xtables: introduce save_chain callback

In preparation for ebtables-save implementation, introduce a callback
for convenient per-family formatting of chains in save output.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index cbc4be737cd18f7d6e3105a3ccd860f1b26b5be8..0cfe84e11b2d930561e876e91f07420b2a22090b 100644 (file)
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -485,6 +485,7 @@ struct nft_family_ops nft_family_ops_ipv4 = {
        .print_rule             = nft_ipv4_print_rule,
        .save_rule              = nft_ipv4_save_rule,
        .save_counters          = save_counters,
+       .save_chain             = nft_ipv46_save_chain,
        .proto_parse            = nft_ipv4_proto_parse,
        .post_parse             = nft_ipv4_post_parse,
        .parse_target           = nft_ipv46_parse_target,

diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index 6aa913edc21c3b997ed619099272ba1bbf34437e..a33d4573b4df68e52177e610f380ef5044c014e9 100644 (file)
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -440,6 +440,7 @@ struct nft_family_ops nft_family_ops_ipv6 = {
        .print_rule             = nft_ipv6_print_rule,
        .save_rule              = nft_ipv6_save_rule,
        .save_counters          = save_counters,
+       .save_chain             = nft_ipv46_save_chain,
        .proto_parse            = nft_ipv6_proto_parse,
        .post_parse             = nft_ipv6_post_parse,
        .parse_target           = nft_ipv46_parse_target,

diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 60b539c89b1944dc76101c205d2331978a923ec1..66db7ed1fa34fc3b4e152ea0e44995c7b4bee19c 100644 (file)
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -16,6 +16,7 @@
 #include <stdbool.h>
 #include <netdb.h>
 #include <errno.h>
+#include <inttypes.h>
 
 #include <xtables.h>
 
@@ -802,6 +803,16 @@ void save_counters(const void *data)
                               (unsigned long long)cs->counters.bcnt);
 }
 
+void nft_ipv46_save_chain(const struct nftnl_chain *c, const char *policy)
+{
+       const char *chain = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
+       uint64_t pkts = nftnl_chain_get_u64(c, NFTNL_CHAIN_PACKETS);
+       uint64_t bytes = nftnl_chain_get_u64(c, NFTNL_CHAIN_BYTES);
+
+       printf(":%s %s [%"PRIu64":%"PRIu64"]\n",
+              chain, policy ?: "-", pkts, bytes);
+}
+
 void save_matches_and_target(struct xtables_rule_match *m,
                             struct xtables_target *target,
                             const char *jumpto, uint8_t flags, const void *fw)

diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
index 20c198631a23e58b185d0b5f457ff44517d7ee90..882f60e868c09c8fa56e9f33879bf8f9e8fa804d 100644 (file)
--- a/iptables/nft-shared.h
+++ b/iptables/nft-shared.h
@@ -5,6 +5,7 @@
 
 #include <libnftnl/rule.h>
 #include <libnftnl/expr.h>
+#include <libnftnl/chain.h>
 
 #include <linux/netfilter_arp/arp_tables.h>
 
@@ -95,6 +96,7 @@ struct nft_family_ops {
                           unsigned int format);
        void (*save_rule)(const void *data, unsigned int format);
        void (*save_counters)(const void *data);
+       void (*save_chain)(const struct nftnl_chain *c, const char *policy);
        void (*proto_parse)(struct iptables_command_state *cs,
                            struct xtables_args *args);
        void (*post_parse)(int command, struct iptables_command_state *cs,
@@ -166,6 +168,7 @@ void save_rule_details(const struct iptables_command_state *cs,
                       const char *outiface,
                       unsigned const char *outiface_mask);
 void save_counters(const void *data);
+void nft_ipv46_save_chain(const struct nftnl_chain *c, const char *policy);
 void save_matches_and_target(struct xtables_rule_match *m,
                             struct xtables_target *target,
                             const char *jumpto,

diff --git a/iptables/nft.c b/iptables/nft.c
index 7ce7fd2f03831689d3c5e46aa01ebd0194b49827..9f650f5af5fe8dd4311e4c28bd66cec7ba225af8 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1276,32 +1276,15 @@ static const char *policy_name[NF_ACCEPT+1] = {
        [NF_ACCEPT] = "ACCEPT",
 };
 
-static void nft_chain_print_save(struct nftnl_chain *c, bool basechain)
-{
-       const char *chain = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
-       uint64_t pkts = nftnl_chain_get_u64(c, NFTNL_CHAIN_PACKETS);
-       uint64_t bytes = nftnl_chain_get_u64(c, NFTNL_CHAIN_BYTES);
-
-       /* print chain name */
-       if (basechain) {
-               uint32_t pol = NF_ACCEPT;
-
-               /* no default chain policy? don't crash, display accept */
-               if (nftnl_chain_get(c, NFTNL_CHAIN_POLICY))
-                       pol = nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
-
-               printf(":%s %s [%"PRIu64":%"PRIu64"]\n", chain, policy_name[pol],
-                                            pkts, bytes);
-       } else
-               printf(":%s - [%"PRIu64":%"PRIu64"]\n", chain, pkts, bytes);
-}
-
 int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list,
                   const char *table)
 {
        struct nftnl_chain_list_iter *iter;
+       struct nft_family_ops *ops;
        struct nftnl_chain *c;
 
+       ops = nft_family_ops_lookup(h->family);
+
        iter = nftnl_chain_list_iter_create(list);
        if (iter == NULL)
                return 0;
@@ -1310,13 +1293,21 @@ int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list,
        while (c != NULL) {
                const char *chain_table =
                        nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
-               bool basechain = false;
+               const char *policy = NULL;
 
                if (strcmp(table, chain_table) != 0)
                        goto next;
 
-               basechain = nft_chain_builtin(c);
-               nft_chain_print_save(c, basechain);
+               if (nft_chain_builtin(c)) {
+                       uint32_t pol = NF_ACCEPT;
+
+                       if (nftnl_chain_get(c, NFTNL_CHAIN_POLICY))
+                               pol = nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
+                       policy = policy_name[pol];
+               }
+
+               if (ops->save_chain)
+                       ops->save_chain(c, policy);
 next:
                c = nftnl_chain_list_iter_next(iter);
        }