This is a partial revert of b0f6a45b25dd1 ("src: add --literal option")
which was added during the development cycle before 0.9.1 is released.
After looking at patch: https://patchwork.ozlabs.org/patch/969864/ that
allows to print priority, uid, gid and protocols as numerics, I decided
to revisit this to provide individual options to turn on literal
printing.
What I'm proposing is to provide a good default for everyone, and
provide options to turn on literal/numeric printing.
This patch adds nft_ctx_output_flags() and define two flags to enable
reverse DNS lookups and to print ports as service names.
This patch introduces -S/--services, to print service names as per
/etc/services.
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
v2: Fix nft_ctx_output_get_flags() to return unsigned int, not bool.
Use -S instead of -p, let's use uppercase to enable printing output
of some type, like -N.
We can replace all the existing nft_ctx_output_* to use _flags instead.
I had a look at py/nftables.py, we can keep the existing interface, eg.
get_handle_output() using the new _flags interface. So python
applications don't break.
doc/libnftables.adoc | 23 +++++++++++------------
doc/nft.txt | 17 +++++++++--------
include/nftables.h | 2 +-
include/nftables/libnftables.h | 15 +++++++--------
src/datatype.c | 6 +++---
src/json.c | 2 +-
src/libnftables.c | 8 ++++----
src/main.c | 30 ++++++++++--------------------
8 files changed, 46 insertions(+), 57 deletions(-)
diff --git a/doc/libnftables.adoc b/doc/libnftables.adoc
index 0387652fa3c1..7cb13bf3a134 100644
--- a/doc/libnftables.adoc
+++ b/doc/libnftables.adoc
@@ -18,6 +18,9 @@ void nft_ctx_free(struct nft_ctx* '\*ctx'*);
bool nft_ctx_get_dry_run(struct nft_ctx* '\*ctx'*);
void nft_ctx_set_dry_run(struct nft_ctx* '\*ctx'*, bool* 'dry'*);
+unsigned int nft_ctx_output_get_flags(struct nft_ctx* '\*ctx'*);
+void nft_ctx_output_set_flags(struct nft_ctx* '\*ctx'*, unsigned int* 'flags'*);
+
enum nft_numeric_level nft_ctx_output_get_numeric(struct nft_ctx* '\*ctx'*);
void nft_ctx_output_set_numeric(struct nft_ctx* '\*ctx'*,
enum nft_numeric_level* 'level'*);
@@ -25,9 +28,6 @@ void nft_ctx_output_set_numeric(struct nft_ctx* '\*ctx'*,
bool nft_ctx_output_get_stateless(struct nft_ctx* '\*ctx'*);
void nft_ctx_output_set_stateless(struct nft_ctx* '\*ctx'*, bool* 'val'*);
-enum nft_literal_level nft_ctx_output_get_literal(struct nft_ctx* '\*ctx'*);
-void nft_ctx_output_set_literal(struct nft_ctx* '\*ctx'*, bool* 'val'*);
-
unsigned int nft_ctx_output_get_debug(struct nft_ctx* '\*ctx'*);
void nft_ctx_output_set_debug(struct nft_ctx* '\*ctx'*, unsigned int* 'mask'*);
@@ -91,6 +91,14 @@ The *nft_ctx_get_dry_run*() function returns the dry-run setting's value contain
The *nft_ctx_set_dry_run*() function sets the dry-run setting in 'ctx' to the value of 'dry'.
+=== nft_ctx_output_get_flags() and nft_ctx_output_set_flags()
+The flags setting controls the output format, eg. whether reverse DNS lookups are performed for IP addresses
+when printing them via NFT_CTX_OUTPUT_REVERSEDNS. Note that this may add significant delay to *list* commands depending on DNS resolver speed.
+
+The *nft_ctx_output_get_flags*() function returns the output flags setting's value in 'ctx'.
+
+The *nft_ctx_output_set_flags*() function sets the output flags setting in 'ctx' to the value of 'val'.
+
=== nft_ctx_output_get_numeric() and nft_ctx_output_set_numeric()
These functions allow control over value representation in library output.
For instance, port numbers by default are printed by their name (as listed in '/etc/services' file), if known.
@@ -133,15 +141,6 @@ The *nft_ctx_output_get_stateless*() function returns the stateless output setti
The *nft_ctx_output_set_stateless*() function sets the stateless output setting in 'ctx' to the value of 'val'.
-=== nft_ctx_output_get_literal() and nft_ctx_output_set_literal()
-The literal setting controls whether reverse DNS lookups are performed for IP addresses when printing them.
-Note that this may add significant delay to *list* commands depending on DNS resolver speed.
-The default setting is *NFT_LITERAL_NONE*.
-
-The *nft_ctx_output_get_literal*() function returns the literal output setting's value in 'ctx'.
-
-The *nft_ctx_output_set_literal*() function sets the literal output setting in 'ctx' to the value of 'val'.
-
=== nft_ctx_output_get_debug() and nft_ctx_output_set_debug()
Libnftables supports separate debugging of different parts of its internals.
