Patchwork [v3,1/2] iptables-nftables: function nft_chain_zero_counters added.

login
register
mail settings
Submitter Giuseppe Longo
Date June 17, 2013, 9:26 a.m.
Message ID <20130617092600.2814.15883.stgit@localhost>
Download mbox | patch
Permalink /patch/251793/
State Superseded
Headers show

Comments

Giuseppe Longo - June 17, 2013, 9:26 a.m.
Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
---
 iptables/nft.c |   54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 iptables/nft.h |    1 +
 2 files changed, 55 insertions(+), 0 deletions(-)


--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Tomasz Bursztyka - June 17, 2013, 10:13 a.m.
Hi Giuseppe,

Minor comments below.

> +
> +		nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,

This line seems to have more than 80 characters.

There is a script in linux kernel sources that might help you before 
sending any patches: scripts/checkpatch.pl
Run it against your patches, it will tell you about such style issues. 
At least at the beginning, at some point code style becomes a reflex.


> +						NLM_F_ACK, h->seq);
> +
> +		nft_chain_nlmsg_build_payload(nlh, c);
> +
> +		ret = mnl_talk(h, nlh, NULL, NULL);
> +		if (ret < 0)
> +			perror("mnl_talk:nft_chain_zero_counters");

I guess you don't want to continue looping after you found your chain. 
On success, make it break.

And on error your function should return the error code.


Tomasz
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pablo Neira - June 17, 2013, 11:29 a.m.
On Mon, Jun 17, 2013 at 01:13:08PM +0300, Tomasz Bursztyka wrote:
> Hi Giuseppe,
> 
> Minor comments below.
> 
> >+
> >+		nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,
> 
> This line seems to have more than 80 characters.
> 
> There is a script in linux kernel sources that might help you before
> sending any patches: scripts/checkpatch.pl
> Run it against your patches, it will tell you about such style
> issues. At least at the beginning, at some point code style becomes
> a reflex.
> 
> 
> >+						NLM_F_ACK, h->seq);
> >+
> >+		nft_chain_nlmsg_build_payload(nlh, c);
> >+
> >+		ret = mnl_talk(h, nlh, NULL, NULL);
> >+		if (ret < 0)
> >+			perror("mnl_talk:nft_chain_zero_counters");
> 
> I guess you don't want to continue looping after you found your
> chain. On success, make it break.
> 
> And on error your function should return the error code.

While at it, please also merge patch 1/2 and 2/2, we need that the
repository remains consistent across updates. Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Giuseppe Longo - June 17, 2013, 12:22 p.m.
Hi Tomasz,

>> >+
>> >+            nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,
>>
>> This line seems to have more than 80 characters.
>>
>> There is a script in linux kernel sources that might help you before
>> sending any patches: scripts/checkpatch.pl
>> Run it against your patches, it will tell you about such style
>> issues. At least at the beginning, at some point code style becomes
>> a reflex.
>>

I runned checkscript.pl with my patch, but i don't get any style issues.
This is the output:

./scripts/checkpatch.pl --file /home/giuseppe/nft_chain_zero_counters.patch
/home/giuseppe/nft_chain_zero_counters.patch:83: ERROR: trailing whitespace
/home/giuseppe/nft_chain_zero_counters.patch:92: ERROR: trailing whitespace
total: 2 errors, 0 warnings, 141 lines checked
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Tomasz Bursztyka - June 17, 2013, 12:41 p.m.
Hi Giuseppe,

> I runned checkscript.pl with my patch, but i don't get any style issues.
> This is the output:
>
> ./scripts/checkpatch.pl --file /home/giuseppe/nft_chain_zero_counters.patch
> /home/giuseppe/nft_chain_zero_counters.patch:83: ERROR: trailing whitespace
> /home/giuseppe/nft_chain_zero_counters.patch:92: ERROR: trailing whitespace
> total: 2 errors, 0 warnings, 141 lines checked

It's due to --file option you used.

