nftnl-rs icon indicating copy to clipboard operation
nftnl-rs copied to clipboard

fixes #45 - Add a log expression with group argument

Open lafleurdeboum opened this issue 4 years ago • 1 comments

This PR adds a log expression, solving #45 . To add a log rule do

use std::ffi::CString;
use nftnl::{Rule, Chain, nft_expr};
let chain = Chain::new(&CString::new("some-chain-name")?);
let rule = Rule::new(&chain);
rule.add_expr(&nft_expr!(log));

And then insert in the chain where you bet useful.

To set the group argument to a value between zero and seven, pick a value in the expr::LogGroup enum and do :

use std::ffi::CString;
use nftnl::{Rule, Chain, nft_expr, expr::LogGroup::LogGroupZero};
let chain = Chain::new(&CString::new("some-chain-name")?);
let rule = Rule::new(&chain);
rule.add_expr(&nft_expr!(log group LogGroupZero));

As stated in nftables' wiki, setting the group argument activates NFLog output, useable by ulogd2, a more advanced logging target than the default. The default is to output to kernel log, which is a pity, because it's often unprotected. ulogd needs a running daemon, and lets you choose output targets and log format.

So this PR is probably not the most urgent thing in Mullvad userland, but can prove useful, and is very compact. Besides, it is very much needed for other applications that would use this library for its quality. nftnl-rs rocks, by the way ! :1st_place_medal:


This change is Reviewable

lafleurdeboum avatar Sep 28 '21 20:09 lafleurdeboum

@faern would you consider commenting this PR ? I believe it can't break anything from any mullvad crate, since it simply adds functionality that was nonexistent until then. Besides, it is (arguably) quite needed to use nftnl-rs as a main linux firewall library, since logging is a critical concern for those.

lafleurdeboum avatar Oct 16 '21 20:10 lafleurdeboum

Thanks for wanting to contribute! However, due to inactivity (from both sides I have to say), this is superseded by #56

faern avatar May 29 '24 13:05 faern