[PATCH nft] src: display service name with -NN

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Default not to print the service name as we discussed during the NFWS.

 # nft list ruleset
 table ip x {
        chain y {
		...
                tcp dport 22 counter packets 0 bytes 0
        }
 }

Still, if you want it to be displayed, you can pass -NN.

 # nft list ruleset -NN
 table ip x {
        chain y {
		...
                tcp dport ssh counter packets 0 bytes 0
        }
 }

Single -N still retains the same behaviour, ie. display FQDN. --ip2name
option is still left in place but the new --literal is preferred.

Note that the -nn option becomes noop.

Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
Warning: This removes the ip2name knob that is available through libnftables.

 doc/libnftables.adoc           | 14 +++++++-------
 include/nftables.h             |  2 +-
 include/nftables/libnftables.h | 10 ++++++++--
 src/datatype.c                 | 10 +++++-----
 src/libnftables.c              |  8 ++++----
 src/main.c                     | 20 ++++++++++++++++----
 6 files changed, 41 insertions(+), 23 deletions(-)

diff --git a/doc/libnftables.adoc b/doc/libnftables.adoc
index adfc94205a8a..0387652fa3c1 100644
--- a/doc/libnftables.adoc
+++ b/doc/libnftables.adoc
@@ -25,8 +25,8 @@ void nft_ctx_output_set_numeric(struct nft_ctx* '\*ctx'*,
 bool nft_ctx_output_get_stateless(struct nft_ctx* '\*ctx'*);
 void nft_ctx_output_set_stateless(struct nft_ctx* '\*ctx'*, bool* 'val'*);
 
-bool nft_ctx_output_get_ip2name(struct nft_ctx* '\*ctx'*);
-void nft_ctx_output_set_ip2name(struct nft_ctx* '\*ctx'*, bool* 'val'*);
+enum nft_literal_level nft_ctx_output_get_literal(struct nft_ctx* '\*ctx'*);
+void nft_ctx_output_set_literal(struct nft_ctx* '\*ctx'*, bool* 'val'*);
 
 unsigned int nft_ctx_output_get_debug(struct nft_ctx* '\*ctx'*);
 void nft_ctx_output_set_debug(struct nft_ctx* '\*ctx'*, unsigned int* 'mask'*);
@@ -133,14 +133,14 @@ The *nft_ctx_output_get_stateless*() function returns the stateless output setti
 
 The *nft_ctx_output_set_stateless*() function sets the stateless output setting in 'ctx' to the value of 'val'.
 
-=== nft_ctx_output_get_ip2name() and nft_ctx_output_set_ip2name()
-The ip2name setting controls whether reverse DNS lookups are performed for IP addresses when printing them.
+=== nft_ctx_output_get_literal() and nft_ctx_output_set_literal()
+The literal setting controls whether reverse DNS lookups are performed for IP addresses when printing them.
 Note that this may add significant delay to *list* commands depending on DNS resolver speed.
-The default setting is *false*.
+The default setting is *NFT_LITERAL_NONE*.
 
-The *nft_ctx_output_get_ip2name*() function returns the ip2name output setting's value in 'ctx'.
+The *nft_ctx_output_get_literal*() function returns the literal output setting's value in 'ctx'.
 
-The *nft_ctx_output_set_ip2name*() function sets the ip2name output setting in 'ctx' to the value of 'val'.
+The *nft_ctx_output_set_literal*() function sets the literal output setting in 'ctx' to the value of 'val'.
 
 === nft_ctx_output_get_debug() and nft_ctx_output_set_debug()
 Libnftables supports separate debugging of different parts of its internals.
diff --git a/include/nftables.h b/include/nftables.h
index 5e209b417d5a..25e78c80df7e 100644
--- a/include/nftables.h
+++ b/include/nftables.h
@@ -18,7 +18,7 @@ struct cookie {
 struct output_ctx {
 	unsigned int numeric;
 	unsigned int stateless;
-	unsigned int ip2name;
+	unsigned int literal;
 	unsigned int handle;
 	unsigned int echo;
 	unsigned int json;
diff --git a/include/nftables/libnftables.h b/include/nftables/libnftables.h
index 13ec39273581..fda5cad76b65 100644
--- a/include/nftables/libnftables.h
+++ b/include/nftables/libnftables.h
@@ -33,6 +33,12 @@ enum nft_numeric_level {
 	NFT_NUMERIC_ALL,
 };
 
