Compare commits
No commits in common. "imports/c8-beta/iptables-1.8.2-12.el8" and "c8" have entirely different histories.
imports/c8
...
c8
|
@ -1 +1 @@
|
|||
SOURCES/iptables-1.8.2.tar.bz2
|
||||
SOURCES/iptables-1.8.5.tar.bz2
|
||||
|
|
|
@ -1 +1 @@
|
|||
215c4ef4c6cd29ef0dd265b4fa5ec51a4f930c92 SOURCES/iptables-1.8.2.tar.bz2
|
||||
f177a58d0a71b00d68ef5792ae4676bcc0ad29e6 SOURCES/iptables-1.8.5.tar.bz2
|
||||
|
|
File diff suppressed because it is too large
Load Diff
|
@ -0,0 +1,41 @@
|
|||
From 4806ba770a3aaadd0a3975ac1ea92dff3ea87ee4 Mon Sep 17 00:00:00 2001
|
||||
From: Jan Engelhardt <jengelh@inai.de>
|
||||
Date: Wed, 3 Jun 2020 15:38:48 +0200
|
||||
Subject: [PATCH] build: resolve iptables-apply not getting installed
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
ip6tables-apply gets installed but iptables-apply does not.
|
||||
That is wrong.
|
||||
|
||||
» make install DESTDIR=$PWD/r
|
||||
» find r -name "*app*"
|
||||
r/usr/local/sbin/ip6tables-apply
|
||||
r/usr/local/share/man/man8/iptables-apply.8
|
||||
r/usr/local/share/man/man8/ip6tables-apply.8
|
||||
|
||||
Fixes: v1.8.5~87
|
||||
Signed-off-by: Jan Engelhardt <jengelh@inai.de>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit d4ed0c741fc789bb09d977d74d30875fdd50d08b)
|
||||
---
|
||||
iptables/Makefile.am | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/Makefile.am b/iptables/Makefile.am
|
||||
index dc66b3cc09c08..2024dbf5cb88c 100644
|
||||
--- a/iptables/Makefile.am
|
||||
+++ b/iptables/Makefile.am
|
||||
@@ -56,7 +56,7 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \
|
||||
ip6tables-save.8 iptables-extensions.8 \
|
||||
iptables-apply.8 ip6tables-apply.8
|
||||
|
||||
-sbin_SCRIPT = iptables-apply
|
||||
+sbin_SCRIPTS = iptables-apply
|
||||
|
||||
if ENABLE_NFTABLES
|
||||
man_MANS += xtables-nft.8 xtables-translate.8 xtables-legacy.8 \
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,35 +0,0 @@
|
|||
From 7fe7c604d819d0b827f2abce253280b38a374cf1 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <psutter@redhat.com>
|
||||
Date: Mon, 17 Sep 2018 11:39:50 +0200
|
||||
Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile
|
||||
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/iptables-apply | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/iptables/iptables-apply b/iptables/iptables-apply
|
||||
index 819ca4a459c42..a685b6bbcd7dc 100755
|
||||
--- a/iptables/iptables-apply
|
||||
+++ b/iptables/iptables-apply
|
||||
@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then
|
||||
exit 2
|
||||
fi
|
||||
|
||||
-COMMANDS=(tempfile "$SAVE" "$RESTORE")
|
||||
+COMMANDS=(mktemp "$SAVE" "$RESTORE")
|
||||
|
||||
for cmd in "${COMMANDS[@]}"; do
|
||||
if ! command -v $cmd >/dev/null; then
|
||||
@@ -122,7 +122,7 @@ done
|
||||
|
||||
umask 0700
|
||||
|
||||
-TMPFILE=$(tempfile -p iptap)
|
||||
+TMPFILE=$(mktemp)
|
||||
trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \
|
||||
FPE USR1 SEGV USR2 PIPE ALRM TERM
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
From eaad1950f1952733c2770b29b593613cfe9af8a8 Mon Sep 17 00:00:00 2001
|
||||
From: Arturo Borrero Gonzalez <arturo@netfilter.org>
|
||||
Date: Tue, 16 Jun 2020 11:20:42 +0200
|
||||
Subject: [PATCH] xtables-translate: don't fail if help was requested
|
||||
|
||||
If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle
|
||||
this case in do_command_xlate().
|
||||
|
||||
Before this patch, you would see:
|
||||
|
||||
user@debian:~$ sudo iptables-translate -h
|
||||
[..]
|
||||
nft Unsupported command?
|
||||
user@debian:~$ echo $?
|
||||
1
|
||||
|
||||
After this patch:
|
||||
|
||||
user@debian:~$ sudo iptables-translate -h
|
||||
[..]
|
||||
user@debian:~$ echo $?
|
||||
0
|
||||
|
||||
Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts")
|
||||
Acked-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
|
||||
(cherry picked from commit 2757c0b5e5fbbf569695469b331453cecefdf069)
|
||||
---
|
||||
iptables/xtables-translate.c | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
|
||||
index 5aa42496b5a48..363c8be15b3fa 100644
|
||||
--- a/iptables/xtables-translate.c
|
||||
+++ b/iptables/xtables-translate.c
|
||||
@@ -249,7 +249,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
|
||||
|
||||
cs.restore = restore;
|
||||
|
||||
- if (!restore)
|
||||
+ if (!restore && p.command != CMD_NONE)
|
||||
printf("nft ");
|
||||
|
||||
switch (p.command) {
|
||||
@@ -310,6 +310,9 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
|
||||
break;
|
||||
case CMD_SET_POLICY:
|
||||
break;
|
||||
+ case CMD_NONE:
|
||||
+ ret = 1;
|
||||
+ break;
|
||||
default:
|
||||
/* We should never reach this... */
|
||||
printf("Unsupported command?\n");
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,61 +0,0 @@
|
|||
From 7e63dd95957a264d15eefdda3ea9449a6c72eb86 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= <adamg@pld-linux.org>
|
||||
Date: Wed, 14 Nov 2018 07:35:28 +0100
|
||||
Subject: [PATCH] extensions: format-security fixes in libip[6]t_icmp
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
|
||||
introduced support for gcc feature to check format string against passed
|
||||
argument. This commit adds missing bits to extenstions's libipt_icmp.c
|
||||
and libip6t_icmp6.c that were causing build to fail.
|
||||
|
||||
Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
|
||||
Signed-off-by: Adam Gołębiowski <adamg@pld-linux.org>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 907e429d7548157016cd51aba4adc5d0c7d9f816)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libip6t_icmp6.c | 4 ++--
|
||||
extensions/libipt_icmp.c | 2 +-
|
||||
2 files changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c
|
||||
index 45a71875722c4..cc7bfaeb72fd7 100644
|
||||
--- a/extensions/libip6t_icmp6.c
|
||||
+++ b/extensions/libip6t_icmp6.c
|
||||
@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
|
||||
type_name = icmp6_type_xlate(icmptype);
|
||||
|
||||
if (type_name) {
|
||||
- xt_xlate_add(xl, type_name);
|
||||
+ xt_xlate_add(xl, "%s", type_name);
|
||||
} else {
|
||||
for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
|
||||
if (icmpv6_codes[i].type == icmptype &&
|
||||
@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
|
||||
break;
|
||||
|
||||
if (i != ARRAY_SIZE(icmpv6_codes))
|
||||
- xt_xlate_add(xl, icmpv6_codes[i].name);
|
||||
+ xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
|
||||
else
|
||||
return 0;
|
||||
}
|
||||
diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
|
||||
index 5418997668d4c..e76257c54708c 100644
|
||||
--- a/extensions/libipt_icmp.c
|
||||
+++ b/extensions/libipt_icmp.c
|
||||
@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
|
||||
if (icmp_codes[i].type == icmptype &&
|
||||
icmp_codes[i].code_min == code_min &&
|
||||
icmp_codes[i].code_max == code_max) {
|
||||
- xt_xlate_add(xl, icmp_codes[i].name);
|
||||
+ xt_xlate_add(xl, "%s", icmp_codes[i].name);
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
From d9497b521e6f512f27bd1d4a88086f50418cb7b8 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 16 Jun 2020 13:06:26 +0200
|
||||
Subject: [PATCH] xtables-translate: Use proper clear_cs function
|
||||
|
||||
Avoid memleaks by performing a full free of any allocated data in local
|
||||
iptables_command_state variable.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 63fa2b1cb98be66990912d7eb42eab5440437087)
|
||||
---
|
||||
iptables/xtables-translate.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
|
||||
index 363c8be15b3fa..575fb320dc408 100644
|
||||
--- a/iptables/xtables-translate.c
|
||||
+++ b/iptables/xtables-translate.c
|
||||
@@ -319,7 +319,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
|
||||
exit(1);
|
||||
}
|
||||
|
||||
- xtables_rule_matches_free(&cs.matches);
|
||||
+ nft_clear_iptables_command_state(&cs);
|
||||
|
||||
if (h->family == AF_INET) {
|
||||
free(args.s.addr.v4);
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,190 +0,0 @@
|
|||
From abf79e364e9ef2dc355eb52d07d160b1f6c0f8c4 Mon Sep 17 00:00:00 2001
|
||||
From: Florian Westphal <fw@strlen.de>
|
||||
Date: Sun, 18 Nov 2018 12:31:33 +0100
|
||||
Subject: [PATCH] arptables-nft: use generic expression parsing function
|
||||
|
||||
since commit d9c6a5d0977a6d8bbe772dbc31a2c4f58eec1708
|
||||
("xtables: merge {ip,arp}tables_command_state structs") arptables
|
||||
uses the shared representation.
|
||||
|
||||
With only minor changes (e.g., use generic counters in command_state),
|
||||
in print/save functions we can use the shared nftnl expression parser
|
||||
too.
|
||||
|
||||
arptables-legacy prints (-L) the jump target first, i.e.:
|
||||
-j MARK -d 0.0.0.0/8 --h-length 6 ...
|
||||
|
||||
... so keep that here too.
|
||||
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit aa5d3c5b16e94036ac0dc6d44194db7b009ced53)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libarpt_standard.t | 4 +-
|
||||
iptables/nft-arp.c | 92 ++++-------------------------------
|
||||
2 files changed, 12 insertions(+), 84 deletions(-)
|
||||
|
||||
diff --git a/extensions/libarpt_standard.t b/extensions/libarpt_standard.t
|
||||
index bef682afec374..195865929c8d3 100644
|
||||
--- a/extensions/libarpt_standard.t
|
||||
+++ b/extensions/libarpt_standard.t
|
||||
@@ -5,8 +5,8 @@
|
||||
-d 192.168.0.1;=;OK
|
||||
! -d 0.0.0.0;=;OK
|
||||
-d 0.0.0.0/24;=;OK
|
||||
--i lo;=;OK
|
||||
-! -i lo;=;OK
|
||||
+-i lo -j DROP;-i lo --h-length 6 --h-type 1 -j DROP;OK
|
||||
+! -i lo -j ACCEPT;! -i lo --h-length 6 --h-type 1 -j ACCEPT;OK
|
||||
-i ppp+;=;OK
|
||||
! -i ppp+;=;OK
|
||||
-i lo --destination-mac 11:22:33:44:55:66;-i lo --dst-mac 11:22:33:44:55:66;OK
|
||||
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
|
||||
index 1a98996f94bda..37850bd328b71 100644
|
||||
--- a/iptables/nft-arp.c
|
||||
+++ b/iptables/nft-arp.c
|
||||
@@ -412,56 +412,6 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
|
||||
}
|
||||
}
|
||||
|
||||
-static void nft_arp_rule_to_cs(const struct nftnl_rule *r,
|
||||
- struct iptables_command_state *cs)
|
||||
-{
|
||||
- struct nftnl_expr_iter *iter;
|
||||
- struct nftnl_expr *expr;
|
||||
- int family = nftnl_rule_get_u32(r, NFTNL_RULE_FAMILY);
|
||||
- struct nft_xt_ctx ctx = {
|
||||
- .cs = cs,
|
||||
- .family = family,
|
||||
- };
|
||||
-
|
||||
- iter = nftnl_expr_iter_create(r);
|
||||
- if (iter == NULL)
|
||||
- return;
|
||||
-
|
||||
- ctx.iter = iter;
|
||||
- expr = nftnl_expr_iter_next(iter);
|
||||
- while (expr != NULL) {
|
||||
- const char *name =
|
||||
- nftnl_expr_get_str(expr, NFTNL_EXPR_NAME);
|
||||
-
|
||||
- if (strcmp(name, "counter") == 0)
|
||||
- nft_parse_counter(expr, &ctx.cs->arp.counters);
|
||||
- else if (strcmp(name, "payload") == 0)
|
||||
- nft_parse_payload(&ctx, expr);
|
||||
- else if (strcmp(name, "meta") == 0)
|
||||
- nft_parse_meta(&ctx, expr);
|
||||
- else if (strcmp(name, "bitwise") == 0)
|
||||
- nft_parse_bitwise(&ctx, expr);
|
||||
- else if (strcmp(name, "cmp") == 0)
|
||||
- nft_parse_cmp(&ctx, expr);
|
||||
- else if (strcmp(name, "immediate") == 0)
|
||||
- nft_parse_immediate(&ctx, expr);
|
||||
- else if (strcmp(name, "target") == 0)
|
||||
- nft_parse_target(&ctx, expr);
|
||||
-
|
||||
- expr = nftnl_expr_iter_next(iter);
|
||||
- }
|
||||
-
|
||||
- nftnl_expr_iter_destroy(iter);
|
||||
-
|
||||
- if (cs->jumpto != NULL)
|
||||
- return;
|
||||
-
|
||||
- if (cs->target != NULL && cs->target->name != NULL)
|
||||
- cs->target = xtables_find_target(cs->target->name, XTF_TRY_LOAD);
|
||||
- else
|
||||
- cs->jumpto = "";
|
||||
-}
|
||||
-
|
||||
static void nft_arp_print_header(unsigned int format, const char *chain,
|
||||
const char *pol,
|
||||
const struct xt_counters *counters,
|
||||
@@ -627,14 +577,6 @@ after_devdst:
|
||||
}
|
||||
}
|
||||
|
||||
-static void nft_arp_save_counters(const void *data)
|
||||
-{
|
||||
- const struct iptables_command_state *cs = data;
|
||||
-
|
||||
- printf("[%llu:%llu] ", (unsigned long long)cs->arp.counters.pcnt,
|
||||
- (unsigned long long)cs->arp.counters.bcnt);
|
||||
-}
|
||||
-
|
||||
static void
|
||||
nft_arp_save_rule(const void *data, unsigned int format)
|
||||
{
|
||||
@@ -643,17 +585,7 @@ nft_arp_save_rule(const void *data, unsigned int format)
|
||||
format |= FMT_NUMERIC;
|
||||
|
||||
nft_arp_print_rule_details(&cs->arp, format);
|
||||
-
|
||||
- if (cs->jumpto != NULL && strcmp(cs->jumpto, "") != 0) {
|
||||
- printf("-j %s", cs->jumpto);
|
||||
- } else if (cs->target) {
|
||||
- printf("-j %s", cs->target->name);
|
||||
- if (cs->target->save != NULL)
|
||||
- cs->target->save(&cs->arp, cs->target->t);
|
||||
- }
|
||||
-
|
||||
- if (!(format & FMT_NONEWLINE))
|
||||
- fputc('\n', stdout);
|
||||
+ save_matches_and_target(cs, false, &cs->arp, format);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -664,22 +596,18 @@ nft_arp_print_rule(struct nftnl_rule *r, unsigned int num, unsigned int format)
|
||||
if (format & FMT_LINENUMBERS)
|
||||
printf("%u ", num);
|
||||
|
||||
- nft_arp_rule_to_cs(r, &cs);
|
||||
+ nft_rule_to_iptables_command_state(r, &cs);
|
||||
|
||||
+ if (cs.jumpto)
|
||||
+ printf("-j %s ", cs.jumpto);
|
||||
nft_arp_print_rule_details(&cs.arp, format);
|
||||
-
|
||||
- if (cs.jumpto != NULL && strcmp(cs.jumpto, "") != 0) {
|
||||
- printf("-j %s", cs.jumpto);
|
||||
- } else if (cs.target) {
|
||||
- printf("-j %s", cs.target->name);
|
||||
- cs.target->print(&cs.arp, cs.target->t, format & FMT_NUMERIC);
|
||||
- }
|
||||
+ print_matches_and_target(&cs, format);
|
||||
|
||||
if (!(format & FMT_NOCOUNTS)) {
|
||||
printf(", pcnt=");
|
||||
- xtables_print_num(cs.arp.counters.pcnt, format);
|
||||
+ xtables_print_num(cs.counters.pcnt, format);
|
||||
printf("-- bcnt=");
|
||||
- xtables_print_num(cs.arp.counters.bcnt, format);
|
||||
+ xtables_print_num(cs.counters.bcnt, format);
|
||||
}
|
||||
|
||||
if (!(format & FMT_NONEWLINE))
|
||||
@@ -720,7 +648,7 @@ static bool nft_arp_rule_find(struct nft_family_ops *ops, struct nftnl_rule *r,
|
||||
struct iptables_command_state this = {};
|
||||
|
||||
/* Delete by matching rule case */
|
||||
- nft_arp_rule_to_cs(r, &this);
|
||||
+ nft_rule_to_iptables_command_state(r, &this);
|
||||
|
||||
if (!nft_arp_is_same(&cs->arp, &this.arp))
|
||||
return false;
|
||||
@@ -751,10 +679,10 @@ struct nft_family_ops nft_family_ops_arp = {
|
||||
.print_header = nft_arp_print_header,
|
||||
.print_rule = nft_arp_print_rule,
|
||||
.save_rule = nft_arp_save_rule,
|
||||
- .save_counters = nft_arp_save_counters,
|
||||
+ .save_counters = save_counters,
|
||||
.save_chain = nft_arp_save_chain,
|
||||
.post_parse = NULL,
|
||||
- .rule_to_cs = nft_arp_rule_to_cs,
|
||||
+ .rule_to_cs = nft_rule_to_iptables_command_state,
|
||||
.clear_cs = nft_clear_iptables_command_state,
|
||||
.rule_find = nft_arp_rule_find,
|
||||
.parse_target = nft_ipv46_parse_target,
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
From 94fcba7825b121cbb7d3ff73f4e80a798feccdee Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
|
||||
Date: Tue, 23 Jun 2020 16:09:02 -0700
|
||||
Subject: [PATCH] libxtables: compiler warning fixes for NO_SHARED_LIBS
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Fixes two issues with NO_SHARED_LIBS:
|
||||
- #include <dlfcn.h> is ifdef'ed out and thus dlclose()
|
||||
triggers an undeclared function compiler warning
|
||||
- dlreg_add() is unused and thus triggers an unused
|
||||
function warning
|
||||
|
||||
Test: builds without warnings
|
||||
Signed-off-by: Maciej Żenczykowski <maze@google.com>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 6cb8af1ff3951e47def7a16db39289dc9d9c61fe)
|
||||
---
|
||||
libxtables/xtables.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
|
||||
index 7fe42580f9b70..8907ba2069be7 100644
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -206,6 +206,7 @@ struct xtables_target *xtables_targets;
|
||||
static bool xtables_fully_register_pending_match(struct xtables_match *me);
|
||||
static bool xtables_fully_register_pending_target(struct xtables_target *me);
|
||||
|
||||
+#ifndef NO_SHARED_LIBS
|
||||
/* registry for loaded shared objects to close later */
|
||||
struct dlreg {
|
||||
struct dlreg *next;
|
||||
@@ -237,6 +238,7 @@ static void dlreg_free(void)
|
||||
dlreg = next;
|
||||
}
|
||||
}
|
||||
+#endif
|
||||
|
||||
void xtables_init(void)
|
||||
{
|
||||
@@ -267,7 +269,9 @@ void xtables_init(void)
|
||||
|
||||
void xtables_fini(void)
|
||||
{
|
||||
+#ifndef NO_SHARED_LIBS
|
||||
dlreg_free();
|
||||
+#endif
|
||||
}
|
||||
|
||||
void xtables_set_nfproto(uint8_t nfproto)
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
From 0323122f6a3ef9ab2ded571685d3c64851c6df86 Mon Sep 17 00:00:00 2001
|
||||
From: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
Date: Wed, 22 Jul 2020 13:04:34 +0200
|
||||
Subject: [PATCH] extensions: libxt_conntrack: provide translation for DNAT and
|
||||
SNAT --ctstate
|
||||
|
||||
iptables-translate -t filter -A INPUT -m conntrack --ctstate DNAT -j ACCEPT
|
||||
nft add rule ip filter INPUT ct status dnat counter accept
|
||||
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 26ec09bf6b9b674a7e3a65fc9c12599bd81dfe0f)
|
||||
---
|
||||
extensions/libxt_conntrack.c | 18 +++++++++++++-----
|
||||
extensions/libxt_conntrack.txlate | 7 +++++++
|
||||
2 files changed, 20 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
|
||||
index 6f3503933e664..7734509c9af84 100644
|
||||
--- a/extensions/libxt_conntrack.c
|
||||
+++ b/extensions/libxt_conntrack.c
|
||||
@@ -1249,11 +1249,19 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
|
||||
}
|
||||
|
||||
if (sinfo->match_flags & XT_CONNTRACK_STATE) {
|
||||
- xt_xlate_add(xl, "%sct state %s", space,
|
||||
- sinfo->invert_flags & XT_CONNTRACK_STATE ?
|
||||
- "!= " : "");
|
||||
- state_xlate_print(xl, sinfo->state_mask);
|
||||
- space = " ";
|
||||
+ if ((sinfo->state_mask & XT_CONNTRACK_STATE_SNAT) ||
|
||||
+ (sinfo->state_mask & XT_CONNTRACK_STATE_DNAT)) {
|
||||
+ xt_xlate_add(xl, "%sct status %s%s", space,
|
||||
+ sinfo->invert_flags & XT_CONNTRACK_STATUS ? "!=" : "",
|
||||
+ sinfo->state_mask & XT_CONNTRACK_STATE_SNAT ? "snat" : "dnat");
|
||||
+ space = " ";
|
||||
+ } else {
|
||||
+ xt_xlate_add(xl, "%sct state %s", space,
|
||||
+ sinfo->invert_flags & XT_CONNTRACK_STATE ?
|
||||
+ "!= " : "");
|
||||
+ state_xlate_print(xl, sinfo->state_mask);
|
||||
+ space = " ";
|
||||
+ }
|
||||
}
|
||||
|
||||
if (sinfo->match_flags & XT_CONNTRACK_STATUS) {
|
||||
diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate
|
||||
index 8a3d0181c71ef..d374f8a035f00 100644
|
||||
--- a/extensions/libxt_conntrack.txlate
|
||||
+++ b/extensions/libxt_conntrack.txlate
|
||||
@@ -42,3 +42,10 @@ nft add rule ip filter INPUT ct direction original counter accept
|
||||
|
||||
iptables-translate -t filter -A INPUT -m conntrack --ctstate NEW --ctproto tcp --ctorigsrc 192.168.0.1 --ctorigdst 192.168.0.1 --ctreplsrc 192.168.0.1 --ctrepldst 192.168.0.1 --ctorigsrcport 12 --ctorigdstport 14 --ctreplsrcport 16 --ctrepldstport 18 --ctexpire 10 --ctstatus SEEN_REPLY --ctdir ORIGINAL -j ACCEPT
|
||||
nft add rule ip filter INPUT ct direction original ct original protocol 6 ct state new ct status seen-reply ct expiration 10 ct original saddr 192.168.0.1 ct original daddr 192.168.0.1 ct reply saddr 192.168.0.1 ct reply daddr 192.168.0.1 ct original proto-src 12 ct original proto-dst 14 ct reply proto-src 16 ct reply proto-dst 18 counter accept
|
||||
+
|
||||
+iptables-translate -t filter -A INPUT -m conntrack --ctstate SNAT -j ACCEPT
|
||||
+nft add rule ip filter INPUT ct status snat counter accept
|
||||
+
|
||||
+iptables-translate -t filter -A INPUT -m conntrack --ctstate DNAT -j ACCEPT
|
||||
+nft add rule ip filter INPUT ct status dnat counter accept
|
||||
+
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,143 +0,0 @@
|
|||
From b7556207b12decbe4e79bf218ec5bff073a04ad2 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 27 Nov 2018 20:07:11 +0100
|
||||
Subject: [PATCH] xtables: Don't use native nftables comments
|
||||
|
||||
The problem with converting libxt_comment into nftables comment is that
|
||||
rules change when parsing from kernel due to comment match being moved
|
||||
to the end of the match list. And since match ordering matters, the rule
|
||||
may not be found anymore when checking or deleting. Apart from that,
|
||||
iptables-nft didn't support multiple comments per rule anymore. This is
|
||||
a compatibility issue without technical reason.
|
||||
|
||||
Leave conversion from nftables comment to libxt_comment in place so we
|
||||
don't break running systems during an update.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit ccf154d7420c07b6e6febc1c3b8b31d2bd1adbe6)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libxt_comment.t | 2 ++
|
||||
iptables/nft-ipv4.c | 14 +++-----------
|
||||
iptables/nft-ipv6.c | 14 +++-----------
|
||||
iptables/nft.c | 27 ---------------------------
|
||||
iptables/nft.h | 1 -
|
||||
5 files changed, 8 insertions(+), 50 deletions(-)
|
||||
|
||||
diff --git a/extensions/libxt_comment.t b/extensions/libxt_comment.t
|
||||
index f12cd66841e7f..f0c8fb999401b 100644
|
||||
--- a/extensions/libxt_comment.t
|
||||
+++ b/extensions/libxt_comment.t
|
||||
@@ -1,6 +1,8 @@
|
||||
:INPUT,FORWARD,OUTPUT
|
||||
-m comment;;FAIL
|
||||
-m comment --comment;;FAIL
|
||||
+-p tcp -m tcp --dport 22 -m comment --comment foo;=;OK
|
||||
+-p tcp -m comment --comment foo -m tcp --dport 22;=;OK
|
||||
#
|
||||
# it fails with 256 characters
|
||||
#
|
||||
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
|
||||
index ffb439b4a1128..4497eb9b9347c 100644
|
||||
--- a/iptables/nft-ipv4.c
|
||||
+++ b/iptables/nft-ipv4.c
|
||||
@@ -77,17 +77,9 @@ static int nft_ipv4_add(struct nftnl_rule *r, void *data)
|
||||
add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags & XT_INV_PROTO);
|
||||
|
||||
for (matchp = cs->matches; matchp; matchp = matchp->next) {
|
||||
- /* Use nft built-in comments support instead of comment match */
|
||||
- if (strcmp(matchp->match->name, "comment") == 0) {
|
||||
- ret = add_comment(r, (char *)matchp->match->m->data);
|
||||
- if (ret < 0)
|
||||
- goto try_match;
|
||||
- } else {
|
||||
-try_match:
|
||||
- ret = add_match(r, matchp->match->m);
|
||||
- if (ret < 0)
|
||||
- return ret;
|
||||
- }
|
||||
+ ret = add_match(r, matchp->match->m);
|
||||
+ if (ret < 0)
|
||||
+ return ret;
|
||||
}
|
||||
|
||||
/* Counters need to me added before the target, otherwise they are
|
||||
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
|
||||
index 7bacee4ab3a21..cacb1c9e141f2 100644
|
||||
--- a/iptables/nft-ipv6.c
|
||||
+++ b/iptables/nft-ipv6.c
|
||||
@@ -66,17 +66,9 @@ static int nft_ipv6_add(struct nftnl_rule *r, void *data)
|
||||
add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags & XT_INV_PROTO);
|
||||
|
||||
for (matchp = cs->matches; matchp; matchp = matchp->next) {
|
||||
- /* Use nft built-in comments support instead of comment match */
|
||||
- if (strcmp(matchp->match->name, "comment") == 0) {
|
||||
- ret = add_comment(r, (char *)matchp->match->m->data);
|
||||
- if (ret < 0)
|
||||
- goto try_match;
|
||||
- } else {
|
||||
-try_match:
|
||||
- ret = add_match(r, matchp->match->m);
|
||||
- if (ret < 0)
|
||||
- return ret;
|
||||
- }
|
||||
+ ret = add_match(r, matchp->match->m);
|
||||
+ if (ret < 0)
|
||||
+ return ret;
|
||||
}
|
||||
|
||||
/* Counters need to me added before the target, otherwise they are
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index e8538d38e0109..6863d851e44c2 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1107,33 +1107,6 @@ enum udata_type {
|
||||
};
|
||||
#define UDATA_TYPE_MAX (__UDATA_TYPE_MAX - 1)
|
||||
|
||||
-int add_comment(struct nftnl_rule *r, const char *comment)
|
||||
-{
|
||||
- struct nftnl_udata_buf *udata;
|
||||
- uint32_t len;
|
||||
-
|
||||
- if (nftnl_rule_get_data(r, NFTNL_RULE_USERDATA, &len))
|
||||
- return -EALREADY;
|
||||
-
|
||||
- udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);
|
||||
- if (!udata)
|
||||
- return -ENOMEM;
|
||||
-
|
||||
- if (strnlen(comment, 255) == 255)
|
||||
- return -ENOSPC;
|
||||
-
|
||||
- if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comment))
|
||||
- return -ENOMEM;
|
||||
-
|
||||
- nftnl_rule_set_data(r, NFTNL_RULE_USERDATA,
|
||||
- nftnl_udata_buf_data(udata),
|
||||
- nftnl_udata_buf_len(udata));
|
||||
-
|
||||
- nftnl_udata_buf_free(udata);
|
||||
-
|
||||
- return 0;
|
||||
-}
|
||||
-
|
||||
static int parse_udata_cb(const struct nftnl_udata *attr, void *data)
|
||||
{
|
||||
unsigned char *value = nftnl_udata_get(attr);
|
||||
diff --git a/iptables/nft.h b/iptables/nft.h
|
||||
index 9b4ba5f9a63eb..052105fc6f3cd 100644
|
||||
--- a/iptables/nft.h
|
||||
+++ b/iptables/nft.h
|
||||
@@ -116,7 +116,6 @@ int add_match(struct nftnl_rule *r, struct xt_entry_match *m);
|
||||
int add_target(struct nftnl_rule *r, struct xt_entry_target *t);
|
||||
int add_jumpto(struct nftnl_rule *r, const char *name, int verdict);
|
||||
int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, bool goto_set);
|
||||
-int add_comment(struct nftnl_rule *r, const char *comment);
|
||||
char *get_comment(const void *data, uint32_t data_len);
|
||||
|
||||
enum nft_rule_print {
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
From 13abbdd7789da8616a903b5b8dc5ff69fb2af2c7 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 10 Jul 2020 21:12:34 +0200
|
||||
Subject: [PATCH] nft: Drop pointless nft_xt_builtin_init() call
|
||||
|
||||
When renaming a chain, either everything is in place already or the
|
||||
command will bail anyway. So just drop this superfluous call.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 7a700c47fe121c65c550ab24de3284abbb1e82f8)
|
||||
---
|
||||
iptables/nft.c | 2 --
|
||||
1 file changed, 2 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 0c5a74fc232c6..e795d4ae6d241 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1934,8 +1934,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
|
||||
return 0;
|
||||
}
|
||||
|
||||
- nft_xt_builtin_init(h, table);
|
||||
-
|
||||
/* Config load changed errno. Ensure genuine info for our callers. */
|
||||
errno = 0;
|
||||
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,592 +0,0 @@
|
|||
From a09e8ae2a1e2ff589af839ad3460493fc04306d7 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 15 Nov 2018 14:53:02 +0100
|
||||
Subject: [PATCH] xtables: Introduce per table chain caches
|
||||
|
||||
Being able to omit the previously obligatory table name check when
|
||||
iterating over the chain cache might help restore performance with large
|
||||
rulesets in xtables-save and -restore.
