[nft PATCH 1/3] rule: rename do_command_list_cleanup() to table_cleanup()

[nft PATCH 1/3] rule: rename do_command_list_cleanup() to table_cleanup()

[Arturo Borrero Gonzalez]

Let's use a more generic name for this functions, since it has nothing to do
with commands.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
 src/rule.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/rule.c b/src/rule.c
index 2fe2520..ab533da 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -733,7 +733,7 @@ static int do_command_export(struct netlink_ctx *ctx, struct cmd *cmd)
 	return 0;
 }
 
-static void do_command_list_cleanup(struct table *table)
+static void table_cleanup(struct table *table)
 {
 	struct chain *chain, *nchain;
 	struct set *set, *nset;
@@ -837,10 +837,10 @@ static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd)
 	}
 
 	table_print(table);
-	do_command_list_cleanup(table);
+	table_cleanup(table);
 	return 0;
 err:
-	do_command_list_cleanup(table);
+	table_cleanup(table);
 	return -1;
 }
 
-- 
1.7.10.4

[nft PATCH 2/3 v2] rule: factorize chain and table listing code

[Arturo Borrero Gonzalez]

Let's factorize common code. This is also useful in follow-up patches.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
v2: rename function to do_list_table()

 src/rule.c |   67 +++++++++++++++++++++++++++++++-----------------------------
 1 file changed, 35 insertions(+), 32 deletions(-)

diff --git a/src/rule.c b/src/rule.c
index ab533da..336c159 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -749,11 +749,42 @@ static void table_cleanup(struct table *table)
 	}
 }
 
+static int do_list_table(struct netlink_ctx *ctx, struct cmd *cmd,
+			 struct table *table)
+{
+	struct rule *rule, *nrule;
+	struct chain *chain;
+
+	if (do_list_sets(ctx, &cmd->location, table) < 0)
+		goto err;
+	if (netlink_list_chains(ctx, &cmd->handle, &cmd->location) < 0)
+		goto err;
+	list_splice_tail_init(&ctx->list, &table->chains);
+	if (netlink_list_table(ctx, &cmd->handle, &cmd->location) < 0)
+		goto err;
+
+	list_for_each_entry_safe(rule, nrule, &ctx->list, list) {
+		table = table_lookup(&rule->handle);
+		chain = chain_lookup(table, &rule->handle);
+		if (chain == NULL) {
+			chain = chain_alloc(rule->handle.chain);
+			chain_add_hash(chain, table);
+		}
+
+		list_move_tail(&rule->list, &chain->rules);
+	}
+
+	table_print(table);
+	table_cleanup(table);
+	return 0;
+err:
+	table_cleanup(table);
+	return -1;
+}
+
 static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd)
 {
 	struct table *table = NULL;
-	struct chain *chain;
-	struct rule *rule, *nrule;
 	struct set *set;
 
 	/* No need to allocate the table object when listing all tables */
@@ -781,24 +812,9 @@ static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd)
 			}
 			return 0;
 		}
-		/* List content of this table */
-		if (do_list_sets(ctx, &cmd->location, table) < 0)
-			goto err;
-		if (netlink_list_chains(ctx, &cmd->handle, &cmd->location) < 0)
-			goto err;
-		list_splice_tail_init(&ctx->list, &table->chains);
-		if (netlink_list_table(ctx, &cmd->handle, &cmd->location) < 0)
-			goto err;
-		break;
+		return do_list_table(ctx, cmd, table);
 	case CMD_OBJ_CHAIN:
-		if (do_list_sets(ctx, &cmd->location, table) < 0)
-			goto err;
-		if (netlink_list_chains(ctx, &cmd->handle, &cmd->location) < 0)
-			goto err;
-		list_splice_tail_init(&ctx->list, &table->chains);
-		if (netlink_list_table(ctx, &cmd->handle, &cmd->location) < 0)
-			goto err;
-		break;
+		return do_list_table(ctx, cmd, table);
 	case CMD_OBJ_SETS:
 		if (netlink_list_sets(ctx, &cmd->handle, &cmd->location) < 0)
 			goto err;
@@ -825,19 +841,6 @@ static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd)
 		BUG("invalid command object type %u\n", cmd->obj);
 	}
 
-	list_for_each_entry_safe(rule, nrule, &ctx->list, list) {
-		table = table_lookup(&rule->handle);
-		chain = chain_lookup(table, &rule->handle);
-		if (chain == NULL) {
-			chain = chain_alloc(rule->handle.chain);
-			chain_add_hash(chain, table);
-		}
-
-		list_move_tail(&rule->list, &chain->rules);
-	}
-
-	table_print(table);
-	table_cleanup(table);
 	return 0;
 err:
 	table_cleanup(table);
-- 
1.7.10.4

[nft PATCH 3/3 v2] src: add list ruleset command

[Arturo Borrero Gonzalez]

This patch adds a new command to nft:
	% nft list ruleset [family]

Which list the entire ruleset.
If no family is specified, all tables of all families are listed.