To facilitate this, debugging output is controlled via a bit mask.
diff --git a/doc/nft.txt b/doc/nft.txt
index 2a76a6cc63c4..2bc911ca9dab 100644
--- a/doc/nft.txt
+++ b/doc/nft.txt
@@ -9,7 +9,7 @@ nft - Administration tool of the nftables framework for packet filtering and cla
SYNOPSIS
--------
[verse]
-*nft* [ *-nNscae* ] [ *-I* 'directory' ] [ *-f* 'filename' | *-i* | 'cmd' ...]
+*nft* [ *-nNscaeS* ] [ *-I* 'directory' ] [ *-f* 'filename' | *-i* | 'cmd' ...]
*nft* *-h*
*nft* *-v*
@@ -43,13 +43,14 @@ For a full summary of options, run *nft --help*.
*--stateless*::
Omit stateful information of rules and stateful objects.
-*-l*::
-*--literal*::
- Translate numeric to literal. When used once (the default
- behaviour), print services (instead of numerical port numbers). Use
- twice to perform the IP address to name lookup, this usually
- requires network traffic for DNS lookup that slows down the
- ruleset listing.
+*-S*::
+*--service*::
+ Translate ports to service names.
+
+*-N*::
+*--reversedns*::
+ Translate IP address to names via reverse DNS lookup. This may slow down
+ your listing since it generates network traffic.
*-c*::
*--check*::
diff --git a/include/nftables.h b/include/nftables.h
index 25e78c80df7e..eae1ac1220db 100644
--- a/include/nftables.h
+++ b/include/nftables.h
@@ -16,9 +16,9 @@ struct cookie {
};
struct output_ctx {
+ unsigned int flags;
unsigned int numeric;
unsigned int stateless;
- unsigned int literal;
unsigned int handle;
unsigned int echo;
unsigned int json;
diff --git a/include/nftables/libnftables.h b/include/nftables/libnftables.h
index dee099f279c1..f0fccab38b15 100644
--- a/include/nftables/libnftables.h
+++ b/include/nftables/libnftables.h
@@ -33,12 +33,6 @@ enum nft_numeric_level {
NFT_NUMERIC_ALL,
};
-enum nft_literal_level {
- NFT_LITERAL_NONE,
- NFT_LITERAL_PORT,
- NFT_LITERAL_ADDR,
-};
-
/**
* Possible flags to pass to nft_ctx_new()
*/
@@ -49,12 +43,17 @@ void nft_ctx_free(struct nft_ctx *ctx);
bool nft_ctx_get_dry_run(struct nft_ctx *ctx);
void nft_ctx_set_dry_run(struct nft_ctx *ctx, bool dry);
+
+#define NFT_CTX_OUTPUT_REVERSEDNS (1 << 0)
+#define NFT_CTX_OUTPUT_SERVICE (1 << 1)
+
+unsigned int nft_ctx_output_get_flags(struct nft_ctx *ctx);
+void nft_ctx_output_set_flags(struct nft_ctx *ctx, unsigned int output_flags);
+
enum nft_numeric_level nft_ctx_output_get_numeric(struct nft_ctx *ctx);
void nft_ctx_output_set_numeric(struct nft_ctx *ctx, enum nft_numeric_level level);
bool nft_ctx_output_get_stateless(struct nft_ctx *ctx);
void nft_ctx_output_set_stateless(struct nft_ctx *ctx, bool val);
-enum nft_literal_level nft_ctx_output_get_literal(struct nft_ctx *ctx);
-void nft_ctx_output_set_literal(struct nft_ctx *ctx, enum nft_literal_level val);
unsigned int nft_ctx_output_get_debug(struct nft_ctx *ctx);
void nft_ctx_output_set_debug(struct nft_ctx *ctx, unsigned int mask);
bool nft_ctx_output_get_handle(struct nft_ctx *ctx);
diff --git a/src/datatype.c b/src/datatype.c
index 50af3df04f74..a7d18b302f58 100644
--- a/src/datatype.c
+++ b/src/datatype.c
@@ -454,7 +454,7 @@ static void ipaddr_type_print(const struct expr *expr, struct output_ctx *octx)
sin.sin_addr.s_addr = mpz_get_be32(expr->value);
err = getnameinfo((struct sockaddr *)&sin, sizeof(sin), buf,
sizeof(buf), NULL, 0,
- octx->literal >= NFT_LITERAL_ADDR ? 0 : NI_NUMERICHOST);
+ octx->flags & NFT_CTX_OUTPUT_REVERSEDNS ? 0 : NI_NUMERICHOST);
if (err != 0) {
getnameinfo((struct sockaddr *)&sin, sizeof(sin), buf,
sizeof(buf), NULL, 0, NI_NUMERICHOST);
@@ -512,7 +512,7 @@ static void ip6addr_type_print(const struct expr *expr, struct output_ctx *octx)
err = getnameinfo((struct sockaddr *)&sin6, sizeof(sin6), buf,