|
||||
|
||||
There is one subtle quirk in the code: flush_chain_cache() did free the
|
||||
global chain cache if not called with a table name but didn't if a table
|
||||
name was given even if it emptied the chain cache. In other places,
|
||||
chain_cache being non-NULL prevented a cache update from happening, so
|
||||
this patch establishes the same behaviour (for each individual chain
|
||||
cache) since otherwise unexpected cache updates lead to weird problems.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit c58ecf9f8bcb7619a27ef8ffaddf847a562475a5)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-shared.h | 3 +-
|
||||
iptables/nft.c | 160 +++++++++++++++++--------------------
|
||||
iptables/nft.h | 10 ++-
|
||||
iptables/xtables-restore.c | 16 ++--
|
||||
iptables/xtables-save.c | 12 +--
|
||||
5 files changed, 95 insertions(+), 106 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
|
||||
index e3ecdb4d23df3..9a61d8d2863e3 100644
|
||||
--- a/iptables/nft-shared.h
|
||||
+++ b/iptables/nft-shared.h
|
||||
@@ -251,7 +251,8 @@ struct nftnl_chain_list;
|
||||
|
||||
struct nft_xt_restore_cb {
|
||||
void (*table_new)(struct nft_handle *h, const char *table);
|
||||
- struct nftnl_chain_list *(*chain_list)(struct nft_handle *h);
|
||||
+ struct nftnl_chain_list *(*chain_list)(struct nft_handle *h,
|
||||
+ const char *table);
|
||||
void (*chain_del)(struct nftnl_chain_list *clist, const char *curtable,
|
||||
const char *chain);
|
||||
int (*chain_user_flush)(struct nft_handle *h,
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 6863d851e44c2..36529048a0ca6 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -673,15 +673,17 @@ nft_chain_builtin_find(struct builtin_table *t, const char *chain)
|
||||
static void nft_chain_builtin_init(struct nft_handle *h,
|
||||
struct builtin_table *table)
|
||||
{
|
||||
- struct nftnl_chain_list *list = nft_chain_list_get(h);
|
||||
+ struct nftnl_chain_list *list = nft_chain_list_get(h, table->name);
|
||||
struct nftnl_chain *c;
|
||||
int i;
|
||||
|
||||
+ if (!list)
|
||||
+ return;
|
||||
+
|
||||
/* Initialize built-in chains if they don't exist yet */
|
||||
for (i=0; i < NF_INET_NUMHOOKS && table->chains[i].name != NULL; i++) {
|
||||
|
||||
- c = nft_chain_list_find(list, table->name,
|
||||
- table->chains[i].name);
|
||||
+ c = nft_chain_list_find(list, table->chains[i].name);
|
||||
if (c != NULL)
|
||||
continue;
|
||||
|
||||
@@ -782,27 +784,33 @@ static void flush_rule_cache(struct nft_handle *h, const char *tablename)
|
||||
|
||||
static int __flush_chain_cache(struct nftnl_chain *c, void *data)
|
||||
{
|
||||
- const char *tablename = data;
|
||||
-
|
||||
- if (!strcmp(nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), tablename)) {
|
||||
- nftnl_chain_list_del(c);
|
||||
- nftnl_chain_free(c);
|
||||
- }
|
||||
+ nftnl_chain_list_del(c);
|
||||
+ nftnl_chain_free(c);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void flush_chain_cache(struct nft_handle *h, const char *tablename)
|
||||
{
|
||||
- if (!h->chain_cache)
|
||||
- return;
|
||||
+ int i;
|
||||
|
||||
- if (tablename) {
|
||||
- nftnl_chain_list_foreach(h->chain_cache, __flush_chain_cache,
|
||||
- (void *)tablename);
|
||||
- } else {
|
||||
- nftnl_chain_list_free(h->chain_cache);
|
||||
- h->chain_cache = NULL;
|
||||
+ for (i = 0; i < NFT_TABLE_MAX; i++) {
|
||||
+ if (h->tables[i].name == NULL)
|
||||
+ continue;
|
||||
+
|
||||
+ if (tablename && strcmp(h->tables[i].name, tablename))
|
||||
+ continue;
|
||||
+
|
||||
+ if (h->tables[i].chain_cache) {
|
||||
+ if (tablename) {
|
||||
+ nftnl_chain_list_foreach(h->tables[i].chain_cache,
|
||||
+ __flush_chain_cache, NULL);
|
||||
+ break;
|
||||
+ } else {
|
||||
+ nftnl_chain_list_free(h->tables[i].chain_cache);
|
||||
+ h->tables[i].chain_cache = NULL;
|
||||
+ }
|
||||
+ }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1244,8 +1252,9 @@ nft_rule_print_save(const struct nftnl_rule *r, enum nft_rule_print type,
|
||||
|
||||
static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
|
||||
{
|
||||
+ struct nft_handle *h = data;
|
||||
+ struct builtin_table *t;
|
||||
struct nftnl_chain *c;
|
||||
- struct nftnl_chain_list *list = data;
|
||||
|
||||
c = nftnl_chain_alloc();
|
||||
if (c == NULL)
|
||||
@@ -1254,7 +1263,18 @@ static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
|
||||
if (nftnl_chain_nlmsg_parse(nlh, c) < 0)
|
||||
goto out;
|
||||
|
||||
- nftnl_chain_list_add_tail(c, list);
|
||||
+ t = nft_table_builtin_find(h,
|
||||
+ nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE));
|
||||
+ if (!t)
|
||||
+ goto out;
|
||||
+
|
||||
+ if (!t->chain_cache) {
|
||||
+ t->chain_cache = nftnl_chain_list_alloc();
|
||||
+ if (!t->chain_cache)
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
+ nftnl_chain_list_add_tail(c, t->chain_cache);
|
||||
|
||||
return MNL_CB_OK;
|
||||
out:
|
||||
@@ -1263,35 +1283,34 @@ err:
|
||||
return MNL_CB_OK;
|
||||
}
|
||||
|
||||
-struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h)
|
||||
+struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
+ const char *table)
|
||||
{
|
||||
char buf[16536];
|
||||
struct nlmsghdr *nlh;
|
||||
- struct nftnl_chain_list *list;
|
||||
+ struct builtin_table *t;
|
||||
int ret;
|
||||
|
||||
- if (h->chain_cache)
|
||||
- return h->chain_cache;
|
||||
-retry:
|
||||
- list = nftnl_chain_list_alloc();
|
||||
- if (list == NULL) {
|
||||
- errno = ENOMEM;
|
||||
+ t = nft_table_builtin_find(h, table);
|
||||
+ if (!t)
|
||||
return NULL;
|
||||
- }
|
||||
|
||||
+ if (t->chain_cache)
|
||||
+ return t->chain_cache;
|
||||
+retry:
|
||||
nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, h->family,
|
||||
NLM_F_DUMP, h->seq);
|
||||
|
||||
- ret = mnl_talk(h, nlh, nftnl_chain_list_cb, list);
|
||||
+ ret = mnl_talk(h, nlh, nftnl_chain_list_cb, h);
|
||||
if (ret < 0 && errno == EINTR) {
|
||||
assert(nft_restart(h) >= 0);
|
||||
- nftnl_chain_list_free(list);
|
||||
goto retry;
|
||||
}
|
||||
|
||||
- h->chain_cache = list;
|
||||
+ if (!t->chain_cache)
|
||||
+ t->chain_cache = nftnl_chain_list_alloc();
|
||||
|
||||
- return list;
|
||||
+ return t->chain_cache;
|
||||
}
|
||||
|
||||
static const char *policy_name[NF_ACCEPT+1] = {
|
||||
@@ -1299,8 +1318,7 @@ static const char *policy_name[NF_ACCEPT+1] = {
|
||||
[NF_ACCEPT] = "ACCEPT",
|
||||
};
|
||||
|
||||
-int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list,
|
||||
- const char *table)
|
||||
+int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list)
|
||||
{
|
||||
struct nftnl_chain_list_iter *iter;
|
||||
struct nft_family_ops *ops;
|
||||
@@ -1314,13 +1332,8 @@ int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list,
|
||||
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
while (c != NULL) {
|
||||
- const char *chain_table =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
||||
const char *policy = NULL;
|
||||
|
||||
- if (strcmp(table, chain_table) != 0)
|
||||
- goto next;
|
||||
-
|
||||
if (nft_chain_builtin(c)) {
|
||||
uint32_t pol = NF_ACCEPT;
|
||||
|
||||
@@ -1331,7 +1344,7 @@ int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list,
|
||||
|
||||
if (ops->save_chain)
|
||||
ops->save_chain(c, policy);
|
||||
-next:
|
||||
+
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
}
|
||||
|
||||
@@ -1502,7 +1515,7 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
|
||||
|
||||
nft_fn = nft_rule_flush;
|
||||
|
||||
- list = nft_chain_list_get(h);
|
||||
+ list = nft_chain_list_get(h, table);
|
||||
if (list == NULL) {
|
||||
ret = 1;
|
||||
goto err;
|
||||
@@ -1516,21 +1529,16 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
|
||||
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
while (c != NULL) {
|
||||
- const char *table_name =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
||||
const char *chain_name =
|
||||
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
|
||||
- if (strcmp(table, table_name) != 0)
|
||||
- goto next;
|
||||
-
|
||||
if (chain != NULL && strcmp(chain, chain_name) != 0)
|
||||
goto next;
|
||||
|
||||
if (verbose)
|
||||
fprintf(stdout, "Flushing chain `%s'\n", chain_name);
|
||||
|
||||
- __nft_rule_flush(h, table_name, chain_name);
|
||||
+ __nft_rule_flush(h, table, chain_name);
|
||||
|
||||
if (chain != NULL)
|
||||
break;
|
||||
@@ -1546,6 +1554,7 @@ err:
|
||||
|
||||
int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *table)
|
||||
{
|
||||
+ struct nftnl_chain_list *list;
|
||||
struct nftnl_chain *c;
|
||||
int ret;
|
||||
|
||||
@@ -1564,9 +1573,9 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
|
||||
|
||||
ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c);
|
||||
|
||||
- nft_chain_list_get(h);
|
||||
-
|
||||
- nftnl_chain_list_add(c, h->chain_cache);
|
||||
+ list = nft_chain_list_get(h, table);
|
||||
+ if (list)
|
||||
+ nftnl_chain_list_add(c, list);
|
||||
|
||||
/* the core expects 1 for success and 0 for error */
|
||||
return ret == 0 ? 1 : 0;
|
||||
@@ -1588,7 +1597,7 @@ int nft_chain_user_del(struct nft_handle *h, const char *chain,
|
||||
|
||||
nft_fn = nft_chain_user_del;
|
||||
|
||||
- list = nft_chain_list_get(h);
|
||||
+ list = nft_chain_list_get(h, table);
|
||||
if (list == NULL)
|
||||
goto err;
|
||||
|
||||
@@ -1598,8 +1607,6 @@ int nft_chain_user_del(struct nft_handle *h, const char *chain,
|
||||
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
while (c != NULL) {
|
||||
- const char *table_name =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
||||
const char *chain_name =
|
||||
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
|
||||
@@ -1607,9 +1614,6 @@ int nft_chain_user_del(struct nft_handle *h, const char *chain,
|
||||
if (nft_chain_builtin(c))
|
||||
goto next;
|
||||
|
||||
- if (strcmp(table, table_name) != 0)
|
||||
- goto next;
|
||||
-
|
||||
if (chain != NULL && strcmp(chain, chain_name) != 0)
|
||||
goto next;
|
||||
|
||||
@@ -1644,8 +1648,7 @@ err:
|
||||
}
|
||||
|
||||
struct nftnl_chain *
|
||||
-nft_chain_list_find(struct nftnl_chain_list *list,
|
||||
- const char *table, const char *chain)
|
||||
+nft_chain_list_find(struct nftnl_chain_list *list, const char *chain)
|
||||
{
|
||||
struct nftnl_chain_list_iter *iter;
|
||||
struct nftnl_chain *c;
|
||||
@@ -1656,14 +1659,9 @@ nft_chain_list_find(struct nftnl_chain_list *list,
|
||||
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
while (c != NULL) {
|
||||
- const char *table_name =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
||||
const char *chain_name =
|
||||
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
|
||||
- if (strcmp(table, table_name) != 0)
|
||||
- goto next;
|
||||
-
|
||||
if (strcmp(chain, chain_name) != 0)
|
||||
goto next;
|
||||
|
||||
@@ -1681,11 +1679,11 @@ nft_chain_find(struct nft_handle *h, const char *table, const char *chain)
|
||||
{
|
||||
struct nftnl_chain_list *list;
|
||||
|
||||
- list = nft_chain_list_get(h);
|
||||
+ list = nft_chain_list_get(h, table);
|
||||
if (list == NULL)
|
||||
return NULL;
|
||||
|
||||
- return nft_chain_list_find(list, table, chain);
|
||||
+ return nft_chain_list_find(list, chain);
|
||||
}
|
||||
|
||||
bool nft_chain_exists(struct nft_handle *h,
|
||||
@@ -2297,7 +2295,9 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
||||
return 1;
|
||||
}
|
||||
|
||||
- list = nft_chain_list_get(h);
|
||||
+ list = nft_chain_list_get(h, table);
|
||||
+ if (!list)
|
||||
+ goto err; /* XXX: return 0 instead? */
|
||||
|
||||
iter = nftnl_chain_list_iter_create(list);
|
||||
if (iter == NULL)
|
||||
@@ -2308,8 +2308,6 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
||||
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
while (c != NULL) {
|
||||
- const char *chain_table =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
||||
const char *chain_name =
|
||||
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
uint32_t policy =
|
||||
@@ -2326,8 +2324,6 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
||||
if (nftnl_chain_get(c, NFTNL_CHAIN_HOOKNUM))
|
||||
basechain = true;
|
||||
|
||||
- if (strcmp(table, chain_table) != 0)
|
||||
- goto next;
|
||||
if (chain) {
|
||||
if (strcmp(chain, chain_name) != 0)
|
||||
goto next;
|
||||
@@ -2442,7 +2438,9 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain,
|
||||
return 0;
|
||||
}
|
||||
|
||||
- list = nft_chain_list_get(h);
|
||||
+ list = nft_chain_list_get(h, table);
|
||||
+ if (!list)
|
||||
+ goto err; /* XXX: correct? */
|
||||
|
||||
/* Dump policies and custom chains first */
|
||||
if (!rulenum)
|
||||
@@ -2460,13 +2458,9 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain,
|
||||
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
while (c != NULL) {
|
||||
- const char *chain_table =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
||||
const char *chain_name =
|
||||
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
|
||||
- if (strcmp(table, chain_table) != 0)
|
||||
- goto next;
|
||||
if (chain && strcmp(chain, chain_name) != 0)
|
||||
goto next;
|
||||
|
||||
@@ -3045,7 +3039,7 @@ int nft_chain_zero_counters(struct nft_handle *h, const char *chain,
|
||||
struct nftnl_chain *c;
|
||||
int ret = 0;
|
||||
|
||||
- list = nft_chain_list_get(h);
|
||||
+ list = nft_chain_list_get(h, table);
|
||||
if (list == NULL)
|
||||
goto err;
|
||||
|
||||
@@ -3057,11 +3051,6 @@ int nft_chain_zero_counters(struct nft_handle *h, const char *chain,
|
||||
while (c != NULL) {
|
||||
const char *chain_name =
|
||||
nftnl_chain_get(c, NFTNL_CHAIN_NAME);
|
||||
- const char *chain_table =
|
||||
- nftnl_chain_get(c, NFTNL_CHAIN_TABLE);
|
||||
-
|
||||
- if (strcmp(table, chain_table) != 0)
|
||||
- goto next;
|
||||
|
||||
if (chain != NULL && strcmp(chain, chain_name) != 0)
|
||||
goto next;
|
||||
@@ -3202,7 +3191,7 @@ static int nft_are_chains_compatible(struct nft_handle *h, const char *tablename
|
||||
struct nftnl_chain *chain;
|
||||
int ret = 0;
|
||||
|
||||
- list = nft_chain_list_get(h);
|
||||
+ list = nft_chain_list_get(h, tablename);
|
||||
if (list == NULL)
|
||||
return -1;
|
||||
|
||||
@@ -3212,12 +3201,7 @@ static int nft_are_chains_compatible(struct nft_handle *h, const char *tablename
|
||||
|
||||
chain = nftnl_chain_list_iter_next(iter);
|
||||
while (chain != NULL) {
|
||||
- const char *chain_table;
|
||||
-
|
||||
- chain_table = nftnl_chain_get_str(chain, NFTNL_CHAIN_TABLE);
|
||||
-
|
||||
- if (strcmp(chain_table, tablename) ||
|
||||
- !nft_chain_builtin(chain))
|
||||
+ if (!nft_chain_builtin(chain))
|
||||
goto next;
|
||||
|
||||
ret = nft_is_chain_compatible(h, chain);
|
||||
diff --git a/iptables/nft.h b/iptables/nft.h
|
||||
index 052105fc6f3cd..6229221bd51f7 100644
|
||||
--- a/iptables/nft.h
|
||||
+++ b/iptables/nft.h
|
||||
@@ -25,6 +25,7 @@ struct builtin_table {
|
||||
const char *name;
|
||||
struct builtin_chain chains[NF_INET_NUMHOOKS];
|
||||
bool initialized;
|
||||
+ struct nftnl_chain_list *chain_cache;
|
||||
};
|
||||
|
||||
struct nft_handle {
|
||||
@@ -38,7 +39,6 @@ struct nft_handle {
|
||||
struct list_head err_list;
|
||||
struct nft_family_ops *ops;
|
||||
struct builtin_table *tables;
|
||||
- struct nftnl_chain_list *chain_cache;
|
||||
struct nftnl_rule_list *rule_cache;
|
||||
bool restore;
|
||||
int8_t config_done;
|
||||
@@ -78,9 +78,11 @@ struct builtin_table *nft_table_builtin_find(struct nft_handle *h, const char *t
|
||||
struct nftnl_chain;
|
||||
|
||||
int nft_chain_set(struct nft_handle *h, const char *table, const char *chain, const char *policy, const struct xt_counters *counters);
|
||||
-struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h);
|
||||
-struct nftnl_chain *nft_chain_list_find(struct nftnl_chain_list *list, const char *table, const char *chain);
|
||||
-int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list, const char *table);
|
||||
+struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
+ const char *table);
|
||||
+struct nftnl_chain *nft_chain_list_find(struct nftnl_chain_list *list,
|
||||
+ const char *chain);
|
||||
+int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list);
|
||||
int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *table);
|
||||
int nft_chain_user_del(struct nft_handle *h, const char *chain, const char *table, bool verbose);
|
||||
int nft_chain_user_flush(struct nft_handle *h, struct nftnl_chain_list *list,
|
||||
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
|
||||
index f529774054215..a46a92955a01a 100644
|
||||
--- a/iptables/xtables-restore.c
|
||||
+++ b/iptables/xtables-restore.c
|
||||
@@ -56,11 +56,12 @@ static void print_usage(const char *name, const char *version)
|
||||
" [ --ipv6 ]\n", name);
|
||||
}
|
||||
|
||||
-static struct nftnl_chain_list *get_chain_list(struct nft_handle *h)
|
||||
+static struct nftnl_chain_list *get_chain_list(struct nft_handle *h,
|
||||
+ const char *table)
|
||||
{
|
||||
struct nftnl_chain_list *chain_list;
|
||||
|
||||
- chain_list = nft_chain_list_get(h);
|
||||
+ chain_list = nft_chain_list_get(h, table);
|
||||
if (chain_list == NULL)
|
||||
xtables_error(OTHER_PROBLEM, "cannot retrieve chain list\n");
|
||||
|
||||
@@ -72,7 +73,7 @@ static void chain_delete(struct nftnl_chain_list *clist, const char *curtable,
|
||||
{
|
||||
struct nftnl_chain *chain_obj;
|
||||
|
||||
- chain_obj = nft_chain_list_find(clist, curtable, chain);
|
||||
+ chain_obj = nft_chain_list_find(clist, chain);
|
||||
/* This chain has been found, delete from list. Later
|
||||
* on, unvisited chains will be purged out.
|
||||
*/
|
||||
@@ -112,9 +113,6 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
|
||||
line = 0;
|
||||
|
||||
- if (cb->chain_list)
|
||||
- chain_list = cb->chain_list(h);
|
||||
-
|
||||
/* Grab standard input. */
|
||||
while (fgets(buffer, sizeof(buffer), p->in)) {
|
||||
int ret = 0;
|
||||
@@ -165,6 +163,9 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
if (p->tablename && (strcmp(p->tablename, table) != 0))
|
||||
continue;
|
||||
|
||||
+ if (cb->chain_list)
|
||||
+ chain_list = cb->chain_list(h, table);
|
||||
+
|
||||
if (noflush == 0) {
|
||||
DEBUGP("Cleaning all chains of table '%s'\n",
|
||||
table);
|
||||
@@ -197,8 +198,7 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
if (cb->chain_del)
|
||||
cb->chain_del(chain_list, curtable->name,
|
||||
chain);
|
||||
- } else if (nft_chain_list_find(chain_list,
|
||||
- curtable->name, chain)) {
|
||||
+ } else if (nft_chain_list_find(chain_list, chain)) {
|
||||
chain_exists = true;
|
||||
/* Apparently -n still flushes existing user
|
||||
* defined chains that are redefined. Otherwise,
|
||||
diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c
|
||||
index bed3ee0318995..d121d50e180ff 100644
|
||||
--- a/iptables/xtables-save.c
|
||||
+++ b/iptables/xtables-save.c
|
||||
@@ -73,7 +73,9 @@ __do_output(struct nft_handle *h, const char *tablename, bool counters)
|
||||
return 0;
|
||||
}
|
||||
|
||||
- chain_list = nft_chain_list_get(h);
|
||||
+ chain_list = nft_chain_list_get(h, tablename);
|
||||
+ if (!chain_list)
|
||||
+ return 0;
|
||||
|
||||
time_t now = time(NULL);
|
||||
|
||||
@@ -83,7 +85,7 @@ __do_output(struct nft_handle *h, const char *tablename, bool counters)
|
||||
|
||||
/* Dump out chain names first,
|
||||
* thereby preventing dependency conflicts */
|
||||
- nft_chain_save(h, chain_list, tablename);
|
||||
+ nft_chain_save(h, chain_list);
|
||||
nft_rule_save(h, tablename, counters ? 0 : FMT_NOCOUNTS);
|
||||
|
||||
now = time(NULL);
|
||||
@@ -257,7 +259,7 @@ static int __ebt_save(struct nft_handle *h, const char *tablename, bool counters
|
||||
return 0;
|
||||
}
|
||||
|
||||
- chain_list = nft_chain_list_get(h);
|
||||
+ chain_list = nft_chain_list_get(h, tablename);
|
||||
|
||||
if (first) {
|
||||
now = time(NULL);
|
||||
@@ -272,7 +274,7 @@ static int __ebt_save(struct nft_handle *h, const char *tablename, bool counters
|
||||
|
||||
/* Dump out chain names first,
|
||||
* thereby preventing dependency conflicts */
|
||||
- nft_chain_save(h, chain_list, tablename);
|
||||
+ nft_chain_save(h, chain_list);
|
||||
nft_rule_save(h, tablename, format);
|
||||
printf("\n");
|
||||
return 0;
|
||||
@@ -399,7 +401,7 @@ int xtables_arp_save_main(int argc, char **argv)
|
||||
}
|
||||
|
||||
printf("*filter\n");
|
||||
- nft_chain_save(&h, nft_chain_list_get(&h), "filter");
|
||||
+ nft_chain_save(&h, nft_chain_list_get(&h, "filter"));
|
||||
nft_rule_save(&h, "filter", show_counters ? 0 : FMT_NOCOUNTS);
|
||||
printf("\n");
|
||||
nft_fini(&h);
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
From a58c38e4c579f409669b5ab82d3b039528a129af Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 7 Aug 2020 13:48:28 +0200
|
||||
Subject: [PATCH] nft: Fix command name in ip6tables error message
|
||||
|
||||
Upon errors, ip6tables-nft would prefix its error messages with
|
||||
'iptables:' instead of 'ip6tables:'. Turns out the command name was
|
||||
hard-coded, use 'progname' variable instead.
|
||||
While being at it, merge the two mostly identical fprintf() calls into
|
||||
one.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13)
|
||||
---
|
||||
iptables/xtables-standalone.c | 12 ++++--------
|
||||
1 file changed, 4 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
|
||||
index dd6fb7919d2e1..7b71db62f1ea6 100644
|
||||
--- a/iptables/xtables-standalone.c
|
||||
+++ b/iptables/xtables-standalone.c
|
||||
@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
|
||||
xtables_fini();
|
||||
|
||||
if (!ret) {
|
||||
- if (errno == EINVAL) {
|
||||
- fprintf(stderr, "iptables: %s. "
|
||||
- "Run `dmesg' for more information.\n",
|
||||
- nft_strerror(errno));
|
||||
- } else {
|
||||
- fprintf(stderr, "iptables: %s.\n",
|
||||
- nft_strerror(errno));
|
||||
- }
|
||||
+ fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno),
|
||||
+ (errno == EINVAL ?
|
||||
+ " Run `dmesg' for more information." : ""));
|
||||
+
|
||||
if (errno == EAGAIN)
|
||||
exit(RESOURCE_PROBLEM);
|
||||
}
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,99 +0,0 @@
|
|||
From 312897725486bf4a3014076f3659cc1d8ce294ce Mon Sep 17 00:00:00 2001
|
||||
From: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
Date: Sat, 17 Nov 2018 18:10:15 +0100
|
||||
Subject: [PATCH] nft: add type field to builtin_table
|
||||
|
||||
Use enum nft_table_type to set the new type field in the structure that
|
||||
define tables.
|
||||
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 9847abe6fbb91621f6494df8243ff96f04efdc4a)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 8 ++++++++
|
||||
iptables/nft.h | 1 +
|
||||
2 files changed, 9 insertions(+)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 36529048a0ca6..f0a60e1f568af 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -379,6 +379,7 @@ static int batch_rule_add(struct nft_handle *h, enum obj_update_type type,
|
||||
struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
|
||||
[NFT_TABLE_RAW] = {
|
||||
.name = "raw",
|
||||
+ .type = NFT_TABLE_RAW,
|
||||
.chains = {
|
||||
{
|
||||
.name = "PREROUTING",
|
||||
@@ -396,6 +397,7 @@ struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
|
||||
},
|
||||
[NFT_TABLE_MANGLE] = {
|
||||
.name = "mangle",
|
||||
+ .type = NFT_TABLE_MANGLE,
|
||||
.chains = {
|
||||
{
|
||||
.name = "PREROUTING",
|
||||
@@ -431,6 +433,7 @@ struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
|
||||
},
|
||||
[NFT_TABLE_FILTER] = {
|
||||
.name = "filter",
|
||||
+ .type = NFT_TABLE_FILTER,
|
||||
.chains = {
|
||||
{
|
||||
.name = "INPUT",
|
||||
@@ -454,6 +457,7 @@ struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
|
||||
},
|
||||
[NFT_TABLE_SECURITY] = {
|
||||
.name = "security",
|
||||
+ .type = NFT_TABLE_SECURITY,
|
||||
.chains = {
|
||||
{
|
||||
.name = "INPUT",
|
||||
@@ -477,6 +481,7 @@ struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
|
||||
},
|
||||
[NFT_TABLE_NAT] = {
|
||||
.name = "nat",
|
||||
+ .type = NFT_TABLE_NAT,
|
||||
.chains = {
|
||||
{
|
||||
.name = "PREROUTING",
|
||||
@@ -511,6 +516,7 @@ struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
|
||||
struct builtin_table xtables_arp[NFT_TABLE_MAX] = {
|
||||
[NFT_TABLE_FILTER] = {
|
||||
.name = "filter",
|
||||
+ .type = NFT_TABLE_FILTER,
|
||||
.chains = {
|
||||
{
|
||||
.name = "INPUT",
|
||||
@@ -533,6 +539,7 @@ struct builtin_table xtables_arp[NFT_TABLE_MAX] = {
|
||||
struct builtin_table xtables_bridge[NFT_TABLE_MAX] = {
|
||||
[NFT_TABLE_FILTER] = {
|
||||
.name = "filter",
|
||||
+ .type = NFT_TABLE_FILTER,
|
||||
.chains = {
|
||||
{
|
||||
.name = "INPUT",
|
||||
@@ -556,6 +563,7 @@ struct builtin_table xtables_bridge[NFT_TABLE_MAX] = {
|
||||
},
|
||||
[NFT_TABLE_NAT] = {
|
||||
.name = "nat",
|
||||
+ .type = NFT_TABLE_NAT,
|
||||
.chains = {
|
||||
{
|
||||
.name = "PREROUTING",
|
||||
diff --git a/iptables/nft.h b/iptables/nft.h
|
||||
index 6229221bd51f7..85c894e80e02e 100644
|
||||
--- a/iptables/nft.h
|
||||
+++ b/iptables/nft.h
|
||||
@@ -23,6 +23,7 @@ struct builtin_chain {
|
||||
|
||||
struct builtin_table {
|
||||
const char *name;
|
||||
+ enum nft_table_type type;
|
||||
struct builtin_chain chains[NF_INET_NUMHOOKS];
|
||||
bool initialized;
|
||||
struct nftnl_chain_list *chain_cache;
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -1,106 +0,0 @@
|
|||
From 48455efdfbee0df02c724a594cf8af8c440ded7d Mon Sep 17 00:00:00 2001
|
||||
From: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
Date: Sat, 17 Nov 2018 18:16:45 +0100
|
||||
Subject: [PATCH] nft: move chain_cache back to struct nft_handle
|
||||
|
||||
Place this back into the structure that stores the state information.
|
||||
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 1847d9db753825b0bd1cd450b549f4e39f7bcc31)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 26 +++++++++++++-------------
|
||||
iptables/nft.h | 4 +++-
|
||||
2 files changed, 16 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index f0a60e1f568af..fdb4ead55a873 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -809,14 +809,14 @@ static void flush_chain_cache(struct nft_handle *h, const char *tablename)
|
||||
if (tablename && strcmp(h->tables[i].name, tablename))
|
||||
continue;
|
||||
|
||||
- if (h->tables[i].chain_cache) {
|
||||
+ if (h->table[i].chain_cache) {
|
||||
if (tablename) {
|
||||
- nftnl_chain_list_foreach(h->tables[i].chain_cache,
|
||||
+ nftnl_chain_list_foreach(h->table[i].chain_cache,
|
||||
__flush_chain_cache, NULL);
|
||||
break;
|
||||
} else {
|
||||
- nftnl_chain_list_free(h->tables[i].chain_cache);
|
||||
- h->tables[i].chain_cache = NULL;
|
||||
+ nftnl_chain_list_free(h->table[i].chain_cache);
|
||||
+ h->table[i].chain_cache = NULL;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1276,13 +1276,13 @@ static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
|
||||
if (!t)
|
||||
goto out;
|
||||
|
||||
- if (!t->chain_cache) {
|
||||
- t->chain_cache = nftnl_chain_list_alloc();
|
||||
- if (!t->chain_cache)
|
||||
+ if (!h->table[t->type].chain_cache) {
|
||||
+ h->table[t->type].chain_cache = nftnl_chain_list_alloc();
|
||||
+ if (!h->table[t->type].chain_cache)
|
||||
goto out;
|
||||
}
|
||||
|
||||
- nftnl_chain_list_add_tail(c, t->chain_cache);
|
||||
+ nftnl_chain_list_add_tail(c, h->table[t->type].chain_cache);
|
||||
|
||||
return MNL_CB_OK;
|
||||
out:
|
||||
@@ -1303,8 +1303,8 @@ struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
if (!t)
|
||||
return NULL;
|
||||
|
||||
- if (t->chain_cache)
|
||||
- return t->chain_cache;
|
||||
+ if (h->table[t->type].chain_cache)
|
||||
+ return h->table[t->type].chain_cache;
|
||||
retry:
|
||||
nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, h->family,
|
||||
NLM_F_DUMP, h->seq);
|
||||
@@ -1315,10 +1315,10 @@ retry:
|
||||
goto retry;
|
||||
}
|
||||
|
||||
- if (!t->chain_cache)
|
||||
- t->chain_cache = nftnl_chain_list_alloc();
|
||||
+ if (!h->table[t->type].chain_cache)
|
||||
+ h->table[t->type].chain_cache = nftnl_chain_list_alloc();
|
||||
|
||||
- return t->chain_cache;
|
||||
+ return h->table[t->type].chain_cache;
|
||||
}
|
||||
|
||||
static const char *policy_name[NF_ACCEPT+1] = {
|
||||
diff --git a/iptables/nft.h b/iptables/nft.h
|
||||
index 85c894e80e02e..1c028206221c4 100644
|
||||
--- a/iptables/nft.h
|
||||
+++ b/iptables/nft.h
|
||||
@@ -26,7 +26,6 @@ struct builtin_table {
|
||||
enum nft_table_type type;
|
||||
struct builtin_chain chains[NF_INET_NUMHOOKS];
|
||||
bool initialized;
|
||||
- struct nftnl_chain_list *chain_cache;
|
||||
};
|
||||
|
||||
struct nft_handle {
|
||||
@@ -40,6 +39,9 @@ struct nft_handle {
|
||||
struct list_head err_list;
|
||||
struct nft_family_ops *ops;
|
||||
struct builtin_table *tables;
|
||||
+ struct {
|
||||
+ struct nftnl_chain_list *chain_cache;
|
||||
+ } table[NFT_TABLE_MAX];
|
||||
struct nftnl_rule_list *rule_cache;
|
||||
bool restore;
|
||||
int8_t config_done;
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,208 @@
|
|||
From 529dee8412eb216a2432e063136ede732edb9cc1 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 6 Aug 2020 18:52:34 +0200
|
||||
Subject: [PATCH] tests: shell: Merge and extend return codes test
|
||||
|
||||
Merge scripts for iptables and ip6tables, they were widely identical.
|
||||
Also extend the test by one check (removing a non-existent rule with
|
||||
valid chain and target) and quote the error messages where differences
|
||||
are deliberately ignored.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit cd3e83d1b04fd2683f0fb06e496ee5be08a96b4f)
|
||||
---
|
||||
.../testcases/ip6tables/0004-return-codes_0 | 39 ------
|
||||
.../testcases/iptables/0004-return-codes_0 | 113 ++++++++++--------
|
||||
2 files changed, 61 insertions(+), 91 deletions(-)
|
||||
delete mode 100755 iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/ip6tables/0004-return-codes_0 b/iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
|
||||
deleted file mode 100755
|
||||
index c583b0ebd97c3..0000000000000
|
||||
--- a/iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
|
||||
+++ /dev/null
|
||||
@@ -1,39 +0,0 @@
|
||||
-#!/bin/sh
|
||||
-
|
||||
-# make sure error return codes are as expected useful cases
|
||||
-# (e.g. commands to check ruleset state)
|
||||
-
|
||||
-global_rc=0
|
||||
-
|
||||
-cmd() { # (rc, cmd, [args ...])
|
||||
- rc_exp=$1; shift
|
||||
-
|
||||
- $XT_MULTI "$@"
|
||||
- rc=$?
|
||||
-
|
||||
- [ $rc -eq $rc_exp ] || {
|
||||
- echo "---> expected $rc_exp, got $rc for command '$@'"
|
||||
- global_rc=1
|
||||
- }
|
||||
-}
|
||||
-
|
||||
-# test chain creation
|
||||
-cmd 0 ip6tables -N foo
|
||||
-cmd 1 ip6tables -N foo
|
||||
-# iptables-nft allows this - bug or feature?
|
||||
-#cmd 2 ip6tables -N "invalid name"
|
||||
-
|
||||
-# test rule adding
|
||||
-cmd 0 ip6tables -A INPUT -j ACCEPT
|
||||
-cmd 1 ip6tables -A noexist -j ACCEPT
|
||||
-cmd 2 ip6tables -I INPUT -j foobar
|
||||
-
|
||||
-# test rule checking
|
||||
-cmd 0 ip6tables -C INPUT -j ACCEPT
|
||||
-cmd 1 ip6tables -C FORWARD -j ACCEPT
|
||||
-cmd 1 ip6tables -C nonexist -j ACCEPT
|
||||
-cmd 2 ip6tables -C INPUT -j foobar
|
||||
-cmd 2 ip6tables -C INPUT -m foobar -j ACCEPT
|
||||
-cmd 3 ip6tables -t foobar -C INPUT -j ACCEPT
|
||||
-
|
||||
-exit $global_rc
|
||||
diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
|
||||
index f730bede1f612..dcd9dfd3c0806 100755
|
||||
--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0
|
||||
+++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
|
||||
@@ -13,75 +13,84 @@ cmd() { # (rc, msg, cmd, [args ...])
|
||||
msg_exp="$1"; shift
|
||||
}
|
||||
|
||||
- msg="$($XT_MULTI "$@" 2>&1 >/dev/null)"
|
||||
- rc=$?
|
||||
+ for ipt in iptables ip6tables; do
|
||||
+ msg="$($XT_MULTI $ipt "$@" 2>&1 >/dev/null)"
|
||||
+ rc=$?
