This is a partial revert of b0f6a45b25dd1 ("src: add --literal option")
which was added during the development cycle before 0.9.1 is released.After looking at patch: https://patchwork.ozlabs.org/patch/969864/ that allows to print priority, uid, gid and protocols as numerics, I decided to revisit this to provide individual options to turn on literal printing. What I'm proposing is to provide a good default for everyone, and provide options to turn on literal/numeric printing. This patch adds nft_ctx_output_flags() and define two flags to enable reverse DNS lookups and to print ports as service names. This patch introduces -S/--services, to print service names as per /etc/services. Signed-off-by: Pablo Neira Ayuso <[email protected]> --- v2: Fix nft_ctx_output_get_flags() to return unsigned int, not bool. Use -S instead of -p, let's use uppercase to enable printing output of some type, like -N. We can replace all the existing nft_ctx_output_* to use _flags instead. I had a look at py/nftables.py, we can keep the existing interface, eg. get_handle_output() using the new _flags interface. So python applications don't break. doc/libnftables.adoc | 23 +++++++++++------------ doc/nft.txt | 17 +++++++++-------- include/nftables.h | 2 +- include/nftables/libnftables.h | 15 +++++++-------- src/datatype.c | 6 +++--- src/json.c | 2 +- src/libnftables.c | 8 ++++---- src/main.c | 30 ++++++++++-------------------- 8 files changed, 46 insertions(+), 57 deletions(-) diff --git a/doc/libnftables.adoc b/doc/libnftables.adoc index 0387652fa3c1..7cb13bf3a134 100644 --- a/doc/libnftables.adoc +++ b/doc/libnftables.adoc @@ -18,6 +18,9 @@ void nft_ctx_free(struct nft_ctx* '\*ctx'*); bool nft_ctx_get_dry_run(struct nft_ctx* '\*ctx'*); void nft_ctx_set_dry_run(struct nft_ctx* '\*ctx'*, bool* 'dry'*); +unsigned int nft_ctx_output_get_flags(struct nft_ctx* '\*ctx'*); +void nft_ctx_output_set_flags(struct nft_ctx* '\*ctx'*, unsigned int* 'flags'*); + enum nft_numeric_level nft_ctx_output_get_numeric(struct nft_ctx* '\*ctx'*); void nft_ctx_output_set_numeric(struct nft_ctx* '\*ctx'*, enum nft_numeric_level* 'level'*); @@ -25,9 +28,6 @@ void nft_ctx_output_set_numeric(struct nft_ctx* '\*ctx'*, bool nft_ctx_output_get_stateless(struct nft_ctx* '\*ctx'*); void nft_ctx_output_set_stateless(struct nft_ctx* '\*ctx'*, bool* 'val'*); -enum nft_literal_level nft_ctx_output_get_literal(struct nft_ctx* '\*ctx'*); -void nft_ctx_output_set_literal(struct nft_ctx* '\*ctx'*, bool* 'val'*); - unsigned int nft_ctx_output_get_debug(struct nft_ctx* '\*ctx'*); void nft_ctx_output_set_debug(struct nft_ctx* '\*ctx'*, unsigned int* 'mask'*); @@ -91,6 +91,14 @@ The *nft_ctx_get_dry_run*() function returns the dry-run setting's value contain The *nft_ctx_set_dry_run*() function sets the dry-run setting in 'ctx' to the value of 'dry'. +=== nft_ctx_output_get_flags() and nft_ctx_output_set_flags() +The flags setting controls the output format, eg. whether reverse DNS lookups are performed for IP addresses +when printing them via NFT_CTX_OUTPUT_REVERSEDNS. Note that this may add significant delay to *list* commands depending on DNS resolver speed. + +The *nft_ctx_output_get_flags*() function returns the output flags setting's value in 'ctx'. + +The *nft_ctx_output_set_flags*() function sets the output flags setting in 'ctx' to the value of 'val'. + === nft_ctx_output_get_numeric() and nft_ctx_output_set_numeric() These functions allow control over value representation in library output. For instance, port numbers by default are printed by their name (as listed in '/etc/services' file), if known. @@ -133,15 +141,6 @@ The *nft_ctx_output_get_stateless*() function returns the stateless output setti The *nft_ctx_output_set_stateless*() function sets the stateless output setting in 'ctx' to the value of 'val'. -=== nft_ctx_output_get_literal() and nft_ctx_output_set_literal() -The literal setting controls whether reverse DNS lookups are