This option allows you to specify which net namespace you want to run this
command on.
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
doc/nft.txt | 4 ++++
src/main.c | 28 +++++++++++++++++++++++-----
2 files changed, 27 insertions(+), 5 deletions(-)
diff --git a/doc/nft.txt b/doc/nft.txt
index 45350253ccbf..a668c33b3c6d 100644
--- a/doc/nft.txt
+++ b/doc/nft.txt
@@ -32,6 +32,10 @@ For a full summary of options, run *nft --help*.
*--version*::
Show version.
+*-w*::
+*--netns 'namespace'*::
+ Run command on the specified net namespace.
+
*-n*::
*--numeric*::
Print fully numerical output.
diff --git a/src/main.c b/src/main.c
index 0f2b57cbacbb..df88c028fcb3 100644
--- a/src/main.c
+++ b/src/main.c
@@ -28,6 +28,7 @@ enum opt_vals {
OPT_HELP = 'h',
OPT_VERSION = 'v',
OPT_CHECK = 'c',
+ OPT_NETNS = 'w',
OPT_FILE = 'f',
OPT_INTERACTIVE = 'i',
OPT_INCLUDEPATH = 'I',
@@ -46,7 +47,7 @@ enum opt_vals {
OPT_TERSE = 't',
OPT_INVALID = '?',
};
-#define OPTSTRING "+hvd:cf:iI:jvnsNaeSupypTt"
+#define OPTSTRING "+hvd:cf:iI:jvnsNaeSupypTtw:"
static const struct option options[] = {
{
@@ -129,6 +130,11 @@ static const struct option options[] = {
.val = OPT_TERSE,
},
{
+ .name = "netns",
+ .val = OPT_NETNS,
+ .has_arg = 1,
+ },
+ {
.name = NULL
}
};
@@ -150,6 +156,7 @@ static void show_help(const char *name)
" -n, --numeric Print fully numerical output.\n"
" -s, --stateless Omit stateful information of ruleset.\n"
" -t, --terse Omit contents of sets.\n"
+" -w, --netns Run command on network namespace\n"
" -u, --guid Print UID/GID as defined in /etc/passwd and /etc/group.\n"
" -N Translate IP addresses to names.\n"
" -S, --service Translate ports to service names as described in /etc/services.\n"
@@ -231,9 +238,11 @@ static bool nft_options_check(int argc, char * const argv[])
} else if (argv[i][1] == 'd' ||
argv[i][1] == 'I' ||
argv[i][1] == 'f' ||
+ argv[i][1] == 'w' ||
!strcmp(argv[i], "--debug") ||
!strcmp(argv[i], "--includepath") ||
- !strcmp(argv[i], "--file")) {
+ !strcmp(argv[i], "--file") ||
+ !strcmp(argv[i], "--netns")) {
skip = true;
continue;
}
@@ -247,10 +256,10 @@ static bool nft_options_check(int argc, char * const argv[])
int main(int argc, char * const *argv)
{
- char *buf = NULL, *filename = NULL, *includepath = NULL;
+ char *buf = NULL, *filename = NULL, *includepath = NULL, *netns = NULL;
unsigned int output_flags = 0, debug_mask = 0, len;
bool interactive = false, dry_run = false;
- int i, val, rc;
+ int i, val, rc, ctx = NFT_CTX_DEFAULT;
if (!nft_options_check(argc, argv))
exit(EXIT_FAILURE);
@@ -271,6 +280,9 @@ int main(int argc, char * const *argv)
case OPT_CHECK:
dry_run = true;
break;
+ case OPT_NETNS:
+ netns = optarg;
+ break;
case OPT_FILE:
filename = optarg;
break;
@@ -353,12 +365,18 @@ int main(int argc, char * const *argv)
}
}
- nft = nft_ctx_new(NFT_CTX_DEFAULT);
+ if (netns)
+ ctx = NFT_CTX_NETNS;
+
+ nft = nft_ctx_new(ctx);
if (includepath && nft_ctx_add_include_path(nft, includepath) < 0) {
fprintf(stderr, "Failed to add include path '%s'\n", optarg);
exit(EXIT_FAILURE);
}
+ if (netns && nft_ctx_set_netns(nft, netns) < 0)
+ exit(EXIT_FAILURE);
+
nft_ctx_set_dry_run(nft, dry_run);
nft_ctx_output_set_debug(nft, debug_mask);
nft_ctx_output_set_flags(nft, output_flags);
--
2.11.0