|
||||
|
||||
- [ $rc -eq $rc_exp ] || {
|
||||
- echo "---> expected return code $rc_exp, got $rc for command '$@'"
|
||||
- global_rc=1
|
||||
- }
|
||||
+ [ $rc -eq $rc_exp ] || {
|
||||
+ echo "---> expected return code $rc_exp, got $rc for command '$ipt $@'"
|
||||
+ global_rc=1
|
||||
+ }
|
||||
|
||||
- [ -n "$msg_exp" ] || return
|
||||
- grep -q "$msg_exp" <<< $msg || {
|
||||
- echo "---> expected error message '$msg_exp', got '$msg' for command '$@'"
|
||||
- global_rc=1
|
||||
- }
|
||||
+ [ -n "$msg_exp" ] || continue
|
||||
+ msg_exp_full="${ipt}$msg_exp"
|
||||
+ grep -q "$msg_exp_full" <<< $msg || {
|
||||
+ echo "---> expected error message '$msg_exp_full', got '$msg' for command '$ipt $@'"
|
||||
+ global_rc=1
|
||||
+ }
|
||||
+ done
|
||||
}
|
||||
|
||||
-EEXIST_F="File exists."
|
||||
-EEXIST="Chain already exists."
|
||||
-ENOENT="No chain/target/match by that name."
|
||||
-E2BIG_I="Index of insertion too big."
|
||||
-E2BIG_D="Index of deletion too big."
|
||||
-E2BIG_R="Index of replacement too big."
|
||||
-EBADRULE="Bad rule (does a matching rule exist in that chain?)."
|
||||
-ENOTGT="Couldn't load target \`foobar':No such file or directory"
|
||||
-ENOMTH="Couldn't load match \`foobar':No such file or directory"
|
||||
-ENOTBL="can't initialize iptables table \`foobar': Table does not exist"
|
||||
+EEXIST_F=": File exists."
|
||||
+EEXIST=": Chain already exists."
|
||||
+ENOENT=": No chain/target/match by that name."
|
||||
+E2BIG_I=": Index of insertion too big."
|
||||
+E2BIG_D=": Index of deletion too big."
|
||||
+E2BIG_R=": Index of replacement too big."
|
||||
+EBADRULE=": Bad rule (does a matching rule exist in that chain?)."
|
||||
+#ENOTGT=" v[0-9\.]* [^ ]*: Couldn't load target \`foobar':No such file or directory"
|
||||
+ENOMTH=" v[0-9\.]* [^ ]*: Couldn't load match \`foobar':No such file or directory"
|
||||
+ENOTBL=": can't initialize iptables table \`foobar': Table does not exist"
|
||||
|
||||
# test chain creation
|
||||
-cmd 0 iptables -N foo
|
||||
-cmd 1 "$EEXIST" iptables -N foo
|
||||
+cmd 0 -N foo
|
||||
+cmd 1 "$EEXIST" -N foo
|
||||
# iptables-nft allows this - bug or feature?
|
||||
-#cmd 2 iptables -N "invalid name"
|
||||
+#cmd 2 -N "invalid name"
|
||||
|
||||
# test chain flushing/zeroing
|
||||
-cmd 0 iptables -F foo
|
||||
-cmd 0 iptables -Z foo
|
||||
-cmd 1 "$ENOENT" iptables -F bar
|
||||
-cmd 1 "$ENOENT" iptables -Z bar
|
||||
+cmd 0 -F foo
|
||||
+cmd 0 -Z foo
|
||||
+cmd 1 "$ENOENT" -F bar
|
||||
+cmd 1 "$ENOENT" -Z bar
|
||||
|
||||
# test chain rename
|
||||
-cmd 0 iptables -E foo bar
|
||||
-cmd 1 "$EEXIST_F" iptables -E foo bar
|
||||
-cmd 1 "$ENOENT" iptables -E foo bar2
|
||||
-cmd 0 iptables -N foo2
|
||||
-cmd 1 "$EEXIST_F" iptables -E foo2 bar
|
||||
+cmd 0 -E foo bar
|
||||
+cmd 1 "$EEXIST_F" -E foo bar
|
||||
+cmd 1 "$ENOENT" -E foo bar2
|
||||
+cmd 0 -N foo2
|
||||
+cmd 1 "$EEXIST_F" -E foo2 bar
|
||||
|
||||
# test rule adding
|
||||
-cmd 0 iptables -A INPUT -j ACCEPT
|
||||
-cmd 1 "$ENOENT" iptables -A noexist -j ACCEPT
|
||||
-cmd 2 "" iptables -I INPUT -j foobar
|
||||
-cmd 2 "" iptables -R INPUT 1 -j foobar
|
||||
-cmd 2 "" iptables -D INPUT -j foobar
|
||||
+cmd 0 -A INPUT -j ACCEPT
|
||||
+cmd 1 "$ENOENT" -A noexist -j ACCEPT
|
||||
+# next three differ:
|
||||
+# legacy: Couldn't load target `foobar':No such file or directory
|
||||
+# nft: Chain 'foobar' does not exist
|
||||
+cmd 2 "" -I INPUT -j foobar
|
||||
+cmd 2 "" -R INPUT 1 -j foobar
|
||||
+cmd 2 "" -D INPUT -j foobar
|
||||
+cmd 1 "$EBADRULE" -D INPUT -p tcp --dport 22 -j ACCEPT
|
||||
|
||||
# test rulenum commands
|
||||
-cmd 1 "$E2BIG_I" iptables -I INPUT 23 -j ACCEPT
|
||||
-cmd 1 "$E2BIG_D" iptables -D INPUT 23
|
||||
-cmd 1 "$E2BIG_R" iptables -R INPUT 23 -j ACCEPT
|
||||
-cmd 1 "$ENOENT" iptables -I nonexist 23 -j ACCEPT
|
||||
-cmd 1 "$ENOENT" iptables -D nonexist 23
|
||||
-cmd 1 "$ENOENT" iptables -R nonexist 23 -j ACCEPT
|
||||
+cmd 1 "$E2BIG_I" -I INPUT 23 -j ACCEPT
|
||||
+cmd 1 "$E2BIG_D" -D INPUT 23
|
||||
+cmd 1 "$E2BIG_R" -R INPUT 23 -j ACCEPT
|
||||
+cmd 1 "$ENOENT" -I nonexist 23 -j ACCEPT
|
||||
+cmd 1 "$ENOENT" -D nonexist 23
|
||||
+cmd 1 "$ENOENT" -R nonexist 23 -j ACCEPT
|
||||
|
||||
# test rule checking
|
||||
-cmd 0 iptables -C INPUT -j ACCEPT
|
||||
-cmd 1 "$EBADRULE" iptables -C FORWARD -j ACCEPT
|
||||
-cmd 1 "$BADRULE" iptables -C nonexist -j ACCEPT
|
||||
-cmd 2 "$ENOMTH" iptables -C INPUT -m foobar -j ACCEPT
|
||||
+cmd 0 -C INPUT -j ACCEPT
|
||||
+cmd 1 "$EBADRULE" -C FORWARD -j ACCEPT
|
||||
+cmd 1 "$BADRULE" -C nonexist -j ACCEPT
|
||||
+cmd 2 "$ENOMTH" -C INPUT -m foobar -j ACCEPT
|
||||
# messages of those don't match, but iptables-nft ones are actually nicer.
|
||||
-#cmd 2 "$ENOTGT" iptables -C INPUT -j foobar
|
||||
-#cmd 3 "$ENOTBL" iptables -t foobar -C INPUT -j ACCEPT
|
||||
-cmd 2 "" iptables -C INPUT -j foobar
|
||||
-cmd 3 "" iptables -t foobar -C INPUT -j ACCEPT
|
||||
+# legacy: Couldn't load target `foobar':No such file or directory
|
||||
+# nft: Chain 'foobar' does not exist
|
||||
+cmd 2 "" -C INPUT -j foobar
|
||||
+# legacy: can't initialize ip6tables table `foobar': Table does not exist (do you need to insmod?)
|
||||
+# nft: table 'foobar' does not exist
|
||||
+cmd 3 "" -t foobar -C INPUT -j ACCEPT
|
||||
|
||||
exit $global_rc
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,91 +0,0 @@
|
|||
From 6186853420f23e500e0b9a234cc446697cca16a7 Mon Sep 17 00:00:00 2001
|
||||
From: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
Date: Sat, 17 Nov 2018 18:38:30 +0100
|
||||
Subject: [PATCH] nft: move initialize to struct nft_handle
|
||||
|
||||
Move this to the structure that stores, stateful information. Introduce
|
||||
nft_table_initialized() and use it.
|
||||
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 5016d1eb84f951d84f5a0c18f994f40677ad0643)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 14 ++++++++++----
|
||||
iptables/nft.h | 2 +-
|
||||
2 files changed, 11 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index fdb4ead55a873..9b479307a2fbc 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -587,13 +587,19 @@ struct builtin_table xtables_bridge[NFT_TABLE_MAX] = {
|
||||
},
|
||||
};
|
||||
|
||||
+static bool nft_table_initialized(const struct nft_handle *h,
|
||||
+ enum nft_table_type type)
|
||||
+{
|
||||
+ return h->table[type].initialized;
|
||||
+}
|
||||
+
|
||||
static int nft_table_builtin_add(struct nft_handle *h,
|
||||
struct builtin_table *_t)
|
||||
{
|
||||
struct nftnl_table *t;
|
||||
int ret;
|
||||
|
||||
- if (_t->initialized)
|
||||
+ if (nft_table_initialized(h, _t->type))
|
||||
return 0;
|
||||
|
||||
t = nftnl_table_alloc();
|
||||
@@ -707,7 +713,7 @@ static int nft_xt_builtin_init(struct nft_handle *h, const char *table)
|
||||
if (t == NULL)
|
||||
return -1;
|
||||
|
||||
- if (t->initialized)
|
||||
+ if (nft_table_initialized(h, t->type))
|
||||
return 0;
|
||||
|
||||
if (nft_table_builtin_add(h, t) < 0)
|
||||
@@ -715,7 +721,7 @@ static int nft_xt_builtin_init(struct nft_handle *h, const char *table)
|
||||
|
||||
nft_chain_builtin_init(h, t);
|
||||
|
||||
- t->initialized = true;
|
||||
+ h->table[t->type].initialized = true;
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -1875,7 +1881,7 @@ static int __nft_table_flush(struct nft_handle *h, const char *table)
|
||||
|
||||
_t = nft_table_builtin_find(h, table);
|
||||
assert(_t);
|
||||
- _t->initialized = false;
|
||||
+ h->table[_t->type].initialized = false;
|
||||
|
||||
flush_chain_cache(h, table);
|
||||
flush_rule_cache(h, table);
|
||||
diff --git a/iptables/nft.h b/iptables/nft.h
|
||||
index 1c028206221c4..b9ba66b110042 100644
|
||||
--- a/iptables/nft.h
|
||||
+++ b/iptables/nft.h
|
||||
@@ -25,7 +25,6 @@ struct builtin_table {
|
||||
const char *name;
|
||||
enum nft_table_type type;
|
||||
struct builtin_chain chains[NF_INET_NUMHOOKS];
|
||||
- bool initialized;
|
||||
};
|
||||
|
||||
struct nft_handle {
|
||||
@@ -41,6 +40,7 @@ struct nft_handle {
|
||||
struct builtin_table *tables;
|
||||
struct {
|
||||
struct nftnl_chain_list *chain_cache;
|
||||
+ bool initialized;
|
||||
} table[NFT_TABLE_MAX];
|
||||
struct nftnl_rule_list *rule_cache;
|
||||
bool restore;
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
From fe5db6f78145aeac1b18d21c38c178b99cd7c04a Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 7 Aug 2020 16:42:07 +0200
|
||||
Subject: [PATCH] xtables-monitor: Fix ip6tables rule printing
|
||||
|
||||
When printing an ip6tables rule event, false family ops are used as they
|
||||
are initially looked up for AF_INET and reused no matter the current
|
||||
rule's family. In practice, this means that nft_rule_print_save() calls
|
||||
the wrong rule_to_cs, save_rule and clear_cs callbacks. Therefore, if a
|
||||
rule specifies a source or destination address, the address is not
|
||||
printed.
|
||||
|
||||
Fix this by performing a family lookup each time rule_cb is called.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit ca69b0290dc509d72118f0a054a5c740cb913875)
|
||||
---
|
||||
iptables/xtables-monitor.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
|
||||
index 57def83e2eea0..4008cc00d4694 100644
|
||||
--- a/iptables/xtables-monitor.c
|
||||
+++ b/iptables/xtables-monitor.c
|
||||
@@ -93,6 +93,8 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
|
||||
if (arg->nfproto && arg->nfproto != family)
|
||||
goto err_free;
|
||||
|
||||
+ arg->h->ops = nft_family_ops_lookup(family);
|
||||
+
|
||||
if (arg->is_event)
|
||||
printf(" EVENT: ");
|
||||
switch (family) {
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
From 895077fbd8f11b717fd414a02d22dae99d94b390 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 29 Jul 2020 15:39:31 +0200
|
||||
Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too
|
||||
|
||||
Athough this cache level fetches table names only, it shouldn't skip the
|
||||
consistency check.
|
||||
|
||||
Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd)
|
||||
---
|
||||
iptables/nft-cache.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
|
||||
index 638b18bc7e382..434cc10b82ce7 100644
|
||||
--- a/iptables/nft-cache.c
|
||||
+++ b/iptables/nft-cache.c
|
||||
@@ -511,14 +511,14 @@ __nft_build_cache(struct nft_handle *h)
|
||||
if (req->level >= NFT_CL_TABLES)
|
||||
fetch_table_cache(h);
|
||||
if (req->level == NFT_CL_FAKE)
|
||||
- return;
|
||||
+ goto genid_check;
|
||||
if (req->level >= NFT_CL_CHAINS)
|
||||
fetch_chain_cache(h, t, chains);
|
||||
if (req->level >= NFT_CL_SETS)
|
||||
fetch_set_cache(h, t, NULL);
|
||||
if (req->level >= NFT_CL_RULES)
|
||||
fetch_rule_cache(h, t);
|
||||
-
|
||||
+genid_check:
|
||||
mnl_genid_get(h, &genid_check);
|
||||
if (h->nft_genid != genid_check) {
|
||||
flush_cache(h, h->cache, NULL);
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,287 +0,0 @@
|
|||
From e73749ba27388068af05e78ed6cb03b1824182c0 Mon Sep 17 00:00:00 2001
|
||||
From: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
Date: Sat, 17 Nov 2018 18:25:58 +0100
|
||||
Subject: [PATCH] xtables: constify struct builtin_table and struct
|
||||
builtin_chain
|
||||
|
||||
These definitions should be const, propagate this to all existing users.
|
||||
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 3c7ea26c85b95a4c62355c359030d6bbdf2f8df0)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 42 ++++++++++++++++++------------------
|
||||
iptables/nft.h | 14 ++++++------
|
||||
iptables/xtables-restore.c | 4 ++--
|
||||
iptables/xtables-save.c | 2 +-
|
||||
iptables/xtables-translate.c | 2 +-
|
||||
5 files changed, 32 insertions(+), 32 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 9b479307a2fbc..7b6fb2b10686d 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -376,7 +376,7 @@ static int batch_rule_add(struct nft_handle *h, enum obj_update_type type,
|
||||
return batch_add(h, type, r);
|
||||
}
|
||||
|
||||
-struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
|
||||
+const struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
|
||||
[NFT_TABLE_RAW] = {
|
||||
.name = "raw",
|
||||
.type = NFT_TABLE_RAW,
|
||||
@@ -513,7 +513,7 @@ struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
|
||||
|
||||
#include <linux/netfilter_arp.h>
|
||||
|
||||
-struct builtin_table xtables_arp[NFT_TABLE_MAX] = {
|
||||
+const struct builtin_table xtables_arp[NFT_TABLE_MAX] = {
|
||||
[NFT_TABLE_FILTER] = {
|
||||
.name = "filter",
|
||||
.type = NFT_TABLE_FILTER,
|
||||
@@ -536,7 +536,7 @@ struct builtin_table xtables_arp[NFT_TABLE_MAX] = {
|
||||
|
||||
#include <linux/netfilter_bridge.h>
|
||||
|
||||
-struct builtin_table xtables_bridge[NFT_TABLE_MAX] = {
|
||||
+const struct builtin_table xtables_bridge[NFT_TABLE_MAX] = {
|
||||
[NFT_TABLE_FILTER] = {
|
||||
.name = "filter",
|
||||
.type = NFT_TABLE_FILTER,
|
||||
@@ -594,7 +594,7 @@ static bool nft_table_initialized(const struct nft_handle *h,
|
||||
}
|
||||
|
||||
static int nft_table_builtin_add(struct nft_handle *h,
|
||||
- struct builtin_table *_t)
|
||||
+ const struct builtin_table *_t)
|
||||
{
|
||||
struct nftnl_table *t;
|
||||
int ret;
|
||||
@@ -614,8 +614,8 @@ static int nft_table_builtin_add(struct nft_handle *h,
|
||||
}
|
||||
|
||||
static struct nftnl_chain *
|
||||
-nft_chain_builtin_alloc(struct builtin_table *table,
|
||||
- struct builtin_chain *chain, int policy)
|
||||
+nft_chain_builtin_alloc(const struct builtin_table *table,
|
||||
+ const struct builtin_chain *chain, int policy)
|
||||
{
|
||||
struct nftnl_chain *c;
|
||||
|
||||
@@ -634,8 +634,8 @@ nft_chain_builtin_alloc(struct builtin_table *table,
|
||||
}
|
||||
|
||||
static void nft_chain_builtin_add(struct nft_handle *h,
|
||||
- struct builtin_table *table,
|
||||
- struct builtin_chain *chain)
|
||||
+ const struct builtin_table *table,
|
||||
+ const struct builtin_chain *chain)
|
||||
{
|
||||
struct nftnl_chain *c;
|
||||
|
||||
@@ -647,7 +647,7 @@ static void nft_chain_builtin_add(struct nft_handle *h,
|
||||
}
|
||||
|
||||
/* find if built-in table already exists */
|
||||
-struct builtin_table *
|
||||
+const struct builtin_table *
|
||||
nft_table_builtin_find(struct nft_handle *h, const char *table)
|
||||
{
|
||||
int i;
|
||||
@@ -668,8 +668,8 @@ nft_table_builtin_find(struct nft_handle *h, const char *table)
|
||||
}
|
||||
|
||||
/* find if built-in chain already exists */
|
||||
-struct builtin_chain *
|
||||
-nft_chain_builtin_find(struct builtin_table *t, const char *chain)
|
||||
+const struct builtin_chain *
|
||||
+nft_chain_builtin_find(const struct builtin_table *t, const char *chain)
|
||||
{
|
||||
int i;
|
||||
bool found = false;
|
||||
@@ -685,7 +685,7 @@ nft_chain_builtin_find(struct builtin_table *t, const char *chain)
|
||||
}
|
||||
|
||||
static void nft_chain_builtin_init(struct nft_handle *h,
|
||||
- struct builtin_table *table)
|
||||
+ const struct builtin_table *table)
|
||||
{
|
||||
struct nftnl_chain_list *list = nft_chain_list_get(h, table->name);
|
||||
struct nftnl_chain *c;
|
||||
@@ -707,7 +707,7 @@ static void nft_chain_builtin_init(struct nft_handle *h,
|
||||
|
||||
static int nft_xt_builtin_init(struct nft_handle *h, const char *table)
|
||||
{
|
||||
- struct builtin_table *t;
|
||||
+ const struct builtin_table *t;
|
||||
|
||||
t = nft_table_builtin_find(h, table);
|
||||
if (t == NULL)
|
||||
@@ -750,7 +750,7 @@ static int nft_restart(struct nft_handle *h)
|
||||
return 0;
|
||||
}
|
||||
|
||||
-int nft_init(struct nft_handle *h, struct builtin_table *t)
|
||||
+int nft_init(struct nft_handle *h, const struct builtin_table *t)
|
||||
{
|
||||
h->nl = mnl_socket_open(NETLINK_NETFILTER);
|
||||
if (h->nl == NULL)
|
||||
@@ -852,8 +852,8 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h,
|
||||
const struct xt_counters *counters)
|
||||
{
|
||||
struct nftnl_chain *c;
|
||||
- struct builtin_table *_t;
|
||||
- struct builtin_chain *_c;
|
||||
+ const struct builtin_table *_t;
|
||||
+ const struct builtin_chain *_c;
|
||||
|
||||
_t = nft_table_builtin_find(h, table);
|
||||
if (!_t) {
|
||||
@@ -1267,7 +1267,7 @@ nft_rule_print_save(const struct nftnl_rule *r, enum nft_rule_print type,
|
||||
static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
|
||||
{
|
||||
struct nft_handle *h = data;
|
||||
- struct builtin_table *t;
|
||||
+ const struct builtin_table *t;
|
||||
struct nftnl_chain *c;
|
||||
|
||||
c = nftnl_chain_alloc();
|
||||
@@ -1302,7 +1302,7 @@ struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
{
|
||||
char buf[16536];
|
||||
struct nlmsghdr *nlh;
|
||||
- struct builtin_table *t;
|
||||
+ const struct builtin_table *t;
|
||||
int ret;
|
||||
|
||||
t = nft_table_builtin_find(h, table);
|
||||
@@ -1703,7 +1703,7 @@ nft_chain_find(struct nft_handle *h, const char *table, const char *chain)
|
||||
bool nft_chain_exists(struct nft_handle *h,
|
||||
const char *table, const char *chain)
|
||||
{
|
||||
- struct builtin_table *t = nft_table_builtin_find(h, table);
|
||||
+ const struct builtin_table *t = nft_table_builtin_find(h, table);
|
||||
|
||||
/* xtables does not support custom tables */
|
||||
if (!t)
|
||||
@@ -1868,7 +1868,7 @@ int nft_for_each_table(struct nft_handle *h,
|
||||
|
||||
static int __nft_table_flush(struct nft_handle *h, const char *table)
|
||||
{
|
||||
- struct builtin_table *_t;
|
||||
+ const struct builtin_table *_t;
|
||||
struct nftnl_table *t;
|
||||
|
||||
t = nftnl_table_alloc();
|
||||
@@ -3166,7 +3166,7 @@ static int nft_is_chain_compatible(const struct nft_handle *h,
|
||||
const struct nftnl_chain *chain)
|
||||
{
|
||||
const char *table, *name, *type, *cur_table;
|
||||
- struct builtin_chain *chains;
|
||||
+ const struct builtin_chain *chains;
|
||||
int i, j, prio;
|
||||
enum nf_inet_hooks hook;
|
||||
|
||||
diff --git a/iptables/nft.h b/iptables/nft.h
|
||||
index b9ba66b110042..bf60ab3943659 100644
|
||||
--- a/iptables/nft.h
|
||||
+++ b/iptables/nft.h
|
||||
@@ -37,7 +37,7 @@ struct nft_handle {
|
||||
struct nftnl_batch *batch;
|
||||
struct list_head err_list;
|
||||
struct nft_family_ops *ops;
|
||||
- struct builtin_table *tables;
|
||||
+ const struct builtin_table *tables;
|
||||
struct {
|
||||
struct nftnl_chain_list *chain_cache;
|
||||
bool initialized;
|
||||
@@ -52,14 +52,14 @@ struct nft_handle {
|
||||
} error;
|
||||
};
|
||||
|
||||
-extern struct builtin_table xtables_ipv4[NFT_TABLE_MAX];
|
||||
-extern struct builtin_table xtables_arp[NFT_TABLE_MAX];
|
||||
-extern struct builtin_table xtables_bridge[NFT_TABLE_MAX];
|
||||
+extern const struct builtin_table xtables_ipv4[NFT_TABLE_MAX];
|
||||
+extern const struct builtin_table xtables_arp[NFT_TABLE_MAX];
|
||||
+extern const struct builtin_table xtables_bridge[NFT_TABLE_MAX];
|
||||
|
||||
int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh,
|
||||
int (*cb)(const struct nlmsghdr *nlh, void *data),
|
||||
void *data);
|
||||
-int nft_init(struct nft_handle *h, struct builtin_table *t);
|
||||
+int nft_init(struct nft_handle *h, const struct builtin_table *t);
|
||||
void nft_fini(struct nft_handle *h);
|
||||
|
||||
/*
|
||||
@@ -73,7 +73,7 @@ bool nft_table_find(struct nft_handle *h, const char *tablename);
|
||||
int nft_table_purge_chains(struct nft_handle *h, const char *table, struct nftnl_chain_list *list);
|
||||
int nft_table_flush(struct nft_handle *h, const char *table);
|
||||
void nft_table_new(struct nft_handle *h, const char *table);
|
||||
-struct builtin_table *nft_table_builtin_find(struct nft_handle *h, const char *table);
|
||||
+const struct builtin_table *nft_table_builtin_find(struct nft_handle *h, const char *table);
|
||||
|
||||
/*
|
||||
* Operations with chains.
|
||||
@@ -92,7 +92,7 @@ int nft_chain_user_flush(struct nft_handle *h, struct nftnl_chain_list *list,
|
||||
const char *chain, const char *table);
|
||||
int nft_chain_user_rename(struct nft_handle *h, const char *chain, const char *table, const char *newname);
|
||||
int nft_chain_zero_counters(struct nft_handle *h, const char *chain, const char *table, bool verbose);
|
||||
-struct builtin_chain *nft_chain_builtin_find(struct builtin_table *t, const char *chain);
|
||||
+const struct builtin_chain *nft_chain_builtin_find(const struct builtin_table *t, const char *chain);
|
||||
bool nft_chain_exists(struct nft_handle *h, const char *table, const char *chain);
|
||||
|
||||
/*
|
||||
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
|
||||
index a46a92955a01a..642876d6c70ac 100644
|
||||
--- a/iptables/xtables-restore.c
|
||||
+++ b/iptables/xtables-restore.c
|
||||
@@ -105,9 +105,9 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
struct nft_xt_restore_cb *cb,
|
||||
int argc, char *argv[])
|
||||
{
|
||||
+ const struct builtin_table *curtable = NULL;
|
||||
char buffer[10240];
|
||||
int in_table = 0;
|
||||
- struct builtin_table *curtable = NULL;
|
||||
const struct xtc_ops *ops = &xtc_ops;
|
||||
struct nftnl_chain_list *chain_list = NULL;
|
||||
|
||||
@@ -359,7 +359,7 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
static int
|
||||
xtables_restore_main(int family, const char *progname, int argc, char *argv[])
|
||||
{
|
||||
- struct builtin_table *tables;
|
||||
+ const struct builtin_table *tables;
|
||||
struct nft_handle h = {
|
||||
.family = family,
|
||||
.restore = true,
|
||||
diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c
|
||||
index d121d50e180ff..414a864b6196b 100644
|
||||
--- a/iptables/xtables-save.c
|
||||
+++ b/iptables/xtables-save.c
|
||||
@@ -122,7 +122,7 @@ do_output(struct nft_handle *h, const char *tablename, bool counters)
|
||||
static int
|
||||
xtables_save_main(int family, const char *progname, int argc, char *argv[])
|
||||
{
|
||||
- struct builtin_table *tables;
|
||||
+ const struct builtin_table *tables;
|
||||
const char *tablename = NULL;
|
||||
bool dump = false;
|
||||
struct nft_handle h = {
|
||||
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
|
||||
index 849c53f30e155..e1d2a7d6cce88 100644
|
||||
--- a/iptables/xtables-translate.c
|
||||
+++ b/iptables/xtables-translate.c
|
||||
@@ -426,7 +426,7 @@ static int xtables_xlate_main_common(struct nft_handle *h,
|
||||
int family,
|
||||
const char *progname)
|
||||
{
|
||||
- struct builtin_table *tables;
|
||||
+ const struct builtin_table *tables;
|
||||
int ret;
|
||||
|
||||
xtables_globals.program_name = progname;
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
From ba2da85b5a8940035f57dd395205c726c0c68ec7 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Mon, 28 Sep 2020 18:57:18 +0200
|
||||
Subject: [PATCH] nft: Fix for broken address mask match detection
|
||||
|
||||
Trying to decide whether a bitwise expression is needed to match parts
|
||||
of a source or destination address only, add_addr() checks if all bytes
|
||||
in 'mask' are 0xff or not. The check is apparently broken though as each
|
||||
byte in 'mask' is cast to a signed char before comparing against 0xff,
|
||||
therefore the bitwise is always added:
|
||||
|
||||
| # ./bad/iptables-nft -A foo -s 10.0.0.1 -j ACCEPT
|
||||
| # ./good/iptables-nft -A foo -s 10.0.0.2 -j ACCEPT
|
||||
| # nft --debug=netlink list chain ip filter foo
|
||||
| ip filter foo 5
|
||||
| [ payload load 4b @ network header + 12 => reg 1 ]
|
||||
| [ bitwise reg 1 = (reg=1 & 0xffffffff ) ^ 0x00000000 ]
|
||||
| [ cmp eq reg 1 0x0100000a ]
|
||||
| [ counter pkts 0 bytes 0 ]
|
||||
| [ immediate reg 0 accept ]
|
||||
|
|
||||
| ip filter foo 6 5
|
||||
| [ payload load 4b @ network header + 12 => reg 1 ]
|
||||
| [ cmp eq reg 1 0x0200000a ]
|
||||
| [ counter pkts 0 bytes 0 ]
|
||||
| [ immediate reg 0 accept ]
|
||||
|
|
||||
| table ip filter {
|
||||
| chain foo {
|
||||
| ip saddr 10.0.0.1 counter packets 0 bytes 0 accept
|
||||
| ip saddr 10.0.0.2 counter packets 0 bytes 0 accept
|
||||
| }
|
||||
| }
|
||||
|
||||
Fix the cast, safe an extra op and gain 100% performance in ideal cases.
|
||||
|
||||
Fixes: 56859380eb328 ("xtables-compat: avoid unneeded bitwise ops")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 72ed608bf1ea550ac13b5b880afc7ad3ffa0afd0)
|
||||
---
|
||||
iptables/nft-shared.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
||||
index c5a8f3fcc051d..7741d23befc5a 100644
|
||||
--- a/iptables/nft-shared.c
|
||||
+++ b/iptables/nft-shared.c
|
||||
@@ -165,7 +165,7 @@ void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op)
|
||||
void add_addr(struct nftnl_rule *r, int offset,
|
||||
void *data, void *mask, size_t len, uint32_t op)
|
||||
{
|
||||
- const char *m = mask;
|
||||
+ const unsigned char *m = mask;
|
||||
int i;
|
||||
|
||||
add_payload(r, offset, len, NFT_PAYLOAD_NETWORK_HEADER);
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,60 +0,0 @@
|
|||
From 014b6acbb382f42dd20577fa1ff6e013526a57d5 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:02 +0100
|
||||
Subject: [PATCH] nft: Simplify nftnl_rule_list_chain_save()
|
||||
|
||||
Since there are per table chain caches, The chain list passed to that
|
||||
function is comprised of chains belonging to the right table only.
|
||||
Therefore the table name check can safely be skipped.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 71f9e474d467dd59582d7a3920eded9613b99000)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 10 +++-------
|
||||
1 file changed, 3 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 7b6fb2b10686d..9d20eb0eac2db 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -2381,8 +2381,7 @@ list_save(struct nftnl_rule *r, unsigned int num, unsigned int format)
|
||||
|
||||
static int
|
||||
nftnl_rule_list_chain_save(struct nft_handle *h, const char *chain,
|
||||
- const char *table, struct nftnl_chain_list *list,
|
||||
- int counters)
|
||||
+ struct nftnl_chain_list *list, int counters)
|
||||
{
|
||||
struct nftnl_chain_list_iter *iter;
|
||||
struct nftnl_chain *c;
|
||||
@@ -2393,15 +2392,12 @@ nftnl_rule_list_chain_save(struct nft_handle *h, const char *chain,
|
||||
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
while (c != NULL) {
|
||||
- const char *chain_table =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
||||
const char *chain_name =
|
||||
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
uint32_t policy =
|
||||
nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
|
||||
|
||||
- if (strcmp(table, chain_table) != 0 ||
|
||||
- (chain && strcmp(chain, chain_name) != 0))
|
||||
+ if (chain && strcmp(chain, chain_name) != 0)
|
||||
goto next;
|
||||
|
||||
/* this is a base chain */
|
||||
@@ -2458,7 +2454,7 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain,
|
||||
|
||||
/* Dump policies and custom chains first */
|
||||
if (!rulenum)
|
||||
- nftnl_rule_list_chain_save(h, chain, table, list, counters);
|
||||
+ nftnl_rule_list_chain_save(h, chain, list, counters);
|
||||
|
||||
/* Now dump out rules in this table */
|
||||
iter = nftnl_chain_list_iter_create(list);
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
From e674863343bf3233d2d1cdd9e17adad5381796a9 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 6 Oct 2020 19:07:19 +0200
|
||||
Subject: [PATCH] extensions: libipt_icmp: Fix translation of type 'any'
|
||||
|
||||
By itself, '-m icmp --icmp-type any' is a noop, it matches any icmp
|
||||
types. Yet nft_ipv4_xlate() does not emit an 'ip protocol' match if
|
||||
there's an extension with same name present in the rule. Luckily, legacy
|
||||
iptables demands icmp match to be prepended by '-p icmp', so we can
|
||||
assume this is present and just emit the 'ip protocol' match from icmp
|
||||
xlate callback.
|
||||
|
||||
Fixes: aa158ca0fda65 ("extensions: libipt_icmp: Add translation to nft")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Reviewed-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit ad4b17b98bbedf93d2182a4dc9a37e9cf3adfe1b)
|
||||
---
|
||||
extensions/libipt_icmp.c | 5 +++++
|
||||
extensions/libipt_icmp.txlate | 3 +++
|
||||
2 files changed, 8 insertions(+)
|
||||
|
||||
diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
|
||||
index e76257c54708c..e5e236613f39f 100644
|
||||
--- a/extensions/libipt_icmp.c
|
||||
+++ b/extensions/libipt_icmp.c
|
||||
@@ -256,6 +256,11 @@ static int icmp_xlate(struct xt_xlate *xl,
|
||||
if (!type_xlate_print(xl, info->type, info->code[0],
|
||||
info->code[1]))
|
||||
return 0;
|
||||
+ } else {
|
||||
+ /* '-m icmp --icmp-type any' is a noop by itself,
|
||||
+ * but it eats a (mandatory) previous '-p icmp' so
|
||||
+ * emit it here */
|
||||
+ xt_xlate_add(xl, "ip protocol icmp");
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
diff --git a/extensions/libipt_icmp.txlate b/extensions/libipt_icmp.txlate
|
||||
index 434f8cc4eb1ae..a2aec8e26df75 100644
|
||||
--- a/extensions/libipt_icmp.txlate
|
||||
+++ b/extensions/libipt_icmp.txlate
|
||||
@@ -6,3 +6,6 @@ nft add rule ip filter INPUT icmp type destination-unreachable counter accept
|
||||
|
||||
iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT
|
||||
nft add rule ip filter INPUT icmp type != destination-unreachable counter accept
|
||||
+
|
||||
+iptables-translate -t filter -A INPUT -m icmp --icmp-type any -j ACCEPT
|
||||
+nft add rule ip filter INPUT ip protocol icmp counter accept
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,43 +0,0 @@
|
|||
From d54baa487a93f54d192de82704e1fba9675fcadc Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:03 +0100
|
||||
Subject: [PATCH] nft: Review unclear return points
|
||||
|
||||
When converting to per table chain caches, these two error returns were
|
||||
marked for review but apparently forgotten. Make sure error condition is
|
||||
propagated when returning at those points.