Users can now make several operations at ruleset level:

 % nft list ruleset > ruleset.nft
 % nft -f ruleset.nft
 % nft flush ruleset

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
v3: rename function to do_list_ruleset() and use list_splice_tail_init()

 src/parser.y |    4 ++++
 src/rule.c   |   25 +++++++++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/src/parser.y b/src/parser.y
index e35eede..8f58e3a 100644
--- a/src/parser.y
+++ b/src/parser.y
@@ -753,6 +753,10 @@ list_cmd		:	TABLE		table_spec
 			{
 				$$ = cmd_alloc(CMD_LIST, CMD_OBJ_SET, &$2, &@$, NULL);
 			}
+			|	RULESET		ruleset_spec
+			{
+				$$ = cmd_alloc(CMD_LIST, CMD_OBJ_RULESET, &$2, &@$, NULL);
+			}
 			;
 
 flush_cmd		:	TABLE		table_spec
diff --git a/src/rule.c b/src/rule.c
index 336c159..c5a117d 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -782,6 +782,29 @@ err:
 	return -1;
 }
 
+static int do_list_ruleset(struct netlink_ctx *ctx, struct cmd *cmd)
+{
+	struct table *table, *next;
+	LIST_HEAD(table_list);
+
+	if (netlink_list_tables(ctx, &cmd->handle, &cmd->location) < 0)
+		return -1;
+
+	list_splice_tail_init(&ctx->list, &table_list);
+
+	list_for_each_entry_safe(table, next, &table_list, list) {
+		table_add_hash(table);
+
+		cmd->handle.family = table->handle.family;
+		cmd->handle.table = table->handle.table;
+
+		if (do_list_table(ctx, cmd, table) < 0)
+			return -1;
+	}
+
+	return 0;
+}
+
 static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd)
 {
 	struct table *table = NULL;
@@ -837,6 +860,8 @@ static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd)
 			set_print(set);
 		}
 		return 0;
+	case CMD_OBJ_RULESET:
+		return do_list_ruleset(ctx, cmd);
 	default:
 		BUG("invalid command object type %u\n", cmd->obj);
 	}
-- 
1.7.10.4

Re: [nft PATCH 3/3 v2] src: add list ruleset command

[Arturo Borrero Gonzalez]

On 24 September 2014 12:32, Arturo Borrero Gonzalez
<arturo.borrero.glez@gmail.com> wrote:
> This patch adds a new command to nft:
>         % nft list ruleset [family]
>

Hi,

this patch requires further review and tuning.

When using the interactive mode there are weird behaviours I need to
investigate.
Any pointer will be appreciated.
-- 
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [nft PATCH 3/3 v2] src: add list ruleset command

[Pablo Neira Ayuso]

On Wed, Sep 24, 2014 at 04:54:10PM +0200, Arturo Borrero Gonzalez wrote:
> On 24 September 2014 12:32, Arturo Borrero Gonzalez
> <arturo.borrero.glez@gmail.com> wrote:
> > This patch adds a new command to nft:
> >         % nft list ruleset [family]
> >
> 
> Hi,
> 
> this patch requires further review and tuning.
> 
> When using the interactive mode there are weird behaviours I need to
> investigate.
> Any pointer will be appreciated.

static LIST_HEAD(table_list);

void table_add_hash(struct table *table)
{
        list_add_tail(&table->list, &table_list);
}

+static int do_list_ruleset(struct netlink_ctx *ctx, struct cmd *cmd)
+{
+       struct table *table, *next;
+       LIST_HEAD(table_list);
        ^------------------^

I think we have to select a different name for this variable that is
allocated in the stack, since we already have a global table_list.

Re: [nft PATCH 1/3] rule: rename do_command_list_cleanup() to table_cleanup()

[Pablo Neira Ayuso]

On Wed, Sep 24, 2014 at 12:32:18PM +0200, Arturo Borrero Gonzalez wrote:
> Let's use a more generic name for this functions, since it has nothing to do
> with commands.

Applied, thanks.