performed for IP addresses when printing them. -Note that this may add significant delay to *list* commands depending on DNS resolver speed. -The default setting is *NFT_LITERAL_NONE*. - -The *nft_ctx_output_get_literal*() function returns the literal output setting's value in 'ctx'. - -The *nft_ctx_output_set_literal*() function sets the literal output setting in 'ctx' to the value of 'val'. - === nft_ctx_output_get_debug() and nft_ctx_output_set_debug() Libnftables supports separate debugging of different parts of its internals. To facilitate this, debugging output is controlled via a bit mask. diff --git a/doc/nft.txt b/doc/nft.txt index 2a76a6cc63c4..2bc911ca9dab 100644 --- a/doc/nft.txt +++ b/doc/nft.txt @@ -9,7 +9,7 @@ nft - Administration tool of the nftables framework for packet filtering and cla SYNOPSIS -------- [verse] -*nft* [ *-nNscae* ] [ *-I* 'directory' ] [ *-f* 'filename' | *-i* | 'cmd' ...] +*nft* [ *-nNscaeS* ] [ *-I* 'directory' ] [ *-f* 'filename' | *-i* | 'cmd' ...] *nft* *-h* *nft* *-v* @@ -43,13 +43,14 @@ For a full summary of options, run *nft --help*. *--stateless*:: Omit stateful information of rules and stateful objects. -*-l*:: -*--literal*:: - Translate numeric to literal. When used once (the default - behaviour), print services (instead of numerical port numbers). Use - twice to perform the IP address to name lookup, this usually - requires network traffic for DNS lookup that slows down the - ruleset listing. +*-S*:: +*--service*:: + Translate ports to service names. + +*-N*:: +*--reversedns*:: + Translate IP address to names via reverse DNS lookup. This may slow down + your listing since it generates network traffic. *-c*:: *--check*:: diff --git a/include/nftables.h b/include/nftables.h index 25e78c80df7e..eae1ac1220db 100644 --- a/include/nftables.h +++ b/include/nftables.h @@ -16,9 +16,9 @@ struct cookie { }; struct output_ctx { + unsigned int flags; unsigned int numeric; unsigned int stateless; - unsigned int literal; unsigned int handle; unsigned int echo; unsigned int json; diff --git a/include/nftables/libnftables.h b/include/nftables/libnftables.h index dee099f279c1..f0fccab38b15 100644 --- a/include/nftables/libnftables.h +++ b/include/nftables/libnftables.h @@ -33,12 +33,6 @@ enum nft_numeric_level { NFT_NUMERIC_ALL, }; -enum nft_literal_level { - NFT_LITERAL_NONE, - NFT_LITERAL_PORT, - NFT_LITERAL_ADDR, -}; - /** * Possible flags to pass to nft_ctx_new() */ @@ -49,12 +43,17 @@ void nft_ctx_free(struct nft_ctx *ctx); bool nft_ctx_get_dry_run(struct nft_ctx *ctx); void nft_ctx_set_dry_run(struct nft_ctx *ctx, bool dry); + +#define NFT_CTX_OUTPUT_REVERSEDNS (1 << 0) +#define NFT_CTX_OUTPUT_SERVICE (1 << 1) + +unsigned int nft_ctx_output_get_flags(struct nft_ctx *ctx); +void nft_ctx_output_set_flags(struct nft_ctx *ctx, unsigned int output_flags); + enum nft_numeric_level nft_ctx_output_get_numeric(struct nft_ctx *ctx); void nft_ctx_output_set_numeric(struct nft_ctx *ctx, enum nft_numeric_level level); bool nft_ctx_output_get_stateless(struct nft_ctx *ctx); void nft_ctx_output_set_stateless(struct nft_ctx *ctx, bool val); -enum nft_literal_level nft_ctx_output_get_literal(struct nft_ctx *ctx); -void nft_ctx_output_set_literal(struct nft_ctx *ctx, enum nft_literal_level val); unsigned int nft_ctx_output_get_debug(struct nft_ctx *ctx); void nft_ctx_output_set_debug(struct nft_ctx *ctx, unsigned int mask); bool nft_ctx_output_get_handle(struct nft_ctx *ctx); diff --git a/src/datatype.c b/src/datatype.c index 50af3df04f74..a7d18b302f58 100644 --- a/src/datatype.c +++ b/src/datatype.c @@ -454,7 +454,7 @@ static void ipaddr_type_print(const struct expr *expr, struct output_ctx *octx) sin.sin_addr.s_addr = mpz_get_be32(expr->value); err = getnameinfo((struct sockaddr *)&sin, sizeof(sin), buf, sizeof(buf), NULL, 0, - octx->literal >= NFT_LITERAL_ADDR ? 0 : NI_NUMERICHOST); + octx->flags & NFT_CTX_OUTPUT_REVERSEDNS ? 