|
||||
|
||||
Fixes: c58ecf9f8bcb7 ("xtables: Introduce per table chain caches")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 7e09582a57440f13796bdd5bd70466ef0913345b)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 9d20eb0eac2db..1fca1f17147f6 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -2311,7 +2311,7 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
||||
|
||||
list = nft_chain_list_get(h, table);
|
||||
if (!list)
|
||||
- goto err; /* XXX: return 0 instead? */
|
||||
+ return 0;
|
||||
|
||||
iter = nftnl_chain_list_iter_create(list);
|
||||
if (iter == NULL)
|
||||
@@ -2450,7 +2450,7 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain,
|
||||
|
||||
list = nft_chain_list_get(h, table);
|
||||
if (!list)
|
||||
- goto err; /* XXX: correct? */
|
||||
+ goto err;
|
||||
|
||||
/* Dump policies and custom chains first */
|
||||
if (!rulenum)
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,127 @@
|
|||
From 4616623e18cb1868960194cd7f695969c594a35b Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Mon, 21 Sep 2020 13:42:06 +0200
|
||||
Subject: [PATCH] libxtables: Make sure extensions register in revision order
|
||||
|
||||
Insert extensions into pending lists in ordered fashion: Group by
|
||||
extension name (and, for matches, family) and order groups by descending
|
||||
revision number.
|
||||
|
||||
This allows to simplify the later full registration considerably. Since
|
||||
that involves kernel compatibility checks, the extra cycles here pay off
|
||||
eventually.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit b3ac87038f4e45141831d9ab485a2f627daba3f1)
|
||||
---
|
||||
libxtables/xtables.c | 71 +++++++++++++++++++++++++++++++++++++++-----
|
||||
1 file changed, 64 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
|
||||
index 8907ba2069be7..de52e3e2bbc15 100644
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -948,8 +948,14 @@ static void xtables_check_options(const char *name, const struct option *opt)
|
||||
}
|
||||
}
|
||||
|
||||
+static int xtables_match_prefer(const struct xtables_match *a,
|
||||
+ const struct xtables_match *b);
|
||||
+
|
||||
void xtables_register_match(struct xtables_match *me)
|
||||
{
|
||||
+ struct xtables_match **pos;
|
||||
+ bool seen_myself = false;
|
||||
+
|
||||
if (me->next) {
|
||||
fprintf(stderr, "%s: match \"%s\" already registered\n",
|
||||
xt_params->program_name, me->name);
|
||||
@@ -1001,10 +1007,34 @@ void xtables_register_match(struct xtables_match *me)
|
||||
if (me->extra_opts != NULL)
|
||||
xtables_check_options(me->name, me->extra_opts);
|
||||
|
||||
-
|
||||
- /* place on linked list of matches pending full registration */
|
||||
- me->next = xtables_pending_matches;
|
||||
- xtables_pending_matches = me;
|
||||
+ /* order into linked list of matches pending full registration */
|
||||
+ for (pos = &xtables_pending_matches; *pos; pos = &(*pos)->next) {
|
||||
+ /* group by name and family */
|
||||
+ if (strcmp(me->name, (*pos)->name) ||
|
||||
+ me->family != (*pos)->family) {
|
||||
+ if (seen_myself)
|
||||
+ break; /* end of own group, append to it */
|
||||
+ continue;
|
||||
+ }
|
||||
+ /* found own group */
|
||||
+ seen_myself = true;
|
||||
+ if (xtables_match_prefer(me, *pos) >= 0)
|
||||
+ break; /* put preferred items first in group */
|
||||
+ }
|
||||
+ /* if own group was not found, prepend item */
|
||||
+ if (!*pos && !seen_myself)
|
||||
+ pos = &xtables_pending_matches;
|
||||
+
|
||||
+ me->next = *pos;
|
||||
+ *pos = me;
|
||||
+#ifdef DEBUG
|
||||
+ printf("%s: inserted match %s (family %d, revision %d):\n",
|
||||
+ __func__, me->name, me->family, me->revision);
|
||||
+ for (pos = &xtables_pending_matches; *pos; pos = &(*pos)->next) {
|
||||
+ printf("%s:\tmatch %s (family %d, revision %d)\n", __func__,
|
||||
+ (*pos)->name, (*pos)->family, (*pos)->revision);
|
||||
+ }
|
||||
+#endif
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -1143,6 +1173,9 @@ void xtables_register_matches(struct xtables_match *match, unsigned int n)
|
||||
|
||||
void xtables_register_target(struct xtables_target *me)
|
||||
{
|
||||
+ struct xtables_target **pos;
|
||||
+ bool seen_myself = false;
|
||||
+
|
||||
if (me->next) {
|
||||
fprintf(stderr, "%s: target \"%s\" already registered\n",
|
||||
xt_params->program_name, me->name);
|
||||
@@ -1198,9 +1231,33 @@ void xtables_register_target(struct xtables_target *me)
|
||||
if (me->family != afinfo->family && me->family != AF_UNSPEC)
|
||||
return;
|
||||
|
||||
- /* place on linked list of targets pending full registration */
|
||||
- me->next = xtables_pending_targets;
|
||||
- xtables_pending_targets = me;
|
||||
+ /* order into linked list of targets pending full registration */
|
||||
+ for (pos = &xtables_pending_targets; *pos; pos = &(*pos)->next) {
|
||||
+ /* group by name */
|
||||
+ if (!extension_cmp(me->name, (*pos)->name, (*pos)->family)) {
|
||||
+ if (seen_myself)
|
||||
+ break; /* end of own group, append to it */
|
||||
+ continue;
|
||||
+ }
|
||||
+ /* found own group */
|
||||
+ seen_myself = true;
|
||||
+ if (xtables_target_prefer(me, *pos) >= 0)
|
||||
+ break; /* put preferred items first in group */
|
||||
+ }
|
||||
+ /* if own group was not found, prepend item */
|
||||
+ if (!*pos && !seen_myself)
|
||||
+ pos = &xtables_pending_targets;
|
||||
+
|
||||
+ me->next = *pos;
|
||||
+ *pos = me;
|
||||
+#ifdef DEBUG
|
||||
+ printf("%s: inserted target %s (family %d, revision %d):\n",
|
||||
+ __func__, me->name, me->family, me->revision);
|
||||
+ for (pos = &xtables_pending_targets; *pos; pos = &(*pos)->next) {
|
||||
+ printf("%s:\ttarget %s (family %d, revision %d)\n", __func__,
|
||||
+ (*pos)->name, (*pos)->family, (*pos)->revision);
|
||||
+ }
|
||||
+#endif
|
||||
}
|
||||
|
||||
static bool xtables_fully_register_pending_target(struct xtables_target *me)
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,172 +0,0 @@
|
|||
From 757b84e866dc1f288c54ad5ca9868b1765da3948 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:04 +0100
|
||||
Subject: [PATCH] xtables-restore: Review chain handling
|
||||
|
||||
There is no need to "delete" (actually, remove from cache) a chain if
|
||||
noflush wasn't given: While handling the corresponding table line,
|
||||
'table_flush' callback has already taken care of that.
|
||||
|
||||
This .chain_del indirection is not required since d1eb4d587297
|
||||
("iptables-compat: chains are purge out already from table flush").
|
||||
|
||||
Streamlining the code further, move syntax checks to the top. If these
|
||||
concede, there are three cases to distinguish:
|
||||
|
||||
A) Given chain name matches a builtin one in current table, so assume it
|
||||
exists already and just set policy and counters.
|
||||
|
||||
B) Noflush was given and the (custom) chain exists already, flush it.
|
||||
|
||||
C) Custom chain was either flushed (noflush not given) or didn't exist
|
||||
before, create it.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 9523b2e9dee3d9b4439214092c496542ce9f434e)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-shared.h | 2 --
|
||||
iptables/xtables-restore.c | 68 +++++++++++---------------------------
|
||||
2 files changed, 19 insertions(+), 51 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
|
||||
index 9a61d8d2863e3..17fff984ba312 100644
|
||||
--- a/iptables/nft-shared.h
|
||||
+++ b/iptables/nft-shared.h
|
||||
@@ -253,8 +253,6 @@ struct nft_xt_restore_cb {
|
||||
void (*table_new)(struct nft_handle *h, const char *table);
|
||||
struct nftnl_chain_list *(*chain_list)(struct nft_handle *h,
|
||||
const char *table);
|
||||
- void (*chain_del)(struct nftnl_chain_list *clist, const char *curtable,
|
||||
- const char *chain);
|
||||
int (*chain_user_flush)(struct nft_handle *h,
|
||||
struct nftnl_chain_list *clist,
|
||||
const char *table, const char *chain);
|
||||
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
|
||||
index 642876d6c70ac..4e00ed86be06d 100644
|
||||
--- a/iptables/xtables-restore.c
|
||||
+++ b/iptables/xtables-restore.c
|
||||
@@ -68,21 +68,6 @@ static struct nftnl_chain_list *get_chain_list(struct nft_handle *h,
|
||||
return chain_list;
|
||||
}
|
||||
|
||||
-static void chain_delete(struct nftnl_chain_list *clist, const char *curtable,
|
||||
- const char *chain)
|
||||
-{
|
||||
- struct nftnl_chain *chain_obj;
|
||||
-
|
||||
- chain_obj = nft_chain_list_find(clist, chain);
|
||||
- /* This chain has been found, delete from list. Later
|
||||
- * on, unvisited chains will be purged out.
|
||||
- */
|
||||
- if (chain_obj != NULL) {
|
||||
- nftnl_chain_list_del(chain_obj);
|
||||
- nftnl_chain_free(chain_obj);
|
||||
- }
|
||||
-}
|
||||
-
|
||||
struct nft_xt_restore_cb restore_cb = {
|
||||
.chain_list = get_chain_list,
|
||||
.commit = nft_commit,
|
||||
@@ -90,7 +75,6 @@ struct nft_xt_restore_cb restore_cb = {
|
||||
.table_new = nft_table_new,
|
||||
.table_flush = nft_table_flush,
|
||||
.chain_user_flush = nft_chain_user_flush,
|
||||
- .chain_del = chain_delete,
|
||||
.do_command = do_commandx,
|
||||
.chain_set = nft_chain_set,
|
||||
.chain_user_add = nft_chain_user_add,
|
||||
@@ -183,7 +167,6 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
/* New chain. */
|
||||
char *policy, *chain = NULL;
|
||||
struct xt_counters count = {};
|
||||
- bool chain_exists = false;
|
||||
|
||||
chain = strtok(buffer+1, " \t\n");
|
||||
DEBUGP("line %u, chain '%s'\n", line, chain);
|
||||
@@ -194,21 +177,6 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
exit(1);
|
||||
}
|
||||
|
||||
- if (noflush == 0) {
|
||||
- if (cb->chain_del)
|
||||
- cb->chain_del(chain_list, curtable->name,
|
||||
- chain);
|
||||
- } else if (nft_chain_list_find(chain_list, chain)) {
|
||||
- chain_exists = true;
|
||||
- /* Apparently -n still flushes existing user
|
||||
- * defined chains that are redefined. Otherwise,
|
||||
- * leave them as is.
|
||||
- */
|
||||
- if (cb->chain_user_flush)
|
||||
- cb->chain_user_flush(h, chain_list,
|
||||
- curtable->name, chain);
|
||||
- }
|
||||
-
|
||||
if (strlen(chain) >= XT_EXTENSION_MAXNAMELEN)
|
||||
xtables_error(PARAMETER_PROBLEM,
|
||||
"Invalid chain name `%s' "
|
||||
@@ -246,24 +214,28 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
}
|
||||
DEBUGP("Setting policy of chain %s to %s\n",
|
||||
chain, policy);
|
||||
- ret = 1;
|
||||
|
||||
- } else {
|
||||
- if (!chain_exists &&
|
||||
- cb->chain_user_add &&
|
||||
- cb->chain_user_add(h, chain,
|
||||
- curtable->name) < 0) {
|
||||
- if (errno == EEXIST)
|
||||
- continue;
|
||||
+ } else if (noflush &&
|
||||
+ nftnl_chain_list_lookup_byname(chain_list, chain)) {
|
||||
+ /* Apparently -n still flushes existing user
|
||||
+ * defined chains that are redefined. Otherwise,
|
||||
+ * leave them as is.
|
||||
+ */
|
||||
+ if (cb->chain_user_flush)
|
||||
+ cb->chain_user_flush(h, chain_list,
|
||||
+ curtable->name, chain);
|
||||
+ } else if (cb->chain_user_add &&
|
||||
+ cb->chain_user_add(h, chain,
|
||||
+ curtable->name) < 0) {
|
||||
+ if (errno == EEXIST)
|
||||
+ continue;
|
||||
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "cannot create chain "
|
||||
- "'%s' (%s)\n", chain,
|
||||
- strerror(errno));
|
||||
- }
|
||||
- continue;
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "cannot create chain "
|
||||
+ "'%s' (%s)\n", chain,
|
||||
+ strerror(errno));
|
||||
}
|
||||
-
|
||||
+ ret = 1;
|
||||
} else if (in_table) {
|
||||
int a;
|
||||
char *pcnt = NULL;
|
||||
@@ -496,7 +468,6 @@ struct nft_xt_restore_cb ebt_restore_cb = {
|
||||
.table_new = nft_table_new,
|
||||
.table_flush = nft_table_flush,
|
||||
.chain_user_flush = nft_chain_user_flush,
|
||||
- .chain_del = chain_delete,
|
||||
.do_command = do_commandeb,
|
||||
.chain_set = nft_chain_set,
|
||||
.chain_user_add = nft_chain_user_add,
|
||||
@@ -542,7 +513,6 @@ struct nft_xt_restore_cb arp_restore_cb = {
|
||||
.table_new = nft_table_new,
|
||||
.table_flush = nft_table_flush,
|
||||
.chain_user_flush = nft_chain_user_flush,
|
||||
- .chain_del = chain_delete,
|
||||
.do_command = do_commandarp,
|
||||
.chain_set = nft_chain_set,
|
||||
.chain_user_add = nft_chain_user_add,
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,240 @@
|
|||
From 4b5e9e71fbad66aef1db079905cba2db032a7515 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 18 Sep 2020 18:48:14 +0200
|
||||
Subject: [PATCH] libxtables: Simplify pending extension registration
|
||||
|
||||
Assuming that pending extensions are sorted by first name and family,
|
||||
then descending revision, the decision where to insert a newly
|
||||
registered extension may be simplified by memorizing the previous
|
||||
registration (which obviously is of same name and family and higher
|
||||
revision).
|
||||
|
||||
As a side-effect, fix for unsupported old extension revisions lingering
|
||||
in pending extension list forever and being retried with every use of
|
||||
the given extension. Any revision being rejected by the kernel may
|
||||
safely be dropped iff a previous (read: higher) revision was accepted
|
||||
already.
|
||||
|
||||
Yet another side-effect of this change is the removal of an unwanted
|
||||
recursion by xtables_fully_register_pending_*() into itself via
|
||||
xtables_find_*().
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit a1eaaceb0460b338294e40bdd5bc5186320a478c)
|
||||
---
|
||||
libxtables/xtables.c | 128 +++++++++++--------------------------------
|
||||
1 file changed, 33 insertions(+), 95 deletions(-)
|
||||
|
||||
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
|
||||
index de52e3e2bbc15..10d4e70328500 100644
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -203,8 +203,10 @@ struct xtables_match *xtables_matches;
|
||||
struct xtables_target *xtables_targets;
|
||||
|
||||
/* Fully register a match/target which was previously partially registered. */
|
||||
-static bool xtables_fully_register_pending_match(struct xtables_match *me);
|
||||
-static bool xtables_fully_register_pending_target(struct xtables_target *me);
|
||||
+static bool xtables_fully_register_pending_match(struct xtables_match *me,
|
||||
+ struct xtables_match *prev);
|
||||
+static bool xtables_fully_register_pending_target(struct xtables_target *me,
|
||||
+ struct xtables_target *prev);
|
||||
|
||||
#ifndef NO_SHARED_LIBS
|
||||
/* registry for loaded shared objects to close later */
|
||||
@@ -662,6 +664,7 @@ struct xtables_match *
|
||||
xtables_find_match(const char *name, enum xtables_tryload tryload,
|
||||
struct xtables_rule_match **matches)
|
||||
{
|
||||
+ struct xtables_match *prev = NULL;
|
||||
struct xtables_match **dptr;
|
||||
struct xtables_match *ptr;
|
||||
const char *icmp6 = "icmp6";
|
||||
@@ -683,8 +686,12 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
|
||||
if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
|
||||
ptr = *dptr;
|
||||
*dptr = (*dptr)->next;
|
||||
- if (xtables_fully_register_pending_match(ptr))
|
||||
+ if (xtables_fully_register_pending_match(ptr, prev)) {
|
||||
+ prev = ptr;
|
||||
continue;
|
||||
+ } else if (prev) {
|
||||
+ continue;
|
||||
+ }
|
||||
*dptr = ptr;
|
||||
}
|
||||
dptr = &((*dptr)->next);
|
||||
@@ -778,6 +785,7 @@ xtables_find_match_revision(const char *name, enum xtables_tryload tryload,
|
||||
struct xtables_target *
|
||||
xtables_find_target(const char *name, enum xtables_tryload tryload)
|
||||
{
|
||||
+ struct xtables_target *prev = NULL;
|
||||
struct xtables_target **dptr;
|
||||
struct xtables_target *ptr;
|
||||
|
||||
@@ -794,8 +802,12 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
|
||||
if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
|
||||
ptr = *dptr;
|
||||
*dptr = (*dptr)->next;
|
||||
- if (xtables_fully_register_pending_target(ptr))
|
||||
+ if (xtables_fully_register_pending_target(ptr, prev)) {
|
||||
+ prev = ptr;
|
||||
continue;
|
||||
+ } else if (prev) {
|
||||
+ continue;
|
||||
+ }
|
||||
*dptr = ptr;
|
||||
}
|
||||
dptr = &((*dptr)->next);
|
||||
@@ -1098,64 +1110,27 @@ static int xtables_target_prefer(const struct xtables_target *a,
|
||||
b->revision, b->family);
|
||||
}
|
||||
|
||||
-static bool xtables_fully_register_pending_match(struct xtables_match *me)
|
||||
+static bool xtables_fully_register_pending_match(struct xtables_match *me,
|
||||
+ struct xtables_match *prev)
|
||||
{
|
||||
- struct xtables_match **i, *old, *pos = NULL;
|
||||
+ struct xtables_match **i;
|
||||
const char *rn;
|
||||
- int compare;
|
||||
|
||||
/* See if new match can be used. */
|
||||
rn = (me->real_name != NULL) ? me->real_name : me->name;
|
||||
if (!compatible_match_revision(rn, me->revision))
|
||||
return false;
|
||||
|
||||
- old = xtables_find_match(me->name, XTF_DURING_LOAD, NULL);
|
||||
- while (old) {
|
||||
- compare = xtables_match_prefer(old, me);
|
||||
- if (compare == 0) {
|
||||
- fprintf(stderr,
|
||||
- "%s: match `%s' already registered.\n",
|
||||
- xt_params->program_name, me->name);
|
||||
- exit(1);
|
||||
- }
|
||||
-
|
||||
- /* Now we have two (or more) options, check compatibility. */
|
||||
- rn = (old->real_name != NULL) ? old->real_name : old->name;
|
||||
- if (compare > 0) {
|
||||
- /* Kernel tells old isn't compatible anymore??? */
|
||||
- if (!compatible_match_revision(rn, old->revision)) {
|
||||
- /* Delete old one. */
|
||||
- for (i = &xtables_matches; *i != old;)
|
||||
- i = &(*i)->next;
|
||||
- *i = old->next;
|
||||
- }
|
||||
- pos = old;
|
||||
- old = old->next;
|
||||
- if (!old)
|
||||
- break;
|
||||
- if (!extension_cmp(me->name, old->name, old->family))
|
||||
- break;
|
||||
- continue;
|
||||
- }
|
||||
-
|
||||
- /* Found right old */
|
||||
- pos = old;
|
||||
- break;
|
||||
- }
|
||||
-
|
||||
- if (!pos) {
|
||||
+ if (!prev) {
|
||||
/* Append to list. */
|
||||
for (i = &xtables_matches; *i; i = &(*i)->next);
|
||||
- } else if (compare < 0) {
|
||||
- /* Prepend it */
|
||||
- for (i = &xtables_matches; *i != pos; i = &(*i)->next);
|
||||
- } else if (compare > 0) {
|
||||
+ } else {
|
||||
/* Append it */
|
||||
- i = &pos->next;
|
||||
- pos = pos->next;
|
||||
+ i = &prev->next;
|
||||
+ prev = prev->next;
|
||||
}
|
||||
|
||||
- me->next = pos;
|
||||
+ me->next = prev;
|
||||
*i = me;
|
||||
|
||||
me->m = NULL;
|
||||
@@ -1260,11 +1235,11 @@ void xtables_register_target(struct xtables_target *me)
|
||||
#endif
|
||||
}
|
||||
|
||||
-static bool xtables_fully_register_pending_target(struct xtables_target *me)
|
||||
+static bool xtables_fully_register_pending_target(struct xtables_target *me,
|
||||
+ struct xtables_target *prev)
|
||||
{
|
||||
- struct xtables_target **i, *old, *pos = NULL;
|
||||
+ struct xtables_target **i;
|
||||
const char *rn;
|
||||
- int compare;
|
||||
|
||||
if (strcmp(me->name, "standard") != 0) {
|
||||
/* See if new target can be used. */
|
||||
@@ -1273,54 +1248,17 @@ static bool xtables_fully_register_pending_target(struct xtables_target *me)
|
||||
return false;
|
||||
}
|
||||
|
||||
- old = xtables_find_target(me->name, XTF_DURING_LOAD);
|
||||
- while (old) {
|
||||
- compare = xtables_target_prefer(old, me);
|
||||
- if (compare == 0) {
|
||||
- fprintf(stderr,
|
||||
- "%s: target `%s' already registered.\n",
|
||||
- xt_params->program_name, me->name);
|
||||
- exit(1);
|
||||
- }
|
||||
-
|
||||
- /* Now we have two (or more) options, check compatibility. */
|
||||
- rn = (old->real_name != NULL) ? old->real_name : old->name;
|
||||
- if (compare > 0) {
|
||||
- /* Kernel tells old isn't compatible anymore??? */
|
||||
- if (!compatible_target_revision(rn, old->revision)) {
|
||||
- /* Delete old one. */
|
||||
- for (i = &xtables_targets; *i != old;)
|
||||
- i = &(*i)->next;
|
||||
- *i = old->next;
|
||||
- }
|
||||
- pos = old;
|
||||
- old = old->next;
|
||||
- if (!old)
|
||||
- break;
|
||||
- if (!extension_cmp(me->name, old->name, old->family))
|
||||
- break;
|
||||
- continue;
|
||||
- }
|
||||
-
|
||||
- /* Found right old */
|
||||
- pos = old;
|
||||
- break;
|
||||
- }
|
||||
-
|
||||
- if (!pos) {
|
||||
+ if (!prev) {
|
||||
/* Prepend to list. */
|
||||
i = &xtables_targets;
|
||||
- pos = xtables_targets;
|
||||
- } else if (compare < 0) {
|
||||
- /* Prepend it */
|
||||
- for (i = &xtables_targets; *i != pos; i = &(*i)->next);
|
||||
- } else if (compare > 0) {
|
||||
+ prev = xtables_targets;
|
||||
+ } else {
|
||||
/* Append it */
|
||||
- i = &pos->next;
|
||||
- pos = pos->next;
|
||||
+ i = &prev->next;
|
||||
+ prev = prev->next;
|
||||
}
|
||||
|
||||
- me->next = pos;
|
||||
+ me->next = prev;
|
||||
*i = me;
|
||||
|
||||
me->t = NULL;
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,233 +0,0 @@
|
|||
From 109b8f2d637b5e4b1a6ff6994297203834e4e77a Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:05 +0100
|
||||
Subject: [PATCH] nft: Review is_*_compatible() routines
|
||||
|
||||
- Call to nft_table_builtin_find() in nft_is_table_compatible() is not
|
||||
needed, as it is repeated in the latter call to nft_chain_list_get()
|
||||
by nft_are_chains_compatible().
|
||||
|
||||
- Turn nft_is_chain_compatible(), nft_is_rule_compatible() and
|
||||
nft_is_expr_compatible() into callbacks for use with respective
|
||||
foreach functions.
|
||||
|
||||
- nft_are_chains_compatible() is not needed anymore due to foreach
|
||||
function use.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit e774b15299c271a4c7570899591cf1b7960477ea)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 153 ++++++++++++++++++-------------------------------
|
||||
1 file changed, 55 insertions(+), 98 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 1fca1f17147f6..5032c718b33a9 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -3115,7 +3115,7 @@ static const char *supported_exprs[NFT_COMPAT_EXPR_MAX] = {
|
||||
};
|
||||
|
||||
|
||||
-static int nft_is_expr_compatible(const struct nftnl_expr *expr)
|
||||
+static int nft_is_expr_compatible(struct nftnl_expr *expr, void *data)
|
||||
{
|
||||
const char *name = nftnl_expr_get_str(expr, NFTNL_EXPR_NAME);
|
||||
int i;
|
||||
@@ -3130,138 +3130,95 @@ static int nft_is_expr_compatible(const struct nftnl_expr *expr)
|
||||
nftnl_expr_get_u32(expr, NFTNL_EXPR_LIMIT_FLAGS) == 0)
|
||||
return 0;
|
||||
|
||||
- return 1;
|
||||
+ return -1;
|
||||
}
|
||||
|
||||
-static bool nft_is_rule_compatible(struct nftnl_rule *rule)
|
||||
-{
|
||||
- struct nftnl_expr_iter *iter;
|
||||
- struct nftnl_expr *expr;
|
||||
- bool compatible = false;
|
||||
-
|
||||
- iter = nftnl_expr_iter_create(rule);
|
||||
- if (iter == NULL)
|
||||
- return false;
|
||||
+struct nft_is_rule_compatible_data {
|
||||
+ const char *tablename;
|
||||
+};
|
||||
|
||||
- expr = nftnl_expr_iter_next(iter);
|
||||
- while (expr != NULL) {
|
||||
- if (nft_is_expr_compatible(expr) == 0) {
|
||||
- expr = nftnl_expr_iter_next(iter);
|
||||
- continue;
|
||||
- }
|
||||
+static int nft_is_rule_compatible(struct nftnl_rule *rule, void *data)
|
||||
+{
|
||||
+ const char *table = nftnl_rule_get_str(rule, NFTNL_RULE_TABLE);
|
||||
+ struct nft_is_rule_compatible_data *d = data;
|
||||
|
||||
- compatible = true;
|
||||
- break;
|
||||
- }
|
||||
+ /* ignore rules belonging to a different table */
|
||||
+ if (strcmp(table, d->tablename))
|
||||
+ return 0;
|
||||
|
||||
- nftnl_expr_iter_destroy(iter);
|
||||
- return compatible;
|
||||
+ return nftnl_expr_foreach(rule, nft_is_expr_compatible, NULL);
|
||||
}
|
||||
|
||||
-static int nft_is_chain_compatible(const struct nft_handle *h,
|
||||
- const struct nftnl_chain *chain)
|
||||
+static int nft_is_chain_compatible(struct nftnl_chain *c, void *data)
|
||||
{
|
||||
- const char *table, *name, *type, *cur_table;
|
||||
- const struct builtin_chain *chains;
|
||||
- int i, j, prio;
|
||||
+ const struct builtin_chain *chains = NULL, *chain = NULL;
|
||||
+ const char *table, *name, *type;
|
||||
+ struct nft_handle *h = data;
|
||||
enum nf_inet_hooks hook;
|
||||
+ int i, prio;
|
||||
|
||||
- table = nftnl_chain_get(chain, NFTNL_CHAIN_TABLE);
|
||||
- name = nftnl_chain_get(chain, NFTNL_CHAIN_NAME);
|
||||
- type = nftnl_chain_get(chain, NFTNL_CHAIN_TYPE);
|
||||
- prio = nftnl_chain_get_u32(chain, NFTNL_CHAIN_PRIO);
|
||||
- hook = nftnl_chain_get_u32(chain, NFTNL_CHAIN_HOOKNUM);
|
||||
+ if (!nft_chain_builtin(c))
|
||||
+ return 0;
|
||||
|
||||
+ /* find chain's table in builtin tables */
|
||||
+ table = nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
||||
for (i = 0; i < NFT_TABLE_MAX; i++) {
|
||||
- cur_table = h->tables[i].name;
|
||||
- chains = h->tables[i].chains;
|
||||
+ const char *cur_table = h->tables[i].name;
|
||||
|
||||
- if (!cur_table || strcmp(table, cur_table) != 0)
|
||||
+ if (!cur_table || strcmp(cur_table, table))
|
||||
continue;
|
||||
|
||||
- for (j = 0; j < NF_INET_NUMHOOKS && chains[j].name; j++) {
|
||||
- if (strcmp(name, chains[j].name) != 0)
|
||||
- continue;
|
||||
-
|
||||
- if (strcmp(type, chains[j].type) == 0 &&
|
||||
- prio == chains[j].prio &&
|
||||
- hook == chains[j].hook)
|
||||
- return 0;
|
||||
- break;
|
||||
- }
|
||||
+ chains = h->tables[i].chains;
|
||||
+ break;
|
||||
}
|
||||
-
|
||||
- return 1;
|
||||
-}
|
||||
-
|
||||
-static int nft_are_chains_compatible(struct nft_handle *h, const char *tablename)
|
||||
-{
|
||||
- struct nftnl_chain_list *list;
|
||||
- struct nftnl_chain_list_iter *iter;
|
||||
- struct nftnl_chain *chain;
|
||||
- int ret = 0;
|
||||
-
|
||||
- list = nft_chain_list_get(h, tablename);
|
||||
- if (list == NULL)
|
||||
- return -1;
|
||||
-
|
||||
- iter = nftnl_chain_list_iter_create(list);
|
||||
- if (iter == NULL)
|
||||
+ if (!chains)
|
||||
return -1;
|
||||
|
||||
- chain = nftnl_chain_list_iter_next(iter);
|
||||
- while (chain != NULL) {
|
||||
- if (!nft_chain_builtin(chain))
|
||||
- goto next;
|
||||
+ /* find chain in builtin chain list */
|
||||
+ name = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
+ for (i = 0; i < NF_INET_NUMHOOKS && chains[i].name; i++) {
|
||||
+ if (strcmp(name, chains[i].name))
|
||||
+ continue;
|
||||
|
||||
- ret = nft_is_chain_compatible(h, chain);
|
||||
- if (ret != 0)
|
||||
- break;
|
||||
-next:
|
||||
- chain = nftnl_chain_list_iter_next(iter);
|
||||
+ chain = &chains[i];
|
||||
+ break;
|
||||
}
|
||||
+ if (!chain)
|
||||
+ return -1;
|
||||
|
||||
- nftnl_chain_list_iter_destroy(iter);
|
||||
+ /* compare properties */
|
||||
+ type = nftnl_chain_get_str(c, NFTNL_CHAIN_TYPE);
|
||||
+ prio = nftnl_chain_get_u32(c, NFTNL_CHAIN_PRIO);
|
||||
+ hook = nftnl_chain_get_u32(c, NFTNL_CHAIN_HOOKNUM);
|
||||
+ if (strcmp(type, chain->type) ||
|
||||
+ prio != chain->prio ||
|
||||
+ hook != chain->hook)
|
||||
+ return -1;
|
||||
|
||||
- return ret;
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
bool nft_is_table_compatible(struct nft_handle *h, const char *tablename)
|
||||
{
|
||||
+ struct nft_is_rule_compatible_data rcd = {
|
||||
+ .tablename = tablename
|
||||
+ };
|
||||
+ struct nftnl_chain_list *clist;
|
||||
struct nftnl_rule_list *list;
|
||||
- struct nftnl_rule_list_iter *iter;
|
||||
- struct nftnl_rule *rule;
|
||||
- int ret = 0;
|
||||
|
||||
- if (!nft_table_builtin_find(h, tablename))
|
||||
+ clist = nft_chain_list_get(h, tablename);
|
||||
+ if (clist == NULL)
|
||||
return false;
|
||||
|
||||
- ret = nft_are_chains_compatible(h, tablename);
|
||||
- if (ret != 0)
|
||||
+ if (nftnl_chain_list_foreach(clist, nft_is_chain_compatible, h))
|
||||
return false;
|
||||
|
||||
list = nft_rule_list_get(h);
|
||||
if (list == NULL)
|
||||
return true;
|
||||
|
||||
- iter = nftnl_rule_list_iter_create(list);
|
||||
- if (iter == NULL)
|
||||
- return true;
|
||||
-
|
||||
- rule = nftnl_rule_list_iter_next(iter);
|
||||
- while (rule != NULL) {
|
||||
- const char *table = nftnl_rule_get_str(rule, NFTNL_RULE_TABLE);
|
||||
-
|
||||
- if (strcmp(table, tablename))
|
||||
- goto next_rule;
|
||||
-
|
||||
- ret = nft_is_rule_compatible(rule);
|
||||
- if (ret != 0)
|
||||
- break;
|
||||
-next_rule:
|
||||
- rule = nftnl_rule_list_iter_next(iter);
|
||||
- }
|
||||
+ if (nftnl_rule_list_foreach(list, nft_is_rule_compatible, &rcd))
|
||||
+ return false;
|
||||
|
||||
- nftnl_rule_list_iter_destroy(iter);
|
||||
- return ret == 0;
|
||||
+ return true;
|
||||
}
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
From 1ae06e3a2da1c21a75b55609b99d1ab3ef6cf709 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 22 Sep 2020 20:01:15 +0200
|
||||
Subject: [PATCH] libxtables: Register multiple extensions in ascending order
|
||||
|
||||
The newly introduced ordered insert algorithm in
|
||||
xtables_register_{match,target}() works best if extensions of same name
|
||||
are passed in ascending revisions. Since this is the case in about all
|
||||
extensions' arrays, iterate over them from beginning to end.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit b5f1a3beac1d1f2b96c8be8ebec450f5ea758090)
|
||||
---
|
||||
libxtables/xtables.c | 14 ++++++++------
|
||||
1 file changed, 8 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
|
||||
index 10d4e70328500..7152c6576cd63 100644
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -1141,9 +1141,10 @@ static bool xtables_fully_register_pending_match(struct xtables_match *me,
|
||||
|
||||
void xtables_register_matches(struct xtables_match *match, unsigned int n)
|
||||
{
|
||||
- do {
|
||||
- xtables_register_match(&match[--n]);
|
||||
- } while (n > 0);
|
||||
+ int i;
|
||||
+
|
||||
+ for (i = 0; i < n; i++)
|
||||
+ xtables_register_match(&match[i]);
|
||||
}
|
||||
|
||||
void xtables_register_target(struct xtables_target *me)
|
||||
@@ -1269,9 +1270,10 @@ static bool xtables_fully_register_pending_target(struct xtables_target *me,
|
||||
|
||||
void xtables_register_targets(struct xtables_target *target, unsigned int n)
|
||||
{
|
||||
- do {
|
||||
- xtables_register_target(&target[--n]);
|
||||
- } while (n > 0);
|
||||
+ int i;
|
||||
+
|
||||
+ for (i = 0; i < n; i++)
|
||||
+ xtables_register_target(&target[i]);
|
||||
}
|
||||
|
||||
/* receives a list of xtables_rule_match, release them */
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,51 +0,0 @@
|
|||
From 0e260c69746ea4ff101b6f66bf40de8426cfccbd Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:06 +0100
|
||||
Subject: [PATCH] nft: Reduce __nft_rule_del() signature
|
||||
|
||||
The function does not use passed struct nftnl_rule_list, so remove it
|
||||
from its parameters.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 9975b6da9f926994bcea8ae788e47aab4b5b235e)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 7 +++----
|
||||
1 file changed, 3 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 5032c718b33a9..befd9f4dd9026 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1946,8 +1946,7 @@ void nft_table_new(struct nft_handle *h, const char *table)
|
||||
nft_xt_builtin_init(h, table);
|
||||
}
|
||||
|
||||
-static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule_list *list,
|
||||
- struct nftnl_rule *r)
|
||||
+static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r)
|
||||
{
|
||||
int ret;
|
||||
|
||||
@@ -2046,7 +2045,7 @@ int nft_rule_delete(struct nft_handle *h, const char *chain,
|
||||
|
||||
r = nft_rule_find(h, list, chain, table, data, -1);
|
||||
if (r != NULL) {
|
||||
- ret =__nft_rule_del(h, list, r);
|
||||
+ ret =__nft_rule_del(h, r);
|
||||
if (ret < 0)
|
||||
errno = ENOMEM;
|
||||
if (verbose)
|
||||
@@ -2151,7 +2150,7 @@ int nft_rule_delete_num(struct nft_handle *h, const char *chain,
|
||||
r = nft_rule_find(h, list, chain, table, NULL, rulenum);
|
||||
if (r != NULL) {
|
||||
DEBUGP("deleting rule by number %d\n", rulenum);
|
||||
- ret = __nft_rule_del(h, list, r);
|
||||
+ ret = __nft_rule_del(h, r);
|
||||
if (ret < 0)
|
||||
errno = ENOMEM;
|
||||
} else
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,161 @@
|
|||
From 99bf566bfcabce101940b28a12f61c637ccfb489 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Sat, 3 Oct 2020 17:46:09 +0200
|
||||
Subject: [PATCH] nft: Make batch_add_chain() return the added batch object
|
||||
|
||||
Do this so in a later patch the 'skip' field can be adjusted.
