Skip to contentSkip to conversation

iptables-nftables: function nft_chain_zero_counters added.

PATCH Superseded Giuseppe Longo 3 participants 8 messages Jun 17, 2013 – Jun 18, 2013 netfilter

lore
Share & tools
lore

Giuseppe Longo

author
#0 lore raw

PATCH v3 1/2 iptables-nftables: function nft_chain_zero_counters added.

Signed-off-by Giuseppe Longo <[email protected]>
---
 iptables/nft.c |   54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 iptables/nft.h |    1 +
 2 files changed, 55 insertions(+), 0 deletions(-)
iptables/nft.c +54 -0
index 2b191c6..81729b4 100644
@@ -2845,3 +2845,57 @@ int nft_xtables_config_load(struct nft_handle *h, const char *filename,
 	}
 	return 0;
 }
+
+int nft_chain_zero_counters(struct nft_handle *h, const char *chain, const char *table)
+{
+	struct nft_chain_list *list;
+	struct nft_chain_list_iter *iter;
+	struct nft_chain *c;
+	struct nlmsghdr *nlh;
+	char buf[MNL_SOCKET_BUFFER_SIZE];
+	int ret = 0;
+
+	list = nft_chain_dump(h);
+
+	iter = nft_chain_list_iter_create(list);
+	if (iter == NULL) {
+		DEBUGP("cannot allocate rule list iterator\n");
+		return 0;
+	}
+
+	c = nft_chain_list_iter_next(iter);
+	while (c != NULL) {
+		const char *chain_name =
+			nft_chain_attr_get(c, NFT_CHAIN_ATTR_NAME);
+		const char *chain_table =
+			nft_chain_attr_get(c, NFT_CHAIN_ATTR_TABLE);
+
+		if (strcmp(table, chain_table) != 0)
+			goto next;
+
+		if (chain != NULL && strcmp(chain, chain_name) != 0)
+			goto next;
+
+		nft_chain_attr_set_u64(c, NFT_CHAIN_ATTR_PACKETS, 0);
+		nft_chain_attr_set_u64(c, NFT_CHAIN_ATTR_BYTES, 0);
+
+		nft_chain_attr_unset(c, NFT_CHAIN_ATTR_HANDLE);
+
+		nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,
+						NLM_F_ACK, h->seq);
+
+		nft_chain_nlmsg_build_payload(nlh, c);
+
+		ret = mnl_talk(h, nlh, NULL, NULL);
+		if (ret < 0)
+			perror("mnl_talk:nft_chain_zero_counters");
+
+next:
+		c = nft_chain_list_iter_next(iter);
+	}
+
+	nft_chain_list_iter_destroy(iter);
+	nft_chain_list_free(list);
+
+	return 1;
+}
iptables/nft.h +1 -0
index 8d5881d..082260e 100644
@@ -42,6 +42,7 @@ int nft_chain_save(struct nft_handle *h, struct nft_chain_list *list, const char
 int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *table);
 int nft_chain_user_del(struct nft_handle *h, const char *chain, const char *table);
 int nft_chain_user_rename(struct nft_handle *h, const char *chain, const char *table, const char *newname);
+int nft_chain_zero_counters(struct nft_handle *h, const char *chain, const char *table);
 
 /*
  * Operations with rule-set.
author
#1 lore raw

PATCH v3 2/2 xtables: function zero_entries removed

Signed-off-by Giuseppe Longo <[email protected]>
---
 iptables/xtables.c |   25 +++++--------------------
 1 files changed, 5 insertions(+), 20 deletions(-)
iptables/xtables.c +5 -20
index a06988e..cfc91e4 100644
@@ -549,14 +549,6 @@ check_entry(const char *chain, const char *table,
 }
 
 static int
-zero_entries(const xt_chainlabel chain, int verbose,
-	     struct xtc_handle *handle)
-{
-	/* XXX iterate over chains and reset counters */
-	return 1;
-}
-
-static int
 list_entries(struct nft_handle *h, const char *chain, const char *table,
 	     int rulenum, int verbose, int numeric, int expanded,
 	     int linenumbers)

@@ -1171,8 +1163,7 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table)
 		ret = nft_rule_flush(h, chain, *table);
 		break;
 	case CMD_ZERO:
-		/* FIXME */
-//		ret = zero_entries(chain, cs.options&OPT_VERBOSE, *handle);
+		ret = nft_chain_zero_counters(h, chain, *table);
 		break;
 	case CMD_ZERO_NUM:
 		/* FIXME */

@@ -1188,22 +1179,16 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table)
 				   cs.options&OPT_NUMERIC,
 				   cs.options&OPT_EXPANDED,
 				   cs.options&OPT_LINENUMBERS);
-/*		if (ret && (command & CMD_ZERO))
-			ret = zero_entries(chain,
-					   cs.options&OPT_VERBOSE, *handle);
-		if (ret && (command & CMD_ZERO_NUM))
-			ret = iptc_zero_counter(chain, rulenum, *handle); */
+		if (ret && (command & CMD_ZERO))
+			ret = nft_chain_zero_counters(h, chain, *table);
 		break;
 	case CMD_LIST_RULES:
 	case CMD_LIST_RULES|CMD_ZERO:
 	case CMD_LIST_RULES|CMD_ZERO_NUM:
 		/* FIXME */
 		ret = list_rules(h, chain, *table, rulenum, cs.options&OPT_VERBOSE);
-/*		if (ret && (command & CMD_ZERO))
-			ret = zero_entries(chain,
-					   cs.options&OPT_VERBOSE, *handle);
-		if (ret && (command & CMD_ZERO_NUM))
-			ret = iptc_zero_counter(chain, rulenum, *handle); */
+		if (ret && (command & CMD_ZERO))
+			ret = nft_chain_zero_counters(h, chain, *table);
 		break;
 	case CMD_NEW_CHAIN:
 		ret = nft_chain_user_add(h, chain, *table);
#2 lore raw
In reply to Giuseppe Longo

Hi Giuseppe,

Minor comments below.

