Skip to content

nft event monitor

Arturo Borrero Gonzalez netfilter-devel 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest8 patches 4 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/8rule: allow to print sets in plain formatinclude/rule.h src/rule.c+53 -100 replies
2/8netlink: add netlink_delinearize_set() funcsrc/netlink.c+53 -590 replies
3/8rule: generalize chain_print()include/rule.h src/rule.c+15 -00 replies
4/8netlink: add netlink_delinearize_chain() funcsrc/netlink.c+21 -250 replies
5/8netlink: add netlink_delinearize_table() funcsrc/netlink.c+11 -20 replies
6/8netlink: refactorize set_elem conversion from netlinksrc/netlink.c+8 -30 replies
7/8netlink: add socket error reporting helper functiondoc/nftables.xml include/netlink.h include/nftables.h +1 more+12 -10 replies
8/8src: add events reportinginclude/mnl.h include/netlink.h include/rule.h +6 more+784 -191 reply

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [nft PATCH 0/8] nft event monitor

The following series implements a basic nftables monitor via Netlink messages.

Most of the work in first patches is related to refactorization/generalization of code.

The final patch is the big one.

About the syntax, i'm proposing:
% nft monitor [added|deleted] [tables|chains|sets|elements|rules] [xml|json]

The straight-forward way of test this new feature is to simply run:
% nft monitor

Other examples:
* report new tables in XML format
% nft monitor added tables xml
* report deleted elements in standar nft syntax
% nft monitor deleted elements
* report all added/deleted rules in JSON format
% nft monitor rules json

Handling set/set_elems is one of the harders parts of event reporting. I've succesfully tested many cases (maps, named sets, anon-sets..), but I guess more tuning can be done in the future, with some additional use and testing by the community.

Please comment.

regards.
---

Arturo Borrero Gonzalez (8):
rule: allow to print sets in plain format
netlink: add netlink_delinearize_set() func
rule: generalize chain_print()
netlink: add netlink_delinearize_chain() func
netlink: add netlink_delinearize_table() func
netlink: refactorize set_elem conversion from netlink
netlink: add socket error reporting helper function
src: add events reporting

 doc/nftables.xml   |    1 
 include/mnl.h      |    3 
 include/netlink.h  |   11 +
 include/nftables.h |    1 
 include/rule.h     |   10 +
 src/evaluate.c     |    1 
 src/mnl.c          |   45 ++-
 src/netlink.c      |  746 ++++++++++++++++++++++++++++++++++++++++++++++------
 src/parser.y       |   90 ++++++
 src/rule.c         |  163 +++++++++++
 src/scanner.l      |    5 
 11 files changed, 957 insertions(+), 119 deletions(-)
Signature · 1 line
Arturo Borrero Gonzalez