On Tue, Jul 19, 2016 at 10:59:28AM +0200, jalvarez wrote: > I dug into the kernel code yesterday and I have come up with a small patch > (see below). > I am a complete newbie in kernel development, please feel free to correct me > if there is anything I did wrong. > > The kernel builds ok but I didn't tested my changes yet. Have you an idea of > what the best approach > should be to test these changes (using User Mode Linux maybe ?) ? You can mangle one of the existing examples in libnftnl to set the table and/or chain when listing rules, specifically examples/nft-rule-get.c You only have to set the table and/or chain attributes. > Also, I would like to know what is the exact meaning and expected behavior > of the idx counter in nf_tables_dump_rules(). Every time you call recvmsg(), the dump routine runs and fill a page with entries, if there are more entries that can fit into the page, the idx tells us where to follow up from in the next recvmsg() invocation. > My current changes might actually break the expected behavior if it was some > kind of "rule id counter" instead of "iteration counter". If it is possible, > I would rather not put the continues in the rules loop, as the goal of these > changes is mostly to avoid looping through the whole ruleset. > > Again, I am very thankful for your help. > > Here is the patch Just sent a patch to netfilter-devel, I've Cc'ed you. It would be good if you can test it. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