+enum nft_literal_level {
+	NFT_LITERAL_NONE,
+	NFT_LITERAL_ADDR,
+	NFT_LITERAL_PORT,
+};
+
 /**
  * Possible flags to pass to nft_ctx_new()
  */
@@ -47,8 +53,8 @@ enum nft_numeric_level nft_ctx_output_get_numeric(struct nft_ctx *ctx);
 void nft_ctx_output_set_numeric(struct nft_ctx *ctx, enum nft_numeric_level level);
 bool nft_ctx_output_get_stateless(struct nft_ctx *ctx);
 void nft_ctx_output_set_stateless(struct nft_ctx *ctx, bool val);
-bool nft_ctx_output_get_ip2name(struct nft_ctx *ctx);
-void nft_ctx_output_set_ip2name(struct nft_ctx *ctx, bool val);
+enum nft_literal_level nft_ctx_output_get_literal(struct nft_ctx *ctx);
+void nft_ctx_output_set_literal(struct nft_ctx *ctx, enum nft_literal_level val);
 unsigned int nft_ctx_output_get_debug(struct nft_ctx *ctx);
 void nft_ctx_output_set_debug(struct nft_ctx *ctx, unsigned int mask);
 bool nft_ctx_output_get_handle(struct nft_ctx *ctx);
diff --git a/src/datatype.c b/src/datatype.c
index 209044539bb8..fbc3ac35da4d 100644
--- a/src/datatype.c
+++ b/src/datatype.c
@@ -454,7 +454,7 @@ static void ipaddr_type_print(const struct expr *expr, struct output_ctx *octx)
 	sin.sin_addr.s_addr = mpz_get_be32(expr->value);
 	err = getnameinfo((struct sockaddr *)&sin, sizeof(sin), buf,
 			  sizeof(buf), NULL, 0,
-			  octx->ip2name ? 0 : NI_NUMERICHOST);
+			  octx->literal >= NFT_LITERAL_ADDR ? 0 : NI_NUMERICHOST);
 	if (err != 0) {
 		getnameinfo((struct sockaddr *)&sin, sizeof(sin), buf,
 			    sizeof(buf), NULL, 0, NI_NUMERICHOST);
@@ -512,7 +512,7 @@ static void ip6addr_type_print(const struct expr *expr, struct output_ctx *octx)
 
 	err = getnameinfo((struct sockaddr *)&sin6, sizeof(sin6), buf,
 			  sizeof(buf), NULL, 0,
-			  octx->ip2name ? 0 : NI_NUMERICHOST);
+			  octx->literal >= NFT_LITERAL_ADDR ? 0 : NI_NUMERICHOST);
 	if (err != 0) {
 		getnameinfo((struct sockaddr *)&sin6, sizeof(sin6), buf,
 			    sizeof(buf), NULL, 0, NI_NUMERICHOST);
@@ -617,11 +617,11 @@ const struct datatype inet_protocol_type = {
 static void inet_service_type_print(const struct expr *expr,
 				     struct output_ctx *octx)
 {
-	if (octx->numeric >= NFT_NUMERIC_PORT) {
-		integer_type_print(expr, octx);
+	if (octx->literal == NFT_LITERAL_PORT) {
+		symbolic_constant_print(&inet_service_tbl, expr, false, octx);
 		return;
 	}
-	symbolic_constant_print(&inet_service_tbl, expr, false, octx);
+	integer_type_print(expr, octx);
 }
 
 static struct error_record *inet_service_type_parse(const struct expr *sym,
diff --git a/src/libnftables.c b/src/libnftables.c
index 9a97a3c5342f..656b0a1c3f98 100644
--- a/src/libnftables.c
+++ b/src/libnftables.c
@@ -336,14 +336,14 @@ void nft_ctx_output_set_stateless(struct nft_ctx *ctx, bool val)
 	ctx->output.stateless = val;
 }
 
-bool nft_ctx_output_get_ip2name(struct nft_ctx *ctx)
+enum nft_literal_level nft_ctx_output_get_literal(struct nft_ctx *ctx)
 {
-	return ctx->output.ip2name;
+	return ctx->output.literal;
 }
 
-void nft_ctx_output_set_ip2name(struct nft_ctx *ctx, bool val)
+void nft_ctx_output_set_literal(struct nft_ctx *ctx, enum nft_literal_level val)
 {
-	ctx->output.ip2name = val;
+	ctx->output.literal = val;
 }
 
 unsigned int nft_ctx_output_get_debug(struct nft_ctx *ctx)
diff --git a/src/main.c b/src/main.c
index b2966a41e14f..5a23de24a3bd 100644
--- a/src/main.c
+++ b/src/main.c
@@ -34,7 +34,7 @@ enum opt_vals {
 	OPT_JSON		= 'j',
 	OPT_NUMERIC		= 'n',
 	OPT_STATELESS		= 's',
-	OPT_IP2NAME		= 'N',
+	OPT_LITERAL		= 'N',
 	OPT_DEBUG		= 'd',
 	OPT_HANDLE_OUTPUT	= 'a',
 	OPT_ECHO		= 'e',
@@ -75,7 +75,11 @@ static const struct option options[] = {
 	},
 	{
 		.name		= "reversedns",
-		.val		= OPT_IP2NAME,
+		.val		= OPT_LITERAL,
+	},
+	{
+		.name		= "literal",
+		.val		= OPT_LITERAL,
 	},
 	{
 		.name		= "includepath",
@@ -173,6 +177,7 @@ int main(int argc, char * const *argv)
 {
 	char *buf = NULL, *filename = NULL;
 	enum nft_numeric_level numeric;
+	enum nft_literal_level literal;
 	bool interactive = false;
 	unsigned int debug_mask;
 	unsigned int len;
@@ -223,8 +228,15 @@ int main(int argc, char * const *argv)
 		case OPT_STATELESS:
 			nft_ctx_output_set_stateless(nft, true);
 			break;
-		case OPT_IP2NAME:
-			nft_ctx_output_set_ip2name(nft, true);
+		case OPT_LITERAL:
+			literal = nft_ctx_output_get_literal(nft);
+			if (literal == NFT_LITERAL_PORT) {
+				fprintf(stderr, "Too many literal options "
+						"used, max. %u\n",
+					NFT_LITERAL_PORT);
+				exit(EXIT_FAILURE);
+			}
+			nft_ctx_output_set_literal(nft, literal + 1);
 			break;
 		case OPT_DEBUG:
 			debug_mask = nft_ctx_output_get_debug(nft);
-- 
2.11.0


--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux