink attributes * * @NFTA_TABLE_NAME: name of the table (NLA_STRING) + * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32) */ enum nft_table_attributes { NFTA_TABLE_UNSPEC, @@ -103,8 +123,13 @@ enum nft_table_attributes { * enum nft_chain_attributes - nf_tables chain netlink attributes * * @NFTA_CHAIN_TABLE: name of the table containing the chain (NLA_STRING) + * @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64) * @NFTA_CHAIN_NAME: name of the chain (NLA_STRING) * @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes) + * @NFTA_CHAIN_POLICY: numeric policy of the chain (NLA_U32) + * @NFTA_CHAIN_USE: number of references to this chain (NLA_U32) + * @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING) + * @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes) */ enum nft_chain_attributes { NFTA_CHAIN_UNSPEC, @@ -125,8 +150,10 @@ enum nft_chain_attributes { * * @NFTA_RULE_TABLE: name of the table containing the rule (NLA_STRING) * @NFTA_RULE_CHAIN: name of the chain containing the rule (NLA_STRING) - * @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U16) + * @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U64) * @NFTA_RULE_EXPRESSIONS: list of expressions (NLA_NESTED: nft_expr_attributes) + * @NFTA_RULE_COMPAT: compatibility specifications of the rule (NLA_NESTED: nft_rule_compat_attributes) + * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64) */ enum nft_rule_attributes { NFTA_RULE_UNSPEC, @@ -140,11 +167,22 @@ enum nft_rule_attributes { }; #define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1) +/** + * enum nft_rule_compat_flags - nf_tables rule compat flags + * + * @NFT_RULE_COMPAT_F_INV: invert the check result + */ enum nft_rule_compat_flags { NFT_RULE_COMPAT_F_INV = (1 << 1), NFT_RULE_COMPAT_F_MASK = NFT_RULE_COMPAT_F_INV, }; +/** + * enum nft_rule_compat_attributes - nf_tables rule compat attributes + * + * @NFTA_RULE_COMPAT_PROTO: numerice value of handled protocol (NLA_U32) + * @NFTA_RULE_COMPAT_FLAGS: bitmask of enum nft_rule_compat_flags (NLA_U32) + */ enum nft_rule_compat_attributes { NFTA_RULE_COMPAT_UNSPEC, NFTA_RULE_COMPAT_PROTO, @@ -342,11 +380,26 @@ enum nft_bitwise_attributes { }; #define NFTA_BITWISE_MAX (__NFTA_BITWISE_MAX - 1) +/** + * enum nft_byteorder_ops - nf_tables byteorder operators + * + * @NFT_BYTEORDER_NTOH: network to host operator + * @NFT_BYTEORDER_HTON: host to network opertaor + */ enum nft_byteorder_ops { NFT_BYTEORDER_NTOH, NFT_BYTEORDER_HTON, }; +/** + * enum nft_byteorder_attributes - nf_tables byteorder expression netlink attributes + * + * @NFTA_BYTEORDER_SREG: source register (NLA_U32: nft_registers) + * @NFTA_BYTEORDER_DREG: destination register (NLA_U32: nft_registers) + * @NFTA_BYTEORDER_OP: operator (NLA_U32: enum nft_byteorder_ops) + * @NFTA_BYTEORDER_LEN: length of the data (NLA_U32) + * @NFTA_BYTEORDER_SIZE: data size in bytes (NLA_U32: 2 or 4) + */ enum nft_byteorder_attributes { NFTA_BYTEORDER_UNSPEC, NFTA_BYTEORDER_SREG, @@ -358,6 +411,16 @@ enum nft_byteorder_attributes { }; #define NFTA_BYTEORDER_MAX (__NFTA_BYTEORDER_MAX - 1) +/** + * enum nft_cmp_ops - nf_tables relational operator + * + * @NFT_CMP_EQ: equal + * @NFT_CMP_NEQ: not equal + * @NFT_CMP_LT: less than + * @NFT_CMP_LTE: less than or equal to + * @NFT_CMP_GT: greater than + * @NFT_CMP_GTE: greater than or equal to + */ enum nft_cmp_ops { NFT_CMP_EQ, NFT_CMP_NEQ, @@ -383,6 +446,13 @@ enum nft_cmp_attributes { }; #define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1) +/** + * enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes + * + * @NFTA_LOOKUP_SET: name of the set where to look for (NLA_STRING) + * @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers) + * @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers) + */ enum nft_lookup_attributes { NFTA_LOOKUP_UNSPEC, NFTA_LOOKUP_SET, @@ -423,6 +493,14 @@ enum nft_payload_attributes { }; #define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1) +/** + * enum nft_exthdr_attributes - nf_tables IPv6 extension header expression netlink attributes + * + * @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers) + * @NFTA_EXTHDR_TYPE: extension header type (NLA_U8) + * @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32) + * @NFTA_EXTHDR_LEN: extension header length (NLA_U32) + */ enum nft_exthdr_attributes { NFTA_EXTHDR_UNSPEC, NFTA_EXTHDR_DREG, @@ -639,10 +717,11 @@ enum nft_nat_types { * enum nft_nat_attributes - nf_tables nat expression netlink attributes * * @NFTA_NAT_TYPE: NAT type (NLA_U32: nft_nat_types) - * @NFTA_NAT_ADDR_MIN: source register of address range start (NLA_U32: nft_registers) - * @NFTA_NAT_ADDR_MAX: source register of address range end (NLA_U32: nft_registers) - * @NFTA_NAT_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers) - * @NFTA_NAT_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers) + * @NFTA_NAT_FAMILY: NAT family (NLA_U32) + * @NFTA_NAT_REG_ADDR_MIN: source register of address range start (NLA_U32: nft_registers) + * @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers) + * @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers) + * @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers) */ enum nft_nat_attributes { NFTA_NAT_UNSPEC, -- 1.8.4.4 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [libnftables PATCH 1/2] include: Update API documentation in sync with kernel's one 2013-12-12 13:00 ` [libnftables PATCH 1/2] include: Update API documentation in sync with kernel's one Tomasz Bursztyka @ 2013-12-12 18:01 ` Pablo Neira Ayuso 2013-12-13 7:42 ` Tomasz Bursztyka 0 siblings, 1 reply; 11+ messages in thread From: Pablo Neira Ayuso @ 2013-12-12 18:01 UTC (permalink / raw) To: Tomasz Bursztyka; +Cc: netfilter-devel On Thu, Dec 12, 2013 at 03:00:43PM +0200, Tomasz Bursztyka wrote: > Adding or modifying API's documentation on nf_tables.h. I have mangled the description to clarify that we are just getting the cached copy in sync with Linux 3.13-rc. Applied, thanks. ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [libnftables PATCH 1/2] include: Update API documentation in sync with kernel's one 2013-12-12 18:01 ` Pablo Neira Ayuso @ 2013-12-13 7:42 ` Tomasz Bursztyka 0 siblings, 0 replies; 11+ messages in thread From: Tomasz Bursztyka @ 2013-12-13 7:42 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: netfilter-devel Hi Pablo, >> Adding or modifying API's documentation on nf_tables.h. > I have mangled the description to clarify that we are just getting the > cached copy in sync with Linux 3.13-rc. Ok thanks. That reminds me we should do the same for iptables-nftables which has an even more outdated header. I'll send a patch for it. Tomasz ^ permalink raw reply [flat|nested] 11+ messages in thread
* [libnftables PATCH 2/2] table: Add support for NFTA_TABLE_USE nftables attribute 2013-12-12 13:00 [nftables PATCH] Expose tables's chain usage and handle it Tomasz Bursztyka 2013-12-12 13:00 ` [nftables-kernel PATCH] netfilter: nf_tables: Expose the table's chain usage to the netlink API Tomasz Bursztyka 2013-12-12 13:00 ` [libnftables PATCH 1/2] include: Update API documentation in sync with kernel's one Tomasz Bursztyka @ 2013-12-12 13:00 ` Tomasz Bursztyka 2013-12-12 13:06 ` Arturo Borrero Gonzalez 2 siblings, 1 reply; 11+ messages in thread From: Tomasz Bursztyka @ 2013-12-12 13:00 UTC (permalink / raw) To: netfilter-devel; +Cc: Tomasz Bursztyka This adds support for table's attribute "use" which let us know about how many chains are in the table, if any. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> --- include/libnftables/table.h | 1 + include/linux/netfilter/nf_tables.h | 2 ++ src/table.c | 35 +++++++++++++++++++++++++++++------ 3 files changed, 32 insertions(+), 6 deletions(-) diff --git a/include/libnftables/table.h b/include/libnftables/table.h index be60da9..1d2be07 100644 --- a/include/libnftables/table.h +++ b/include/libnftables/table.h @@ -21,6 +21,7 @@ enum { NFT_TABLE_ATTR_NAME = 0, NFT_TABLE_ATTR_FAMILY, NFT_TABLE_ATTR_FLAGS, + NFT_TABLE_ATTR_USE, }; bool nft_table_attr_is_set(const struct nft_table *t, uint16_t attr); diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index 256d36b..b25481e 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -110,11 +110,13 @@ enum nft_table_flags { * * @NFTA_TABLE_NAME: name of the table (NLA_STRING) * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32) + * @NFTA_TABLE_USE: number of chains in this table (NLA_U32) */ enum nft_table_attributes { NFTA_TABLE_UNSPEC, NFTA_TABLE_NAME, NFTA_TABLE_FLAGS, + NFTA_TABLE_USE, __NFTA_TABLE_MAX }; #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) diff --git a/src/table.c b/src/table.c index 9e20768..ecc57a6 100644 --- a/src/table.c +++ b/src/table.c @@ -31,6 +31,7 @@ struct nft_table { const char *name; uint8_t family; uint32_t table_flags; + uint32_t use; uint32_t flags; }; @@ -70,6 +71,9 @@ void nft_table_attr_unset(struct nft_table *t, uint16_t attr) case NFT_TABLE_ATTR_FLAGS: case NFT_TABLE_ATTR_FAMILY: break; + case NFT_TABLE_ATTR_USE: + /* Cannot be unset, ignoring it */ + return; } t->flags &= ~(1 << attr); } @@ -93,6 +97,9 @@ void nft_table_attr_set(struct nft_table *t, uint16_t attr, const void *data) t->family = *((uint8_t *)data); t->flags |= (1 << NFT_TABLE_ATTR_FAMILY); break; + case NFT_TABLE_ATTR_USE: + /* Cannot be unset, ignoring it */ + break; } } EXPORT_SYMBOL(nft_table_attr_set); @@ -127,6 +134,8 @@ const void *nft_table_attr_get(struct nft_table *t, uint16_t attr) return &t->table_flags; case NFT_TABLE_ATTR_FAMILY: return &t->family; + case NFT_TABLE_ATTR_USE: + return &t->use; } return NULL; } @@ -182,6 +191,12 @@ static int nft_table_parse_attr_cb(const struct nlattr *attr, void *data) return MNL_CB_ERROR; } break; + case NFTA_TABLE_USE: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; } tb[type] = attr; @@ -202,6 +217,10 @@ int nft_table_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_table *t) t->table_flags = ntohl(mnl_attr_get_u32(tb[NFTA_TABLE_FLAGS])); t->flags |= (1 << NFT_TABLE_ATTR_FLAGS); } + if (tb[NFTA_TABLE_USE]) { + t->use = ntohl(mnl_attr_get_u32(tb[NFTA_TABLE_USE])); + t->flags |= (1 << NFT_TABLE_ATTR_USE); + } t->family = nfg->nfgen_family; t->flags |= (1 << NFT_TABLE_ATTR_FAMILY); @@ -344,23 +363,27 @@ static int nft_table_snprintf_json(char *buf, size_t size, struct nft_table *t) "{\"table\":{" "\"name\":\"%s\"," "\"family\":\"%s\"," - "\"flags\":%d" + "\"flags\":%d," + "\"use\":%d" "}" "}" , - t->name, nft_family2str(t->family), t->table_flags); + t->name, nft_family2str(t->family), + t->table_flags, t->use); } static int nft_table_snprintf_xml(char *buf, size_t size, struct nft_table *t) { return snprintf(buf, size, "<table><name>%s</name><family>%s</family>" - "<flags>%d</flags></table>", - t->name, nft_family2str(t->family), t->table_flags); + "<flags>%d</flags><use%d</use></table>", + t->name, nft_family2str(t->family), + t->table_flags, t->use); } static int