nftnl-rs
nftnl-rs copied to clipboard
fixes #45 - Add a log expression with group argument
This PR adds a log expression, solving #45 . To add a log rule do
use std::ffi::CString;
use nftnl::{Rule, Chain, nft_expr};
let chain = Chain::new(&CString::new("some-chain-name")?);
let rule = Rule::new(&chain);
rule.add_expr(&nft_expr!(log));
And then insert in the chain where you bet useful.
To set the group argument to a value between zero and seven, pick a value in the expr::LogGroup enum and do :
use std::ffi::CString;
use nftnl::{Rule, Chain, nft_expr, expr::LogGroup::LogGroupZero};
let chain = Chain::new(&CString::new("some-chain-name")?);
let rule = Rule::new(&chain);
rule.add_expr(&nft_expr!(log group LogGroupZero));
As stated in nftables' wiki, setting the group argument activates NFLog output, useable by ulogd2, a more advanced logging target than the default. The default is to output to kernel log, which is a pity, because it's often unprotected. ulogd needs a running daemon, and lets you choose output targets and log format.
So this PR is probably not the most urgent thing in Mullvad userland, but can prove useful, and is very compact. Besides, it is very much needed for other applications that would use this library for its quality. nftnl-rs rocks, by the way ! :1st_place_medal:
@faern would you consider commenting this PR ? I believe it can't break anything from any mullvad crate, since it simply adds functionality that was nonexistent until then. Besides, it is (arguably) quite needed to use nftnl-rs as a main linux firewall library, since logging is a critical concern for those.
Thanks for wanting to contribute! However, due to inactivity (from both sides I have to say), this is superseded by #56