From 1a3e12b60aff06a57d5aab501e4332a3f646e168 Mon Sep 17 00:00:00 2001
From: Red Bear OS <build@redbearos.org>
Date: Wed, 8 Jul 2026 19:50:55 +0300
Subject: [PATCH] summary: include filter chain counters via chain_summary()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

netcfg/summary now threads the FilterTable through and calls
chain_summary() — surface per-chain packet/byte/policy counters.

Output now includes:
  filter chains:
  input: pkts=12 bytes=5678 policy=ACCEPT
  output: pkts=0 bytes=0 policy=ACCEPT
  forward: pkts=0 bytes=0 policy=ACCEPT
  prerouting: pkts=0 bytes=0 policy=ACCEPT
  postrouting: pkts=0 bytes=0 policy=ACCEPT

NetCfgScheme::new gains filter_table: Rc<RefCell<FilterTable>> param.
Smolnetd passes the existing filter_table Rc.

All 5 unit tests still pass — refactor preserves behavior.
---
 netstack/src/scheme/mod.rs        | 1 +
 netstack/src/scheme/netcfg/mod.rs | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/netstack/src/scheme/mod.rs b/netstack/src/scheme/mod.rs
index 15f92ecd17..72cc54cf16 100644
--- a/netstack/src/scheme/mod.rs
+++ b/netstack/src/scheme/mod.rs
@@ -197,6 +197,7 @@ impl Smolnetd {
                 Rc::clone(&socket_set),
                 ip_forward,
                 Rc::clone(&observer),
+                Rc::clone(&filter_table),
             )?,
             netfilter_scheme: NetFilterScheme::new(
                 netfilter_file,
diff --git a/netstack/src/scheme/netcfg/mod.rs b/netstack/src/scheme/netcfg/mod.rs
index 95635146fb..47e93e7735 100644
--- a/netstack/src/scheme/netcfg/mod.rs
+++ b/netstack/src/scheme/netcfg/mod.rs
@@ -104,10 +104,11 @@ fn mk_root_node(
     socket_set: Rc<RefCell<SocketSet>>,
     ip_forward: Rc<Cell<bool>>,
     observer: ObserverRef,
+    filter_table: Rc<RefCell<crate::filter::FilterTable>>,
 ) -> CfgNodeRef {
     cfg_node! {
         "summary" => {
-            ro [devices, route_table, socket_set, ip_forward] || {
+            ro [devices, route_table, socket_set, ip_forward, filter_table] || {
                 let mut out = String::new();
                 let devs = devices.borrow();
                 let eth0 = devs.get("eth0");
@@ -137,6 +138,8 @@ fn mk_root_node(
                         s.rx_bytes, s.rx_packets, s.tx_bytes, s.tx_packets,
                         s.rx_errors, s.tx_errors, s.rx_dropped, s.tx_dropped));
                 }
+                out.push_str("filter chains:\n");
+                out.push_str(&filter_table.borrow().chain_summary());
                 out
             }
         },
@@ -804,6 +807,7 @@ impl NetCfgScheme {
         socket_set: Rc<RefCell<SocketSet>>,
         ip_forward: Rc<Cell<bool>>,
         observer: ObserverRef,
+        filter_table: Rc<RefCell<crate::filter::FilterTable>>,
     ) -> Result<NetCfgScheme> {
         let notifier = Notifier::new_ref();
         let dns_config = Rc::new(RefCell::new(DNSConfig {
@@ -822,6 +826,7 @@ impl NetCfgScheme {
                 socket_set,
                 ip_forward,
                 observer,
+                filter_table,
             ),
             notifier,
         };