[nft PATCH v3 0/3] Stateless output fixes

[nft PATCH v3 0/3] Stateless output fixes

[Jeremy Sowden]

The first patch removes some dummy output for named counters.  The
second patch fixes a bug that erroneously clears the stateless output
flag.  The third patch merges some conditionals.

Changes since v2: fixes for commit-messages of patches 2 & 3.
Changes since v1: patches 2 & 3 are new.

Jeremy Sowden (3):
  rule: remove fake stateless output of named counters
  rule: fix stateless output after listing sets containing counters
  rule: replace three conditionals with one

 src/rule.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

-- 
2.33.0

[nft PATCH v3 1/3] rule: remove fake stateless output of named counters

[Jeremy Sowden]

When `-s` is passed, no state is output for named quotas and counter and
quota rules, but fake zero state is output for named counters.  Remove
the output of named counters to match the remaining stateful objects.

Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
---
 src/rule.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/src/rule.c b/src/rule.c
index 6091067f608b..50e16cf9e028 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -1811,13 +1811,12 @@ static void obj_print_data(const struct obj *obj,
 			nft_print(octx, " # handle %" PRIu64, obj->handle.handle.id);
 
 		obj_print_comment(obj, opts, octx);
-		nft_print(octx, "%s%s%s", opts->nl, opts->tab, opts->tab);
-		if (nft_output_stateless(octx)) {
-			nft_print(octx, "packets 0 bytes 0");
-			break;
-		}
-		nft_print(octx, "packets %" PRIu64 " bytes %" PRIu64 "%s",
-			  obj->counter.packets, obj->counter.bytes, opts->nl);
+		if (nft_output_stateless(octx))
+			nft_print(octx, "%s", opts->nl);
+		else
+			nft_print(octx, "%s%s%spackets %" PRIu64 " bytes %" PRIu64 "%s",
+				  opts->nl, opts->tab, opts->tab,
+				  obj->counter.packets, obj->counter.bytes, opts->nl);
 		break;
 	case NFT_OBJECT_QUOTA: {
 		const char *data_unit;
-- 
2.33.0

[nft PATCH v3 2/3] rule: fix stateless output after listing sets containing counters

[Jeremy Sowden]

Before outputting counters in set definitions the
`NFT_CTX_OUTPUT_STATELESS` flag was set to suppress output of the
counter state and unconditionally cleared afterwards, regardless of
whether it had been originally set.  Record the original set of flags
and restore it.

Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994273
Fixes: 6d80e0f15492 ("src: support for counter in set definition")
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
---
 src/rule.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/rule.c b/src/rule.c
index 50e16cf9e028..b566adf07b1f 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -370,13 +370,15 @@ static void set_print_declaration(const struct set *set,
 		nft_print(octx, "%s%s", opts->tab, opts->tab);
 
 	if (!list_empty(&set->stmt_list)) {
+		unsigned int flags = octx->flags;
+
 		octx->flags |= NFT_CTX_OUTPUT_STATELESS;
 		list_for_each_entry(stmt, &set->stmt_list, list) {
 			stmt_print(stmt, octx);
 			if (!list_is_last(&stmt->list, &set->stmt_list))
 				nft_print(octx, " ");
 		}
-		octx->flags &= ~NFT_CTX_OUTPUT_STATELESS;
+		octx->flags = flags;
 	}
 
 	if (!list_empty(&set->stmt_list))
-- 
2.33.0

[nft PATCH v3 3/3] rule: replace three conditionals with one

[Jeremy Sowden]

When outputting set definitions, merge three consecutive
`if (!list_empty(&set->stmt_list))` conditionals.

Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
---
 src/rule.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/rule.c b/src/rule.c
index b566adf07b1f..7c048fcc1eee 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -366,12 +366,11 @@ static void set_print_declaration(const struct set *set,
 		nft_print(octx, "%s", opts->stmt_separator);
 	}
 
-	if (!list_empty(&set->stmt_list))
-		nft_print(octx, "%s%s", opts->tab, opts->tab);
-
 	if (!list_empty(&set->stmt_list)) {
 		unsigned int flags = octx->flags;
 
+		nft_print(octx, "%s%s", opts->tab, opts->tab);
+
 		octx->flags |= NFT_CTX_OUTPUT_STATELESS;
 		list_for_each_entry(stmt, &set->stmt_list, list) {
 			stmt_print(stmt, octx);
@@ -379,10 +378,9 @@ static void set_print_declaration(const struct set *set,
 				nft_print(octx, " ");
 		}
 		octx->flags = flags;
-	}
 
-	if (!list_empty(&set->stmt_list))
 		nft_print(octx, "%s", opts->stmt_separator);
+	}
 
 	if (set->automerge)
 		nft_print(octx, "%s%sauto-merge%s", opts->tab, opts->tab,
-- 
2.33.0

Re: [nft PATCH v3 0/3] Stateless output fixes

[Pablo Neira Ayuso]

On Thu, Oct 07, 2021 at 09:12:19PM +0100, Jeremy Sowden wrote:
> The first patch removes some dummy output for named counters.  The
> second patch fixes a bug that erroneously clears the stateless output
> flag.  The third patch merges some conditionals.

Series applied, thanks.