On Mon, Jan 16, 2023 at 01:30:42PM +0100, Pablo Neira Ayuso wrote: > On Thu, Jan 12, 2023 at 05:23:42PM +0100, Phil Sutter wrote: > > Reset rule counters and quotas in kernel, i.e. without having to reload > > them. Requires respective kernel patch to support NFT_MSG_GETRULE_RESET > > message type. > > Only thing to mention: This adds a new rule_cache_dump() call, this > was consolidated on top of the cache infrastructure, to have a single > spot in the code to fetch kernel objects via netlink. This triggers to > netlink dumps, one to populate the cache and another for the reset, > right? Well, rule_cache_dump() becomes dual-use, because the rule reset call is so similar to the regular rule dump one. I also changed it to allow turning the actual dump off (by sending NLM_F_ACK instead of NLM_F_DUMP to kernel). This is used for resetting a single rule (identified by rule-handle). Same functionality as with resetting (a single) quota instead of "quotas". If dump is active, the kernel returns the rules that have been reset to user space, so users see the last state data. To correctly print this, nft needs a table and chain cache. My v2 has this wrong, it needlessly requests a rule cache also. Thanks for making me validate this aspect of the implementation! :) The only caveat I just noticed with reduced cache is that "whole ruleset reset" does not print the rules because list_rule_cb() expects h->family to be set. Making it accept NFPROTO_UNSPEC is trivial, though. Cheers, Phil