|
||||
|
||||
While being at it, simplify a few callers and eliminate the need for a
|
||||
'ret' variable.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Reviewed-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 0d77e64e8d9b8a3984b01a4951524dc40f61f4b6)
|
||||
---
|
||||
iptables/nft.c | 35 +++++++++++++++++------------------
|
||||
1 file changed, 17 insertions(+), 18 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index e795d4ae6d241..ec5f7457e4784 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -389,10 +389,11 @@ batch_set_add(struct nft_handle *h, enum obj_update_type type,
|
||||
return batch_add(h, type, s);
|
||||
}
|
||||
|
||||
-static int batch_chain_add(struct nft_handle *h, enum obj_update_type type,
|
||||
+static struct obj_update *
|
||||
+batch_chain_add(struct nft_handle *h, enum obj_update_type type,
|
||||
struct nftnl_chain *c)
|
||||
{
|
||||
- return batch_add(h, type, c) ? 0 : -1;
|
||||
+ return batch_add(h, type, c);
|
||||
}
|
||||
|
||||
static struct obj_update *
|
||||
@@ -920,7 +921,6 @@ int nft_chain_set(struct nft_handle *h, const char *table,
|
||||
const struct xt_counters *counters)
|
||||
{
|
||||
struct nftnl_chain *c = NULL;
|
||||
- int ret;
|
||||
|
||||
nft_fn = nft_chain_set;
|
||||
|
||||
@@ -934,10 +934,11 @@ int nft_chain_set(struct nft_handle *h, const char *table,
|
||||
if (c == NULL)
|
||||
return 0;
|
||||
|
||||
- ret = batch_chain_add(h, NFT_COMPAT_CHAIN_UPDATE, c);
|
||||
+ if (!batch_chain_add(h, NFT_COMPAT_CHAIN_UPDATE, c))
|
||||
+ return 0;
|
||||
|
||||
/* the core expects 1 for success and 0 for error */
|
||||
- return ret == 0 ? 1 : 0;
|
||||
+ return 1;
|
||||
}
|
||||
|
||||
static int __add_match(struct nftnl_expr *e, struct xt_entry_match *m)
|
||||
@@ -1752,7 +1753,6 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
|
||||
{
|
||||
struct nftnl_chain_list *list;
|
||||
struct nftnl_chain *c;
|
||||
- int ret;
|
||||
|
||||
nft_fn = nft_chain_user_add;
|
||||
|
||||
@@ -1772,14 +1772,15 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
|
||||
if (h->family == NFPROTO_BRIDGE)
|
||||
nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, NF_ACCEPT);
|
||||
|
||||
- ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c);
|
||||
+ if (!batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c))
|
||||
+ return 0;
|
||||
|
||||
list = nft_chain_list_get(h, table, chain);
|
||||
if (list)
|
||||
nftnl_chain_list_add(c, list);
|
||||
|
||||
/* the core expects 1 for success and 0 for error */
|
||||
- return ret == 0 ? 1 : 0;
|
||||
+ return 1;
|
||||
}
|
||||
|
||||
int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table)
|
||||
@@ -1787,7 +1788,6 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
|
||||
struct nftnl_chain_list *list;
|
||||
struct nftnl_chain *c;
|
||||
bool created = false;
|
||||
- int ret;
|
||||
|
||||
c = nft_chain_find(h, table, chain);
|
||||
if (c) {
|
||||
@@ -1812,14 +1812,15 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
|
||||
if (!created)
|
||||
return 1;
|
||||
|
||||
- ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c);
|
||||
+ if (!batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c))
|
||||
+ return 0;
|
||||
|
||||
list = nft_chain_list_get(h, table, chain);
|
||||
if (list)
|
||||
nftnl_chain_list_add(c, list);
|
||||
|
||||
/* the core expects 1 for success and 0 for error */
|
||||
- return ret == 0 ? 1 : 0;
|
||||
+ return 1;
|
||||
}
|
||||
|
||||
/* From linux/netlink.h */
|
||||
@@ -1837,7 +1838,6 @@ static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
|
||||
{
|
||||
struct chain_user_del_data *d = data;
|
||||
struct nft_handle *h = d->handle;
|
||||
- int ret;
|
||||
|
||||
/* don't delete built-in chain */
|
||||
if (nft_chain_builtin(c))
|
||||
@@ -1849,8 +1849,7 @@ static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
|
||||
|
||||
/* XXX This triggers a fast lookup from the kernel. */
|
||||
nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
|
||||
- ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_DEL, c);
|
||||
- if (ret)
|
||||
+ if (!batch_chain_add(h, NFT_COMPAT_CHAIN_USER_DEL, c))
|
||||
return -1;
|
||||
|
||||
nftnl_chain_list_del(c);
|
||||
@@ -1925,7 +1924,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
|
||||
{
|
||||
struct nftnl_chain *c;
|
||||
uint64_t handle;
|
||||
- int ret;
|
||||
|
||||
nft_fn = nft_chain_user_rename;
|
||||
|
||||
@@ -1954,10 +1952,11 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
|
||||
nftnl_chain_set_str(c, NFTNL_CHAIN_NAME, newname);
|
||||
nftnl_chain_set_u64(c, NFTNL_CHAIN_HANDLE, handle);
|
||||
|
||||
- ret = batch_chain_add(h, NFT_COMPAT_CHAIN_RENAME, c);
|
||||
+ if (!batch_chain_add(h, NFT_COMPAT_CHAIN_RENAME, c))
|
||||
+ return 0;
|
||||
|
||||
/* the core expects 1 for success and 0 for error */
|
||||
- return ret == 0 ? 1 : 0;
|
||||
+ return 1;
|
||||
}
|
||||
|
||||
bool nft_table_find(struct nft_handle *h, const char *tablename)
|
||||
@@ -3404,7 +3403,7 @@ static int __nft_chain_zero_counters(struct nftnl_chain *c, void *data)
|
||||
nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0);
|
||||
nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0);
|
||||
nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
|
||||
- if (batch_chain_add(h, NFT_COMPAT_CHAIN_ZERO, c))
|
||||
+ if (!batch_chain_add(h, NFT_COMPAT_CHAIN_ZERO, c))
|
||||
return -1;
|
||||
}
|
||||
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,60 +0,0 @@
|
|||
From 3614b4bee283ea6d08207ccc5e2efa3ebfad321c Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:07 +0100
|
||||
Subject: [PATCH] nft: Reduce indenting level in flush_chain_cache()
|
||||
|
||||
Instead of doing all in one go, make two separate decisions:
|
||||
|
||||
1) If table has no chain cache, either continue or return depending on
|
||||
whether we're flushing for a specific table.
|
||||
|
||||
2) With chain cache present, flushing strategy once more depends on
|
||||
whether we're flushing for a specific table: If given, just remove
|
||||
all rules and return. If not, free the cache and set to NULL (so that
|
||||
it will be repopulated later), then continue the loop.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit d4b0d248cc057e39608c7c1c1203dd3f1ea96645)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 22 +++++++++++++---------
|
||||
1 file changed, 13 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index befd9f4dd9026..997d7bc58fd00 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -815,16 +815,20 @@ static void flush_chain_cache(struct nft_handle *h, const char *tablename)
|
||||
if (tablename && strcmp(h->tables[i].name, tablename))
|
||||
continue;
|
||||
|
||||
- if (h->table[i].chain_cache) {
|
||||
- if (tablename) {
|
||||
- nftnl_chain_list_foreach(h->table[i].chain_cache,
|
||||
- __flush_chain_cache, NULL);
|
||||
- break;
|
||||
- } else {
|
||||
- nftnl_chain_list_free(h->table[i].chain_cache);
|
||||
- h->table[i].chain_cache = NULL;
|
||||
- }
|
||||
+ if (!h->table[i].chain_cache) {
|
||||
+ if (tablename)
|
||||
+ return;
|
||||
+ continue;
|
||||
}
|
||||
+
|
||||
+ if (tablename) {
|
||||
+ nftnl_chain_list_foreach(h->table[i].chain_cache,
|
||||
+ __flush_chain_cache, NULL);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ nftnl_chain_list_free(h->table[i].chain_cache);
|
||||
+ h->table[i].chain_cache = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
From 8ab5e29f192187bc12a2064036cf406de60b2cd5 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Mon, 5 Oct 2020 15:54:35 +0200
|
||||
Subject: [PATCH] nft: Fix error reporting for refreshed transactions
|
||||
|
||||
When preparing a batch from the list of batch objects in nft_action(),
|
||||
the sequence number used for each object is stored within that object
|
||||
for later matching against returned error messages. Though if the
|
||||
transaction has to be refreshed, some of those objects may be skipped,
|
||||
other objects take over their sequence number and errors are matched to
|
||||
skipped objects. Avoid this by resetting the skipped object's sequence
|
||||
number to zero.
|
||||
|
||||
Fixes: 58d7de0181f61 ("xtables: handle concurrent ruleset modifications")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Reviewed-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit e98b825a037807bf6c918eb66ee9682cc4c46183)
|
||||
---
|
||||
iptables/nft.c | 5 +++--
|
||||
1 file changed, 3 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index ec5f7457e4784..d3eb0840a9fc0 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -2832,9 +2832,10 @@ static int nft_action(struct nft_handle *h, int action)
|
||||
h->nft_genid++;
|
||||
|
||||
list_for_each_entry(n, &h->obj_list, head) {
|
||||
-
|
||||
- if (n->skip)
|
||||
+ if (n->skip) {
|
||||
+ n->seq = 0;
|
||||
continue;
|
||||
+ }
|
||||
|
||||
n->seq = seq++;
|
||||
switch (n->type) {
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,86 +0,0 @@
|
|||
From eafa37433c920c6613bd351017d31cfd6e4cc397 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:08 +0100
|
||||
Subject: [PATCH] nft: Simplify per table chain cache update
|
||||
|
||||
Previously, each table's chain cache was potentially unallocated until
|
||||
nftnl_chain_list_cb() saw a chain for it. This means such callback had to
|
||||
check the chain_cache pointer for each chain belonging to that table.
|
||||
|
||||
In addition to the above, nft_chain_list_get() had to cover for the
|
||||
possibility that a given table didn't have any chains at all in kernel,
|
||||
so check requested table's chain cache once more and allocate it if
|
||||
NULL.
|
||||
|
||||
Instead, simply iterate over all tables and preallocate their chain
|
||||
caches prior to requesting the chain list from kernel. The only caveat
|
||||
is to flush the chain cache completely before retrying in case of EINTR.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 402dac2190e6011d4f4ad81c2992b7126b3d79d9)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 23 +++++++++++++----------
|
||||
1 file changed, 13 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 997d7bc58fd00..7d08a0884adde 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1286,12 +1286,6 @@ static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
|
||||
if (!t)
|
||||
goto out;
|
||||
|
||||
- if (!h->table[t->type].chain_cache) {
|
||||
- h->table[t->type].chain_cache = nftnl_chain_list_alloc();
|
||||
- if (!h->table[t->type].chain_cache)
|
||||
- goto out;
|
||||
- }
|
||||
-
|
||||
nftnl_chain_list_add_tail(c, h->table[t->type].chain_cache);
|
||||
|
||||
return MNL_CB_OK;
|
||||
@@ -1307,7 +1301,7 @@ struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
char buf[16536];
|
||||
struct nlmsghdr *nlh;
|
||||
const struct builtin_table *t;
|
||||
- int ret;
|
||||
+ int i, ret;
|
||||
|
||||
t = nft_table_builtin_find(h, table);
|
||||
if (!t)
|
||||
@@ -1316,18 +1310,27 @@ struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
if (h->table[t->type].chain_cache)
|
||||
return h->table[t->type].chain_cache;
|
||||
retry:
|
||||
+ for (i = 0; i < NFT_TABLE_MAX; i++) {
|
||||
+ enum nft_table_type type = h->tables[i].type;
|
||||
+
|
||||
+ if (!h->tables[i].name)
|
||||
+ continue;
|
||||
+
|
||||
+ h->table[type].chain_cache = nftnl_chain_list_alloc();
|
||||
+ if (!h->table[type].chain_cache)
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, h->family,
|
||||
NLM_F_DUMP, h->seq);
|
||||
|
||||
ret = mnl_talk(h, nlh, nftnl_chain_list_cb, h);
|
||||
if (ret < 0 && errno == EINTR) {
|
||||
assert(nft_restart(h) >= 0);
|
||||
+ flush_chain_cache(h, NULL);
|
||||
goto retry;
|
||||
}
|
||||
|
||||
- if (!h->table[t->type].chain_cache)
|
||||
- h->table[t->type].chain_cache = nftnl_chain_list_alloc();
|
||||
-
|
||||
return h->table[t->type].chain_cache;
|
||||
}
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,235 @@
|
|||
From 412c52e9ab9d5d1d1a1e5e09a122cca43895451a Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Mon, 5 Oct 2020 16:06:49 +0200
|
||||
Subject: [PATCH] nft: Fix for concurrent noflush restore calls
|
||||
|
||||
Transaction refresh was broken with regards to nft_chain_restore(): It
|
||||
created a rule flush batch object only if the chain was found in cache
|
||||
and a chain add object only if the chain was not found. Yet with
|
||||
concurrent ruleset updates, one has to expect both situations:
|
||||
|
||||
* If a chain vanishes, the rule flush job must be skipped and instead
|
||||
the chain add job become active.
|
||||
|
||||
* If a chain appears, the chain add job must be skipped and instead
|
||||
rules flushed.
|
||||
|
||||
Change the code accordingly: Create both batch objects and set their
|
||||
'skip' field depending on the situation in cache and adjust both in
|
||||
nft_refresh_transaction().
|
||||
|
||||
As a side-effect, the implicit rule flush becomes explicit and all
|
||||
handling of implicit batch jobs is dropped along with the related field
|
||||
indicating such.
|
||||
|
||||
Reuse the 'implicit' parameter of __nft_rule_flush() to control the
|
||||
initial 'skip' field value instead.
|
||||
|
||||
A subtle caveat is vanishing of existing chains: Creating the chain add
|
||||
job based on the chain in cache causes a netlink message containing that
|
||||
chain's handle which the kernel dislikes. Therefore unset the chain's
|
||||
handle in that case.
|
||||
|
||||
Fixes: 58d7de0181f61 ("xtables: handle concurrent ruleset modifications")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit dac904bdcd9a18aabafee7275ccf0c2bd53800f3)
|
||||
---
|
||||
iptables/nft.c | 58 ++++++++++---------
|
||||
.../ipt-restore/0016-concurrent-restores_0 | 53 +++++++++++++++++
|
||||
2 files changed, 83 insertions(+), 28 deletions(-)
|
||||
create mode 100755 iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index d3eb0840a9fc0..bdb633a82a655 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -265,7 +265,6 @@ struct obj_update {
|
||||
struct list_head head;
|
||||
enum obj_update_type type:8;
|
||||
uint8_t skip:1;
|
||||
- uint8_t implicit:1;
|
||||
unsigned int seq;
|
||||
union {
|
||||
struct nftnl_table *table;
|
||||
@@ -1668,7 +1667,7 @@ struct nftnl_set *nft_set_batch_lookup_byid(struct nft_handle *h,
|
||||
|
||||
static void
|
||||
__nft_rule_flush(struct nft_handle *h, const char *table,
|
||||
- const char *chain, bool verbose, bool implicit)
|
||||
+ const char *chain, bool verbose, bool skip)
|
||||
{
|
||||
struct obj_update *obj;
|
||||
struct nftnl_rule *r;
|
||||
@@ -1690,7 +1689,7 @@ __nft_rule_flush(struct nft_handle *h, const char *table,
|
||||
return;
|
||||
}
|
||||
|
||||
- obj->implicit = implicit;
|
||||
+ obj->skip = skip;
|
||||
}
|
||||
|
||||
int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
|
||||
@@ -1786,17 +1785,12 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
|
||||
int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table)
|
||||
{
|
||||
struct nftnl_chain_list *list;
|
||||
+ struct obj_update *obj;
|
||||
struct nftnl_chain *c;
|
||||
bool created = false;
|
||||
|
||||
c = nft_chain_find(h, table, chain);
|
||||
- if (c) {
|
||||
- /* Apparently -n still flushes existing user defined
|
||||
- * chains that are redefined.
|
||||
- */
|
||||
- if (h->noflush)
|
||||
- __nft_rule_flush(h, table, chain, false, true);
|
||||
- } else {
|
||||
+ if (!c) {
|
||||
c = nftnl_chain_alloc();
|
||||
if (!c)
|
||||
return 0;
|
||||
@@ -1804,20 +1798,26 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
|
||||
nftnl_chain_set_str(c, NFTNL_CHAIN_TABLE, table);
|
||||
nftnl_chain_set_str(c, NFTNL_CHAIN_NAME, chain);
|
||||
created = true;
|
||||
- }
|
||||
|
||||
- if (h->family == NFPROTO_BRIDGE)
|
||||
- nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, NF_ACCEPT);
|
||||
+ list = nft_chain_list_get(h, table, chain);
|
||||
+ if (list)
|
||||
+ nftnl_chain_list_add(c, list);
|
||||
+ } else {
|
||||
+ /* If the chain should vanish meanwhile, kernel genid changes
|
||||
+ * and the transaction is refreshed enabling the chain add
|
||||
+ * object. With the handle still set, kernel interprets it as a
|
||||
+ * chain replace job and errors since it is not found anymore.
|
||||
+ */
|
||||
+ nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
|
||||
+ }
|
||||
|
||||
- if (!created)
|
||||
- return 1;
|
||||
+ __nft_rule_flush(h, table, chain, false, created);
|
||||
|
||||
- if (!batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c))
|
||||
+ obj = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c);
|
||||
+ if (!obj)
|
||||
return 0;
|
||||
|
||||
- list = nft_chain_list_get(h, table, chain);
|
||||
- if (list)
|
||||
- nftnl_chain_list_add(c, list);
|
||||
+ obj->skip = !created;
|
||||
|
||||
/* the core expects 1 for success and 0 for error */
|
||||
return 1;
|
||||
@@ -2751,11 +2751,6 @@ static void nft_refresh_transaction(struct nft_handle *h)
|
||||
h->error.lineno = 0;
|
||||
|
||||
list_for_each_entry_safe(n, tmp, &h->obj_list, head) {
|
||||
- if (n->implicit) {
|
||||
- batch_obj_del(h, n);
|
||||
- continue;
|
||||
- }
|
||||
-
|
||||
switch (n->type) {
|
||||
case NFT_COMPAT_TABLE_FLUSH:
|
||||
tablename = nftnl_table_get_str(n->table, NFTNL_TABLE_NAME);
|
||||
@@ -2781,14 +2776,22 @@ static void nft_refresh_transaction(struct nft_handle *h)
|
||||
|
||||
c = nft_chain_find(h, tablename, chainname);
|
||||
if (c) {
|
||||
- /* -restore -n flushes existing rules from redefined user-chain */
|
||||
- __nft_rule_flush(h, tablename,
|
||||
- chainname, false, true);
|
||||
n->skip = 1;
|
||||
} else if (!c) {
|
||||
n->skip = 0;
|
||||
}
|
||||
break;
|
||||
+ case NFT_COMPAT_RULE_FLUSH:
|
||||
+ tablename = nftnl_rule_get_str(n->rule, NFTNL_RULE_TABLE);
|
||||
+ if (!tablename)
|
||||
+ continue;
|
||||
+
|
||||
+ chainname = nftnl_rule_get_str(n->rule, NFTNL_RULE_CHAIN);
|
||||
+ if (!chainname)
|
||||
+ continue;
|
||||
+
|
||||
+ n->skip = !nft_chain_find(h, tablename, chainname);
|
||||
+ break;
|
||||
case NFT_COMPAT_TABLE_ADD:
|
||||
case NFT_COMPAT_CHAIN_ADD:
|
||||
case NFT_COMPAT_CHAIN_ZERO:
|
||||
@@ -2800,7 +2803,6 @@ static void nft_refresh_transaction(struct nft_handle *h)
|
||||
case NFT_COMPAT_RULE_INSERT:
|
||||
case NFT_COMPAT_RULE_REPLACE:
|
||||
case NFT_COMPAT_RULE_DELETE:
|
||||
- case NFT_COMPAT_RULE_FLUSH:
|
||||
case NFT_COMPAT_SET_ADD:
|
||||
case NFT_COMPAT_RULE_LIST:
|
||||
case NFT_COMPAT_RULE_CHECK:
|
||||
diff --git a/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0 b/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
|
||||
new file mode 100755
|
||||
index 0000000000000..53ec12fa368af
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
|
||||
@@ -0,0 +1,53 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+set -e
|
||||
+
|
||||
+RS="*filter
|
||||
+:INPUT ACCEPT [12024:3123388]
|
||||
+:FORWARD ACCEPT [0:0]
|
||||
+:OUTPUT ACCEPT [12840:2144421]
|
||||
+:FOO - [0:0]
|
||||
+:BAR0 - [0:0]
|
||||
+:BAR1 - [0:0]
|
||||
+:BAR2 - [0:0]
|
||||
+:BAR3 - [0:0]
|
||||
+:BAR4 - [0:0]
|
||||
+:BAR5 - [0:0]
|
||||
+:BAR6 - [0:0]
|
||||
+:BAR7 - [0:0]
|
||||
+:BAR8 - [0:0]
|
||||
+:BAR9 - [0:0]
|
||||
+"
|
||||
+
|
||||
+RS1="$RS
|
||||
+-X BAR3
|
||||
+-X BAR6
|
||||
+-X BAR9
|
||||
+-A FOO -s 9.9.0.1/32 -j BAR1
|
||||
+-A FOO -s 9.9.0.2/32 -j BAR2
|
||||
+-A FOO -s 9.9.0.4/32 -j BAR4
|
||||
+-A FOO -s 9.9.0.5/32 -j BAR5
|
||||
+-A FOO -s 9.9.0.7/32 -j BAR7
|
||||
+-A FOO -s 9.9.0.8/32 -j BAR8
|
||||
+COMMIT
|
||||
+"
|
||||
+
|
||||
+RS2="$RS
|
||||
+-X BAR2
|
||||
+-X BAR5
|
||||
+-X BAR7
|
||||
+-A FOO -s 9.9.0.1/32 -j BAR1
|
||||
+-A FOO -s 9.9.0.3/32 -j BAR3
|
||||
+-A FOO -s 9.9.0.4/32 -j BAR4
|
||||
+-A FOO -s 9.9.0.6/32 -j BAR6
|
||||
+-A FOO -s 9.9.0.8/32 -j BAR8
|
||||
+-A FOO -s 9.9.0.9/32 -j BAR9
|
||||
+COMMIT
|
||||
+"
|
||||
+
|
||||
+for n in $(seq 1 10); do
|
||||
+ $XT_MULTI iptables-restore --noflush -w <<< "$RS1" &
|
||||
+ $XT_MULTI iptables-restore --noflush -w <<< "$RS2" &
|
||||
+ wait -n
|
||||
+ wait -n
|
||||
+done
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,49 +0,0 @@
|
|||
From 8ae498f20e89ae11f8cbde9a16e0e5397a274a8c Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:09 +0100
|
||||
Subject: [PATCH] nft: Simplify nft_rule_insert() a bit
|
||||
|
||||
Fetch rule list right on top instead of in each branch separately.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 88bd4f28878bc7d41daa23098d68bf1bf6f5cea2)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 5 +----
|
||||
1 file changed, 1 insertion(+), 4 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 7d08a0884adde..469448f42cd6d 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -2091,8 +2091,8 @@ nft_rule_add(struct nft_handle *h, const char *chain,
|
||||
int nft_rule_insert(struct nft_handle *h, const char *chain,
|
||||
const char *table, void *data, int rulenum, bool verbose)
|
||||
{
|
||||
+ struct nftnl_rule_list *list = nft_rule_list_get(h);
|
||||
struct nftnl_rule *r, *new_rule;
|
||||
- struct nftnl_rule_list *list;
|
||||
uint64_t handle = 0;
|
||||
|
||||
/* If built-in chains don't exist for this table, create them */
|
||||
@@ -2102,7 +2102,6 @@ int nft_rule_insert(struct nft_handle *h, const char *chain,
|
||||
nft_fn = nft_rule_insert;
|
||||
|
||||
if (rulenum > 0) {
|
||||
- list = nft_rule_list_get(h);
|
||||
if (list == NULL)
|
||||
goto err;
|
||||
|
||||
@@ -2123,8 +2122,6 @@ int nft_rule_insert(struct nft_handle *h, const char *chain,
|
||||
|
||||
handle = nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE);
|
||||
DEBUGP("adding after rule handle %"PRIu64"\n", handle);
|
||||
- } else {
|
||||
- nft_rule_list_get(h);
|
||||
}
|
||||
|
||||
new_rule = nft_rule_add(h, chain, table, data, handle, verbose);
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -1,76 +0,0 @@
|
|||
From 0e72e49c0f220a9223de85574b878114bf8ceff3 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:10 +0100
|
||||
Subject: [PATCH] nft: Introduce fetch_chain_cache()
|
||||
|
||||
Move chain cache population from nft_chain_list_get() into a dedicated
|
||||
function.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 8bae620abf9ac81794acca43d305ca74f15a13ff)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 27 +++++++++++++++++----------
|
||||
1 file changed, 17 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 469448f42cd6d..b425577798679 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1295,20 +1295,12 @@ err:
|
||||
return MNL_CB_OK;
|
||||
}
|
||||
|
||||
-struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
- const char *table)
|
||||
+static int fetch_chain_cache(struct nft_handle *h)
|
||||
{
|
||||
char buf[16536];
|
||||
struct nlmsghdr *nlh;
|
||||
- const struct builtin_table *t;
|
||||
int i, ret;
|
||||
|
||||
- t = nft_table_builtin_find(h, table);
|
||||
- if (!t)
|
||||
- return NULL;
|
||||
-
|
||||
- if (h->table[t->type].chain_cache)
|
||||
- return h->table[t->type].chain_cache;
|
||||
retry:
|
||||
for (i = 0; i < NFT_TABLE_MAX; i++) {
|
||||
enum nft_table_type type = h->tables[i].type;
|
||||
@@ -1318,7 +1310,7 @@ retry:
|
||||
|
||||
h->table[type].chain_cache = nftnl_chain_list_alloc();
|
||||
if (!h->table[type].chain_cache)
|
||||
- return NULL;
|
||||
+ return -1;
|
||||
}
|
||||
|
||||
nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, h->family,
|
||||
@@ -1331,6 +1323,21 @@ retry:
|
||||
goto retry;
|
||||
}
|
||||
|
||||
+ return ret;
|
||||
+}
|
||||
+
|
||||
+struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
+ const char *table)
|
||||
+{
|
||||
+ const struct builtin_table *t;
|
||||
+
|
||||
+ t = nft_table_builtin_find(h, table);
|
||||
+ if (!t)
|
||||
+ return NULL;
|
||||
+
|
||||
+ if (!h->table[t->type].chain_cache)
|
||||
+ fetch_chain_cache(h);
|
||||
+
|
||||
return h->table[t->type].chain_cache;
|
||||
}
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
From bb80a77e8b0b2b557c4a2afd88446853e19236da Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Mon, 26 Oct 2020 17:25:03 +0100
|
||||
Subject: [PATCH] tests: shell: Improve concurrent noflush restore test a bit
|
||||
|
||||
The described issue happens only if chain FOO does not exist at program
|
||||
start so flush the ruleset after each iteration to make sure this is the
|
||||
case. Sadly the bug is still not 100% reproducible on my testing VM.
|
||||
|
||||
While being at it, add a paragraph describing what exact situation the
|
||||
test is trying to provoke.
|
||||
|
||||
Fixes: dac904bdcd9a1 ("nft: Fix for concurrent noflush restore calls")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit ed8c8b9316451a4499eeb592d2cf7d782bbe4e9a)
|
||||
---
|
||||
.../ipt-restore/0016-concurrent-restores_0 | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0 b/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
|
||||
index 53ec12fa368af..aa746ab458a3c 100755
|
||||
--- a/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
|
||||
+++ b/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
|
||||
@@ -1,5 +1,14 @@
|
||||
#!/bin/bash
|
||||
|
||||
+# test for iptables-restore --noflush skipping an explicitly requested chain
|
||||
+# flush because the chain did not exist when cache was fetched. In order to
|
||||
+# expect for that chain to appear when refreshing the transaction (due to a
|
||||
+# concurrent ruleset change), the chain flush job has to be present in batch
|
||||
+# job list (although disabled at first).
|
||||
+# The input line requesting chain flush is ':FOO - [0:0]'. RS1 and RS2 contents
|
||||
+# are crafted to cause EBUSY when deleting the BAR* chains if FOO is not
|
||||
+# flushed in the same transaction.
