|
 |
ec5e2e |
From 07f51d26e405b4a328813f35bc27015eb9324330 Mon Sep 17 00:00:00 2001
|
|
|
ec5e2e |
From: Florian Westphal <fw@strlen.de>
|
|
|
ec5e2e |
Date: Sat, 12 Dec 2020 16:15:34 +0100
|
|
|
ec5e2e |
Subject: [PATCH] xtables-monitor: print packet first
|
|
|
ec5e2e |
|
|
|
ec5e2e |
The trace mode should first print the packet that was received and
|
|
|
ec5e2e |
then the rule/verdict.
|
|
|
ec5e2e |
|
|
|
ec5e2e |
Furthermore, the monitor did sometimes print an extra newline.
|
|
|
ec5e2e |
|
|
|
ec5e2e |
After this patch, output is more consistent with nft monitor.
|
|
|
ec5e2e |
|
|
|
ec5e2e |
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
ec5e2e |
(cherry picked from commit 180ba723d0b305fab9287d3bc5f845a43d9eb793)
|
|
|
ec5e2e |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
ec5e2e |
---
|
|
|
ec5e2e |
iptables/xtables-monitor.c | 34 +++++++++++++++++++++++-----------
|
|
|
ec5e2e |
1 file changed, 23 insertions(+), 11 deletions(-)
|
|
|
ec5e2e |
|
|
|
ec5e2e |
diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
|
|
|
ec5e2e |
index 9fa1ca166a61e..23e828988bb8b 100644
|
|
|
ec5e2e |
--- a/iptables/xtables-monitor.c
|
|
|
ec5e2e |
+++ b/iptables/xtables-monitor.c
|
|
|
ec5e2e |
@@ -106,6 +106,7 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
|
|
|
ec5e2e |
printf("-0 ");
|
|
|
ec5e2e |
break;
|
|
|
ec5e2e |
default:
|
|
|
ec5e2e |
+ puts("");
|
|
|
ec5e2e |
goto err_free;
|
|
|
ec5e2e |
}
|
|
|
ec5e2e |
|
|
|
ec5e2e |
@@ -433,9 +434,18 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
|
|
|
ec5e2e |
mark = nftnl_trace_get_u32(nlt, NFTNL_TRACE_MARK);
|
|
|
ec5e2e |
if (mark)
|
|
|
ec5e2e |
printf("MARK=0x%x ", mark);
|
|
|
ec5e2e |
+ puts("");
|
|
|
ec5e2e |
+}
|
|
|
ec5e2e |
+
|
|
|
ec5e2e |
+static void trace_print_hdr(const struct nftnl_trace *nlt)
|
|
|
ec5e2e |
+{
|
|
|
ec5e2e |
+ printf(" TRACE: %d %08x %s:%s", nftnl_trace_get_u32(nlt, NFTNL_TABLE_FAMILY),
|
|
|
ec5e2e |
+ nftnl_trace_get_u32(nlt, NFTNL_TRACE_ID),
|
|
|
ec5e2e |
+ nftnl_trace_get_str(nlt, NFTNL_TRACE_TABLE),
|
|
|
ec5e2e |
+ nftnl_trace_get_str(nlt, NFTNL_TRACE_CHAIN));
|
|
|
ec5e2e |
}
|
|
|
ec5e2e |
|
|
|
ec5e2e |
-static void print_verdict(struct nftnl_trace *nlt, uint32_t verdict)
|
|
|
ec5e2e |
+static void print_verdict(const struct nftnl_trace *nlt, uint32_t verdict)
