|
 |
9ff721 |
From 244a83f9e0809177f07fb7b7474f84a126cf827f Mon Sep 17 00:00:00 2001
|
|
|
9ff721 |
From: Florian Westphal <fw@strlen.de>
|
|
|
9ff721 |
Date: Wed, 20 Jun 2018 23:06:04 +0200
|
|
|
9ff721 |
Subject: [PATCH] src: trace: fix policy printing
|
|
|
9ff721 |
|
|
|
9ff721 |
policy type is erronously handled via verdict, this is wrong.
|
|
|
9ff721 |
It is a different event type and needs to be handled as such.
|
|
|
9ff721 |
|
|
|
9ff721 |
before:
|
|
|
9ff721 |
trace id 42b54e71 inet filter input packet: iif "lo" ip saddr 127.0.0.1 ..
|
|
|
9ff721 |
trace id 42b54e71 inet filter input rule ip protocol icmp nftrace set 1 (verdict continue)
|
|
|
9ff721 |
trace id 42b54e71 inet filter input verdict continue
|
|
|
9ff721 |
trace id 42b54e71 inet filter input
|
|
|
9ff721 |
|
|
|
9ff721 |
after:
|
|
|
9ff721 |
trace id 9f40c5c7 inet filter input packet: iif "lo" ip saddr 127.0.0.1 ..
|
|
|
9ff721 |
trace id 9f40c5c7 inet filter input rule ip protocol icmp nftrace set 1 (verdict continue)
|
|
|
9ff721 |
trace id 9f40c5c7 inet filter input verdict continue
|
|
|
9ff721 |
trace id 9f40c5c7 inet filter input policy drop
|
|
|
9ff721 |
|
|
|
9ff721 |
Reported-by: vtol@gmx.net
|
|
|
9ff721 |
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
9ff721 |
(cherry picked from commit 78ba4ffdeacc9b31f7396d72c98907e861024653)
|
|
|
9ff721 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
9ff721 |
---
|
|
|
9ff721 |
src/netlink.c | 31 ++++++++++++++++++++++++++++++-
|
|
|
9ff721 |
1 file changed, 30 insertions(+), 1 deletion(-)
|
|
|
9ff721 |
|
|
|
9ff721 |
diff --git a/src/netlink.c b/src/netlink.c
|
|
|
9ff721 |
index ca5e9b4a0f8a6..4fd3f2dfefced 100644
|
|
|
9ff721 |
--- a/src/netlink.c
|
|
|
9ff721 |
+++ b/src/netlink.c
|
|
|
9ff721 |
@@ -1705,7 +1705,22 @@ static void trace_print_verdict(const struct nftnl_trace *nlt,
|
|
|
9ff721 |
chain = xstrdup(nftnl_trace_get_str(nlt, NFTNL_TRACE_JUMP_TARGET));
|
|
|
9ff721 |
expr = verdict_expr_alloc(&netlink_location, verdict, chain);
|
|
|
9ff721 |
|
|
|
9ff721 |
- printf("verdict ");
|
|
|
9ff721 |
+ nft_print(octx, "verdict ");
|
|
|
9ff721 |
+ expr_print(expr, octx);
|
|
|
9ff721 |
+ expr_free(expr);
|
|
|
9ff721 |
+}
|
|
|
9ff721 |
+
|
|
|
9ff721 |
+static void trace_print_policy(const struct nftnl_trace *nlt,
|
|
|
9ff721 |
+ struct output_ctx *octx)
|
|
|
9ff721 |
+{
|
|
|
9ff721 |
+ unsigned int policy;
|
|
|
9ff721 |
+ struct expr *expr;
|
|
|
9ff721 |
+
|
|
|
9ff721 |
+ policy = nftnl_trace_get_u32(nlt, NFTNL_TRACE_POLICY);
|
|
|
9ff721 |
+
|
|
|
9ff721 |
+ expr = verdict_expr_alloc(&netlink_location, policy, NULL);
|
|
|
9ff721 |
+
|
|
|
9ff721 |
+ nft_print(octx, "policy ");
|
|
|
9ff721 |
expr_print(expr, octx);
|
|
|
9ff721 |
expr_free(expr);
|
|
|
9ff721 |
}
|
|
|
9ff721 |
@@ -1921,6 +1936,20 @@ int netlink_events_trace_cb(const struct nlmsghdr *nlh, int type,
|
|
|
9ff721 |
trace_print_rule(nlt, monh->ctx->octx, monh->cache);
|
|
|
9ff721 |
break;
|
|
|
9ff721 |
case NFT_TRACETYPE_POLICY:
|
|
|
9ff721 |
+ trace_print_hdr(nlt, monh->ctx->octx);
|
|
|
9ff721 |
+
|
|
|
9ff721 |
+ if (nftnl_trace_is_set(nlt, NFTNL_TRACE_POLICY)) {
|
|
|
9ff721 |
+ trace_print_policy(nlt, monh->ctx->octx);
|
|
|
9ff721 |
+ nft_mon_print(monh, " ");
|
|
|
9ff721 |
+ }
|
|
|
9ff721 |
+
|
|
|
9ff721 |
+ if (nftnl_trace_is_set(nlt, NFTNL_TRACE_MARK))
|
|
|
9ff721 |
+ trace_print_expr(nlt, NFTNL_TRACE_MARK,
|
|
|
9ff721 |
+ meta_expr_alloc(&netlink_location,
|
|
|
9ff721 |
+ NFT_META_MARK),
|
|
|
9ff721 |
+ monh->ctx->octx);
|
|
|
9ff721 |
+ nft_mon_print(monh, "\n");
|
|
|
9ff721 |
+ break;
|
|
|
9ff721 |
case NFT_TRACETYPE_RETURN:
|
|
|
9ff721 |
trace_print_hdr(nlt, monh->ctx->octx);
|
|
|
9ff721 |
|
|
|
9ff721 |
--
|
|
|
bacbc8 |
2.21.0
|
|
|
9ff721 |
|