[PATCH nft 3/3] main: add -w/--netns option

[Pablo Neira Ayuso <pablo@netfilter.org>]

This option allows you to specify which net namespace you want to run this
command on.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 doc/nft.txt |  4 ++++
 src/main.c  | 28 +++++++++++++++++++++++-----
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/doc/nft.txt b/doc/nft.txt
index 45350253ccbf..a668c33b3c6d 100644
--- a/doc/nft.txt
+++ b/doc/nft.txt
@@ -32,6 +32,10 @@ For a full summary of options, run *nft --help*.
 *--version*::
 	Show version.
 
+*-w*::
+*--netns 'namespace'*::
+	Run command on the specified net namespace.
+
 *-n*::
 *--numeric*::
 	Print fully numerical output.
diff --git a/src/main.c b/src/main.c
index 0f2b57cbacbb..df88c028fcb3 100644
--- a/src/main.c
+++ b/src/main.c
@@ -28,6 +28,7 @@ enum opt_vals {
 	OPT_HELP		= 'h',
 	OPT_VERSION		= 'v',
 	OPT_CHECK		= 'c',
+	OPT_NETNS		= 'w',
 	OPT_FILE		= 'f',
 	OPT_INTERACTIVE		= 'i',
 	OPT_INCLUDEPATH		= 'I',
@@ -46,7 +47,7 @@ enum opt_vals {
 	OPT_TERSE		= 't',
 	OPT_INVALID		= '?',
 };
-#define OPTSTRING	"+hvd:cf:iI:jvnsNaeSupypTt"
+#define OPTSTRING	"+hvd:cf:iI:jvnsNaeSupypTtw:"
 
 static const struct option options[] = {
 	{
@@ -129,6 +130,11 @@ static const struct option options[] = {
 		.val		= OPT_TERSE,
 	},
 	{
+		.name		= "netns",
+		.val		= OPT_NETNS,
+		.has_arg	= 1,
+	},
+	{
 		.name		= NULL
 	}
 };
@@ -150,6 +156,7 @@ static void show_help(const char *name)
 "  -n, --numeric			Print fully numerical output.\n"
 "  -s, --stateless		Omit stateful information of ruleset.\n"
 "  -t, --terse			Omit contents of sets.\n"
+"  -w, --netns			Run command on network namespace\n"
 "  -u, --guid			Print UID/GID as defined in /etc/passwd and /etc/group.\n"
 "  -N				Translate IP addresses to names.\n"
 "  -S, --service			Translate ports to service names as described in /etc/services.\n"
@@ -231,9 +238,11 @@ static bool nft_options_check(int argc, char * const argv[])
 			} else if (argv[i][1] == 'd' ||
 				   argv[i][1] == 'I' ||
 				   argv[i][1] == 'f' ||
+				   argv[i][1] == 'w' ||
 				   !strcmp(argv[i], "--debug") ||
 				   !strcmp(argv[i], "--includepath") ||
-				   !strcmp(argv[i], "--file")) {
+				   !strcmp(argv[i], "--file") ||
+				   !strcmp(argv[i], "--netns")) {
 				skip = true;
 				continue;
 			}
@@ -247,10 +256,10 @@ static bool nft_options_check(int argc, char * const argv[])
 
 int main(int argc, char * const *argv)
 {
-	char *buf = NULL, *filename = NULL, *includepath = NULL;
+	char *buf = NULL, *filename = NULL, *includepath = NULL, *netns = NULL;
 	unsigned int output_flags = 0, debug_mask = 0, len;
 	bool interactive = false, dry_run = false;
-	int i, val, rc;
+	int i, val, rc, ctx = NFT_CTX_DEFAULT;
 
 	if (!nft_options_check(argc, argv))
 		exit(EXIT_FAILURE);
@@ -271,6 +280,9 @@ int main(int argc, char * const *argv)
 		case OPT_CHECK:
 			dry_run = true;
 			break;
+		case OPT_NETNS:
+			netns = optarg;
+			break;
 		case OPT_FILE:
 			filename = optarg;
 			break;
@@ -353,12 +365,18 @@ int main(int argc, char * const *argv)
 		}
 	}
 
-	nft = nft_ctx_new(NFT_CTX_DEFAULT);
+	if (netns)
+		ctx = NFT_CTX_NETNS;
+
+	nft = nft_ctx_new(ctx);
 	if (includepath && nft_ctx_add_include_path(nft, includepath) < 0) {
 		fprintf(stderr, "Failed to add include path '%s'\n", optarg);
 		exit(EXIT_FAILURE);
 	}
 
+	if (netns && nft_ctx_set_netns(nft, netns) < 0)
+		exit(EXIT_FAILURE);
+
 	nft_ctx_set_dry_run(nft, dry_run);
 	nft_ctx_output_set_debug(nft, debug_mask);
 	nft_ctx_output_set_flags(nft, output_flags);
-- 
2.11.0