|
|
|
ec5e2e |
{
|
|
|
ec5e2e |
const char *chain;
|
|
|
ec5e2e |
|
|
|
ec5e2e |
@@ -496,35 +506,37 @@ static int trace_cb(const struct nlmsghdr *nlh, struct cb_arg *arg)
|
|
|
ec5e2e |
arg->nfproto != nftnl_trace_get_u32(nlt, NFTNL_TABLE_FAMILY))
|
|
|
ec5e2e |
goto err_free;
|
|
|
ec5e2e |
|
|
|
ec5e2e |
- printf(" TRACE: %d %08x %s:%s", nftnl_trace_get_u32(nlt, NFTNL_TABLE_FAMILY),
|
|
|
ec5e2e |
- nftnl_trace_get_u32(nlt, NFTNL_TRACE_ID),
|
|
|
ec5e2e |
- nftnl_trace_get_str(nlt, NFTNL_TRACE_TABLE),
|
|
|
ec5e2e |
- nftnl_trace_get_str(nlt, NFTNL_TRACE_CHAIN));
|
|
|
ec5e2e |
-
|
|
|
ec5e2e |
switch (nftnl_trace_get_u32(nlt, NFTNL_TRACE_TYPE)) {
|
|
|
ec5e2e |
case NFT_TRACETYPE_RULE:
|
|
|
ec5e2e |
verdict = nftnl_trace_get_u32(nlt, NFTNL_TRACE_VERDICT);
|
|
|
ec5e2e |
- printf(":rule:0x%llx:", (unsigned long long)nftnl_trace_get_u64(nlt, NFTNL_TRACE_RULE_HANDLE));
|
|
|
ec5e2e |
- print_verdict(nlt, verdict);
|
|
|
ec5e2e |
|
|
|
ec5e2e |
- if (nftnl_trace_is_set(nlt, NFTNL_TRACE_RULE_HANDLE))
|
|
|
ec5e2e |
- trace_print_rule(nlt, arg);
|
|
|
ec5e2e |
if (nftnl_trace_is_set(nlt, NFTNL_TRACE_LL_HEADER) ||
|
|
|
ec5e2e |
nftnl_trace_is_set(nlt, NFTNL_TRACE_NETWORK_HEADER))
|
|
|
ec5e2e |
trace_print_packet(nlt, arg);
|
|
|
ec5e2e |
+
|
|
|
ec5e2e |
+ if (nftnl_trace_is_set(nlt, NFTNL_TRACE_RULE_HANDLE)) {
|
|
|
ec5e2e |
+ trace_print_hdr(nlt);
|
|
|
ec5e2e |
+ printf(":rule:0x%" PRIx64":", nftnl_trace_get_u64(nlt, NFTNL_TRACE_RULE_HANDLE));
|
|
|
ec5e2e |
+ print_verdict(nlt, verdict);
|
|
|
ec5e2e |
+ printf(" ");
|
|
|
ec5e2e |
+ trace_print_rule(nlt, arg);
|
|
|
ec5e2e |
+ }
|
|
|
ec5e2e |
break;
|
|
|
ec5e2e |
case NFT_TRACETYPE_POLICY:
|
|
|
ec5e2e |
+ trace_print_hdr(nlt);
|
|
|
ec5e2e |
printf(":policy:");
|
|
|
ec5e2e |
verdict = nftnl_trace_get_u32(nlt, NFTNL_TRACE_POLICY);
|
|
|
ec5e2e |
|
|
|
ec5e2e |
print_verdict(nlt, verdict);
|
|
|
ec5e2e |
+ puts("");
|
|
|
ec5e2e |
break;
|
|
|
ec5e2e |
case NFT_TRACETYPE_RETURN:
|
|
|
ec5e2e |
+ trace_print_hdr(nlt);
|
|
|
ec5e2e |
printf(":return:");
|
|
|
ec5e2e |
trace_print_return(nlt);
|
|
|
ec5e2e |
+ puts("");
|
|
|
ec5e2e |
break;
|
|
|
ec5e2e |
}
|
|
|
ec5e2e |
- puts("");
|
|
|
ec5e2e |
err_free:
|
|
|
ec5e2e |
nftnl_trace_free(nlt);
|
|
|
ec5e2e |
err:
|
|
|
ec5e2e |
--
|
|
|
ec5e2e |
2.31.1
|
|
|
ec5e2e |
|