|
||||
+
|
||||
set -e
|
||||
|
||||
RS="*filter
|
||||
@@ -45,7 +54,12 @@ RS2="$RS
|
||||
COMMIT
|
||||
"
|
||||
|
||||
+NORS="*filter
|
||||
+COMMIT
|
||||
+"
|
||||
+
|
||||
for n in $(seq 1 10); do
|
||||
+ $XT_MULTI iptables-restore <<< "$NORS"
|
||||
$XT_MULTI iptables-restore --noflush -w <<< "$RS1" &
|
||||
$XT_MULTI iptables-restore --noflush -w <<< "$RS2" &
|
||||
wait -n
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,149 +0,0 @@
|
|||
From e3624bf4de451c53a3b42e1b83adab3051c03500 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:11 +0100
|
||||
Subject: [PATCH] nft: Move nft_rule_list_get() above nft_chain_list_get()
|
||||
|
||||
Later when introducing per chain rule caches, nft_rule_list_get() will
|
||||
be removed. But nftnl_rule_list_cb() which it uses will be reused to
|
||||
update each chain's rule cache from inside nftnl_chain_list_get(), so
|
||||
move both into position.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit eb13831f1c41c0efa626ab85d4448fb8ce4c87a2)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 110 ++++++++++++++++++++++++-------------------------
|
||||
1 file changed, 55 insertions(+), 55 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index b425577798679..1840561f2e531 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1326,61 +1326,6 @@ retry:
|
||||
return ret;
|
||||
}
|
||||
|
||||
-struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
- const char *table)
|
||||
-{
|
||||
- const struct builtin_table *t;
|
||||
-
|
||||
- t = nft_table_builtin_find(h, table);
|
||||
- if (!t)
|
||||
- return NULL;
|
||||
-
|
||||
- if (!h->table[t->type].chain_cache)
|
||||
- fetch_chain_cache(h);
|
||||
-
|
||||
- return h->table[t->type].chain_cache;
|
||||
-}
|
||||
-
|
||||
-static const char *policy_name[NF_ACCEPT+1] = {
|
||||
- [NF_DROP] = "DROP",
|
||||
- [NF_ACCEPT] = "ACCEPT",
|
||||
-};
|
||||
-
|
||||
-int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list)
|
||||
-{
|
||||
- struct nftnl_chain_list_iter *iter;
|
||||
- struct nft_family_ops *ops;
|
||||
- struct nftnl_chain *c;
|
||||
-
|
||||
- ops = nft_family_ops_lookup(h->family);
|
||||
-
|
||||
- iter = nftnl_chain_list_iter_create(list);
|
||||
- if (iter == NULL)
|
||||
- return 0;
|
||||
-
|
||||
- c = nftnl_chain_list_iter_next(iter);
|
||||
- while (c != NULL) {
|
||||
- const char *policy = NULL;
|
||||
-
|
||||
- if (nft_chain_builtin(c)) {
|
||||
- uint32_t pol = NF_ACCEPT;
|
||||
-
|
||||
- if (nftnl_chain_get(c, NFTNL_CHAIN_POLICY))
|
||||
- pol = nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
|
||||
- policy = policy_name[pol];
|
||||
- }
|
||||
-
|
||||
- if (ops->save_chain)
|
||||
- ops->save_chain(c, policy);
|
||||
-
|
||||
- c = nftnl_chain_list_iter_next(iter);
|
||||
- }
|
||||
-
|
||||
- nftnl_chain_list_iter_destroy(iter);
|
||||
-
|
||||
- return 1;
|
||||
-}
|
||||
-
|
||||
static int nftnl_rule_list_cb(const struct nlmsghdr *nlh, void *data)
|
||||
{
|
||||
struct nftnl_rule *r;
|
||||
@@ -1437,6 +1382,61 @@ retry:
|
||||
return list;
|
||||
}
|
||||
|
||||
+struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
+ const char *table)
|
||||
+{
|
||||
+ const struct builtin_table *t;
|
||||
+
|
||||
+ t = nft_table_builtin_find(h, table);
|
||||
+ if (!t)
|
||||
+ return NULL;
|
||||
+
|
||||
+ if (!h->table[t->type].chain_cache)
|
||||
+ fetch_chain_cache(h);
|
||||
+
|
||||
+ return h->table[t->type].chain_cache;
|
||||
+}
|
||||
+
|
||||
+static const char *policy_name[NF_ACCEPT+1] = {
|
||||
+ [NF_DROP] = "DROP",
|
||||
+ [NF_ACCEPT] = "ACCEPT",
|
||||
+};
|
||||
+
|
||||
+int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list)
|
||||
+{
|
||||
+ struct nftnl_chain_list_iter *iter;
|
||||
+ struct nft_family_ops *ops;
|
||||
+ struct nftnl_chain *c;
|
||||
+
|
||||
+ ops = nft_family_ops_lookup(h->family);
|
||||
+
|
||||
+ iter = nftnl_chain_list_iter_create(list);
|
||||
+ if (iter == NULL)
|
||||
+ return 0;
|
||||
+
|
||||
+ c = nftnl_chain_list_iter_next(iter);
|
||||
+ while (c != NULL) {
|
||||
+ const char *policy = NULL;
|
||||
+
|
||||
+ if (nft_chain_builtin(c)) {
|
||||
+ uint32_t pol = NF_ACCEPT;
|
||||
+
|
||||
+ if (nftnl_chain_get(c, NFTNL_CHAIN_POLICY))
|
||||
+ pol = nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
|
||||
+ policy = policy_name[pol];
|
||||
+ }
|
||||
+
|
||||
+ if (ops->save_chain)
|
||||
+ ops->save_chain(c, policy);
|
||||
+
|
||||
+ c = nftnl_chain_list_iter_next(iter);
|
||||
+ }
|
||||
+
|
||||
+ nftnl_chain_list_iter_destroy(iter);
|
||||
+
|
||||
+ return 1;
|
||||
+}
|
||||
+
|
||||
int nft_rule_save(struct nft_handle *h, const char *table, unsigned int format)
|
||||
{
|
||||
struct nftnl_rule_list *list;
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,149 @@
|
|||
From a48e8c5a7433c8f7d0f28ed321081b25f3b63a4a Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 2 Oct 2020 09:44:38 +0200
|
||||
Subject: [PATCH] nft: Optimize class-based IP prefix matches
|
||||
|
||||
Payload expression works on byte-boundaries, leverage this with suitable
|
||||
prefix lengths.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 323259001d617ae359430a03ee3d3e7f107684e0)
|
||||
---
|
||||
iptables/nft-arp.c | 11 ++++++++---
|
||||
iptables/nft-ipv4.c | 6 ++++--
|
||||
iptables/nft-ipv6.c | 6 ++++--
|
||||
iptables/nft-shared.c | 14 ++++++++++----
|
||||
iptables/nft-shared.h | 4 ++++
|
||||
5 files changed, 30 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
|
||||
index 67f4529d93652..952f0c6916e59 100644
|
||||
--- a/iptables/nft-arp.c
|
||||
+++ b/iptables/nft-arp.c
|
||||
@@ -303,7 +303,8 @@ static bool nft_arp_parse_devaddr(struct nft_xt_ctx *ctx,
|
||||
memcpy(info->mask, ctx->bitwise.mask, ETH_ALEN);
|
||||
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
||||
} else {
|
||||
- memset(info->mask, 0xff, ETH_ALEN);
|
||||
+ memset(info->mask, 0xff,
|
||||
+ min(ctx->payload.len, ETH_ALEN));
|
||||
}
|
||||
|
||||
return inv;
|
||||
@@ -360,7 +361,9 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
|
||||
parse_mask_ipv4(ctx, &fw->arp.smsk);
|
||||
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
||||
} else {
|
||||
- fw->arp.smsk.s_addr = 0xffffffff;
|
||||
+ memset(&fw->arp.smsk, 0xff,
|
||||
+ min(ctx->payload.len,
|
||||
+ sizeof(struct in_addr)));
|
||||
}
|
||||
|
||||
if (inv)
|
||||
@@ -380,7 +383,9 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
|
||||
parse_mask_ipv4(ctx, &fw->arp.tmsk);
|
||||
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
||||
} else {
|
||||
- fw->arp.tmsk.s_addr = 0xffffffff;
|
||||
+ memset(&fw->arp.tmsk, 0xff,
|
||||
+ min(ctx->payload.len,
|
||||
+ sizeof(struct in_addr)));
|
||||
}
|
||||
|
||||
if (inv)
|
||||
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
|
||||
index afdecf9711e64..ce702041af0f4 100644
|
||||
--- a/iptables/nft-ipv4.c
|
||||
+++ b/iptables/nft-ipv4.c
|
||||
@@ -199,7 +199,8 @@ static void nft_ipv4_parse_payload(struct nft_xt_ctx *ctx,
|
||||
parse_mask_ipv4(ctx, &cs->fw.ip.smsk);
|
||||
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
||||
} else {
|
||||
- cs->fw.ip.smsk.s_addr = 0xffffffff;
|
||||
+ memset(&cs->fw.ip.smsk, 0xff,
|
||||
+ min(ctx->payload.len, sizeof(struct in_addr)));
|
||||
}
|
||||
|
||||
if (inv)
|
||||
@@ -212,7 +213,8 @@ static void nft_ipv4_parse_payload(struct nft_xt_ctx *ctx,
|
||||
parse_mask_ipv4(ctx, &cs->fw.ip.dmsk);
|
||||
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
||||
} else {
|
||||
- cs->fw.ip.dmsk.s_addr = 0xffffffff;
|
||||
+ memset(&cs->fw.ip.dmsk, 0xff,
|
||||
+ min(ctx->payload.len, sizeof(struct in_addr)));
|
||||
}
|
||||
|
||||
if (inv)
|
||||
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
|
||||
index 4008b7eab4f2a..c877ec6d10887 100644
|
||||
--- a/iptables/nft-ipv6.c
|
||||
+++ b/iptables/nft-ipv6.c
|
||||
@@ -146,7 +146,8 @@ static void nft_ipv6_parse_payload(struct nft_xt_ctx *ctx,
|
||||
parse_mask_ipv6(ctx, &cs->fw6.ipv6.smsk);
|
||||
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
||||
} else {
|
||||
- memset(&cs->fw6.ipv6.smsk, 0xff, sizeof(struct in6_addr));
|
||||
+ memset(&cs->fw6.ipv6.smsk, 0xff,
|
||||
+ min(ctx->payload.len, sizeof(struct in6_addr)));
|
||||
}
|
||||
|
||||
if (inv)
|
||||
@@ -159,7 +160,8 @@ static void nft_ipv6_parse_payload(struct nft_xt_ctx *ctx,
|
||||
parse_mask_ipv6(ctx, &cs->fw6.ipv6.dmsk);
|
||||
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
||||
} else {
|
||||
- memset(&cs->fw6.ipv6.dmsk, 0xff, sizeof(struct in6_addr));
|
||||
+ memset(&cs->fw6.ipv6.dmsk, 0xff,
|
||||
+ min(ctx->payload.len, sizeof(struct in6_addr)));
|
||||
}
|
||||
|
||||
if (inv)
|
||||
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
||||
index 7741d23befc5a..545e9c60fa015 100644
|
||||
--- a/iptables/nft-shared.c
|
||||
+++ b/iptables/nft-shared.c
|
||||
@@ -166,16 +166,22 @@ void add_addr(struct nftnl_rule *r, int offset,
|
||||
void *data, void *mask, size_t len, uint32_t op)
|
||||
{
|
||||
const unsigned char *m = mask;
|
||||
+ bool bitwise = false;
|
||||
int i;
|
||||
|
||||
- add_payload(r, offset, len, NFT_PAYLOAD_NETWORK_HEADER);
|
||||
-
|
||||
for (i = 0; i < len; i++) {
|
||||
- if (m[i] != 0xff)
|
||||
+ if (m[i] != 0xff) {
|
||||
+ bitwise = m[i] != 0;
|
||||
break;
|
||||
+ }
|
||||
}
|
||||
|
||||
- if (i != len)
|
||||
+ if (!bitwise)
|
||||
+ len = i;
|
||||
+
|
||||
+ add_payload(r, offset, len, NFT_PAYLOAD_NETWORK_HEADER);
|
||||
+
|
||||
+ if (bitwise)
|
||||
add_bitwise(r, mask, len);
|
||||
|
||||
add_cmp_ptr(r, op, data, len);
|
||||
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
|
||||
index 94437ffe7990c..811fb9a1ebe76 100644
|
||||
--- a/iptables/nft-shared.h
|
||||
+++ b/iptables/nft-shared.h
|
||||
@@ -246,4 +246,8 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
const struct nft_xt_restore_parse *p);
|
||||
|
||||
void nft_check_xt_legacy(int family, bool is_ipt_save);
|
||||
+
|
||||
+#define min(x, y) ((x) < (y) ? (x) : (y))
|
||||
+#define max(x, y) ((x) > (y) ? (x) : (y))
|
||||
+
|
||||
#endif
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -0,0 +1,217 @@
|
|||
From 06f53a3a19c829417c4083fdbbbeba14c92c7b04 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 30 Oct 2020 14:08:33 +0100
|
||||
Subject: [PATCH] ebtables: Optimize masked MAC address matches
|
||||
|
||||
Just like with class-based prefix matches in iptables-nft, optimize
|
||||
masked MAC address matches if the mask is on a byte-boundary.
|
||||
|
||||
To reuse the logic in add_addr(), extend it to accept the payload base
|
||||
value via parameter.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 274cb05edc58d6fa982a34c84b2f4cf6acc3e335)
|
||||
---
|
||||
iptables/nft-arp.c | 12 ++++++++----
|
||||
iptables/nft-bridge.c | 22 ++++++++++------------
|
||||
iptables/nft-ipv4.c | 6 ++++--
|
||||
iptables/nft-ipv6.c | 6 ++++--
|
||||
iptables/nft-shared.c | 5 ++---
|
||||
iptables/nft-shared.h | 3 ++-
|
||||
6 files changed, 30 insertions(+), 24 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
|
||||
index 952f0c6916e59..5dc38da831aa0 100644
|
||||
--- a/iptables/nft-arp.c
|
||||
+++ b/iptables/nft-arp.c
|
||||
@@ -178,7 +178,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
|
||||
if (need_devaddr(&fw->arp.src_devaddr)) {
|
||||
op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCDEVADDR);
|
||||
- add_addr(r, sizeof(struct arphdr),
|
||||
+ add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
+ sizeof(struct arphdr),
|
||||
&fw->arp.src_devaddr.addr,
|
||||
&fw->arp.src_devaddr.mask,
|
||||
fw->arp.arhln, op);
|
||||
@@ -189,7 +190,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
fw->arp.smsk.s_addr != 0 ||
|
||||
fw->arp.invflags & ARPT_INV_SRCIP) {
|
||||
op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCIP);
|
||||
- add_addr(r, sizeof(struct arphdr) + fw->arp.arhln,
|
||||
+ add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
+ sizeof(struct arphdr) + fw->arp.arhln,
|
||||
&fw->arp.src.s_addr, &fw->arp.smsk.s_addr,
|
||||
sizeof(struct in_addr), op);
|
||||
}
|
||||
@@ -197,7 +199,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
|
||||
if (need_devaddr(&fw->arp.tgt_devaddr)) {
|
||||
op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTDEVADDR);
|
||||
- add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
|
||||
+ add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
+ sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
|
||||
&fw->arp.tgt_devaddr.addr,
|
||||
&fw->arp.tgt_devaddr.mask,
|
||||
fw->arp.arhln, op);
|
||||
@@ -207,7 +210,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
fw->arp.tmsk.s_addr != 0 ||
|
||||
fw->arp.invflags & ARPT_INV_TGTIP) {
|
||||
op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTIP);
|
||||
- add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr) + fw->arp.arhln,
|
||||
+ add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
+ sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr) + fw->arp.arhln,
|
||||
&fw->arp.tgt.s_addr, &fw->arp.tmsk.s_addr,
|
||||
sizeof(struct in_addr), op);
|
||||
}
|
||||
diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
|
||||
index dbf11eb5e1fa8..c1a2c209cc1aa 100644
|
||||
--- a/iptables/nft-bridge.c
|
||||
+++ b/iptables/nft-bridge.c
|
||||
@@ -159,20 +159,16 @@ static int nft_bridge_add(struct nft_handle *h,
|
||||
|
||||
if (fw->bitmask & EBT_ISOURCE) {
|
||||
op = nft_invflags2cmp(fw->invflags, EBT_ISOURCE);
|
||||
- add_payload(r, offsetof(struct ethhdr, h_source), 6,
|
||||
- NFT_PAYLOAD_LL_HEADER);
|
||||
- if (!mac_all_ones(fw->sourcemsk))
|
||||
- add_bitwise(r, fw->sourcemsk, 6);
|
||||
- add_cmp_ptr(r, op, fw->sourcemac, 6);
|
||||
+ add_addr(r, NFT_PAYLOAD_LL_HEADER,
|
||||
+ offsetof(struct ethhdr, h_source),
|
||||
+ fw->sourcemac, fw->sourcemsk, ETH_ALEN, op);
|
||||
}
|
||||
|
||||
if (fw->bitmask & EBT_IDEST) {
|
||||
op = nft_invflags2cmp(fw->invflags, EBT_IDEST);
|
||||
- add_payload(r, offsetof(struct ethhdr, h_dest), 6,
|
||||
- NFT_PAYLOAD_LL_HEADER);
|
||||
- if (!mac_all_ones(fw->destmsk))
|
||||
- add_bitwise(r, fw->destmsk, 6);
|
||||
- add_cmp_ptr(r, op, fw->destmac, 6);
|
||||
+ add_addr(r, NFT_PAYLOAD_LL_HEADER,
|
||||
+ offsetof(struct ethhdr, h_dest),
|
||||
+ fw->destmac, fw->destmsk, ETH_ALEN, op);
|
||||
}
|
||||
|
||||
if ((fw->bitmask & EBT_NOPROTO) == 0) {
|
||||
@@ -258,7 +254,8 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,
|
||||
memcpy(fw->destmsk, ctx->bitwise.mask, ETH_ALEN);
|
||||
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
||||
} else {
|
||||
- memset(&fw->destmsk, 0xff, ETH_ALEN);
|
||||
+ memset(&fw->destmsk, 0xff,
|
||||
+ min(ctx->payload.len, ETH_ALEN));
|
||||
}
|
||||
fw->bitmask |= EBT_IDEST;
|
||||
break;
|
||||
@@ -272,7 +269,8 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,
|
||||
memcpy(fw->sourcemsk, ctx->bitwise.mask, ETH_ALEN);
|
||||
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
||||
} else {
|
||||
- memset(&fw->sourcemsk, 0xff, ETH_ALEN);
|
||||
+ memset(&fw->sourcemsk, 0xff,
|
||||
+ min(ctx->payload.len, ETH_ALEN));
|
||||
}
|
||||
fw->bitmask |= EBT_ISOURCE;
|
||||
break;
|
||||
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
|
||||
index ce702041af0f4..fdc15c6f04066 100644
|
||||
--- a/iptables/nft-ipv4.c
|
||||
+++ b/iptables/nft-ipv4.c
|
||||
@@ -50,13 +50,15 @@ static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
|
||||
if (cs->fw.ip.src.s_addr || cs->fw.ip.smsk.s_addr || cs->fw.ip.invflags & IPT_INV_SRCIP) {
|
||||
op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_SRCIP);
|
||||
- add_addr(r, offsetof(struct iphdr, saddr),
|
||||
+ add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
+ offsetof(struct iphdr, saddr),
|
||||
&cs->fw.ip.src.s_addr, &cs->fw.ip.smsk.s_addr,
|
||||
sizeof(struct in_addr), op);
|
||||
}
|
||||
if (cs->fw.ip.dst.s_addr || cs->fw.ip.dmsk.s_addr || cs->fw.ip.invflags & IPT_INV_DSTIP) {
|
||||
op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_DSTIP);
|
||||
- add_addr(r, offsetof(struct iphdr, daddr),
|
||||
+ add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
+ offsetof(struct iphdr, daddr),
|
||||
&cs->fw.ip.dst.s_addr, &cs->fw.ip.dmsk.s_addr,
|
||||
sizeof(struct in_addr), op);
|
||||
}
|
||||
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
|
||||
index c877ec6d10887..130ad3e6e7c44 100644
|
||||
--- a/iptables/nft-ipv6.c
|
||||
+++ b/iptables/nft-ipv6.c
|
||||
@@ -51,7 +51,8 @@ static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
!IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.smsk) ||
|
||||
(cs->fw6.ipv6.invflags & IPT_INV_SRCIP)) {
|
||||
op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_SRCIP);
|
||||
- add_addr(r, offsetof(struct ip6_hdr, ip6_src),
|
||||
+ add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
+ offsetof(struct ip6_hdr, ip6_src),
|
||||
&cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk,
|
||||
sizeof(struct in6_addr), op);
|
||||
}
|
||||
@@ -59,7 +60,8 @@ static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
!IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.dmsk) ||
|
||||
(cs->fw6.ipv6.invflags & IPT_INV_DSTIP)) {
|
||||
op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_DSTIP);
|
||||
- add_addr(r, offsetof(struct ip6_hdr, ip6_dst),
|
||||
+ add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
+ offsetof(struct ip6_hdr, ip6_dst),
|
||||
&cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk,
|
||||
sizeof(struct in6_addr), op);
|
||||
}
|
||||
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
||||
index 545e9c60fa015..10553ab26823b 100644
|
||||
--- a/iptables/nft-shared.c
|
||||
+++ b/iptables/nft-shared.c
|
||||
@@ -20,7 +20,6 @@
|
||||
|
||||
#include <xtables.h>
|
||||
|
||||
-#include <linux/netfilter/nf_tables.h>
|
||||
#include <linux/netfilter/xt_comment.h>
|
||||
#include <linux/netfilter/xt_limit.h>
|
||||
|
||||
@@ -162,7 +161,7 @@ void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op)
|
||||
add_cmp_ptr(r, op, iface, iface_len + 1);
|
||||
}
|
||||
|
||||
-void add_addr(struct nftnl_rule *r, int offset,
|
||||
+void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
|
||||
void *data, void *mask, size_t len, uint32_t op)
|
||||
{
|
||||
const unsigned char *m = mask;
|
||||
@@ -179,7 +178,7 @@ void add_addr(struct nftnl_rule *r, int offset,
|
||||
if (!bitwise)
|
||||
len = i;
|
||||
|
||||
- add_payload(r, offset, len, NFT_PAYLOAD_NETWORK_HEADER);
|
||||
+ add_payload(r, offset, len, base);
|
||||
|
||||
if (bitwise)
|
||||
add_bitwise(r, mask, len);
|
||||
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
|
||||
index 811fb9a1ebe76..6fc81d9ce08ef 100644
|
||||
--- a/iptables/nft-shared.h
|
||||
+++ b/iptables/nft-shared.h
|
||||
@@ -8,6 +8,7 @@
|
||||
#include <libnftnl/chain.h>
|
||||
|
||||
#include <linux/netfilter_arp/arp_tables.h>
|
||||
+#include <linux/netfilter/nf_tables.h>
|
||||
|
||||
#include "xshared.h"
|
||||
|
||||
@@ -121,7 +122,7 @@ void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op);
|
||||
void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op);
|
||||
void add_iniface(struct nftnl_rule *r, char *iface, uint32_t op);
|
||||
void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op);
|
||||
-void add_addr(struct nftnl_rule *r, int offset,
|
||||
+void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
|
||||
void *data, void *mask, size_t len, uint32_t op);
|
||||
void add_proto(struct nftnl_rule *r, int offset, size_t len,
|
||||
uint8_t proto, uint32_t op);
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,802 +0,0 @@
|
|||
From 56521a8270d740184510f660492e2c9f8588afbf Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:12 +0100
|
||||
Subject: [PATCH] xtables: Implement per chain rule cache
|
||||
|
||||
Use recently introduced support for rules inside chains in libnftnl to
|
||||
introduce a rule cache per chain instead of a global one.
|
||||
|
||||
A tricky bit is to decide if cache should be updated or not. Previously,
|
||||
the global rule cache was populated just once and then reused unless
|
||||
being flushed completely (via call to flush_rule_cache() with
|
||||
NULL-pointer table argument). Resemble this behaviour by introducing a
|
||||
boolean indicating cache status and fetch rules for all chains when
|
||||
updating the chain cache in nft_chain_list_get().
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 947c51c95edbbf08d6b3c105177ac5cfa238aade)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 386 +++++++++++++++++++++----------------------------
|
||||
iptables/nft.h | 2 +-
|
||||
2 files changed, 166 insertions(+), 222 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 1840561f2e531..842ed2b805bee 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -772,28 +772,15 @@ int nft_init(struct nft_handle *h, const struct builtin_table *t)
|
||||
|
||||
static int __flush_rule_cache(struct nftnl_rule *r, void *data)
|
||||
{
|
||||
- const char *tablename = data;
|
||||
-
|
||||
- if (!strcmp(nftnl_rule_get_str(r, NFTNL_RULE_TABLE), tablename)) {
|
||||
- nftnl_rule_list_del(r);
|
||||
- nftnl_rule_free(r);
|
||||
- }
|
||||
+ nftnl_rule_list_del(r);
|
||||
+ nftnl_rule_free(r);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
-static void flush_rule_cache(struct nft_handle *h, const char *tablename)
|
||||
+static void flush_rule_cache(struct nftnl_chain *c)
|
||||
{
|
||||
- if (!h->rule_cache)
|
||||
- return;
|
||||
-
|
||||
- if (tablename) {
|
||||
- nftnl_rule_list_foreach(h->rule_cache, __flush_rule_cache,
|
||||
- (void *)tablename);
|
||||
- } else {
|
||||
- nftnl_rule_list_free(h->rule_cache);
|
||||
- h->rule_cache = NULL;
|
||||
- }
|
||||
+ nftnl_rule_foreach(c, __flush_rule_cache, NULL);
|
||||
}
|
||||
|
||||
static int __flush_chain_cache(struct nftnl_chain *c, void *data)
|
||||
@@ -830,12 +817,12 @@ static void flush_chain_cache(struct nft_handle *h, const char *tablename)
|
||||
nftnl_chain_list_free(h->table[i].chain_cache);
|
||||
h->table[i].chain_cache = NULL;
|
||||
}
|
||||
+ h->have_cache = false;
|
||||
}
|
||||
|
||||
void nft_fini(struct nft_handle *h)
|
||||
{
|
||||
flush_chain_cache(h, NULL);
|
||||
- flush_rule_cache(h, NULL);
|
||||
mnl_socket_close(h->nl);
|
||||
}
|
||||
|
||||
@@ -1195,12 +1182,14 @@ err:
|
||||
return NULL;
|
||||
}
|
||||
|
||||
-static struct nftnl_rule_list *nft_rule_list_get(struct nft_handle *h);
|
||||
+static struct nftnl_chain *
|
||||
+nft_chain_find(struct nft_handle *h, const char *table, const char *chain);
|
||||
|
||||
int
|
||||
nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
|
||||
void *data, uint64_t handle, bool verbose)
|
||||
{
|
||||
+ struct nftnl_chain *c;
|
||||
struct nftnl_rule *r;
|
||||
int type;
|
||||
|
||||
@@ -1228,10 +1217,9 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
|
||||
if (verbose)
|
||||
h->ops->print_rule(r, 0, FMT_PRINT_RULE);
|
||||
|
||||
- if (!nft_rule_list_get(h))
|
||||
- return 0;
|
||||
-
|
||||
- nftnl_rule_list_add_tail(r, h->rule_cache);
|
||||
+ c = nft_chain_find(h, table, chain);
|
||||
+ if (c)
|
||||
+ nftnl_chain_rule_add_tail(r, c);
|
||||
|
||||
return 1;
|
||||
}
|
||||
@@ -1328,58 +1316,75 @@ retry:
|
||||
|
||||
static int nftnl_rule_list_cb(const struct nlmsghdr *nlh, void *data)
|
||||
{
|
||||
+ struct nftnl_chain *c = data;
|
||||
struct nftnl_rule *r;
|
||||
- struct nftnl_rule_list *list = data;
|
||||
|
||||
r = nftnl_rule_alloc();
|
||||
if (r == NULL)
|
||||
- goto err;
|
||||
-
|
||||
- if (nftnl_rule_nlmsg_parse(nlh, r) < 0)
|
||||
- goto out;
|
||||
+ return MNL_CB_OK;
|
||||
|
||||
- nftnl_rule_list_add_tail(r, list);
|
||||
+ if (nftnl_rule_nlmsg_parse(nlh, r) < 0) {
|
||||
+ nftnl_rule_free(r);
|
||||
+ return MNL_CB_OK;
|
||||
+ }
|
||||
|
||||
- return MNL_CB_OK;
|
||||
-out:
|
||||
- nftnl_rule_free(r);
|
||||
- nftnl_rule_list_free(list);
|
||||
-err:
|
||||
+ nftnl_chain_rule_add_tail(r, c);
|
||||
return MNL_CB_OK;
|
||||
}
|
||||
|
||||
-static struct nftnl_rule_list *nft_rule_list_get(struct nft_handle *h)
|
||||
+static int nft_rule_list_update(struct nftnl_chain *c, void *data)
|
||||
{
|
||||
+ struct nft_handle *h = data;
|
||||
char buf[16536];
|
||||
struct nlmsghdr *nlh;
|
||||
- struct nftnl_rule_list *list;
|
||||
+ struct nftnl_rule *rule;
|
||||
int ret;
|
||||
|
||||
- if (h->rule_cache)
|
||||
- return h->rule_cache;
|
||||
+ rule = nftnl_rule_alloc();
|
||||
+ if (!rule)
|
||||
+ return -1;
|
||||
|
||||
-retry:
|
||||
- list = nftnl_rule_list_alloc();
|
||||
- if (list == NULL)
|
||||
- return 0;
|
||||
+ nftnl_rule_set_str(rule, NFTNL_RULE_TABLE,
|
||||
+ nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE));
|
||||
+ nftnl_rule_set_str(rule, NFTNL_RULE_CHAIN,
|
||||
+ nftnl_chain_get_str(c, NFTNL_CHAIN_NAME));
|
||||
|
||||
+retry:
|
||||
nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, h->family,
|
||||
NLM_F_DUMP, h->seq);
|
||||
+ nftnl_rule_nlmsg_build_payload(nlh, rule);
|
||||
|
||||
- ret = mnl_talk(h, nlh, nftnl_rule_list_cb, list);
|
||||
+ ret = mnl_talk(h, nlh, nftnl_rule_list_cb, c);
|
||||
if (ret < 0) {
|
||||
+ flush_rule_cache(c);
|
||||
+
|
||||
if (errno == EINTR) {
|
||||
assert(nft_restart(h) >= 0);
|
||||
- nftnl_rule_list_free(list);
|
||||
goto retry;
|
||||
}
|
||||
-
|
||||
- nftnl_rule_list_free(list);
|
||||
- return NULL;
|
||||
+ nftnl_rule_free(rule);
|
||||
+ return -1;
|
||||
}
|
||||
|
||||
- h->rule_cache = list;
|
||||
- return list;
|
||||
+ nftnl_rule_free(rule);
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+static int fetch_rule_cache(struct nft_handle *h)
|
||||
+{
|
||||
+ int i;
|
||||
+
|
||||
+ for (i = 0; i < NFT_TABLE_MAX; i++) {
|
||||
+ enum nft_table_type type = h->tables[i].type;
|
||||
+
|
||||
+ if (!h->tables[i].name)
|
||||
+ continue;
|
||||
+
|
||||
+ if (nftnl_chain_list_foreach(h->table[type].chain_cache,
|
||||
+ nft_rule_list_update, h))
|
||||
+ return -1;
|
||||
+ }
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
@@ -1391,8 +1396,11 @@ struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
if (!t)
|
||||
return NULL;
|
||||
|
||||
- if (!h->table[t->type].chain_cache)
|
||||
+ if (!h->have_cache) {
|
||||
fetch_chain_cache(h);
|
||||
+ fetch_rule_cache(h);
|
||||
+ h->have_cache = true;
|
||||
+ }
|
||||
|
||||
return h->table[t->type].chain_cache;
|
||||
}
|
||||
@@ -1437,38 +1445,54 @@ int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list)
|
||||
return 1;
|
||||
}
|
||||
|
||||
-int nft_rule_save(struct nft_handle *h, const char *table, unsigned int format)
|
||||
+static int nft_chain_save_rules(struct nft_handle *h,
|
||||
+ struct nftnl_chain *c, unsigned int format)
|
||||
{
|
||||
- struct nftnl_rule_list *list;
|
||||
- struct nftnl_rule_list_iter *iter;
|
||||
+ struct nftnl_rule_iter *iter;
|
||||
struct nftnl_rule *r;
|
||||
|
||||
- list = nft_rule_list_get(h);
|
||||
- if (list == NULL)
|
||||
- return 0;
|
||||
-
|
||||
- iter = nftnl_rule_list_iter_create(list);
|
||||
+ iter = nftnl_rule_iter_create(c);
|
||||
if (iter == NULL)
|
||||
- return 0;
|
||||
+ return 1;
|
||||
|
||||
- r = nftnl_rule_list_iter_next(iter);
|
||||
+ r = nftnl_rule_iter_next(iter);
|
||||
while (r != NULL) {
|
||||
- const char *rule_table =
|
||||
- nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
|
||||
+ nft_rule_print_save(r, NFT_RULE_APPEND, format);
|
||||
+ r = nftnl_rule_iter_next(iter);
|
||||
+ }
|
||||
|
||||
- if (strcmp(table, rule_table) != 0)
|
||||
- goto next;
|
||||
+ nftnl_rule_iter_destroy(iter);
|
||||
+ return 0;
|
||||
+}
|
||||
|
||||
- nft_rule_print_save(r, NFT_RULE_APPEND, format);
|
||||
+int nft_rule_save(struct nft_handle *h, const char *table, unsigned int format)
|
||||
+{
|
||||
+ struct nftnl_chain_list_iter *iter;
|
||||
+ struct nftnl_chain_list *list;
|
||||
+ struct nftnl_chain *c;
|
||||
+ int ret = 0;
|
||||
|
||||
-next:
|
||||
- r = nftnl_rule_list_iter_next(iter);
|
||||
+ list = nft_chain_list_get(h, table);
|
||||
+ if (!list)
|
||||
+ return 0;
|
||||
+
|
||||
+ iter = nftnl_chain_list_iter_create(list);
|
||||
+ if (!iter)
|
||||
+ return 0;
|
||||
+
|
||||
+ c = nftnl_chain_list_iter_next(iter);
|
||||
+ while (c) {
|
||||
+ ret = nft_chain_save_rules(h, c, format);
|
||||
+ if (ret != 0)
|
||||
+ break;
|
||||
+
|
||||
+ c = nftnl_chain_list_iter_next(iter);
|
||||
}
|
||||
|
||||
- nftnl_rule_list_iter_destroy(iter);
|
||||
+ nftnl_chain_list_iter_destroy(iter);
|
||||
|
||||
/* the core expects 1 for success and 0 for error */
|
||||
- return 1;
|
||||
+ return ret == 0 ? 1 : 0;
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -1567,6 +1591,7 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
|
||||
fprintf(stdout, "Flushing chain `%s'\n", chain_name);
|
||||
|
||||
__nft_rule_flush(h, table, chain_name);
|
||||
+ flush_rule_cache(c);
|
||||
|
||||
if (chain != NULL)
|
||||
break;
|
||||
@@ -1574,7 +1599,6 @@ next:
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
}
|
||||
nftnl_chain_list_iter_destroy(iter);
|
||||
- flush_rule_cache(h, table);
|
||||
err:
|
||||
/* the core expects 1 for success and 0 for error */
|
||||
return ret == 0 ? 1 : 0;
|
||||
@@ -1898,7 +1922,6 @@ static int __nft_table_flush(struct nft_handle *h, const char *table)
|
||||
h->table[_t->type].initialized = false;
|
||||
|
||||
flush_chain_cache(h, table);
|
||||
- flush_rule_cache(h, table);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -1939,12 +1962,6 @@ next:
|
||||
t = nftnl_table_list_iter_next(iter);
|
||||
}
|
||||
|
||||
- if (!h->rule_cache) {
|
||||
- h->rule_cache = nftnl_rule_list_alloc();
|
||||
- if (h->rule_cache == NULL)
|
||||
- return -1;
|
||||
- }
|
||||
-
|
||||
err_table_iter:
|
||||
nftnl_table_list_iter_destroy(iter);
|
||||
err_table_list:
|
||||
@@ -1975,31 +1992,19 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r)
|
||||
}
|
||||
|
||||
static struct nftnl_rule *
|
||||
-nft_rule_find(struct nft_handle *h, struct nftnl_rule_list *list,
|
||||
- const char *chain, const char *table, void *data, int rulenum)
|
||||
+nft_rule_find(struct nft_handle *h, struct nftnl_chain *c, void *data, int rulenum)
|
||||
{
|
||||
struct nftnl_rule *r;
|
||||
- struct nftnl_rule_list_iter *iter;
|
||||
+ struct nftnl_rule_iter *iter;
|
||||
int rule_ctr = 0;
|
||||
bool found = false;
|
||||
|
||||
- iter = nftnl_rule_list_iter_create(list);
|
||||
+ iter = nftnl_rule_iter_create(c);
|
||||
if (iter == NULL)
|
||||
return 0;
|
||||
|
||||
- r = nftnl_rule_list_iter_next(iter);
|
||||
+ r = nftnl_rule_iter_next(iter);
|
||||
while (r != NULL) {
|
||||
- const char *rule_table =
|
||||
- nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
|
||||
- const char *rule_chain =
|
||||
- nftnl_rule_get_str(r, NFTNL_RULE_CHAIN);
|
||||
-
|
||||
- if (strcmp(table, rule_table) != 0 ||
|
||||
- strcmp(chain, rule_chain) != 0) {
|
||||
- DEBUGP("different chain / table\n");
|
||||
- goto next;
|
||||
- }
|
||||
-
|
||||
if (rulenum >= 0) {
|
||||
/* Delete by rule number case */
|
||||
if (rule_ctr == rulenum) {
|
||||
@@ -2012,11 +2017,10 @@ nft_rule_find(struct nft_handle *h, struct nftnl_rule_list *list,
|
||||
break;
|
||||
}
|
||||
rule_ctr++;
|
||||
-next:
|
||||
- r = nftnl_rule_list_iter_next(iter);
|
||||
+ r = nftnl_rule_iter_next(iter);
|
||||
}
|
||||
|
||||
- nftnl_rule_list_iter_destroy(iter);
|
||||
+ nftnl_rule_iter_destroy(iter);
|
||||
|
||||
return found ? r : NULL;
|
||||
}
|
||||
@@ -2024,16 +2028,16 @@ next:
|
||||
int nft_rule_check(struct nft_handle *h, const char *chain,
|
||||
const char *table, void *data, bool verbose)
|
||||
{
|
||||
- struct nftnl_rule_list *list;
|
||||
+ struct nftnl_chain *c;
|
||||
struct nftnl_rule *r;
|
||||
|
||||
nft_fn = nft_rule_check;
|
||||
|
||||
- list = nft_rule_list_get(h);
|
||||
- if (list == NULL)
|
||||
+ c = nft_chain_find(h, table, chain);
|
||||
+ if (!c)
|
||||
return 0;
|
||||
|
||||
- r = nft_rule_find(h, list, chain, table, data, -1);
|
||||
+ r = nft_rule_find(h, c, data, -1);
|
||||
if (r == NULL) {
|
||||
errno = ENOENT;
|
||||
return 0;
|
||||
@@ -2048,16 +2052,18 @@ int nft_rule_delete(struct nft_handle *h, const char *chain,
|
||||
const char *table, void *data, bool verbose)
|
||||
{
|
||||
int ret = 0;
|
||||
+ struct nftnl_chain *c;
|
||||
struct nftnl_rule *r;
|
||||
- struct nftnl_rule_list *list;
|
||||
|
||||
nft_fn = nft_rule_delete;
|
||||
|
||||
- list = nft_rule_list_get(h);
|
||||
- if (list == NULL)
|
||||
+ c = nft_chain_find(h, table, chain);
|
||||
+ if (!c) {
|
||||
+ errno = ENOENT;
|
||||
return 0;
|
||||
+ }
|
||||
|
||||
- r = nft_rule_find(h, list, chain, table, data, -1);
|
||||
+ r = nft_rule_find(h, c, data, -1);
|
||||
if (r != NULL) {
|
||||
ret =__nft_rule_del(h, r);
|
||||
if (ret < 0)
|
||||
@@ -2098,8 +2104,8 @@ nft_rule_add(struct nft_handle *h, const char *chain,
|
||||
int nft_rule_insert(struct nft_handle *h, const char *chain,
|
||||
const char *table, void *data, int rulenum, bool verbose)
|
||||
{
|
||||
- struct nftnl_rule_list *list = nft_rule_list_get(h);
|
||||
struct nftnl_rule *r, *new_rule;
|
||||
+ struct nftnl_chain *c;
|
||||
uint64_t handle = 0;
|
||||
|
||||
/* If built-in chains don't exist for this table, create them */
|
||||
@@ -2108,17 +2114,19 @@ int nft_rule_insert(struct nft_handle *h, const char *chain,
|
||||
|
||||
nft_fn = nft_rule_insert;
|
||||
|
||||
- if (rulenum > 0) {
|
||||
- if (list == NULL)
|
||||
- goto err;
|
||||
+ c = nft_chain_find(h, table, chain);
|
||||
+ if (!c) {
|
||||
+ errno = ENOENT;
|
||||
+ goto err;
|
||||
+ }
|
||||
|
||||
- r = nft_rule_find(h, list, chain, table, data, rulenum);
|
||||
+ if (rulenum > 0) {
|
||||
+ r = nft_rule_find(h, c, data, rulenum);
|
||||
if (r == NULL) {
|
||||
/* special case: iptables allows to insert into
|
||||
* rule_count + 1 position.
