src: Allow to list ruleset without stateful information

PATCH Superseded Elise Lennion 2 participants 2 messages Jan 13, 2017 – Jan 16, 2017 netfilter

lore

Share & tools

lore

Elise Lennion

author

2017-01-13 14:51 UTC #0 lore raw

PATCH 1/1 src: Allow to list ruleset without stateful information

Currently only counter and quota have stateful information.

Standard list ruleset:

table ip x {
	chain y {
		type filter hook output priority 0; policy accept;
		tcp dport https counter packets 149 bytes 10085
		tcp dport https quota 1025 mbytes used 9 kbytes
	}
}

With stateless option, -s:

table ip x {
	chain y {
		type filter hook output priority 0; policy accept;
		tcp dport https counter
		tcp dport https quota 1025 mbytes
	}
}

Signed-off-by Elise Lennion <[email protected]>

---
 include/nftables.h |  1 +
 src/main.c         | 12 +++++++++++-
 src/statement.c    |  9 +++++++--
 3 files changed, 19 insertions(+), 3 deletions(-)

include/nftables.h +1 -0

index d3f471b..760bbff 100644
@@ -29,6 +29,7 @@ extern unsigned int numeric_output;
 extern unsigned int ip2name_output;
 extern unsigned int handle_output;
 extern unsigned int debug_level;
+extern bool stateless_output;
 extern const char *include_paths[INCLUDE_PATHS_MAX];
 
 enum nftables_exit_codes {

src/main.c +11 -1

index 5c72fc0..fdcaffc 100644
@@ -35,6 +35,7 @@ unsigned int handle_output;
 #ifdef DEBUG
 unsigned int debug_level;
 #endif
+bool stateless_output;
 
 const char *include_paths[INCLUDE_PATHS_MAX] = { DEFAULT_INCLUDE_PATH };
 static unsigned int num_include_paths = 1;

@@ -46,13 +47,14 @@ enum opt_vals {
 	OPT_INTERACTIVE		= 'i',
 	OPT_INCLUDEPATH		= 'I',
 	OPT_NUMERIC		= 'n',
+	OPT_STATELESS		= 's',
 	OPT_IP2NAME		= 'N',
 	OPT_DEBUG		= 'd',
 	OPT_HANDLE_OUTPUT	= 'a',
 	OPT_INVALID		= '?',
 };
 
-#define OPTSTRING	"hvf:iI:vnNa"
+#define OPTSTRING	"hvf:iI:vnsNa"
 
 static const struct option options[] = {
 	{

@@ -77,6 +79,10 @@ static const struct option options[] = {
 		.val		= OPT_NUMERIC,
 	},
 	{
+		.name		= "stateless",
+		.val		= OPT_STATELESS,
+	},
+	{
 		.name		= "reversedns",
 		.val		= OPT_IP2NAME,
 	},

@@ -116,6 +122,7 @@ static void show_help(const char *name)
 "  -n, --numeric			When specified once, show network addresses numerically (default behaviour).\n"
 "  				Specify twice to also show Internet services (port numbers) numerically.\n"
 "				Specify three times to also show protocols, user IDs, and group IDs numerically.\n"
+"  -s, --stateless	       	Omit stateful information of ruleset.\n"
 "  -N				Translate IP addresses to names.\n"
 "  -a, --handle			Output rule handle.\n"
 "  -I, --includepath <directory>	Add <directory> to the paths searched for include files.\n"

@@ -283,6 +290,9 @@ int main(int argc, char * const *argv)
 		case OPT_NUMERIC:
 			numeric_output++;
 			break;
+		case OPT_STATELESS:
+			stateless_output = true;
+			break;
 		case OPT_IP2NAME:
 			ip2name_output++;
 			break;

src/statement.c +7 -2

index 24a53ee..25bed65 100644
@@ -142,7 +142,12 @@ struct stmt *flow_stmt_alloc(const struct location *loc)
 
 static void counter_stmt_print(const struct stmt *stmt)
 {
-	printf("counter packets %" PRIu64 " bytes %" PRIu64,
+	printf("counter");
+
+	if (stateless_output)
+		return;
+
+	printf(" packets %" PRIu64 " bytes %" PRIu64,
 	       stmt->counter.packets, stmt->counter.bytes);
 }

@@ -391,7 +396,7 @@ static void quota_stmt_print(const struct stmt *stmt)
 	printf("quota %s%"PRIu64" %s",
 	       inv ? "over " : "", bytes, data_unit);
 
-	if (stmt->quota.used) {
+	if (!stateless_output && stmt->quota.used) {
 		data_unit = get_rate(stmt->quota.used, &used);
 		printf(" used %"PRIu64" %s", used, data_unit);
 	}

Signature · 1 line

2.7.4

Pablo Neira Ayuso

maintainer

2017-01-16 10:30 UTC #1 lore raw

Quoted 14 lines · Elise Lennion

Currently only counter and quota have stateful information.
Standard list ruleset:
table ip x {
	chain y {
		type filter hook output priority 0; policy accept;
		tcp dport https counter packets 149 bytes 10085
		tcp dport https quota 1025 mbytes used 9 kbytes
	}
}
With stateless option, -s:

Quoted 7 lines

table ip x {
	chain y {
		type filter hook output priority 0; policy accept;
		tcp dport https counter
		tcp dport https quota 1025 mbytes
	}
}

This looks fine.

But you also have to update obj_print_data().

Stateful objects is a new thing, so please make sure you run a fresh kernel, latest libnftnl and nft. You have examples here:

http://marc.info/?l=netfilter-devel&m=148029128323837&w=2

Note: For stateful counter with a name, at this stage, probably best thing is to display 0 both for packets and bytes instead of removing them, ie.

 # nft list counters
 table ip filter {
       counter http-traffic {
             packets 0 bytes 0
       }
 }

Thanks.