Review

Quoted 2 lines
(quoted diff) +2 -0
+
+		nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,

This line seems to have more than 80 characters.

There is a script in linux kernel sources that might help you before sending any patches: scripts/checkpatch.pl
Run it against your patches, it will tell you about such style issues. At least at the beginning, at some point code style becomes a reflex.

iptables/nft.c int nft_xtables_config_load(struct nft_handle *h, const char *filename, · line 2891

Quoted 7 lines
iptables/nft.c +7 -0
+						NLM_F_ACK, h->seq);
+
+		nft_chain_nlmsg_build_payload(nlh, c);
+
+		ret = mnl_talk(h, nlh, NULL, NULL);
+		if (ret < 0)
+			perror("mnl_talk:nft_chain_zero_counters");

I guess you don't want to continue looping after you found your chain. On success, make it break.

And on error your function should return the error code.

Tomasz

maintainer
#3 lore raw
Quoted 27 lines · Tomasz Bursztyka

Hi Giuseppe,

Minor comments below.

Review

Quoted 2 lines
(quoted diff) +2 -0
+
+		nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,

This line seems to have more than 80 characters.

There is a script in linux kernel sources that might help you before sending any patches: scripts/checkpatch.pl
Run it against your patches, it will tell you about such style issues. At least at the beginning, at some point code style becomes a reflex.

iptables/nft.c int nft_xtables_config_load(struct nft_handle *h, const char *filename, · line 2891

Quoted 7 lines
iptables/nft.c +7 -0
+						NLM_F_ACK, h->seq);
+
+		nft_chain_nlmsg_build_payload(nlh, c);
+
+		ret = mnl_talk(h, nlh, NULL, NULL);
+		if (ret < 0)
+			perror("mnl_talk:nft_chain_zero_counters");

I guess you don't want to continue looping after you found your chain. On success, make it break.

Quoted 1 line

And on error your function should return the error code.

While at it, please also merge patch 1/2 and 2/2, we need that the repository remains consistent across updates. Thanks.

author
#4 lore raw

Hi Tomasz,

Quoted 11 lines
Quoted 11 lines

Review

Quoted 2 lines
(quoted diff) +2 -0
+
+            nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,

This line seems to have more than 80 characters.

There is a script in linux kernel sources that might help you before sending any patches: scripts/checkpatch.pl
Run it against your patches, it will tell you about such style issues. At least at the beginning, at some point code style becomes a reflex.

I runned checkscript.pl with my patch, but i don't get any style issues. This is the output:

./scripts/checkpatch.pl --file /home/giuseppe/nft_chain_zero_counters.patch /home/giuseppe/nft_chain_zero_counters.patch:83: ERROR: trailing whitespace /home/giuseppe/nft_chain_zero_counters.patch:92: ERROR: trailing whitespace
total: 2 errors, 0 warnings, 141 lines checked

#5 lore raw

Hi Giuseppe,

Quoted 7 lines

I runned checkscript.pl with my patch, but i don't get any style issues. This is the output:

./scripts/checkpatch.pl --file /home/giuseppe/nft_chain_zero_counters.patch /home/giuseppe/nft_chain_zero_counters.patch:83: ERROR: trailing whitespace /home/giuseppe/nft_chain_zero_counters.patch:92: ERROR: trailing whitespace
total: 2 errors, 0 warnings, 141 lines checked

It's due to --file option you used.

I get that:

WARNING: line over 80 characters
#56: FILE: iptables/nft.c:2884:
+ nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,

I ran it like: ./checkpatch.pl --no-tree <your patch>

--file option is for a plain source file, not a patch file.

Tomasz

author
#6 lore raw
In reply to Tomasz Bursztyka

Hi Tomasz,

Quoted 2 lines

I guess you don't want to continue looping after you found your chain. On success, make it break.

Looking the code, in other functions like nft_chain_user_del, i guess that the loop continue after found the chain. Am i wrong?

Quoted 1 line

And on error your function should return the error code.

return ret == 0 ? 1 : 0;
is it ok this code?

Thanks

#7 lore raw

Hi Giuseppe,

Quoted 5 lines
Quoted 2 lines

I guess you don't want to continue looping after you found your chain. On success, make it break.

Looking the code, in other functions like nft_chain_user_del, i guess that the loop continue after found the chain. Am i wrong?

Looks like you found an optimization patch to make in that function.

Quoted 4 lines
Quoted 1 line

And on error your function should return the error code.

return ret == 0 ? 1 : 0;
is it ok this code?

Sound fine to me in that particular case.

Tomasz