src: add NFT_CTX_OUTPUT_NUMERIC_PROTO

We keep printing layer 4 protocols as literals since we do not use
/etc/protocols. This new flag allows us to print it as a number.

libnftables internally uses this to print layer 4 protocol as numbers
when part of a range.

Acked-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/doc/libnftables.adoc b/doc/libnftables.adoc
index 67d9f261034ca5d7c10963791eb49a73f1571c47..dc3299f037dfa3c7b9b0562b5814ee4c42471a43 100644 (file)
--- a/doc/libnftables.adoc
+++ b/doc/libnftables.adoc
@@ -91,6 +91,7 @@ enum {
         NFT_CTX_OUTPUT_JSON        = (1 << 4),
         NFT_CTX_OUTPUT_ECHO        = (1 << 5),
         NFT_CTX_OUTPUT_GUID        = (1 << 6),
+        NFT_CTX_OUTPUT_NUMERIC_PROTO = (1 << 7),
 };
 ----
 
@@ -119,6 +120,8 @@ NFT_CTX_OUTPUT_GUID::
 The *nft_ctx_output_get_flags*() function returns the output flags setting's value in 'ctx'.
 
 The *nft_ctx_output_set_flags*() function sets the output flags setting in 'ctx' to the value of 'val'.
+NFT_CTX_OUTPUT_NUMERIC_PROTO::
+       Display layer 4 protocol numerically.
 
 === nft_ctx_output_get_numeric() and nft_ctx_output_set_numeric()
 These functions allow control over value representation in library output.

diff --git a/include/nftables.h b/include/nftables.h
index 2dff07fef5990c17a5543e2bd68218e87a7ba550..d0031e8411341c9fb23a9ae2029b8c8f765afad4 100644 (file)
--- a/include/nftables.h
+++ b/include/nftables.h
@@ -63,6 +63,11 @@ static inline bool nft_output_guid(const struct output_ctx *octx)
        return octx->flags & NFT_CTX_OUTPUT_GUID;
 }
 
+static inline bool nft_output_numeric_proto(const struct output_ctx *octx)
+{
+       return octx->flags & NFT_CTX_OUTPUT_NUMERIC_PROTO;
+}
+
 struct nft_cache {
        uint16_t                genid;
        struct list_head        list;

diff --git a/include/nftables/libnftables.h b/include/nftables/libnftables.h
index ff7b47aa3160969a293c5861d3a02156a435f07e..74f2dabbd1d58620c4c47fc4728aed00840dc19e 100644 (file)
--- a/include/nftables/libnftables.h
+++ b/include/nftables/libnftables.h
@@ -52,6 +52,7 @@ enum {
        NFT_CTX_OUTPUT_JSON             = (1 << 4),
        NFT_CTX_OUTPUT_ECHO             = (1 << 5),
        NFT_CTX_OUTPUT_GUID             = (1 << 6),
+       NFT_CTX_OUTPUT_NUMERIC_PROTO    = (1 << 7),
 };
 
 unsigned int nft_ctx_output_get_flags(struct nft_ctx *ctx);

diff --git a/src/datatype.c b/src/datatype.c
index 48eaca2777573c94f5359b868d1f0c78c332f90a..bfb70a6ebb76b753125704396e351dae7efb4a5a 100644 (file)
--- a/src/datatype.c
+++ b/src/datatype.c
@@ -564,7 +564,7 @@ static void inet_protocol_type_print(const struct expr *expr,
 {
        struct protoent *p;
 
-       if (octx->numeric < NFT_NUMERIC_ALL) {
+       if (!nft_output_numeric_proto(octx)) {
                p = getprotobynumber(mpz_get_uint8(expr->value));
                if (p != NULL) {
                        nft_print(octx, "%s", p->p_name);

diff --git a/src/expression.c b/src/expression.c
index 25883ea771efea9bbae4e76feba82a7b7b3630ab..5ff469c561d54ce0745dde9acb4552b262985e04 100644 (file)
--- a/src/expression.c
+++ b/src/expression.c
@@ -663,6 +663,7 @@ static void range_expr_print(const struct expr *expr, struct output_ctx *octx)
        unsigned int flags = octx->flags;
 
        octx->flags &= ~NFT_CTX_OUTPUT_SERVICE;
+       octx->flags |= NFT_CTX_OUTPUT_NUMERIC_PROTO;
        expr_print(expr->left, octx);
        nft_print(octx, "-");
        expr_print(expr->right, octx);

diff --git a/src/json.c b/src/json.c
index e90445fc92762735733917143b31f0d3d6bbfc30..8a2bcd658bd8fc770f94130ab8963aa8f4b4dedc 100644 (file)
--- a/src/json.c
+++ b/src/json.c
@@ -448,6 +448,7 @@ json_t *range_expr_json(const struct expr *expr, struct output_ctx *octx)
        json_t *root;
 
        octx->flags &= ~NFT_CTX_OUTPUT_SERVICE;
+       octx->flags |= NFT_CTX_OUTPUT_NUMERIC_PROTO;
        root = json_pack("{s:[o, o]}", "range",
                         expr_print_json(expr->left, octx),
                         expr_print_json(expr->right, octx));
@@ -961,7 +962,7 @@ json_t *inet_protocol_type_json(const struct expr *expr,
 {
        struct protoent *p;
 
-       if (octx->numeric < NFT_NUMERIC_ALL) {
+       if (!nft_output_numeric_proto(octx)) {
                p = getprotobynumber(mpz_get_uint8(expr->value));
                if (p != NULL)
                        return json_string(p->p_name);