src: default to numeric UID and GID listing

Like iptables-save, print UID and GID as numeric values by default.

Add a new option `-u' to print the UID and GID names as defined by
/etc/passwd and /etc/group.

Note that -n is ignored after this patch, since default are numeric
printing for UID and GID.

Acked-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/doc/libnftables.adoc b/doc/libnftables.adoc
index 6b8098fdf2d24b0f7830000a146f0fbbeab8c80f..67d9f261034ca5d7c10963791eb49a73f1571c47 100644 (file)
--- a/doc/libnftables.adoc
+++ b/doc/libnftables.adoc
@@ -90,6 +90,7 @@ enum {
         NFT_CTX_OUTPUT_HANDLE      = (1 << 3),
         NFT_CTX_OUTPUT_JSON        = (1 << 4),
         NFT_CTX_OUTPUT_ECHO        = (1 << 5),
+        NFT_CTX_OUTPUT_GUID        = (1 << 6),
 };
 ----
 
@@ -112,6 +113,8 @@ This flag controls JSON output format, input is auto-detected.
 NFT_CTX_OUTPUT_ECHO::
        The echo setting makes libnftables print the changes once they are committed to the kernel, just like a running instance of *nft monitor* would.
 Amongst other things, this allows to retrieve an added rule's handle atomically.
+NFT_CTX_OUTPUT_GUID::
+       Display UID and GID as described in the /etc/passwd and /etc/group files.
 
 The *nft_ctx_output_get_flags*() function returns the output flags setting's value in 'ctx'.
 

diff --git a/doc/nft.txt b/doc/nft.txt
index 711d8a4f56b99a66287777b97b992903aa7a2e52..39527c4e8e55a935f73a28e4da98434b83d2f1ac 100644 (file)
--- a/doc/nft.txt
+++ b/doc/nft.txt
@@ -52,6 +52,10 @@ For a full summary of options, run *nft --help*.
 *--service*::
        Translate ports to service names as defined by /etc/services.
 
+*-u*::
+*--guid**::
+       Translate numeric UID/GID to names as defined by /etc/passwd and /etc/group.
+
 *-c*::
 *--check*::
        Check commands validity without actually applying the changes.

diff --git a/include/nftables.h b/include/nftables.h
index fa6665a17a7eec9713b971eddd3f1bae19c6c998..2dff07fef5990c17a5543e2bd68218e87a7ba550 100644 (file)
--- a/include/nftables.h
+++ b/include/nftables.h
@@ -58,6 +58,11 @@ static inline bool nft_output_echo(const struct output_ctx *octx)
        return octx->flags & NFT_CTX_OUTPUT_ECHO;
 }
 
+static inline bool nft_output_guid(const struct output_ctx *octx)
+{
+       return octx->flags & NFT_CTX_OUTPUT_GUID;
+}
+
 struct nft_cache {
        uint16_t                genid;
        struct list_head        list;

diff --git a/include/nftables/libnftables.h b/include/nftables/libnftables.h
index 4777240883f01de4488b437851e87a41abe967bd..ff7b47aa3160969a293c5861d3a02156a435f07e 100644 (file)
--- a/include/nftables/libnftables.h
+++ b/include/nftables/libnftables.h
@@ -51,6 +51,7 @@ enum {
        NFT_CTX_OUTPUT_HANDLE           = (1 << 3),
        NFT_CTX_OUTPUT_JSON             = (1 << 4),
        NFT_CTX_OUTPUT_ECHO             = (1 << 5),
+       NFT_CTX_OUTPUT_GUID             = (1 << 6),
 };
 
 unsigned int nft_ctx_output_get_flags(struct nft_ctx *ctx);

diff --git a/src/json.c b/src/json.c
index 5c96bcd071fe5f0cfe15fac9e637267958214e1f..e90445fc92762735733917143b31f0d3d6bbfc30 100644 (file)
--- a/src/json.c
+++ b/src/json.c
@@ -1021,7 +1021,7 @@ json_t *uid_type_json(const struct expr *expr, struct output_ctx *octx)
 {
        uint32_t uid = mpz_get_uint32(expr->value);
 
-       if (octx->numeric < NFT_NUMERIC_ALL) {
+       if (nft_output_guid(octx)) {
                struct passwd *pw = getpwuid(uid);
 
                if (pw)
@@ -1034,7 +1034,7 @@ json_t *gid_type_json(const struct expr *expr, struct output_ctx *octx)
 {
        uint32_t gid = mpz_get_uint32(expr->value);
 
-       if (octx->numeric < NFT_NUMERIC_ALL) {
+       if (nft_output_guid(octx)) {
                struct group *gr = getgrgid(gid);
 
                if (gr)

diff --git a/src/main.c b/src/main.c
index 6e1e4186675aee25b905212e34e776cc58905f45..0c8fa1e9a108aff5426274dbe59f8cf6b4de9165 100644 (file)
--- a/src/main.c
+++ b/src/main.c
@@ -39,10 +39,11 @@ enum opt_vals {
        OPT_DEBUG               = 'd',
        OPT_HANDLE_OUTPUT       = 'a',
        OPT_ECHO                = 'e',
+       OPT_GUID                = 'u',
        OPT_INVALID             = '?',
 };
 
-#define OPTSTRING      "hvcf:iI:jvnsNaeS"
+#define OPTSTRING      "hvcf:iI:jvnsNaeSu"
 
 static const struct option options[] = {
        {
@@ -104,6 +105,10 @@ static const struct option options[] = {
                .name           = "json",
                .val            = OPT_JSON,
        },
+       {
+               .name           = "guid",
+               .val            = OPT_GUID,
+       },
        {
                .name           = NULL
        }
@@ -127,6 +132,7 @@ static void show_help(const char *name)
 "                              Specify twice to also show Internet services (port numbers) numerically.\n"
 "                              Specify three times to also show protocols, user IDs, and group IDs numerically.\n"
 "  -s, --stateless             Omit stateful information of ruleset.\n"
+"  -u, --guid                  Print UID/GID as defined in /etc/passwd and /etc/group.\n"
 "  -N                          Translate IP addresses to names.\n"
 "  -S, --service                       Translate ports to service names as described in /etc/services.\n"
 "  -a, --handle                        Output rule handle.\n"
@@ -276,6 +282,9 @@ int main(int argc, char * const *argv)
                        output_flags |= NFT_CTX_OUTPUT_JSON;
 #endif
                        break;
+               case OPT_GUID:
+                       output_flags |= NFT_CTX_OUTPUT_GUID;
+                       break;
                case OPT_INVALID:
                        exit(EXIT_FAILURE);
                }

diff --git a/src/meta.c b/src/meta.c
index 3677561bd137630fb33e700f91f48b4e2a9be0de..c8a7b13b1d2bce9b447e60f404e98f2dbe8de22d 100644 (file)
--- a/src/meta.c
+++ b/src/meta.c
@@ -207,7 +207,7 @@ static void uid_type_print(const struct expr *expr, struct output_ctx *octx)
 {
        struct passwd *pw;
 
-       if (octx->numeric < NFT_NUMERIC_ALL) {
+       if (nft_output_guid(octx)) {
                uint32_t uid = mpz_get_uint32(expr->value);
 
                pw = getpwuid(uid);
@@ -260,7 +260,7 @@ static void gid_type_print(const struct expr *expr, struct output_ctx *octx)
 {
        struct group *gr;
 
-       if (octx->numeric < NFT_NUMERIC_ALL) {
+       if (nft_output_guid(octx)) {
                uint32_t gid = mpz_get_uint32(expr->value);
 
                gr = getgrgid(gid);