|
||||
*/
|
||||
- r = nft_rule_find(h, list, chain, table, data,
|
||||
- rulenum - 1);
|
||||
+ r = nft_rule_find(h, c, data, rulenum - 1);
|
||||
if (r != NULL)
|
||||
return nft_rule_append(h, chain, table, data,
|
||||
0, verbose);
|
||||
@@ -2136,9 +2144,9 @@ int nft_rule_insert(struct nft_handle *h, const char *chain,
|
||||
goto err;
|
||||
|
||||
if (handle)
|
||||
- nftnl_rule_list_insert_at(new_rule, r);
|
||||
+ nftnl_chain_rule_insert_at(new_rule, r);
|
||||
else
|
||||
- nftnl_rule_list_add(new_rule, h->rule_cache);
|
||||
+ nftnl_chain_rule_add(new_rule, c);
|
||||
|
||||
return 1;
|
||||
err:
|
||||
@@ -2149,16 +2157,18 @@ int nft_rule_delete_num(struct nft_handle *h, const char *chain,
|
||||
const char *table, int rulenum, bool verbose)
|
||||
{
|
||||
int ret = 0;
|
||||
+ struct nftnl_chain *c;
|
||||
struct nftnl_rule *r;
|
||||
- struct nftnl_rule_list *list;
|
||||
|
||||
nft_fn = nft_rule_delete_num;
|
||||
|
||||
- list = nft_rule_list_get(h);
|
||||
- if (list == NULL)
|
||||
+ c = nft_chain_find(h, table, chain);
|
||||
+ if (!c) {
|
||||
+ errno = ENOENT;
|
||||
return 0;
|
||||
+ }
|
||||
|
||||
- r = nft_rule_find(h, list, chain, table, NULL, rulenum);
|
||||
+ r = nft_rule_find(h, c, NULL, rulenum);
|
||||
if (r != NULL) {
|
||||
DEBUGP("deleting rule by number %d\n", rulenum);
|
||||
ret = __nft_rule_del(h, r);
|
||||
@@ -2174,16 +2184,18 @@ int nft_rule_replace(struct nft_handle *h, const char *chain,
|
||||
const char *table, void *data, int rulenum, bool verbose)
|
||||
{
|
||||
int ret = 0;
|
||||
+ struct nftnl_chain *c;
|
||||
struct nftnl_rule *r;
|
||||
- struct nftnl_rule_list *list;
|
||||
|
||||
nft_fn = nft_rule_replace;
|
||||
|
||||
- list = nft_rule_list_get(h);
|
||||
- if (list == NULL)
|
||||
+ c = nft_chain_find(h, table, chain);
|
||||
+ if (!c) {
|
||||
+ errno = ENOENT;
|
||||
return 0;
|
||||
+ }
|
||||
|
||||
- r = nft_rule_find(h, list, chain, table, data, rulenum);
|
||||
+ r = nft_rule_find(h, c, data, rulenum);
|
||||
if (r != NULL) {
|
||||
DEBUGP("replacing rule with handle=%llu\n",
|
||||
(unsigned long long)
|
||||
@@ -2201,35 +2213,21 @@ int nft_rule_replace(struct nft_handle *h, const char *chain,
|
||||
}
|
||||
|
||||
static int
|
||||
-__nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
||||
+__nft_rule_list(struct nft_handle *h, struct nftnl_chain *c,
|
||||
int rulenum, unsigned int format,
|
||||
void (*cb)(struct nftnl_rule *r, unsigned int num,
|
||||
unsigned int format))
|
||||
{
|
||||
- struct nftnl_rule_list *list;
|
||||
- struct nftnl_rule_list_iter *iter;
|
||||
+ struct nftnl_rule_iter *iter;
|
||||
struct nftnl_rule *r;
|
||||
int rule_ctr = 0;
|
||||
|
||||
- list = nft_rule_list_get(h);
|
||||
- if (list == NULL)
|
||||
- return 0;
|
||||
-
|
||||
- iter = nftnl_rule_list_iter_create(list);
|
||||
+ iter = nftnl_rule_iter_create(c);
|
||||
if (iter == NULL)
|
||||
return 0;
|
||||
|
||||
- r = nftnl_rule_list_iter_next(iter);
|
||||
+ r = nftnl_rule_iter_next(iter);
|
||||
while (r != NULL) {
|
||||
- const char *rule_table =
|
||||
- nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
|
||||
- const char *rule_chain =
|
||||
- nftnl_rule_get_str(r, NFTNL_RULE_CHAIN);
|
||||
-
|
||||
- if (strcmp(table, rule_table) != 0 ||
|
||||
- strcmp(chain, rule_chain) != 0)
|
||||
- goto next;
|
||||
-
|
||||
rule_ctr++;
|
||||
|
||||
if (rulenum > 0 && rule_ctr != rulenum) {
|
||||
@@ -2242,46 +2240,30 @@ __nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
||||
break;
|
||||
|
||||
next:
|
||||
- r = nftnl_rule_list_iter_next(iter);
|
||||
+ r = nftnl_rule_iter_next(iter);
|
||||
}
|
||||
|
||||
- nftnl_rule_list_iter_destroy(iter);
|
||||
+ nftnl_rule_iter_destroy(iter);
|
||||
return 1;
|
||||
}
|
||||
|
||||
-static int nft_rule_count(struct nft_handle *h,
|
||||
- const char *chain, const char *table)
|
||||
+static int nft_rule_count(struct nft_handle *h, struct nftnl_chain *c)
|
||||
{
|
||||
- struct nftnl_rule_list_iter *iter;
|
||||
- struct nftnl_rule_list *list;
|
||||
+ struct nftnl_rule_iter *iter;
|
||||
struct nftnl_rule *r;
|
||||
int rule_ctr = 0;
|
||||
|
||||
- list = nft_rule_list_get(h);
|
||||
- if (list == NULL)
|
||||
- return 0;
|
||||
-
|
||||
- iter = nftnl_rule_list_iter_create(list);
|
||||
+ iter = nftnl_rule_iter_create(c);
|
||||
if (iter == NULL)
|
||||
return 0;
|
||||
|
||||
- r = nftnl_rule_list_iter_next(iter);
|
||||
+ r = nftnl_rule_iter_next(iter);
|
||||
while (r != NULL) {
|
||||
- const char *rule_table =
|
||||
- nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
|
||||
- const char *rule_chain =
|
||||
- nftnl_rule_get_str(r, NFTNL_RULE_CHAIN);
|
||||
-
|
||||
- if (strcmp(table, rule_table) != 0 ||
|
||||
- strcmp(chain, rule_chain) != 0)
|
||||
- goto next;
|
||||
-
|
||||
rule_ctr++;
|
||||
-next:
|
||||
- r = nftnl_rule_list_iter_next(iter);
|
||||
+ r = nftnl_rule_iter_next(iter);
|
||||
}
|
||||
|
||||
- nftnl_rule_list_iter_destroy(iter);
|
||||
+ nftnl_rule_iter_destroy(iter);
|
||||
return rule_ctr;
|
||||
}
|
||||
|
||||
@@ -2314,8 +2296,11 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
||||
}
|
||||
|
||||
if (chain && rulenum) {
|
||||
- __nft_rule_list(h, chain, table,
|
||||
- rulenum, format, ops->print_rule);
|
||||
+ c = nft_chain_find(h, table, chain);
|
||||
+ if (!c)
|
||||
+ return 0;
|
||||
+
|
||||
+ __nft_rule_list(h, c, rulenum, format, ops->print_rule);
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -2358,12 +2343,11 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
||||
if (found)
|
||||
printf("\n");
|
||||
|
||||
- entries = nft_rule_count(h, chain_name, table);
|
||||
+ entries = nft_rule_count(h, c);
|
||||
ops->print_header(format, chain_name, policy_name[policy],
|
||||
&ctrs, basechain, refs - entries, entries);
|
||||
|
||||
- __nft_rule_list(h, chain_name, table,
|
||||
- rulenum, format, ops->print_rule);
|
||||
+ __nft_rule_list(h, c, rulenum, format, ops->print_rule);
|
||||
|
||||
found = true;
|
||||
|
||||
@@ -2484,8 +2468,7 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain,
|
||||
if (chain && strcmp(chain, chain_name) != 0)
|
||||
goto next;
|
||||
|
||||
- ret = __nft_rule_list(h, chain_name, table, rulenum,
|
||||
- format, list_save);
|
||||
+ ret = __nft_rule_list(h, c, rulenum, format, list_save);
|
||||
|
||||
/* we printed the chain we wanted, stop processing. */
|
||||
if (chain)
|
||||
@@ -2503,17 +2486,17 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain,
|
||||
const char *table, int rulenum)
|
||||
{
|
||||
struct iptables_command_state cs = {};
|
||||
- struct nftnl_rule_list *list;
|
||||
+ struct nftnl_chain *c;
|
||||
struct nftnl_rule *r;
|
||||
int ret = 0;
|
||||
|
||||
nft_fn = nft_rule_delete;
|
||||
|
||||
- list = nft_rule_list_get(h);
|
||||
- if (list == NULL)
|
||||
+ c = nft_chain_find(h, table, chain);
|
||||
+ if (!c)
|
||||
return 0;
|
||||
|
||||
- r = nft_rule_find(h, list, chain, table, NULL, rulenum);
|
||||
+ r = nft_rule_find(h, c, NULL, rulenum);
|
||||
if (r == NULL) {
|
||||
errno = ENOENT;
|
||||
ret = 1;
|
||||
@@ -2982,38 +2965,19 @@ int nft_xtables_config_load(struct nft_handle *h, const char *filename,
|
||||
static void nft_chain_zero_rule_counters(struct nft_handle *h,
|
||||
struct nftnl_chain *c)
|
||||
{
|
||||
- struct nftnl_rule_list_iter *iter;
|
||||
- struct nftnl_rule_list *list;
|
||||
- const char *table_name;
|
||||
- const char *chain_name;
|
||||
+ struct nftnl_rule_iter *iter;
|
||||
struct nftnl_rule *r;
|
||||
|
||||
- list = nft_rule_list_get(h);
|
||||
- if (list == NULL)
|
||||
- return;
|
||||
- iter = nftnl_rule_list_iter_create(list);
|
||||
+ iter = nftnl_rule_iter_create(c);
|
||||
if (iter == NULL)
|
||||
return;
|
||||
|
||||
- table_name = nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
||||
- chain_name = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
-
|
||||
- r = nftnl_rule_list_iter_next(iter);
|
||||
+ r = nftnl_rule_iter_next(iter);
|
||||
while (r != NULL) {
|
||||
struct nftnl_expr_iter *ei;
|
||||
- const char *table_chain;
|
||||
- const char *rule_chain;
|
||||
struct nftnl_expr *e;
|
||||
bool zero_needed;
|
||||
|
||||
- table_chain = nftnl_rule_get_str(r, NFTNL_RULE_TABLE);
|
||||
- if (strcmp(table_chain, table_name))
|
||||
- goto next;
|
||||
-
|
||||
- rule_chain = nftnl_rule_get_str(r, NFTNL_RULE_CHAIN);
|
||||
- if (strcmp(rule_chain, chain_name))
|
||||
- goto next;
|
||||
-
|
||||
ei = nftnl_expr_iter_create(r);
|
||||
if (!ei)
|
||||
break;
|
||||
@@ -3044,11 +3008,10 @@ static void nft_chain_zero_rule_counters(struct nft_handle *h,
|
||||
nftnl_rule_unset(r, NFTNL_RULE_POSITION);
|
||||
batch_rule_add(h, NFT_COMPAT_RULE_REPLACE, r);
|
||||
}
|
||||
-next:
|
||||
- r = nftnl_rule_list_iter_next(iter);
|
||||
+ r = nftnl_rule_iter_next(iter);
|
||||
}
|
||||
|
||||
- nftnl_rule_list_iter_destroy(iter);
|
||||
+ nftnl_rule_iter_destroy(iter);
|
||||
}
|
||||
|
||||
int nft_chain_zero_counters(struct nft_handle *h, const char *chain,
|
||||
@@ -3143,19 +3106,8 @@ static int nft_is_expr_compatible(struct nftnl_expr *expr, void *data)
|
||||
return -1;
|
||||
}
|
||||
|
||||
-struct nft_is_rule_compatible_data {
|
||||
- const char *tablename;
|
||||
-};
|
||||
-
|
||||
static int nft_is_rule_compatible(struct nftnl_rule *rule, void *data)
|
||||
{
|
||||
- const char *table = nftnl_rule_get_str(rule, NFTNL_RULE_TABLE);
|
||||
- struct nft_is_rule_compatible_data *d = data;
|
||||
-
|
||||
- /* ignore rules belonging to a different table */
|
||||
- if (strcmp(table, d->tablename))
|
||||
- return 0;
|
||||
-
|
||||
return nftnl_expr_foreach(rule, nft_is_expr_compatible, NULL);
|
||||
}
|
||||
|
||||
@@ -3167,6 +3119,9 @@ static int nft_is_chain_compatible(struct nftnl_chain *c, void *data)
|
||||
enum nf_inet_hooks hook;
|
||||
int i, prio;
|
||||
|
||||
+ if (nftnl_rule_foreach(c, nft_is_rule_compatible, NULL))
|
||||
+ return -1;
|
||||
+
|
||||
if (!nft_chain_builtin(c))
|
||||
return 0;
|
||||
|
||||
@@ -3210,11 +3165,7 @@ static int nft_is_chain_compatible(struct nftnl_chain *c, void *data)
|
||||
|
||||
bool nft_is_table_compatible(struct nft_handle *h, const char *tablename)
|
||||
{
|
||||
- struct nft_is_rule_compatible_data rcd = {
|
||||
- .tablename = tablename
|
||||
- };
|
||||
struct nftnl_chain_list *clist;
|
||||
- struct nftnl_rule_list *list;
|
||||
|
||||
clist = nft_chain_list_get(h, tablename);
|
||||
if (clist == NULL)
|
||||
@@ -3223,12 +3174,5 @@ bool nft_is_table_compatible(struct nft_handle *h, const char *tablename)
|
||||
if (nftnl_chain_list_foreach(clist, nft_is_chain_compatible, h))
|
||||
return false;
|
||||
|
||||
- list = nft_rule_list_get(h);
|
||||
- if (list == NULL)
|
||||
- return true;
|
||||
-
|
||||
- if (nftnl_rule_list_foreach(list, nft_is_rule_compatible, &rcd))
|
||||
- return false;
|
||||
-
|
||||
return true;
|
||||
}
|
||||
diff --git a/iptables/nft.h b/iptables/nft.h
|
||||
index bf60ab3943659..6568257feddc7 100644
|
||||
--- a/iptables/nft.h
|
||||
+++ b/iptables/nft.h
|
||||
@@ -42,7 +42,7 @@ struct nft_handle {
|
||||
struct nftnl_chain_list *chain_cache;
|
||||
bool initialized;
|
||||
} table[NFT_TABLE_MAX];
|
||||
- struct nftnl_rule_list *rule_cache;
|
||||
+ bool have_cache;
|
||||
bool restore;
|
||||
int8_t config_done;
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -1,89 +0,0 @@
|
|||
From 4255a54501f8588b4bd346cd36379cccd6e0abc7 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:13 +0100
|
||||
Subject: [PATCH] nft: Drop nft_chain_list_find()
|
||||
|
||||
Replace the function by nftnl_chain_list_lookup_byname() as provided by
|
||||
libnftnl.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 63dc7a0d86a1b86b10c5e04dd910497b9d8fcfaf)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 31 ++-----------------------------
|
||||
iptables/nft.h | 2 --
|
||||
2 files changed, 2 insertions(+), 31 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 842ed2b805bee..883fb3db2c671 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -697,7 +697,7 @@ static void nft_chain_builtin_init(struct nft_handle *h,
|
||||
/* Initialize built-in chains if they don't exist yet */
|
||||
for (i=0; i < NF_INET_NUMHOOKS && table->chains[i].name != NULL; i++) {
|
||||
|
||||
- c = nft_chain_list_find(list, table->chains[i].name);
|
||||
+ c = nftnl_chain_list_lookup_byname(list, table->chains[i].name);
|
||||
if (c != NULL)
|
||||
continue;
|
||||
|
||||
@@ -1699,33 +1699,6 @@ err:
|
||||
return ret == 0 ? 1 : 0;
|
||||
}
|
||||
|
||||
-struct nftnl_chain *
|
||||
-nft_chain_list_find(struct nftnl_chain_list *list, const char *chain)
|
||||
-{
|
||||
- struct nftnl_chain_list_iter *iter;
|
||||
- struct nftnl_chain *c;
|
||||
-
|
||||
- iter = nftnl_chain_list_iter_create(list);
|
||||
- if (iter == NULL)
|
||||
- return NULL;
|
||||
-
|
||||
- c = nftnl_chain_list_iter_next(iter);
|
||||
- while (c != NULL) {
|
||||
- const char *chain_name =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
-
|
||||
- if (strcmp(chain, chain_name) != 0)
|
||||
- goto next;
|
||||
-
|
||||
- nftnl_chain_list_iter_destroy(iter);
|
||||
- return c;
|
||||
-next:
|
||||
- c = nftnl_chain_list_iter_next(iter);
|
||||
- }
|
||||
- nftnl_chain_list_iter_destroy(iter);
|
||||
- return NULL;
|
||||
-}
|
||||
-
|
||||
static struct nftnl_chain *
|
||||
nft_chain_find(struct nft_handle *h, const char *table, const char *chain)
|
||||
{
|
||||
@@ -1735,7 +1708,7 @@ nft_chain_find(struct nft_handle *h, const char *table, const char *chain)
|
||||
if (list == NULL)
|
||||
return NULL;
|
||||
|
||||
- return nft_chain_list_find(list, chain);
|
||||
+ return nftnl_chain_list_lookup_byname(list, chain);
|
||||
}
|
||||
|
||||
bool nft_chain_exists(struct nft_handle *h,
|
||||
diff --git a/iptables/nft.h b/iptables/nft.h
|
||||
index 6568257feddc7..dfdffd69342db 100644
|
||||
--- a/iptables/nft.h
|
||||
+++ b/iptables/nft.h
|
||||
@@ -83,8 +83,6 @@ struct nftnl_chain;
|
||||
int nft_chain_set(struct nft_handle *h, const char *table, const char *chain, const char *policy, const struct xt_counters *counters);
|
||||
struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
|
||||
const char *table);
|
||||
-struct nftnl_chain *nft_chain_list_find(struct nftnl_chain_list *list,
|
||||
- const char *chain);
|
||||
int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list);
|
||||
int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *table);
|
||||
int nft_chain_user_del(struct nft_handle *h, const char *chain, const char *table, bool verbose);
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,365 @@
|
|||
From f07a5fdd6c2a5ffe962ba77b8bfa08673f3b9408 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 10 Nov 2020 14:50:46 +0100
|
||||
Subject: [PATCH] tests/shell: Add test for bitwise avoidance fixes
|
||||
|
||||
Masked address matching was recently improved to avoid bitwise
|
||||
expression if the given mask covers full bytes. Make use of nft netlink
|
||||
debug output to assert iptables-nft generates the right bytecode for
|
||||
each situation.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 81a2e128512837b53e5b9ea501b6c8dc64eeca78)
|
||||
---
|
||||
.../nft-only/0009-needless-bitwise_0 | 339 ++++++++++++++++++
|
||||
1 file changed, 339 insertions(+)
|
||||
create mode 100755 iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
|
||||
new file mode 100755
|
||||
index 0000000000000..c5c6e706a1029
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
|
||||
@@ -0,0 +1,339 @@
|
||||
+#!/bin/bash -x
|
||||
+
|
||||
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+set -e
|
||||
+
|
||||
+nft flush ruleset
|
||||
+
|
||||
+(
|
||||
+ echo "*filter"
|
||||
+ for plen in "" 32 30 24 16 8 0; do
|
||||
+ addr="10.1.2.3${plen:+/}$plen"
|
||||
+ echo "-A OUTPUT -d $addr"
|
||||
+ done
|
||||
+ echo "COMMIT"
|
||||
+) | $XT_MULTI iptables-restore
|
||||
+
|
||||
+(
|
||||
+ echo "*filter"
|
||||
+ for plen in "" 128 124 120 112 88 80 64 48 16 8 0; do
|
||||
+ addr="feed:c0ff:ee00:0102:0304:0506:0708:090A${plen:+/}$plen"
|
||||
+ echo "-A OUTPUT -d $addr"
|
||||
+ done
|
||||
+ echo "COMMIT"
|
||||
+) | $XT_MULTI ip6tables-restore
|
||||
+
|
||||
+masks="
|
||||
+ff:ff:ff:ff:ff:ff
|
||||
+ff:ff:ff:ff:ff:f0
|
||||
+ff:ff:ff:ff:ff:00
|
||||
+ff:ff:ff:ff:00:00
|
||||
+ff:ff:ff:00:00:00
|
||||
+ff:ff:00:00:00:00
|
||||
+ff:00:00:00:00:00
|
||||
+"
|
||||
+(
|
||||
+ echo "*filter"
|
||||
+ for plen in "" 32 30 24 16 8 0; do
|
||||
+ addr="10.1.2.3${plen:+/}$plen"
|
||||
+ echo "-A OUTPUT -d $addr"
|
||||
+ done
|
||||
+ for mask in $masks; do
|
||||
+ echo "-A OUTPUT --destination-mac fe:ed:00:c0:ff:ee/$mask"
|
||||
+ done
|
||||
+ echo "COMMIT"
|
||||
+) | $XT_MULTI arptables-restore
|
||||
+
|
||||
+(
|
||||
+ echo "*filter"
|
||||
+ for mask in $masks; do
|
||||
+ echo "-A OUTPUT -d fe:ed:00:c0:ff:ee/$mask"
|
||||
+ done
|
||||
+ echo "COMMIT"
|
||||
+) | $XT_MULTI ebtables-restore
|
||||
+
|
||||
+EXPECT="ip filter OUTPUT 4
|
||||
+ [ payload load 4b @ network header + 16 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0302010a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip filter OUTPUT 5 4
|
||||
+ [ payload load 4b @ network header + 16 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0302010a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip filter OUTPUT 6 5
|
||||
+ [ payload load 4b @ network header + 16 => reg 1 ]
|
||||
+ [ bitwise reg 1 = (reg=1 & 0xfcffffff ) ^ 0x00000000 ]
|
||||
+ [ cmp eq reg 1 0x0002010a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip filter OUTPUT 7 6
|
||||
+ [ payload load 3b @ network header + 16 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0002010a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip filter OUTPUT 8 7
|
||||
+ [ payload load 2b @ network header + 16 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0000010a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip filter OUTPUT 9 8
|
||||
+ [ payload load 1b @ network header + 16 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0000000a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip filter OUTPUT 10 9
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 4
|
||||
+ [ payload load 16b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x0a090807 ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 5 4
|
||||
+ [ payload load 16b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x0a090807 ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 6 5
|
||||
+ [ payload load 16b @ network header + 24 => reg 1 ]
|
||||
+ [ bitwise reg 1 = (reg=1 & 0xffffffff 0xffffffff 0xffffffff 0xf0ffffff ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ]
|
||||
+ [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x00090807 ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 7 6
|
||||
+ [ payload load 15b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x00090807 ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 8 7
|
||||
+ [ payload load 14b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x00000807 ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 9 8
|
||||
+ [ payload load 11b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x00050403 ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 10 9
|
||||
+ [ payload load 10b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x00000403 ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 11 10
|
||||
+ [ payload load 8b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xffc0edfe 0x020100ee ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 12 11
|
||||
+ [ payload load 6b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xffc0edfe 0x000000ee ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 13 12
|
||||
+ [ payload load 2b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0000edfe ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 14 13
|
||||
+ [ payload load 1b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x000000fe ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+ip6 filter OUTPUT 15 14
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 3
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 4b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0302010a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 4 3
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 4b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0302010a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 5 4
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 4b @ network header + 24 => reg 1 ]
|
||||
+ [ bitwise reg 1 = (reg=1 & 0xfcffffff ) ^ 0x00000000 ]
|
||||
+ [ cmp eq reg 1 0x0002010a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 6 5
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 3b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0002010a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 7 6
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 2b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0000010a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 8 7
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 1b @ network header + 24 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0000000a ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 9 8
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 10 9
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 6b @ network header + 18 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xc000edfe 0x0000eeff ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 11 10
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 6b @ network header + 18 => reg 1 ]
|
||||
+ [ bitwise reg 1 = (reg=1 & 0xffffffff 0x0000f0ff ) ^ 0x00000000 0x00000000 ]
|
||||
+ [ cmp eq reg 1 0xc000edfe 0x0000e0ff ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 12 11
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 5b @ network header + 18 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xc000edfe 0x000000ff ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 13 12
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 4b @ network header + 18 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xc000edfe ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 14 13
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 3b @ network header + 18 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0000edfe ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 15 14
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 2b @ network header + 18 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0000edfe ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+arp filter OUTPUT 16 15
|
||||
+ [ payload load 2b @ network header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000100 ]
|
||||
+ [ payload load 1b @ network header + 4 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000006 ]
|
||||
+ [ payload load 1b @ network header + 5 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x00000004 ]
|
||||
+ [ payload load 1b @ network header + 18 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x000000fe ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+bridge filter OUTPUT 4
|
||||
+ [ payload load 6b @ link header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xc000edfe 0x0000eeff ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+bridge filter OUTPUT 5 4
|
||||
+ [ payload load 6b @ link header + 0 => reg 1 ]
|
||||
+ [ bitwise reg 1 = (reg=1 & 0xffffffff 0x0000f0ff ) ^ 0x00000000 0x00000000 ]
|
||||
+ [ cmp eq reg 1 0xc000edfe 0x0000e0ff ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+bridge filter OUTPUT 6 5
|
||||
+ [ payload load 5b @ link header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xc000edfe 0x000000ff ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+bridge filter OUTPUT 7 6
|
||||
+ [ payload load 4b @ link header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0xc000edfe ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+bridge filter OUTPUT 8 7
|
||||
+ [ payload load 3b @ link header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0000edfe ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+bridge filter OUTPUT 9 8
|
||||
+ [ payload load 2b @ link header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x0000edfe ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+
|
||||
+bridge filter OUTPUT 10 9
|
||||
+ [ payload load 1b @ link header + 0 => reg 1 ]
|
||||
+ [ cmp eq reg 1 0x000000fe ]
|
||||
+ [ counter pkts 0 bytes 0 ]
|
||||
+"
|
||||
+
|
||||
+diff -u -Z <(echo "$EXPECT") <(nft --debug=netlink list ruleset | awk '/^table/{exit} {print}')
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
From d4e535422a9f4908b6d4b331b9e9cffe7ef161f3 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 17 Nov 2020 11:38:27 +0100
|
||||
Subject: [PATCH] ebtables: Fix for broken chain renaming
|
||||
|
||||
Loading extensions pollutes 'errno' value, hence before using it to
|
||||
indicate failure it should be sanitized. This was done by the called
|
||||
function before the parsing/netlink split and not migrated by accident.
|
||||
Move it into calling code to clarify the connection.
|
||||
|
||||
Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 55b7c71dce7144f4dc0297c17abf0f04879ee247)
|
||||
---
|
||||
iptables/nft.c | 3 ---
|
||||
iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 | 4 ++++
|
||||
iptables/xtables-eb.c | 1 +
|
||||
3 files changed, 5 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index bdb633a82a655..bdf252198f155 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1932,9 +1932,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
|
||||
return 0;
|
||||
}
|
||||
|
||||
- /* Config load changed errno. Ensure genuine info for our callers. */
|
||||
- errno = 0;
|
||||
-
|
||||
/* Find the old chain to be renamed */
|
||||
c = nft_chain_find(h, table, chain);
|
||||
if (c == NULL) {
|
||||
diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
|
||||
index 0c1eb4ca66f52..6f11bd12593dd 100755
|
||||
--- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
|
||||
+++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
|
||||
@@ -86,4 +86,8 @@ if [ $? -eq 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
+$XT_MULTI ebtables -t filter -E FOO BAZ || exit 1
|
||||
+$XT_MULTI ebtables -t filter -L | grep -q FOO && exit 1
|
||||
+$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
|
||||
+
|
||||
$XT_MULTI ebtables -t $t -F || exit 0
|
||||
diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
|
||||
index 375a95d1d5c75..6df5839f07436 100644
|
||||
--- a/iptables/xtables-eb.c
|
||||
+++ b/iptables/xtables-eb.c
|
||||
@@ -853,6 +853,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
|
||||
else if (strchr(argv[optind], ' ') != NULL)
|
||||
xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names");
|
||||
|
||||
+ errno = 0;
|
||||
ret = nft_cmd_chain_user_rename(h, chain, *table,
|
||||
argv[optind]);
|
||||
if (ret != 0 && errno == ENOENT)
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,85 +0,0 @@
|
|||
From 0497d24ecbc4414274bbfa33762de90b28c57be9 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:14 +0100
|
||||
Subject: [PATCH] xtables: Optimize flushing a specific chain
|
||||
|
||||
If a chain name is given to nft_rule_flush(), make use of
|
||||
nftnl_chain_list_lookup_byname().