nft_table_snprintf_default(char *buf, size_t size, struct nft_table *t) { - return snprintf(buf, size, "table %s %s flags %x", - t->name, nft_family2str(t->family), t->table_flags); + return snprintf(buf, size, "table %s %s flags %x use %d", + t->name, nft_family2str(t->family), + t->table_flags, t->use); } int nft_table_snprintf(char *buf, size_t size, struct nft_table *t, -- 1.8.4.4 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [libnftables PATCH 2/2] table: Add support for NFTA_TABLE_USE nftables attribute 2013-12-12 13:00 ` [libnftables PATCH 2/2] table: Add support for NFTA_TABLE_USE nftables attribute Tomasz Bursztyka @ 2013-12-12 13:06 ` Arturo Borrero Gonzalez 2013-12-12 13:10 ` Tomasz Bursztyka 2013-12-12 13:12 ` [libnftables PATCH v2 " Tomasz Bursztyka 0 siblings, 2 replies; 11+ messages in thread From: Arturo Borrero Gonzalez @ 2013-12-12 13:06 UTC (permalink / raw) To: Tomasz Bursztyka; +Cc: Netfilter Development Mailing list On 12 December 2013 14:00, Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> wrote: > static int nft_table_snprintf_xml(char *buf, size_t size, struct nft_table *t) > { > return snprintf(buf, size, "<table><name>%s</name><family>%s</family>" > - "<flags>%d</flags></table>", > - t->name, nft_family2str(t->family), t->table_flags); > + "<flags>%d</flags><use%d</use></table>", small typo: <use>%d</use> regards -- Arturo Borrero González -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [libnftables PATCH 2/2] table: Add support for NFTA_TABLE_USE nftables attribute 2013-12-12 13:06 ` Arturo Borrero Gonzalez @ 2013-12-12 13:10 ` Tomasz Bursztyka 2013-12-12 13:12 ` [libnftables PATCH v2 " Tomasz Bursztyka 1 sibling, 0 replies; 11+ messages in thread From: Tomasz Bursztyka @ 2013-12-12 13:10 UTC (permalink / raw) To: Arturo Borrero Gonzalez; +Cc: Netfilter Development Mailing list >> + "<flags>%d</flags><use%d</use></table>", > small typo: <use>%d</use> Indeed Thanks Arturo Tomasz ^ permalink raw reply [flat|nested] 11+ messages in thread
* [libnftables PATCH v2 2/2] table: Add support for NFTA_TABLE_USE nftables attribute 2013-12-12 13:06 ` Arturo Borrero Gonzalez 2013-12-12 13:10 ` Tomasz Bursztyka @ 2013-12-12 13:12 ` Tomasz Bursztyka 1 sibling, 0 replies; 11+ messages in thread From: Tomasz Bursztyka @ 2013-12-12 13:12 UTC (permalink / raw) To: netfilter-devel; +Cc: Tomasz Bursztyka This adds support for table's attribute "use" which let us know about how many chains are in the table, if any. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> --- include/libnftables/table.h | 1 + include/linux/netfilter/nf_tables.h | 2 ++ src/table.c | 35 +++++++++++++++++++++++++++++------ 3 files changed, 32 insertions(+), 6 deletions(-) diff --git a/include/libnftables/table.h b/include/libnftables/table.h index be60da9..1d2be07 100644 --- a/include/libnftables/table.h +++ b/include/libnftables/table.h @@ -21,6 +21,7 @@ enum { NFT_TABLE_ATTR_NAME = 0, NFT_TABLE_ATTR_FAMILY, NFT_TABLE_ATTR_FLAGS, + NFT_TABLE_ATTR_USE, }; bool nft_table_attr_is_set(const struct nft_table *t, uint16_t attr); diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index 256d36b..b25481e 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -110,11 +110,13 @@ enum nft_table_flags { * * @NFTA_TABLE_NAME: name of the table (NLA_STRING) * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32) + * @NFTA_TABLE_USE: number of chains in this table (NLA_U32) */ enum nft_table_attributes { NFTA_TABLE_UNSPEC, NFTA_TABLE_NAME, NFTA_TABLE_FLAGS, + NFTA_TABLE_USE, __NFTA_TABLE_MAX }; #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) diff --git a/src/table.c b/src/table.c index 9e20768..ecc57a6 