0 : NI_NUMERICHOST); if (err != 0) { getnameinfo((struct sockaddr *)&sin, sizeof(sin), buf, sizeof(buf), NULL, 0, NI_NUMERICHOST); @@ -512,7 +512,7 @@ static void ip6addr_type_print(const struct expr *expr, struct output_ctx *octx) err = getnameinfo((struct sockaddr *)&sin6, sizeof(sin6), buf, sizeof(buf), NULL, 0, - octx->literal >= NFT_LITERAL_ADDR ? 0 : NI_NUMERICHOST); + octx->flags & NFT_CTX_OUTPUT_REVERSEDNS ? 0 : NI_NUMERICHOST); if (err != 0) { getnameinfo((struct sockaddr *)&sin6, sizeof(sin6), buf, sizeof(buf), NULL, 0, NI_NUMERICHOST); @@ -648,7 +648,7 @@ static void inet_service_print(const struct expr *expr, struct output_ctx *octx) void inet_service_type_print(const struct expr *expr, struct output_ctx *octx) { - if (octx->literal >= NFT_LITERAL_PORT) { + if (octx->flags & NFT_CTX_OUTPUT_SERVICE) { inet_service_print(expr, octx); return; } diff --git a/src/json.c b/src/json.c index 431d38afc24b..b2be752a641b 100644 --- a/src/json.c +++ b/src/json.c @@ -970,7 +970,7 @@ json_t *inet_service_type_json(const struct expr *expr, struct output_ctx *octx) }; char buf[NI_MAXSERV]; - if (octx->literal < NFT_LITERAL_PORT || + if (octx->flags & NFT_CTX_OUTPUT_SERVICE || getnameinfo((struct sockaddr *)&sin, sizeof(sin), NULL, 0, buf, sizeof(buf), 0)) return json_integer(ntohs(sin.sin_port)); diff --git a/src/libnftables.c b/src/libnftables.c index 0731c532a22a..4a69757f6b94 100644 --- a/src/libnftables.c +++ b/src/libnftables.c @@ -333,14 +333,14 @@ void nft_ctx_output_set_stateless(struct nft_ctx *ctx, bool val) ctx->output.stateless = val; } -enum nft_literal_level nft_ctx_output_get_literal(struct nft_ctx *ctx) +unsigned int nft_ctx_output_get_flags(struct nft_ctx *ctx) { - return ctx->output.literal; + return ctx->output.flags; } -void nft_ctx_output_set_literal(struct nft_ctx *ctx, enum nft_literal_level val) +void nft_ctx_output_set_flags(struct nft_ctx *ctx, unsigned int flags) { - ctx->output.literal = val; + ctx->output.flags = flags; } unsigned int nft_ctx_output_get_debug(struct nft_ctx *ctx) diff --git a/src/main.c b/src/main.c index 792136f527d9..8dccf465be57 100644 --- a/src/main.c +++ b/src/main.c @@ -35,14 +35,14 @@ enum opt_vals { OPT_NUMERIC = 'n', OPT_STATELESS = 's', OPT_IP2NAME = 'N', - OPT_LITERAL = 'l', + OPT_SERVICES = 'S', OPT_DEBUG = 'd', OPT_HANDLE_OUTPUT = 'a', OPT_ECHO = 'e', OPT_INVALID = '?', }; -#define OPTSTRING "hvcf:iI:jvnsNael" +#define OPTSTRING "hvcf:iI:jvnsNaeS" static const struct option options[] = { { @@ -79,8 +79,8 @@ static const struct option options[] = { .val = OPT_IP2NAME, }, { - .name = "literal", - .val = OPT_LITERAL, + .name = "services", + .val = OPT_SERVICES, }, { .name = "includepath", @@ -178,7 +178,7 @@ int main(int argc, char * const *argv) { char *buf = NULL, *filename = NULL; enum nft_numeric_level numeric; - enum nft_literal_level literal; + unsigned int output_flags = 0; bool interactive = false; unsigned int debug_mask; unsigned int len; @@ -230,22 +230,10 @@ int main(int argc, char * const *argv) nft_ctx_output_set_stateless(nft, true); break; case OPT_IP2NAME: - literal = nft_ctx_output_get_literal(nft); - if (literal + 2 > NFT_LITERAL_ADDR) { - fprintf(stderr, "Cannot combine `-N' with `-l'\n"); - exit(EXIT_FAILURE); - } - nft_ctx_output_set_literal(nft, literal + 2); + output_flags |= NFT_CTX_OUTPUT_REVERSEDNS; break; - case OPT_LITERAL: - literal = nft_ctx_output_get_literal(nft); - if (literal + 1 > NFT_LITERAL_ADDR) { - fprintf(stderr, "Too many `-l' options or " - "perhaps you combined `-l' " - "with `-N'?\n"); - exit(EXIT_FAILURE); - } - nft_ctx_output_set_literal(nft, literal + 1); + case OPT_SERVICES: + output_flags |= NFT_CTX_OUTPUT_SERVICE; break; case OPT_DEBUG: debug_mask = nft_ctx_output_get_debug(nft); @@ -290,6 +278,8 @@ int main(int argc, char * const *argv) } } + nft_ctx_output_set_flags(nft, output_flags); + if (optind != argc) { for (len = 0, i = optind; i < argc; i++) len += strlen(argv[i]) + strlen(" "); -- 2.11.0
