* [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added. @ 2013-06-17 9:26 Giuseppe Longo 2013-06-17 9:26 ` [PATCH v3 2/2] xtables: function zero_entries removed Giuseppe Longo 2013-06-17 10:13 ` [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added Tomasz Bursztyka 0 siblings, 2 replies; 8+ messages in thread From: Giuseppe Longo @ 2013-06-17 9:26 UTC (permalink / raw) To: netfilter-devel Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> --- iptables/nft.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ iptables/nft.h | 1 + 2 files changed, 55 insertions(+), 0 deletions(-) diff --git a/iptables/nft.c b/iptables/nft.c index 2b191c6..81729b4 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -2845,3 +2845,57 @@ int nft_xtables_config_load(struct nft_handle *h, const char *filename, } return 0; } + +int nft_chain_zero_counters(struct nft_handle *h, const char *chain, const char *table) +{ + struct nft_chain_list *list; + struct nft_chain_list_iter *iter; + struct nft_chain *c; + struct nlmsghdr *nlh; + char buf[MNL_SOCKET_BUFFER_SIZE]; + int ret = 0; + + list = nft_chain_dump(h); + + iter = nft_chain_list_iter_create(list); + if (iter == NULL) { + DEBUGP("cannot allocate rule list iterator\n"); + return 0; + } + + c = nft_chain_list_iter_next(iter); + while (c != NULL) { + const char *chain_name = + nft_chain_attr_get(c, NFT_CHAIN_ATTR_NAME); + const char *chain_table = + nft_chain_attr_get(c, NFT_CHAIN_ATTR_TABLE); + + if (strcmp(table, chain_table) != 0) + goto next; + + if (chain != NULL && strcmp(chain, chain_name) != 0) + goto next; + + nft_chain_attr_set_u64(c, NFT_CHAIN_ATTR_PACKETS, 0); + nft_chain_attr_set_u64(c, NFT_CHAIN_ATTR_BYTES, 0); + + nft_chain_attr_unset(c, NFT_CHAIN_ATTR_HANDLE); + + nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family, + NLM_F_ACK, h->seq); + + nft_chain_nlmsg_build_payload(nlh, c); + + ret = mnl_talk(h, nlh, NULL, NULL); + if (ret < 0) + perror("mnl_talk:nft_chain_zero_counters"); + +next: + c = nft_chain_list_iter_next(iter); + } + + nft_chain_list_iter_destroy(iter); + nft_chain_list_free(list); + + return 1; +} diff --git a/iptables/nft.h b/iptables/nft.h index 8d5881d..082260e 100644 --- a/iptables/nft.h +++ b/iptables/nft.h @@ -42,6 +42,7 @@ int nft_chain_save(struct nft_handle *h, struct nft_chain_list *list, const char int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *table); int nft_chain_user_del(struct nft_handle *h, const char *chain, const char *table); int nft_chain_user_rename(struct nft_handle *h, const char *chain, const char *table, const char *newname); +int nft_chain_zero_counters(struct nft_handle *h, const char *chain, const char *table); /* * Operations with rule-set. ^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v3 2/2] xtables: function zero_entries removed 2013-06-17 9:26 [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added Giuseppe Longo @ 2013-06-17 9:26 ` Giuseppe Longo 2013-06-17 10:13 ` [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added Tomasz Bursztyka 1 sibling, 0 replies; 8+ messages in thread From: Giuseppe Longo @ 2013-06-17 9:26 UTC (permalink / raw) To: netfilter-devel Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> --- iptables/xtables.c | 25 +++++-------------------- 1 files changed, 5 insertions(+), 20 deletions(-) diff --git a/iptables/xtables.c b/iptables/xtables.c index a06988e..cfc91e4 100644 --- a/iptables/xtables.c +++ b/iptables/xtables.c @@ -549,14 +549,6 @@ check_entry(const char *chain, const char *table, } static int -zero_entries(const xt_chainlabel chain, int verbose, - struct xtc_handle *handle) -{ - /* XXX iterate over chains and reset counters */ - return 1; -} - -static int list_entries(struct nft_handle *h, const char *chain, const char *table, int rulenum, int verbose, int numeric, int expanded, int linenumbers) @@ -1171,8 +1163,7 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table) ret = nft_rule_flush(h, chain, *table); break; case CMD_ZERO: - /* FIXME */ -// ret = zero_entries(chain, cs.options&OPT_VERBOSE, *handle); + ret = nft_chain_zero_counters(h, chain, *table); break; case CMD_ZERO_NUM: /* FIXME */ @@ -1188,22 +1179,16 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table) cs.options&OPT_NUMERIC, cs.options&OPT_EXPANDED, cs.options&OPT_LINENUMBERS); -/* if (ret && (command & CMD_ZERO)) - ret = zero_entries(chain, - cs.options&OPT_VERBOSE, *handle); - if (ret && (command & CMD_ZERO_NUM)) - ret = iptc_zero_counter(chain, rulenum, *handle); */ + if (ret && (command & CMD_ZERO)) + ret = nft_chain_zero_counters(h, chain, *table); break; case CMD_LIST_RULES: case CMD_LIST_RULES|CMD_ZERO: case CMD_LIST_RULES|CMD_ZERO_NUM: /* FIXME */ ret = list_rules(h, chain, *table, rulenum, cs.options&OPT_VERBOSE); -/* if (ret && (command & CMD_ZERO)) - ret = zero_entries(chain, - cs.options&OPT_VERBOSE, *handle); - if (ret && (command & CMD_ZERO_NUM)) - ret = iptc_zero_counter(chain, rulenum, *handle); */ + if (ret && (command & CMD_ZERO)) + ret = nft_chain_zero_counters(h, chain, *table); break; case CMD_NEW_CHAIN: ret = nft_chain_user_add(h, chain, *table); ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added. 2013-06-17 9:26 [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added Giuseppe Longo 2013-06-17 9:26 ` [PATCH v3 2/2] xtables: function zero_entries removed Giuseppe Longo @ 2013-06-17 10:13 ` Tomasz Bursztyka 2013-06-17 11:29 ` Pablo Neira Ayuso 2013-06-17 13:17 ` Giuseppe Longo 1 sibling, 2 replies; 8+ messages in thread From: Tomasz Bursztyka @ 2013-06-17 10:13 UTC (permalink / raw) To: Giuseppe Longo; +Cc: netfilter-devel Hi Giuseppe, Minor comments below. > + > + nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family, This line seems to have more than 80 characters. There is a script in linux kernel sources that might help you before sending any patches: scripts/checkpatch.pl Run it against your patches, it will tell you about such style issues. At least at the beginning, at some point code style becomes a reflex. > + NLM_F_ACK, h->seq); > + > + nft_chain_nlmsg_build_payload(nlh, c); > + > + ret = mnl_talk(h, nlh, NULL, NULL); > + if (ret < 0) > + perror("mnl_talk:nft_chain_zero_counters"); I guess you don't want to continue looping after you found your chain. On success, make it break. And on error your function should return the error code. Tomasz ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added. 2013-06-17 10:13 ` [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added Tomasz Bursztyka @ 2013-06-17 11:29 ` Pablo Neira Ayuso 2013-06-17 12:22 ` Giuseppe Longo 2013-06-17 13:17 ` Giuseppe Longo 1 sibling, 1 reply; 8+ messages in thread From: Pablo Neira Ayuso @ 2013-06-17 11:29 UTC (permalink / raw) To: Tomasz Bursztyka; +Cc: Giuseppe Longo, netfilter-devel On Mon, Jun 17, 2013 at 01:13:08PM +0300, Tomasz Bursztyka wrote: > Hi Giuseppe, > > Minor comments below. > > >+ > >+ nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family, > > This line seems to have more than 80 characters. > > There is a script in linux kernel sources that might help you before > sending any patches: scripts/checkpatch.pl > Run it against your patches, it will tell you about such style > issues. At least at the beginning, at some point code style becomes > a reflex. > > > >+ NLM_F_ACK, h->seq); > >+ > >+ nft_chain_nlmsg_build_payload(nlh, c); > >+ > >+ ret = mnl_talk(h, nlh, NULL, NULL); > >+ if (ret < 0) > >+ perror("mnl_talk:nft_chain_zero_counters"); > > I guess you don't want to continue looping after you found your > chain. On success, make it break. > > And on error your function should return the error code. While at it, please also merge patch 1/2 and 2/2, we need that the repository remains consistent across updates. Thanks. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added. 