[PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added.

[PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added.

[Giuseppe Longo]

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
---
 iptables/nft.c |   54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 iptables/nft.h |    1 +
 2 files changed, 55 insertions(+), 0 deletions(-)

diff --git a/iptables/nft.c b/iptables/nft.c
index 2b191c6..81729b4 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -2845,3 +2845,57 @@ int nft_xtables_config_load(struct nft_handle *h, const char *filename,
 	}
 	return 0;
 }
+
+int nft_chain_zero_counters(struct nft_handle *h, const char *chain, const char *table)
+{
+	struct nft_chain_list *list;
+	struct nft_chain_list_iter *iter;
+	struct nft_chain *c;
+	struct nlmsghdr *nlh;
+	char buf[MNL_SOCKET_BUFFER_SIZE];
+	int ret = 0;
+
+	list = nft_chain_dump(h);
+
+	iter = nft_chain_list_iter_create(list);
+	if (iter == NULL) {
+		DEBUGP("cannot allocate rule list iterator\n");
+		return 0;
+	}
+
+	c = nft_chain_list_iter_next(iter);
+	while (c != NULL) {
+		const char *chain_name =
+			nft_chain_attr_get(c, NFT_CHAIN_ATTR_NAME);
+		const char *chain_table =
+			nft_chain_attr_get(c, NFT_CHAIN_ATTR_TABLE);
+
+		if (strcmp(table, chain_table) != 0)
+			goto next;
+
+		if (chain != NULL && strcmp(chain, chain_name) != 0)
+			goto next;
+
+		nft_chain_attr_set_u64(c, NFT_CHAIN_ATTR_PACKETS, 0);
+		nft_chain_attr_set_u64(c, NFT_CHAIN_ATTR_BYTES, 0);
+
+		nft_chain_attr_unset(c, NFT_CHAIN_ATTR_HANDLE);
+
+		nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,
+						NLM_F_ACK, h->seq);
+
+		nft_chain_nlmsg_build_payload(nlh, c);
+
+		ret = mnl_talk(h, nlh, NULL, NULL);
+		if (ret < 0)
+			perror("mnl_talk:nft_chain_zero_counters");
+
+next:
+		c = nft_chain_list_iter_next(iter);
+	}
+
+	nft_chain_list_iter_destroy(iter);
+	nft_chain_list_free(list);
+
+	return 1;
+}
diff --git a/iptables/nft.h b/iptables/nft.h
index 8d5881d..082260e 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -42,6 +42,7 @@ int nft_chain_save(struct nft_handle *h, struct nft_chain_list *list, const char
 int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *table);
 int nft_chain_user_del(struct nft_handle *h, const char *chain, const char *table);
 int nft_chain_user_rename(struct nft_handle *h, const char *chain, const char *table, const char *newname);
+int nft_chain_zero_counters(struct nft_handle *h, const char *chain, const char *table);
 
 /*
  * Operations with rule-set.

[PATCH v3 2/2] xtables: function zero_entries removed

[Giuseppe Longo]

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
---
 iptables/xtables.c |   25 +++++--------------------
 1 files changed, 5 insertions(+), 20 deletions(-)

diff --git a/iptables/xtables.c b/iptables/xtables.c
index a06988e..cfc91e4 100644
--- a/iptables/xtables.c
+++ b/iptables/xtables.c
@@ -549,14 +549,6 @@ check_entry(const char *chain, const char *table,
 }
 
 static int
-zero_entries(const xt_chainlabel chain, int verbose,
-	     struct xtc_handle *handle)
-{
-	/* XXX iterate over chains and reset counters */
-	return 1;
-}
-
-static int
 list_entries(struct nft_handle *h, const char *chain, const char *table,
 	     int rulenum, int verbose, int numeric, int expanded,
 	     int linenumbers)
@@ -1171,8 +1163,7 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table)
 		ret = nft_rule_flush(h, chain, *table);
 		break;
 	case CMD_ZERO:
-		/* FIXME */
-//		ret = zero_entries(chain, cs.options&OPT_VERBOSE, *handle);
+		ret = nft_chain_zero_counters(h, chain, *table);
 		break;
 	case CMD_ZERO_NUM:
 		/* FIXME */
@@ -1188,22 +1179,16 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table)
 				   cs.options&OPT_NUMERIC,
 				   cs.options&OPT_EXPANDED,
 				   cs.options&OPT_LINENUMBERS);
-/*		if (ret && (command & CMD_ZERO))
-			ret = zero_entries(chain,
-					   cs.options&OPT_VERBOSE, *handle);
-		if (ret && (command & CMD_ZERO_NUM))
-			ret = iptc_zero_counter(chain, rulenum, *handle); */
+		if (ret && (command & CMD_ZERO))
+			ret = nft_chain_zero_counters(h, chain, *table);
 		break;
 	case CMD_LIST_RULES:
 	case CMD_LIST_RULES|CMD_ZERO:
 	case CMD_LIST_RULES|CMD_ZERO_NUM:
 		/* FIXME */
 		ret = list_rules(h, chain, *table, rulenum, cs.options&OPT_VERBOSE);
-/*		if (ret && (command & CMD_ZERO))
-			ret = zero_entries(chain,
-					   cs.options&OPT_VERBOSE, *handle);
-		if (ret && (command & CMD_ZERO_NUM))
-			ret = iptc_zero_counter(chain, rulenum, *handle); */
+		if (ret && (command & CMD_ZERO))
+			ret = nft_chain_zero_counters(h, chain, *table);
 		break;
 	case CMD_NEW_CHAIN:
 		ret = nft_chain_user_add(h, chain, *table);

Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added.

