From 0028e2ce3fdd0ff5e30a2cc901329b4511a3f450 Mon Sep 17 00:00:00 2001 From: Andrea Scarpino Date: Wed, 4 Dec 2024 17:10:09 +0000 Subject: [PATCH] Add nftables table (#23941) Following the discussion in #15651, this adds the `nftables` table by parsing the binary output. --------- Co-authored-by: Zach Wasserman --- orbit/changes/nftables-table | 1 + orbit/pkg/table/extension_linux.go | 2 ++ 2 files changed, 3 insertions(+) create mode 100644 orbit/changes/nftables-table diff --git a/orbit/changes/nftables-table b/orbit/changes/nftables-table new file mode 100644 index 0000000000..8f593afb6a --- /dev/null +++ b/orbit/changes/nftables-table @@ -0,0 +1 @@ +- Add `nftables` table to show configuration for Linux `nftables` network filters. diff --git a/orbit/pkg/table/extension_linux.go b/orbit/pkg/table/extension_linux.go index 7d653ca8a6..3a28b6922d 100644 --- a/orbit/pkg/table/extension_linux.go +++ b/orbit/pkg/table/extension_linux.go @@ -6,6 +6,7 @@ import ( "github.com/fleetdm/fleet/v4/orbit/pkg/table/crowdstrike/falcon_kernel_check" "github.com/fleetdm/fleet/v4/orbit/pkg/table/crowdstrike/falconctl" "github.com/fleetdm/fleet/v4/orbit/pkg/table/cryptsetup" + "github.com/fleetdm/fleet/v4/orbit/pkg/table/dataflattentable" "github.com/rs/zerolog/log" "github.com/osquery/osquery-go" @@ -16,5 +17,6 @@ func PlatformTables(_ PluginOpts) ([]osquery.OsqueryPlugin, error) { cryptsetup.TablePlugin(log.Logger), // table name is "cryptsetup_status" falconctl.NewFalconctlOptionTable(log.Logger), // table name is "falconctl_option" falcon_kernel_check.TablePlugin(log.Logger), // table name is "falcon_kernel_check" + dataflattentable.TablePluginExec(log.Logger, "nftables", dataflattentable.JsonType, []string{"nft", "-jat", "list", "ruleset"}, dataflattentable.WithBinDirs("/usr/bin", "/usr/sbin")), // -j (json) -a (show object handles) -t (terse, omit set contents) }, nil }