100644 --- a/src/table.c +++ b/src/table.c @@ -31,6 +31,7 @@ struct nft_table { const char *name; uint8_t family; uint32_t table_flags; + uint32_t use; uint32_t flags; }; @@ -70,6 +71,9 @@ void nft_table_attr_unset(struct nft_table *t, uint16_t attr) case NFT_TABLE_ATTR_FLAGS: case NFT_TABLE_ATTR_FAMILY: break; + case NFT_TABLE_ATTR_USE: + /* Cannot be unset, ignoring it */ + return; } t->flags &= ~(1 << attr); } @@ -93,6 +97,9 @@ void nft_table_attr_set(struct nft_table *t, uint16_t attr, const void *data) t->family = *((uint8_t *)data); t->flags |= (1 << NFT_TABLE_ATTR_FAMILY); break; + case NFT_TABLE_ATTR_USE: + /* Cannot be unset, ignoring it */ + break; } } EXPORT_SYMBOL(nft_table_attr_set); @@ -127,6 +134,8 @@ const void *nft_table_attr_get(struct nft_table *t, uint16_t attr) return &t->table_flags; case NFT_TABLE_ATTR_FAMILY: return &t->family; + case NFT_TABLE_ATTR_USE: + return &t->use; } return NULL; } @@ -182,6 +191,12 @@ static int nft_table_parse_attr_cb(const struct nlattr *attr, void *data) return MNL_CB_ERROR; } break; + case NFTA_TABLE_USE: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; } tb[type] = attr; @@ -202,6 +217,10 @@ int nft_table_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_table *t) t->table_flags = ntohl(mnl_attr_get_u32(tb[NFTA_TABLE_FLAGS])); t->flags |= (1 << NFT_TABLE_ATTR_FLAGS); } + if (tb[NFTA_TABLE_USE]) { + t->use = ntohl(mnl_attr_get_u32(tb[NFTA_TABLE_USE])); + t->flags |= (1 << NFT_TABLE_ATTR_USE); + } t->family = nfg->nfgen_family; t->flags |= (1 << NFT_TABLE_ATTR_FAMILY); @@ -344,23 +363,27 @@ static int nft_table_snprintf_json(char *buf, size_t size, struct nft_table *t) "{\"table\":{" "\"name\":\"%s\"," "\"family\":\"%s\"," - "\"flags\":%d" + "\"flags\":%d," + "\"use\":%d" "}" "}" , - t->name, nft_family2str(t->family), t->table_flags); + t->name, nft_family2str(t->family), + t->table_flags, t->use); } static int nft_table_snprintf_xml(char *buf, size_t size, struct nft_table *t) { return snprintf(buf, size, "<table><name>%s</name><family>%s</family>" - "<flags>%d</flags></table>", - t->name, nft_family2str(t->family), t->table_flags); + "<flags>%d</flags><use>%d</use></table>", + t->name, nft_family2str(t->family), + t->table_flags, t->use); } static int nft_table_snprintf_default(char *buf, size_t size, struct nft_table *t) { - return snprintf(buf, size, "table %s %s flags %x", - t->name, nft_family2str(t->family), t->table_flags); + return snprintf(buf, size, "table %s %s flags %x use %d", + t->name, nft_family2str(t->family), + t->table_flags, t->use); } int nft_table_snprintf(char *buf, size_t size, struct nft_table *t, -- 1.8.4.4 ^ permalink raw reply related [flat|nested] 11+ messages in thread
end of thread, other threads:[~2013-12-17 13:53 UTC | newest] Thread overview: 11+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-12-12 13:00 [nftables PATCH] Expose tables's chain usage and handle it Tomasz Bursztyka 2013-12-12 13:00 ` [nftables-kernel PATCH] netfilter: nf_tables: Expose the table's chain usage to the netlink API Tomasz Bursztyka 2013-12-17 13:30 ` Pablo Neira Ayuso 2013-12-17 13:53 ` Pablo Neira Ayuso 2013-12-12 13:00 ` [libnftables PATCH 1/2] include: Update API documentation in sync with kernel's one Tomasz Bursztyka 2013-12-12 18:01 ` Pablo Neira Ayuso 2013-12-13 7:42 ` Tomasz Bursztyka 2013-12-12 13:00 ` [libnftables PATCH 2/2] table: Add support for NFTA_TABLE_USE nftables attribute Tomasz Bursztyka 2013-12-12 13:06 ` Arturo Borrero Gonzalez 2013-12-12 13:10 ` Tomasz Bursztyka 2013-12-12 13:12 ` [libnftables PATCH v2 " Tomasz Bursztyka
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).