sizeof(buf), NULL, 0,
- octx->literal >= NFT_LITERAL_ADDR ? 0 : NI_NUMERICHOST);
+ octx->flags & NFT_CTX_OUTPUT_REVERSEDNS ? 0 : NI_NUMERICHOST);
if (err != 0) {
getnameinfo((struct sockaddr *)&sin6, sizeof(sin6), buf,
sizeof(buf), NULL, 0, NI_NUMERICHOST);
@@ -648,7 +648,7 @@ static void inet_service_print(const struct expr *expr, struct output_ctx *octx)
void inet_service_type_print(const struct expr *expr, struct output_ctx *octx)
{
- if (octx->literal >= NFT_LITERAL_PORT) {
+ if (octx->flags & NFT_CTX_OUTPUT_SERVICE) {
inet_service_print(expr, octx);
return;
}
diff --git a/src/json.c b/src/json.c
index 431d38afc24b..b2be752a641b 100644
--- a/src/json.c
+++ b/src/json.c
@@ -970,7 +970,7 @@ json_t *inet_service_type_json(const struct expr *expr, struct output_ctx *octx)
};
char buf[NI_MAXSERV];
- if (octx->literal < NFT_LITERAL_PORT ||
+ if (octx->flags & NFT_CTX_OUTPUT_SERVICE ||
getnameinfo((struct sockaddr *)&sin, sizeof(sin),
NULL, 0, buf, sizeof(buf), 0))
return json_integer(ntohs(sin.sin_port));
diff --git a/src/libnftables.c b/src/libnftables.c
index 0731c532a22a..4a69757f6b94 100644
--- a/src/libnftables.c
+++ b/src/libnftables.c
@@ -333,14 +333,14 @@ void nft_ctx_output_set_stateless(struct nft_ctx *ctx, bool val)
ctx->output.stateless = val;
}
-enum nft_literal_level nft_ctx_output_get_literal(struct nft_ctx *ctx)
+unsigned int nft_ctx_output_get_flags(struct nft_ctx *ctx)
{
- return ctx->output.literal;
+ return ctx->output.flags;
}
-void nft_ctx_output_set_literal(struct nft_ctx *ctx, enum nft_literal_level val)
+void nft_ctx_output_set_flags(struct nft_ctx *ctx, unsigned int flags)
{
- ctx->output.literal = val;
+ ctx->output.flags = flags;
}
unsigned int nft_ctx_output_get_debug(struct nft_ctx *ctx)
diff --git a/src/main.c b/src/main.c
index 792136f527d9..8dccf465be57 100644
--- a/src/main.c
+++ b/src/main.c
@@ -35,14 +35,14 @@ enum opt_vals {
OPT_NUMERIC = 'n',
OPT_STATELESS = 's',
OPT_IP2NAME = 'N',
- OPT_LITERAL = 'l',
+ OPT_SERVICES = 'S',
OPT_DEBUG = 'd',
OPT_HANDLE_OUTPUT = 'a',
OPT_ECHO = 'e',
OPT_INVALID = '?',
};
-#define OPTSTRING "hvcf:iI:jvnsNael"
+#define OPTSTRING "hvcf:iI:jvnsNaeS"
static const struct option options[] = {
{
@@ -79,8 +79,8 @@ static const struct option options[] = {
.val = OPT_IP2NAME,
},
{
- .name = "literal",
- .val = OPT_LITERAL,
+ .name = "services",
+ .val = OPT_SERVICES,
},
{
.name = "includepath",
@@ -178,7 +178,7 @@ int main(int argc, char * const *argv)
{
char *buf = NULL, *filename = NULL;
enum nft_numeric_level numeric;
- enum nft_literal_level literal;
+ unsigned int output_flags = 0;
bool interactive = false;
unsigned int debug_mask;
unsigned int len;
@@ -230,22 +230,10 @@ int main(int argc, char * const *argv)
nft_ctx_output_set_stateless(nft, true);
break;
case OPT_IP2NAME:
- literal = nft_ctx_output_get_literal(nft);
- if (literal + 2 > NFT_LITERAL_ADDR) {
- fprintf(stderr, "Cannot combine `-N' with `-l'\n");
- exit(EXIT_FAILURE);
- }
- nft_ctx_output_set_literal(nft, literal + 2);
+ output_flags |= NFT_CTX_OUTPUT_REVERSEDNS;
break;
- case OPT_LITERAL:
- literal = nft_ctx_output_get_literal(nft);
- if (literal + 1 > NFT_LITERAL_ADDR) {
- fprintf(stderr, "Too many `-l' options or "
- "perhaps you combined `-l' "
- "with `-N'?\n");
- exit(EXIT_FAILURE);
- }
- nft_ctx_output_set_literal(nft, literal + 1);
+ case OPT_SERVICES:
+ output_flags |= NFT_CTX_OUTPUT_SERVICE;
break;
case OPT_DEBUG:
debug_mask = nft_ctx_output_get_debug(nft);
@@ -290,6 +278,8 @@ int main(int argc, char * const *argv)
}
}
+ nft_ctx_output_set_flags(nft, output_flags);
+
if (optind != argc) {
for (len = 0, i = optind; i < argc; i++)
len += strlen(argv[i]) + strlen(" ");
--
2.11.0