I get that:

WARNING: line over 80 characters
#56: FILE: iptables/nft.c:2884:
+        nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,

I ran it like: ./checkpatch.pl --no-tree <your patch>

--file option is for a plain source file, not a patch file.

Tomasz
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Giuseppe Longo - June 17, 2013, 1:17 p.m.
Hi Tomasz,

> I guess you don't want to continue looping after you found your chain. On
> success, make it break.

Looking the code, in other functions like nft_chain_user_del,
i guess that the loop continue after found the chain.
Am i wrong?

> And on error your function should return the error code.

return ret == 0 ? 1 : 0;
is it ok this code?

Thanks
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Tomasz Bursztyka - June 18, 2013, 4:50 a.m.
Hi Giuseppe,

>> I guess you don't want to continue looping after you found your chain. On
>> success, make it break.
> Looking the code, in other functions like nft_chain_user_del,
> i guess that the loop continue after found the chain.
> Am i wrong?

Looks like you found an optimization patch to make in that function.

>> And on error your function should return the error code.
> return ret == 0 ? 1 : 0;
> is it ok this code?
>

Sound fine to me in that particular case.


Tomasz

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/iptables/nft.c b/iptables/nft.c
index 2b191c6..81729b4 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -2845,3 +2845,57 @@  int nft_xtables_config_load(struct nft_handle *h, const char *filename,
 	}
 	return 0;
 }
+
+int nft_chain_zero_counters(struct nft_handle *h, const char *chain, const char *table)
+{
+	struct nft_chain_list *list;
+	struct nft_chain_list_iter *iter;
+	struct nft_chain *c;
+	struct nlmsghdr *nlh;
+	char buf[MNL_SOCKET_BUFFER_SIZE];
+	int ret = 0;
+
+	list = nft_chain_dump(h);
+
+	iter = nft_chain_list_iter_create(list);
+	if (iter == NULL) {
+		DEBUGP("cannot allocate rule list iterator\n");
+		return 0;
+	}
+
+	c = nft_chain_list_iter_next(iter);
+	while (c != NULL) {
+		const char *chain_name =
+			nft_chain_attr_get(c, NFT_CHAIN_ATTR_NAME);
+		const char *chain_table =
+			nft_chain_attr_get(c, NFT_CHAIN_ATTR_TABLE);
+
+		if (strcmp(table, chain_table) != 0)
+			goto next;
+
+		if (chain != NULL && strcmp(chain, chain_name) != 0)
+			goto next;
+
+		nft_chain_attr_set_u64(c, NFT_CHAIN_ATTR_PACKETS, 0);
+		nft_chain_attr_set_u64(c, NFT_CHAIN_ATTR_BYTES, 0);
+
+		nft_chain_attr_unset(c, NFT_CHAIN_ATTR_HANDLE);
+
+		nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, h->family,
+						NLM_F_ACK, h->seq);
+
+		nft_chain_nlmsg_build_payload(nlh, c);
+
+		ret = mnl_talk(h, nlh, NULL, NULL);
+		if (ret < 0)
+			perror("mnl_talk:nft_chain_zero_counters");
+
+next:
+		c = nft_chain_list_iter_next(iter);
+	}
+
+	nft_chain_list_iter_destroy(iter);
+	nft_chain_list_free(list);
+
+	return 1;
+}
diff --git a/iptables/nft.h b/iptables/nft.h
index 8d5881d..082260e 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -42,6 +42,7 @@  int nft_chain_save(struct nft_handle *h, struct nft_chain_list *list, const char
 int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *table);
 int nft_chain_user_del(struct nft_handle *h, const char *chain, const char *table);
 int nft_chain_user_rename(struct nft_handle *h, const char *chain, const char *table, const char *newname);
+int nft_chain_zero_counters(struct nft_handle *h, const char *chain, const char *table);
 
 /*
  * Operations with rule-set.