2013-06-17 11:29 ` Pablo Neira Ayuso @ 2013-06-17 12:22 ` Giuseppe Longo 2013-06-17 12:41 ` Tomasz Bursztyka 0 siblings, 1 reply; 8+ messages in thread From: Giuseppe Longo @ 2013-06-17 12:22 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: Tomasz Bursztyka, netfilter-devel Hi Tomasz, >> >+ >> >+ nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family, >> >> This line seems to have more than 80 characters. >> >> There is a script in linux kernel sources that might help you before >> sending any patches: scripts/checkpatch.pl >> Run it against your patches, it will tell you about such style >> issues. At least at the beginning, at some point code style becomes >> a reflex. >> I runned checkscript.pl with my patch, but i don't get any style issues. This is the output: ./scripts/checkpatch.pl --file /home/giuseppe/nft_chain_zero_counters.patch /home/giuseppe/nft_chain_zero_counters.patch:83: ERROR: trailing whitespace /home/giuseppe/nft_chain_zero_counters.patch:92: ERROR: trailing whitespace total: 2 errors, 0 warnings, 141 lines checked ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added. 2013-06-17 12:22 ` Giuseppe Longo @ 2013-06-17 12:41 ` Tomasz Bursztyka 0 siblings, 0 replies; 8+ messages in thread From: Tomasz Bursztyka @ 2013-06-17 12:41 UTC (permalink / raw) To: Giuseppe Longo; +Cc: Pablo Neira Ayuso, netfilter-devel Hi Giuseppe, > I runned checkscript.pl with my patch, but i don't get any style issues. > This is the output: > > ./scripts/checkpatch.pl --file /home/giuseppe/nft_chain_zero_counters.patch > /home/giuseppe/nft_chain_zero_counters.patch:83: ERROR: trailing whitespace > /home/giuseppe/nft_chain_zero_counters.patch:92: ERROR: trailing whitespace > total: 2 errors, 0 warnings, 141 lines checked It's due to --file option you used. I get that: WARNING: line over 80 characters #56: FILE: iptables/nft.c:2884: + nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family, I ran it like: ./checkpatch.pl --no-tree <your patch> --file option is for a plain source file, not a patch file. Tomasz ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added. 2013-06-17 10:13 ` [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added Tomasz Bursztyka 2013-06-17 11:29 ` Pablo Neira Ayuso @ 2013-06-17 13:17 ` Giuseppe Longo 2013-06-18 4:50 ` Tomasz Bursztyka 1 sibling, 1 reply; 8+ messages in thread From: Giuseppe Longo @ 2013-06-17 13:17 UTC (permalink / raw) To: Tomasz Bursztyka; +Cc: netfilter-devel Hi Tomasz, > I guess you don't want to continue looping after you found your chain. On > success, make it break. Looking the code, in other functions like nft_chain_user_del, i guess that the loop continue after found the chain. Am i wrong? > And on error your function should return the error code. return ret == 0 ? 1 : 0; is it ok this code? Thanks ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added. 2013-06-17 13:17 ` Giuseppe Longo @ 2013-06-18 4:50 ` Tomasz Bursztyka 0 siblings, 0 replies; 8+ messages in thread From: Tomasz Bursztyka @ 2013-06-18 4:50 UTC (permalink / raw) To: Giuseppe Longo; +Cc: netfilter-devel Hi Giuseppe, >> I guess you don't want to continue looping after you found your chain. On >> success, make it break. > Looking the code, in other functions like nft_chain_user_del, > i guess that the loop continue after found the chain. > Am i wrong? Looks like you found an optimization patch to make in that function. >> And on error your function should return the error code. > return ret == 0 ? 1 : 0; > is it ok this code? > Sound fine to me in that particular case. Tomasz ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2013-06-18 4:50 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-06-17 9:26 [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added Giuseppe Longo 2013-06-17 9:26 ` [PATCH v3 2/2] xtables: function zero_entries removed Giuseppe Longo 2013-06-17 10:13 ` [PATCH v3 1/2] iptables-nftables: function nft_chain_zero_counters added Tomasz Bursztyka 2013-06-17 11:29 ` Pablo Neira Ayuso 2013-06-17 12:22 ` Giuseppe Longo 2013-06-17 12:41 ` Tomasz Bursztyka 2013-06-17 13:17 ` Giuseppe Longo 2013-06-18 4:50 ` Tomasz Bursztyka
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).