[PATCH] extensions: libxt_NFLOG: Add group_info and remove multiple keywords

[PATCH] extensions: libxt_NFLOG: Add group_info and remove multiple keywords

[Shivani Bhardwaj]

Add group_info with every rule as it is mandatory to consider logging to
be same type as NFLOG.
Remove multiple log keywords to avoid loading multiple log expressions
at a time.

Examples:

$ sudo iptables-translate -I INPUT -j NFLOG --nflog-threshold 2
nft insert rule ip filter INPUT counter log queue-threshold 2 group 0

$ sudo iptables-translate -A FORWARD -j NFLOG --nflog-group 32 --nflog-prefix "Prefix 1.0"
nft add rule ip filter FORWARD counter log prefix \"Prefix 1.0\" group 32

Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
---
 extensions/libxt_NFLOG.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/extensions/libxt_NFLOG.c b/extensions/libxt_NFLOG.c
index 53976d2..e1c9f65 100644
--- a/extensions/libxt_NFLOG.c
+++ b/extensions/libxt_NFLOG.c
@@ -8,6 +8,8 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_NFLOG.h>
 
+#define DEFAULT_GROUP 0
+
 enum {
 	O_GROUP = 0,
 	O_PREFIX,
@@ -89,14 +91,17 @@ static void NFLOG_save(const void *ip, const struct xt_entry_target *target)
 static void nflog_print_xlate(const struct xt_nflog_info *info,
 			      struct xt_buf *buf)
 {
+	xt_buf_add(buf, "log ");
 	if (info->prefix[0] != '\0')
-		xt_buf_add(buf, "log prefix \\\"%s\\\" ", info->prefix);
-	if (info->group)
-		xt_buf_add(buf, "log group %u ", info->group);
+		xt_buf_add(buf, "prefix \\\"%s\\\" ", info->prefix);
 	if (info->len)
-		xt_buf_add(buf, "log snaplen %u ", info->len);
+		xt_buf_add(buf, "snaplen %u ", info->len);
 	if (info->threshold != XT_NFLOG_DEFAULT_THRESHOLD)
-		xt_buf_add(buf, "log queue-threshold %u ", info->threshold);
+		xt_buf_add(buf, "queue-threshold %u ", info->threshold);
+	if (info->group)
+		xt_buf_add(buf, "group %u ", info->group);
+	else
+		xt_buf_add(buf, "group %u ", DEFAULT_GROUP);
 }
 
 static int NFLOG_xlate(const struct xt_entry_target *target,
-- 
1.9.1

Re: [PATCH] extensions: libxt_NFLOG: Add group_info and remove multiple keywords

[Pablo Neira Ayuso]

On Wed, Dec 23, 2015 at 01:32:46AM +0530, Shivani Bhardwaj wrote:
> Add group_info with every rule as it is mandatory to consider logging to
> be same type as NFLOG.
> Remove multiple log keywords to avoid loading multiple log expressions
> at a time.
> 
> Examples:
> 
> $ sudo iptables-translate -I INPUT -j NFLOG --nflog-threshold 2
> nft insert rule ip filter INPUT counter log queue-threshold 2 group 0
> 
> $ sudo iptables-translate -A FORWARD -j NFLOG --nflog-group 32 --nflog-prefix "Prefix 1.0"
> nft add rule ip filter FORWARD counter log prefix \"Prefix 1.0\" group 32

Applied, thanks Shivani.

BTW, it's a good practise to credit people that report problems, ie.
add this tag:

Reported-by: Arturo Borrero <arturoborreroglez@gmail.com>

> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>

Re: [PATCH] extensions: libxt_NFLOG: Add group_info and remove multiple keywords

[Shivani Bhardwaj]

On Wed, Dec 23, 2015 at 3:43 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Dec 23, 2015 at 01:32:46AM +0530, Shivani Bhardwaj wrote:
>> Add group_info with every rule as it is mandatory to consider logging to
>> be same type as NFLOG.
>> Remove multiple log keywords to avoid loading multiple log expressions
>> at a time.
>>
>> Examples:
>>
>> $ sudo iptables-translate -I INPUT -j NFLOG --nflog-threshold 2
>> nft insert rule ip filter INPUT counter log queue-threshold 2 group 0
>>
>> $ sudo iptables-translate -A FORWARD -j NFLOG --nflog-group 32 --nflog-prefix "Prefix 1.0"
>> nft add rule ip filter FORWARD counter log prefix \"Prefix 1.0\" group 32
>
> Applied, thanks Shivani.
>
> BTW, it's a good practise to credit people that report problems, ie.
> add this tag:
>
> Reported-by: Arturo Borrero <arturoborreroglez@gmail.com>
>

I didn't know it before. Thanks. I'll take care next time.

>> Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com>
>