src: add input flag NFT_CTX_INPUT_JSON to enable JSON parsing

By default, the input is parsed using the nftables grammar. When setting
NFT_CTX_OUTPUT_JSON flag, nftables will first try to parse the input as
JSON before falling back to the nftables grammar.

But NFT_CTX_OUTPUT_JSON flag also turns on JSON for the output. Add a
flag NFT_CTX_INPUT_JSON which allows to treat only the input as JSON,
but keep the output mode unchanged.

Signed-off-by: Thomas Haller <thaller@redhat.com>
Reviewed-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/doc/libnftables.adoc b/doc/libnftables.adoc
index 62de75f3fa225bdee3bdc92f994a08ad3d3cb76d..2cf78d7ae5367fda4cea7b44989d24fd448190eb 100644 (file)
--- a/doc/libnftables.adoc
+++ b/doc/libnftables.adoc
@@ -87,6 +87,7 @@ The flags setting controls the input format.
 ----
 enum {
         NFT_CTX_INPUT_NO_DNS = (1 << 0),
+        NFT_CTX_INPUT_JSON   = (1 << 1),
 };
 ----
 
@@ -94,6 +95,11 @@ NFT_CTX_INPUT_NO_DNS::
        Avoid resolving IP addresses with blocking getaddrinfo(). In that case,
        only plain IP addresses are accepted.
 
+NFT_CTX_INPUT_JSON:
+       When parsing the input, first try to interpret the input as JSON before
+       falling back to the nftables format. This behavior is implied when setting
+       the NFT_CTX_OUTPUT_JSON flag.
+
 The *nft_ctx_input_get_flags*() function returns the input flags setting's value in 'ctx'.
 
 The *nft_ctx_input_set_flags*() function sets the input flags setting in 'ctx' to the value of 'val'
@@ -139,7 +145,8 @@ NFT_CTX_OUTPUT_HANDLE::
 NFT_CTX_OUTPUT_JSON::
        If enabled at compile-time, libnftables accepts input in JSON format and is able to print output in JSON format as well.
        See *libnftables-json*(5) for a description of the supported schema.
-       This flag controls JSON output format, input is auto-detected.
+       This flag enables JSON output format. If the flag is set, the input will first be tried as JSON format,
+       before falling back to nftables format. This flag implies NFT_CTX_INPUT_JSON.
 NFT_CTX_OUTPUT_ECHO::
        The echo setting makes libnftables print the changes once they are committed to the kernel, just like a running instance of *nft monitor* would.
        Amongst other things, this allows one to retrieve an added rule's handle atomically.

diff --git a/include/nftables.h b/include/nftables.h
index 666a17ae4dab14f3eed42b5bdd7a66e8d90f7c43..f073fa95a60d6f4bbb2634bcf72ef64c7422ffd1 100644 (file)
--- a/include/nftables.h
+++ b/include/nftables.h
@@ -32,6 +32,11 @@ static inline bool nft_input_no_dns(const struct input_ctx *ictx)
        return ictx->flags & NFT_CTX_INPUT_NO_DNS;
 }
 
+static inline bool nft_input_json(const struct input_ctx *ictx)
+{
+       return ictx->flags & NFT_CTX_INPUT_JSON;
+}
+
 struct output_ctx {
        unsigned int flags;
        union {

diff --git a/include/nftables/libnftables.h b/include/nftables/libnftables.h
index e109805f32a1c0c28bca838aeaa7b76f295bb676..cc05969215bc1fa85c91b04cd8579b50def1603b 100644 (file)
--- a/include/nftables/libnftables.h
+++ b/include/nftables/libnftables.h
@@ -50,6 +50,7 @@ void nft_ctx_set_optimize(struct nft_ctx *ctx, uint32_t flags);
 
 enum {
        NFT_CTX_INPUT_NO_DNS            = (1 << 0),
+       NFT_CTX_INPUT_JSON              = (1 << 1),
 };
 
 unsigned int nft_ctx_input_get_flags(struct nft_ctx *ctx);

diff --git a/src/libnftables.c b/src/libnftables.c
index 17438b5330cbd41beeffcbd101b04383feb9ea46..69ea9d4135b703a2ab4378fd71adf8c177648de0 100644 (file)
--- a/src/libnftables.c
+++ b/src/libnftables.c
@@ -582,7 +582,7 @@ int nft_run_cmd_from_buffer(struct nft_ctx *nft, const char *buf)
        nlbuf = xzalloc(strlen(buf) + 2);
        sprintf(nlbuf, "%s\n", buf);
 
-       if (nft_output_json(&nft->output))
+       if (nft_output_json(&nft->output) || nft_input_json(&nft->input))
                rc = nft_parse_json_buffer(nft, nlbuf, &msgs, &cmds);
        if (rc == -EINVAL)
                rc = nft_parse_bison_buffer(nft, nlbuf, &msgs, &cmds,
@@ -683,7 +683,7 @@ static int __nft_run_cmd_from_filename(struct nft_ctx *nft, const char *filename
                goto err;
 
        rc = -EINVAL;
-       if (nft_output_json(&nft->output))
+       if (nft_output_json(&nft->output) || nft_input_json(&nft->input))
                rc = nft_parse_json_filename(nft, filename, &msgs, &cmds);
        if (rc == -EINVAL)
                rc = nft_parse_bison_filename(nft, filename, &msgs, &cmds);