[Tomasz Bursztyka]

Hi Giuseppe,

Minor comments below.

> +
> +		nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,

This line seems to have more than 80 characters.

There is a script in linux kernel sources that might help you before 
sending any patches: scripts/checkpatch.pl
Run it against your patches, it will tell you about such style issues. 
At least at the beginning, at some point code style becomes a reflex.


> +						NLM_F_ACK, h->seq);
> +
> +		nft_chain_nlmsg_build_payload(nlh, c);
> +
> +		ret = mnl_talk(h, nlh, NULL, NULL);
> +		if (ret < 0)
> +			perror("mnl_talk:nft_chain_zero_counters");

I guess you don't want to continue looping after you found your chain. 
On success, make it break.

And on error your function should return the error code.


Tomasz

Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added.

[Pablo Neira Ayuso]

On Mon, Jun 17, 2013 at 01:13:08PM +0300, Tomasz Bursztyka wrote:
> Hi Giuseppe,
> 
> Minor comments below.
> 
> >+
> >+		nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,
> 
> This line seems to have more than 80 characters.
> 
> There is a script in linux kernel sources that might help you before
> sending any patches: scripts/checkpatch.pl
> Run it against your patches, it will tell you about such style
> issues. At least at the beginning, at some point code style becomes
> a reflex.
> 
> 
> >+						NLM_F_ACK, h->seq);
> >+
> >+		nft_chain_nlmsg_build_payload(nlh, c);
> >+
> >+		ret = mnl_talk(h, nlh, NULL, NULL);
> >+		if (ret < 0)
> >+			perror("mnl_talk:nft_chain_zero_counters");
> 
> I guess you don't want to continue looping after you found your
> chain. On success, make it break.
> 
> And on error your function should return the error code.

While at it, please also merge patch 1/2 and 2/2, we need that the
repository remains consistent across updates. Thanks.

Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added.

[Giuseppe Longo]

Hi Tomasz,

>> >+
>> >+            nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,
>>
>> This line seems to have more than 80 characters.
>>
>> There is a script in linux kernel sources that might help you before
>> sending any patches: scripts/checkpatch.pl
>> Run it against your patches, it will tell you about such style
>> issues. At least at the beginning, at some point code style becomes
>> a reflex.
>>

I runned checkscript.pl with my patch, but i don't get any style issues.
This is the output:

./scripts/checkpatch.pl --file /home/giuseppe/nft_chain_zero_counters.patch
/home/giuseppe/nft_chain_zero_counters.patch:83: ERROR: trailing whitespace
/home/giuseppe/nft_chain_zero_counters.patch:92: ERROR: trailing whitespace
total: 2 errors, 0 warnings, 141 lines checked

Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added.

[Tomasz Bursztyka]

Hi Giuseppe,

> I runned checkscript.pl with my patch, but i don't get any style issues.
> This is the output:
>
> ./scripts/checkpatch.pl --file /home/giuseppe/nft_chain_zero_counters.patch
> /home/giuseppe/nft_chain_zero_counters.patch:83: ERROR: trailing whitespace
> /home/giuseppe/nft_chain_zero_counters.patch:92: ERROR: trailing whitespace
> total: 2 errors, 0 warnings, 141 lines checked

It's due to --file option you used.

I get that:

WARNING: line over 80 characters
#56: FILE: iptables/nft.c:2884:
+        nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,

I ran it like: ./checkpatch.pl --no-tree <your patch>

--file option is for a plain source file, not a patch file.

Tomasz

Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added.

[Giuseppe Longo]

Hi Tomasz,

> I guess you don't want to continue looping after you found your chain. On
> success, make it break.

Looking the code, in other functions like nft_chain_user_del,
i guess that the loop continue after found the chain.
Am i wrong?

> And on error your function should return the error code.

return ret == 0 ? 1 : 0;
is it ok this code?

Thanks

Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added.

[Tomasz Bursztyka]

Hi Giuseppe,

>> I guess you don't want to continue looping after you found your chain. On
>> success, make it break.
> Looking the code, in other functions like nft_chain_user_del,
> i guess that the loop continue after found the chain.
> Am i wrong?

Looks like you found an optimization patch to make in that function.

>> And on error your function should return the error code.
> return ret == 0 ? 1 : 0;
> is it ok this code?
>

Sound fine to me in that particular case.


Tomasz