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 196841c9597eff536b59655b60df088ee1929904)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 30 +++++++++++++++++-------------
|
||||
1 file changed, 17 insertions(+), 13 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 883fb3db2c671..a23acbcc9b100 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1496,10 +1496,14 @@ int nft_rule_save(struct nft_handle *h, const char *table, unsigned int format)
|
||||
}
|
||||
|
||||
static void
|
||||
-__nft_rule_flush(struct nft_handle *h, const char *table, const char *chain)
|
||||
+__nft_rule_flush(struct nft_handle *h, const char *table,
|
||||
+ const char *chain, bool verbose)
|
||||
{
|
||||
struct nftnl_rule *r;
|
||||
|
||||
+ if (verbose)
|
||||
+ fprintf(stdout, "Flushing chain `%s'\n", chain);
|
||||
+
|
||||
r = nftnl_rule_alloc();
|
||||
if (r == NULL)
|
||||
return;
|
||||
@@ -1533,7 +1537,7 @@ static int __nft_chain_user_flush(struct nftnl_chain *c, void *data)
|
||||
return 0;
|
||||
|
||||
if (!nftnl_chain_is_set(c, NFTNL_CHAIN_HOOKNUM))
|
||||
- __nft_rule_flush(h, table, chain);
|
||||
+ __nft_rule_flush(h, table, chain, false);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -1573,6 +1577,16 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
|
||||
goto err;
|
||||
}
|
||||
|
||||
+ if (chain) {
|
||||
+ c = nftnl_chain_list_lookup_byname(list, chain);
|
||||
+ if (!c)
|
||||
+ return 0;
|
||||
+
|
||||
+ __nft_rule_flush(h, table, chain, verbose);
|
||||
+ flush_rule_cache(c);
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
iter = nftnl_chain_list_iter_create(list);
|
||||
if (iter == NULL) {
|
||||
ret = 1;
|
||||
@@ -1584,18 +1598,8 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
|
||||
const char *chain_name =
|
||||
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
|
||||
- if (chain != NULL && strcmp(chain, chain_name) != 0)
|
||||
- goto next;
|
||||
-
|
||||
- if (verbose)
|
||||
- fprintf(stdout, "Flushing chain `%s'\n", chain_name);
|
||||
-
|
||||
- __nft_rule_flush(h, table, chain_name);
|
||||
+ __nft_rule_flush(h, table, chain_name, verbose);
|
||||
flush_rule_cache(c);
|
||||
-
|
||||
- if (chain != NULL)
|
||||
- break;
|
||||
-next:
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
}
|
||||
nftnl_chain_list_iter_destroy(iter);
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -1,136 +0,0 @@
|
|||
From 25eff54c9a82ad816f7a4c274d39daf2e1aaf3a7 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:15 +0100
|
||||
Subject: [PATCH] xtables: Optimize nft_chain_zero_counters()
|
||||
|
||||
If a chain name was given, make use of nftnl_chain_list_lookup_byname().
|
||||
Streamline nft_chain_zero_rule_counters() to be suitable for calling
|
||||
from nftnl_chain_list_foreach().
|
||||
|
||||
There is an unrelated optimization in here, too: Add batch job
|
||||
NFT_COMPAT_CHAIN_ZERO only if it is a base chain. Since user-defined
|
||||
chains don't have counters, there is no need to do anything for them.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit a6ce0c65d3a390bfff16e834c18650beedecf40c)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 72 +++++++++++++++++++++++++-------------------------
|
||||
1 file changed, 36 insertions(+), 36 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index a23acbcc9b100..9951bf3212197 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -2939,15 +2939,36 @@ int nft_xtables_config_load(struct nft_handle *h, const char *filename,
|
||||
return h->config_done;
|
||||
}
|
||||
|
||||
-static void nft_chain_zero_rule_counters(struct nft_handle *h,
|
||||
- struct nftnl_chain *c)
|
||||
+struct chain_zero_data {
|
||||
+ struct nft_handle *handle;
|
||||
+ bool verbose;
|
||||
+};
|
||||
+
|
||||
+static int __nft_chain_zero_counters(struct nftnl_chain *c, void *data)
|
||||
{
|
||||
+ struct chain_zero_data *d = data;
|
||||
+ struct nft_handle *h = d->handle;
|
||||
struct nftnl_rule_iter *iter;
|
||||
struct nftnl_rule *r;
|
||||
+ int ret = 0;
|
||||
+
|
||||
+ if (d->verbose)
|
||||
+ fprintf(stdout, "Zeroing chain `%s'\n",
|
||||
+ nftnl_chain_get_str(c, NFTNL_CHAIN_NAME));
|
||||
+
|
||||
+ if (nftnl_chain_is_set(c, NFTNL_CHAIN_HOOKNUM)) {
|
||||
+ /* zero base chain counters. */
|
||||
+ nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0);
|
||||
+ nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0);
|
||||
+ nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
|
||||
+ ret = batch_chain_add(h, NFT_COMPAT_CHAIN_ZERO, c);
|
||||
+ if (ret)
|
||||
+ return -1;
|
||||
+ }
|
||||
|
||||
iter = nftnl_rule_iter_create(c);
|
||||
if (iter == NULL)
|
||||
- return;
|
||||
+ return -1;
|
||||
|
||||
r = nftnl_rule_iter_next(iter);
|
||||
while (r != NULL) {
|
||||
@@ -2989,13 +3010,17 @@ static void nft_chain_zero_rule_counters(struct nft_handle *h,
|
||||
}
|
||||
|
||||
nftnl_rule_iter_destroy(iter);
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
int nft_chain_zero_counters(struct nft_handle *h, const char *chain,
|
||||
const char *table, bool verbose)
|
||||
{
|
||||
struct nftnl_chain_list *list;
|
||||
- struct nftnl_chain_list_iter *iter;
|
||||
+ struct chain_zero_data d = {
|
||||
+ .handle = h,
|
||||
+ .verbose = verbose,
|
||||
+ };
|
||||
struct nftnl_chain *c;
|
||||
int ret = 0;
|
||||
|
||||
@@ -3003,41 +3028,16 @@ int nft_chain_zero_counters(struct nft_handle *h, const char *chain,
|
||||
if (list == NULL)
|
||||
goto err;
|
||||
|
||||
- iter = nftnl_chain_list_iter_create(list);
|
||||
- if (iter == NULL)
|
||||
- goto err;
|
||||
-
|
||||
- c = nftnl_chain_list_iter_next(iter);
|
||||
- while (c != NULL) {
|
||||
- const char *chain_name =
|
||||
- nftnl_chain_get(c, NFTNL_CHAIN_NAME);
|
||||
-
|
||||
- if (chain != NULL && strcmp(chain, chain_name) != 0)
|
||||
- goto next;
|
||||
-
|
||||
- if (verbose)
|
||||
- fprintf(stdout, "Zeroing chain `%s'\n", chain_name);
|
||||
-
|
||||
- if (nftnl_chain_is_set(c, NFTNL_CHAIN_HOOKNUM)) {
|
||||
- /* zero base chain counters. */
|
||||
- nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0);
|
||||
- nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0);
|
||||
- }
|
||||
-
|
||||
- nft_chain_zero_rule_counters(h, c);
|
||||
-
|
||||
- nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
|
||||
-
|
||||
- ret = batch_chain_add(h, NFT_COMPAT_CHAIN_ZERO, c);
|
||||
+ if (chain) {
|
||||
+ c = nftnl_chain_list_lookup_byname(list, chain);
|
||||
+ if (!c)
|
||||
+ return 0;
|
||||
|
||||
- if (chain != NULL)
|
||||
- break;
|
||||
-next:
|
||||
- c = nftnl_chain_list_iter_next(iter);
|
||||
+ ret = __nft_chain_zero_counters(c, &d);
|
||||
+ goto err;
|
||||
}
|
||||
|
||||
- nftnl_chain_list_iter_destroy(iter);
|
||||
-
|
||||
+ ret = nftnl_chain_list_foreach(list, __nft_chain_zero_counters, &d);
|
||||
err:
|
||||
/* the core expects 1 for success and 0 for error */
|
||||
return ret == 0 ? 1 : 0;
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,374 @@
|
|||
From 38e8df1b4409387145c79fc358419d59b5ec3800 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 3 Nov 2020 12:21:29 +0100
|
||||
Subject: [PATCH] xtables-arp: Don't use ARPT_INV_*
|
||||
|
||||
Arptables invflags are partly identical to IPT_INV_* ones but the bits
|
||||
are differently assigned. Eliminate this incompatibility by definition
|
||||
of the unique invflags in nft-arp.h on bits that don't collide with
|
||||
IPT_INV_* ones, then use those in combination with IPT_INV_* ones in
|
||||
arptables-specific code.
|
||||
|
||||
Note that ARPT_INV_ARPPRO is replaced by IPT_INV_PROTO although these
|
||||
are in fact different options - yet since '-p' option is not supported
|
||||
by arptables, this does not lead to a collision.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 44457c0805905ea22b4ecf9156648e774dd29155)
|
||||
---
|
||||
iptables/nft-arp.c | 92 ++++++++++++++++--------------------------
|
||||
iptables/nft-arp.h | 7 ++++
|
||||
iptables/xtables-arp.c | 22 +++++-----
|
||||
3 files changed, 53 insertions(+), 68 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
|
||||
index 5dc38da831aa0..c82ffdc95e300 100644
|
||||
--- a/iptables/nft-arp.c
|
||||
+++ b/iptables/nft-arp.c
|
||||
@@ -134,34 +134,34 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
int ret = 0;
|
||||
|
||||
if (fw->arp.iniface[0] != '\0') {
|
||||
- op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_VIA_IN);
|
||||
+ op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_IN);
|
||||
add_iniface(r, fw->arp.iniface, op);
|
||||
}
|
||||
|
||||
if (fw->arp.outiface[0] != '\0') {
|
||||
- op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_VIA_OUT);
|
||||
+ op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_OUT);
|
||||
add_outiface(r, fw->arp.outiface, op);
|
||||
}
|
||||
|
||||
if (fw->arp.arhrd != 0 ||
|
||||
- fw->arp.invflags & ARPT_INV_ARPHRD) {
|
||||
- op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPHRD);
|
||||
+ fw->arp.invflags & IPT_INV_ARPHRD) {
|
||||
+ op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_ARPHRD);
|
||||
add_payload(r, offsetof(struct arphdr, ar_hrd), 2,
|
||||
NFT_PAYLOAD_NETWORK_HEADER);
|
||||
add_cmp_u16(r, fw->arp.arhrd, op);
|
||||
}
|
||||
|
||||
if (fw->arp.arpro != 0 ||
|
||||
- fw->arp.invflags & ARPT_INV_ARPPRO) {
|
||||
- op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPPRO);
|
||||
+ fw->arp.invflags & IPT_INV_PROTO) {
|
||||
+ op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_PROTO);
|
||||
add_payload(r, offsetof(struct arphdr, ar_pro), 2,
|
||||
NFT_PAYLOAD_NETWORK_HEADER);
|
||||
add_cmp_u16(r, fw->arp.arpro, op);
|
||||
}
|
||||
|
||||
if (fw->arp.arhln != 0 ||
|
||||
- fw->arp.invflags & ARPT_INV_ARPHLN) {
|
||||
- op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPHLN);
|
||||
+ fw->arp.invflags & IPT_INV_ARPHLN) {
|
||||
+ op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_ARPHLN);
|
||||
add_proto(r, offsetof(struct arphdr, ar_hln), 1,
|
||||
fw->arp.arhln, op);
|
||||
}
|
||||
@@ -169,15 +169,15 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
add_proto(r, offsetof(struct arphdr, ar_pln), 1, 4, NFT_CMP_EQ);
|
||||
|
||||
if (fw->arp.arpop != 0 ||
|
||||
- fw->arp.invflags & ARPT_INV_ARPOP) {
|
||||
- op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPOP);
|
||||
+ fw->arp.invflags & IPT_INV_ARPOP) {
|
||||
+ op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_ARPOP);
|
||||
add_payload(r, offsetof(struct arphdr, ar_op), 2,
|
||||
NFT_PAYLOAD_NETWORK_HEADER);
|
||||
add_cmp_u16(r, fw->arp.arpop, op);
|
||||
}
|
||||
|
||||
if (need_devaddr(&fw->arp.src_devaddr)) {
|
||||
- op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCDEVADDR);
|
||||
+ op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_SRCDEVADDR);
|
||||
add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
sizeof(struct arphdr),
|
||||
&fw->arp.src_devaddr.addr,
|
||||
@@ -188,8 +188,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
|
||||
if (fw->arp.src.s_addr != 0 ||
|
||||
fw->arp.smsk.s_addr != 0 ||
|
||||
- fw->arp.invflags & ARPT_INV_SRCIP) {
|
||||
- op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCIP);
|
||||
+ fw->arp.invflags & IPT_INV_SRCIP) {
|
||||
+ op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_SRCIP);
|
||||
add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
sizeof(struct arphdr) + fw->arp.arhln,
|
||||
&fw->arp.src.s_addr, &fw->arp.smsk.s_addr,
|
||||
@@ -198,7 +198,7 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
|
||||
|
||||
if (need_devaddr(&fw->arp.tgt_devaddr)) {
|
||||
- op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTDEVADDR);
|
||||
+ op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_TGTDEVADDR);
|
||||
add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
|
||||
&fw->arp.tgt_devaddr.addr,
|
||||
@@ -208,8 +208,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
|
||||
if (fw->arp.tgt.s_addr != 0 ||
|
||||
fw->arp.tmsk.s_addr != 0 ||
|
||||
- fw->arp.invflags & ARPT_INV_TGTIP) {
|
||||
- op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTIP);
|
||||
+ fw->arp.invflags & IPT_INV_DSTIP) {
|
||||
+ op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_DSTIP);
|
||||
add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
|
||||
sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr) + fw->arp.arhln,
|
||||
&fw->arp.tgt.s_addr, &fw->arp.tmsk.s_addr,
|
||||
@@ -240,28 +240,6 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
return ret;
|
||||
}
|
||||
|
||||
-static uint16_t ipt_to_arpt_flags(uint8_t invflags)
|
||||
-{
|
||||
- uint16_t result = 0;
|
||||
-
|
||||
- if (invflags & IPT_INV_VIA_IN)
|
||||
- result |= ARPT_INV_VIA_IN;
|
||||
-
|
||||
- if (invflags & IPT_INV_VIA_OUT)
|
||||
- result |= ARPT_INV_VIA_OUT;
|
||||
-
|
||||
- if (invflags & IPT_INV_SRCIP)
|
||||
- result |= ARPT_INV_SRCIP;
|
||||
-
|
||||
- if (invflags & IPT_INV_DSTIP)
|
||||
- result |= ARPT_INV_TGTIP;
|
||||
-
|
||||
- if (invflags & IPT_INV_PROTO)
|
||||
- result |= ARPT_INV_ARPPRO;
|
||||
-
|
||||
- return result;
|
||||
-}
|
||||
-
|
||||
static void nft_arp_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
|
||||
void *data)
|
||||
{
|
||||
@@ -273,7 +251,7 @@ static void nft_arp_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
|
||||
fw->arp.outiface, fw->arp.outiface_mask,
|
||||
&flags);
|
||||
|
||||
- fw->arp.invflags |= ipt_to_arpt_flags(flags);
|
||||
+ fw->arp.invflags |= flags;
|
||||
}
|
||||
|
||||
static void nft_arp_parse_immediate(const char *jumpto, bool nft_goto,
|
||||
@@ -330,33 +308,33 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
|
||||
fw->arp.arhrd = ar_hrd;
|
||||
fw->arp.arhrd_mask = 0xffff;
|
||||
if (inv)
|
||||
- fw->arp.invflags |= ARPT_INV_ARPHRD;
|
||||
+ fw->arp.invflags |= IPT_INV_ARPHRD;
|
||||
break;
|
||||
case offsetof(struct arphdr, ar_pro):
|
||||
get_cmp_data(e, &ar_pro, sizeof(ar_pro), &inv);
|
||||
fw->arp.arpro = ar_pro;
|
||||
fw->arp.arpro_mask = 0xffff;
|
||||
if (inv)
|
||||
- fw->arp.invflags |= ARPT_INV_ARPPRO;
|
||||
+ fw->arp.invflags |= IPT_INV_PROTO;
|
||||
break;
|
||||
case offsetof(struct arphdr, ar_op):
|
||||
get_cmp_data(e, &ar_op, sizeof(ar_op), &inv);
|
||||
fw->arp.arpop = ar_op;
|
||||
fw->arp.arpop_mask = 0xffff;
|
||||
if (inv)
|
||||
- fw->arp.invflags |= ARPT_INV_ARPOP;
|
||||
+ fw->arp.invflags |= IPT_INV_ARPOP;
|
||||
break;
|
||||
case offsetof(struct arphdr, ar_hln):
|
||||
get_cmp_data(e, &ar_hln, sizeof(ar_hln), &inv);
|
||||
fw->arp.arhln = ar_hln;
|
||||
fw->arp.arhln_mask = 0xff;
|
||||
if (inv)
|
||||
- fw->arp.invflags |= ARPT_INV_ARPOP;
|
||||
+ fw->arp.invflags |= IPT_INV_ARPOP;
|
||||
break;
|
||||
default:
|
||||
if (ctx->payload.offset == sizeof(struct arphdr)) {
|
||||
if (nft_arp_parse_devaddr(ctx, e, &fw->arp.src_devaddr))
|
||||
- fw->arp.invflags |= ARPT_INV_SRCDEVADDR;
|
||||
+ fw->arp.invflags |= IPT_INV_SRCDEVADDR;
|
||||
} else if (ctx->payload.offset == sizeof(struct arphdr) +
|
||||
fw->arp.arhln) {
|
||||
get_cmp_data(e, &addr, sizeof(addr), &inv);
|
||||
@@ -371,12 +349,12 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
|
||||
}
|
||||
|
||||
if (inv)
|
||||
- fw->arp.invflags |= ARPT_INV_SRCIP;
|
||||
+ fw->arp.invflags |= IPT_INV_SRCIP;
|
||||
} else if (ctx->payload.offset == sizeof(struct arphdr) +
|
||||
fw->arp.arhln +
|
||||
sizeof(struct in_addr)) {
|
||||
if (nft_arp_parse_devaddr(ctx, e, &fw->arp.tgt_devaddr))
|
||||
- fw->arp.invflags |= ARPT_INV_TGTDEVADDR;
|
||||
+ fw->arp.invflags |= IPT_INV_TGTDEVADDR;
|
||||
} else if (ctx->payload.offset == sizeof(struct arphdr) +
|
||||
fw->arp.arhln +
|
||||
sizeof(struct in_addr) +
|
||||
@@ -393,7 +371,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
|
||||
}
|
||||
|
||||
if (inv)
|
||||
- fw->arp.invflags |= ARPT_INV_TGTIP;
|
||||
+ fw->arp.invflags |= IPT_INV_DSTIP;
|
||||
}
|
||||
break;
|
||||
}
|
||||
@@ -448,7 +426,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
else strcat(iface, "any");
|
||||
}
|
||||
if (print_iface) {
|
||||
- printf("%s%s-i %s", sep, fw->arp.invflags & ARPT_INV_VIA_IN ?
|
||||
+ printf("%s%s-i %s", sep, fw->arp.invflags & IPT_INV_VIA_IN ?
|
||||
"! " : "", iface);
|
||||
sep = " ";
|
||||
}
|
||||
@@ -466,13 +444,13 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
else strcat(iface, "any");
|
||||
}
|
||||
if (print_iface) {
|
||||
- printf("%s%s-o %s", sep, fw->arp.invflags & ARPT_INV_VIA_OUT ?
|
||||
+ printf("%s%s-o %s", sep, fw->arp.invflags & IPT_INV_VIA_OUT ?
|
||||
"! " : "", iface);
|
||||
sep = " ";
|
||||
}
|
||||
|
||||
if (fw->arp.smsk.s_addr != 0L) {
|
||||
- printf("%s%s", sep, fw->arp.invflags & ARPT_INV_SRCIP
|
||||
+ printf("%s%s", sep, fw->arp.invflags & IPT_INV_SRCIP
|
||||
? "! " : "");
|
||||
if (format & FMT_NUMERIC)
|
||||
sprintf(buf, "%s", addr_to_dotted(&(fw->arp.src)));
|
||||
@@ -489,7 +467,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
break;
|
||||
if (i == ARPT_DEV_ADDR_LEN_MAX)
|
||||
goto after_devsrc;
|
||||
- printf("%s%s", sep, fw->arp.invflags & ARPT_INV_SRCDEVADDR
|
||||
+ printf("%s%s", sep, fw->arp.invflags & IPT_INV_SRCDEVADDR
|
||||
? "! " : "");
|
||||
printf("--src-mac ");
|
||||
xtables_print_mac_and_mask((unsigned char *)fw->arp.src_devaddr.addr,
|
||||
@@ -498,7 +476,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
after_devsrc:
|
||||
|
||||
if (fw->arp.tmsk.s_addr != 0L) {
|
||||
- printf("%s%s", sep, fw->arp.invflags & ARPT_INV_TGTIP
|
||||
+ printf("%s%s", sep, fw->arp.invflags & IPT_INV_DSTIP
|
||||
? "! " : "");
|
||||
if (format & FMT_NUMERIC)
|
||||
sprintf(buf, "%s", addr_to_dotted(&(fw->arp.tgt)));
|
||||
@@ -515,7 +493,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
break;
|
||||
if (i == ARPT_DEV_ADDR_LEN_MAX)
|
||||
goto after_devdst;
|
||||
- printf("%s%s", sep, fw->arp.invflags & ARPT_INV_TGTDEVADDR
|
||||
+ printf("%s%s", sep, fw->arp.invflags & IPT_INV_TGTDEVADDR
|
||||
? "! " : "");
|
||||
printf("--dst-mac ");
|
||||
xtables_print_mac_and_mask((unsigned char *)fw->arp.tgt_devaddr.addr,
|
||||
@@ -525,7 +503,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
after_devdst:
|
||||
|
||||
if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) {
|
||||
- printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPHLN
|
||||
+ printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN
|
||||
? "! " : "");
|
||||
printf("--h-length %d", fw->arp.arhln);
|
||||
if (fw->arp.arhln_mask != 255)
|
||||
@@ -536,7 +514,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
if (fw->arp.arpop_mask != 0) {
|
||||
int tmp = ntohs(fw->arp.arpop);
|
||||
|
||||
- printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPOP
|
||||
+ printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPOP
|
||||
? "! " : "");
|
||||
if (tmp <= NUMOPCODES && !(format & FMT_NUMERIC))
|
||||
printf("--opcode %s", arp_opcodes[tmp-1]);
|
||||
@@ -551,7 +529,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) {
|
||||
uint16_t tmp = ntohs(fw->arp.arhrd);
|
||||
|
||||
- printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPHRD
|
||||
+ printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD
|
||||
? "! " : "");
|
||||
if (tmp == 1 && !(format & FMT_NUMERIC))
|
||||
printf("--h-type %s", "Ethernet");
|
||||
@@ -565,7 +543,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
if (fw->arp.arpro_mask != 0) {
|
||||
int tmp = ntohs(fw->arp.arpro);
|
||||
|
||||
- printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPPRO
|
||||
+ printf("%s%s", sep, fw->arp.invflags & IPT_INV_PROTO
|
||||
? "! " : "");
|
||||
if (tmp == 0x0800 && !(format & FMT_NUMERIC))
|
||||
printf("--proto-type %s", "IPv4");
|
||||
diff --git a/iptables/nft-arp.h b/iptables/nft-arp.h
|
||||
index 3411fc3d7c7b3..0d93a31f563b1 100644
|
||||
--- a/iptables/nft-arp.h
|
||||
+++ b/iptables/nft-arp.h
|
||||
@@ -4,4 +4,11 @@
|
||||
extern char *arp_opcodes[];
|
||||
#define NUMOPCODES 9
|
||||
|
||||
+/* define invflags which won't collide with IPT ones */
|
||||
+#define IPT_INV_SRCDEVADDR 0x0080
|
||||
+#define IPT_INV_TGTDEVADDR 0x0100
|
||||
+#define IPT_INV_ARPHLN 0x0200
|
||||
+#define IPT_INV_ARPOP 0x0400
|
||||
+#define IPT_INV_ARPHRD 0x0800
|
||||
+
|
||||
#endif
|
||||
diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
|
||||
index 8632774dfb705..3a35dcd107e19 100644
|
||||
--- a/iptables/xtables-arp.c
|
||||
+++ b/iptables/xtables-arp.c
|
||||
@@ -113,22 +113,22 @@ struct xtables_globals arptables_globals = {
|
||||
static int inverse_for_options[] =
|
||||
{
|
||||
/* -n */ 0,
|
||||
-/* -s */ ARPT_INV_SRCIP,
|
||||
-/* -d */ ARPT_INV_TGTIP,
|
||||
+/* -s */ IPT_INV_SRCIP,
|
||||
+/* -d */ IPT_INV_DSTIP,
|
||||
/* -p */ 0,
|
||||
/* -j */ 0,
|
||||
/* -v */ 0,
|
||||
/* -x */ 0,
|
||||
-/* -i */ ARPT_INV_VIA_IN,
|
||||
-/* -o */ ARPT_INV_VIA_OUT,
|
||||
+/* -i */ IPT_INV_VIA_IN,
|
||||
+/* -o */ IPT_INV_VIA_OUT,
|
||||
/*--line*/ 0,
|
||||
/* -c */ 0,
|
||||
-/* 2 */ ARPT_INV_SRCDEVADDR,
|
||||
-/* 3 */ ARPT_INV_TGTDEVADDR,
|
||||
-/* -l */ ARPT_INV_ARPHLN,
|
||||
-/* 4 */ ARPT_INV_ARPOP,
|
||||
-/* 5 */ ARPT_INV_ARPHRD,
|
||||
-/* 6 */ ARPT_INV_ARPPRO,
|
||||
+/* 2 */ IPT_INV_SRCDEVADDR,
|
||||
+/* 3 */ IPT_INV_TGTDEVADDR,
|
||||
+/* -l */ IPT_INV_ARPHLN,
|
||||
+/* 4 */ IPT_INV_ARPOP,
|
||||
+/* 5 */ IPT_INV_ARPHRD,
|
||||
+/* 6 */ IPT_INV_PROTO,
|
||||
};
|
||||
|
||||
/***********************************************/
|
||||
@@ -901,7 +901,7 @@ int do_commandarp(struct nft_handle *h, int argc, char *argv[], char **table,
|
||||
&dmasks, &ndaddrs);
|
||||
|
||||
if ((nsaddrs > 1 || ndaddrs > 1) &&
|
||||
- (cs.arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP)))
|
||||
+ (cs.arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP)))
|
||||
xtables_error(PARAMETER_PROBLEM, "! not allowed with multiple"
|
||||
" source or destination IP addresses");
|
||||
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,79 +0,0 @@
|
|||
From 9cc2fc0be5adc8f828fc8fd62951f7773148b7f0 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:16 +0100
|
||||
Subject: [PATCH] tests: Extend verbose output and return code tests
|
||||
|
||||
Recent changes to chain flush and zero routines incorporate proper error
|
||||
propagation so trying to flush or zero a non-existent chain results in
|
||||
an error. This is consistent with iptables-legacy, extend tests to make
|
||||
sure it stays this way.
|
||||
|
||||
Also extend verbose output test to make these recent changes didn't mess
|
||||
it up.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit e80f7fe56e4c64e05da426418bc2fae7ca221c49)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
.../shell/testcases/iptables/0002-verbose-output_0 | 13 +++++++++----
|
||||
.../shell/testcases/iptables/0004-return-codes_0 | 6 ++++++
|
||||
2 files changed, 15 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/iptables/0002-verbose-output_0 b/iptables/tests/shell/testcases/iptables/0002-verbose-output_0
|
||||
index 2e8059536ea7b..b1ef91f61f481 100755
|
||||
--- a/iptables/tests/shell/testcases/iptables/0002-verbose-output_0
|
||||
+++ b/iptables/tests/shell/testcases/iptables/0002-verbose-output_0
|
||||
@@ -29,23 +29,28 @@ Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
|
||||
|
||||
diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -n -L)
|
||||
|
||||
+[[ -z $($XT_MULTI iptables -v -N foobar) ]] || exit 1
|
||||
+
|
||||
diff -u -Z <(echo -e "$VOUT1") <($XT_MULTI iptables -v -D FORWARD $RULE1)
|
||||
diff -u -Z <(echo -e "$VOUT2") <($XT_MULTI iptables -v -D FORWARD $RULE2)
|
||||
|
||||
EXPECT="Flushing chain \`INPUT'
|
||||
Flushing chain \`FORWARD'
|
||||
-Flushing chain \`OUTPUT'"
|
||||
+Flushing chain \`OUTPUT'
|
||||
+Flushing chain \`foobar'"
|
||||
|
||||
diff -u <(echo -e "$EXPECT") <($XT_MULTI iptables -v -F)
|
||||
|
||||
EXPECT="Zeroing chain \`INPUT'
|
||||
Zeroing chain \`FORWARD'
|
||||
-Zeroing chain \`OUTPUT'"
|
||||
+Zeroing chain \`OUTPUT'
|
||||
+Zeroing chain \`foobar'"
|
||||
|
||||
diff -u <(echo -e "$EXPECT") <($XT_MULTI iptables -v -Z)
|
||||
|
||||
diff -u <(echo "Flushing chain \`OUTPUT'") <($XT_MULTI iptables -v -F OUTPUT)
|
||||
diff -u <(echo "Zeroing chain \`OUTPUT'") <($XT_MULTI iptables -v -Z OUTPUT)
|
||||
+diff -u <(echo "Flushing chain \`foobar'") <($XT_MULTI iptables -v -F foobar)
|
||||
+diff -u <(echo "Zeroing chain \`foobar'") <($XT_MULTI iptables -v -Z foobar)
|
||||
|
||||
-$XT_MULTI iptables -N foo
|
||||
-diff -u <(echo "Deleting chain \`foo'") <($XT_MULTI iptables -v -X foo)
|
||||
+diff -u <(echo "Deleting chain \`foobar'") <($XT_MULTI iptables -v -X foobar)
|
||||
diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
|
||||
index 5b6e1f6f1bc7a..9d2493992bd69 100755
|
||||
--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0
|
||||
+++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
|
||||
@@ -23,6 +23,12 @@ cmd 1 iptables -N foo
|
||||
# iptables-nft allows this - bug or feature?
|
||||
#cmd 2 iptables -N "invalid name"
|
||||
|
||||
+# test chain flushing/zeroing
|
||||
+cmd 0 iptables -F foo
|
||||
+cmd 0 iptables -Z foo
|
||||
+cmd 1 iptables -F bar
|
||||
+cmd 1 iptables -Z bar
|
||||
+
|
||||
# test chain rename
|
||||
cmd 0 iptables -E foo bar
|
||||
cmd 1 iptables -E foo bar
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,517 @@
|
|||
From 003b063b1b40503bc996a4f88c1941c91a0c550b Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 30 Oct 2020 12:42:57 +0100
|
||||
Subject: [PATCH] xshared: Merge some command option-related code
|
||||
|
||||
Add OPT_FRAGMENT define into the enum of other OPT_* defines at the
|
||||
right position and adjust the arptables-specific ones that follow
|
||||
accordingly. Appropriately adjust inverse_for_options array in
|
||||
xtables-arp.c.
|
||||
|
||||
Extend optflags from iptables.c by the arptables values for the sake of
|
||||
completeness, then move it to xshared.h along with NUMBER_OF_OPT
|
||||
definition. As a side-effect, this fixes for wrong ordering of entries
|
||||
in arptables' 'optflags' copy.
|
||||
|
||||
Add arptables-specific bits to commands_v_options table (the speicific
|
||||
options are matches on ARP header fields, just treat them like '-s'
|
||||
option. This is also just a cosmetic change, arptables doesn't have a
|
||||
generic_opt_check() implementation and hence doesn't use such a table.
|
||||
|
||||
With things potentially ready for common use, move commands_v_options
|
||||
table along with generic_opt_check() and opt2char() into xshared.c and
|
||||
drop the local (identical) implementations from iptables.c, ip6tables.c
|
||||
xtables.c and xtables-arp.c. While doing so, fix ordering of entries in
|
||||
that table: the row for CMD_ZERO_NUM was in the wrong position. Since
|
||||
all moved rows though are identical, this had no effect in practice.
|
||||
|
||||
Fixes: d960a991350ca ("xtables-arp: Integrate OPT_* defines into xshared.h")
|
||||
Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 8bd4b4f79b5de483353a8c0d0962e71934b7bdd2)
|
||||
---
|
||||
iptables/ip6tables.c | 79 -----------------------------------------
|
||||
iptables/iptables.c | 80 ------------------------------------------
|
||||
iptables/xshared.c | 74 ++++++++++++++++++++++++++++++++++++++
|
||||
iptables/xshared.h | 20 +++++++----
|
||||
iptables/xtables-arp.c | 14 +-------
|
||||
iptables/xtables.c | 80 ------------------------------------------
|
||||
6 files changed, 89 insertions(+), 258 deletions(-)
|
||||
|
||||
diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
|
||||
index 576c2cf8b0d9f..c95355b091568 100644
|
||||
--- a/iptables/ip6tables.c
|
||||
+++ b/iptables/ip6tables.c
|
||||
@@ -45,10 +45,6 @@
|
||||
#include "ip6tables-multi.h"
|
||||
#include "xshared.h"
|
||||
|
||||
-#define NUMBER_OF_OPT ARRAY_SIZE(optflags)
|
||||
-static const char optflags[]
|
||||
-= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c'};
|
||||
-
|
||||
static const char unsupported_rev[] = " [unsupported revision]";
|
||||
|
||||
static struct option original_opts[] = {
|
||||
@@ -100,36 +96,6 @@ struct xtables_globals ip6tables_globals = {
|
||||
.compat_rev = xtables_compatible_revision,
|
||||
};
|
||||
|
||||
-/* Table of legal combinations of commands and options. If any of the
|
||||
- * given commands make an option legal, that option is legal (applies to
|
||||
- * CMD_LIST and CMD_ZERO only).
|
||||
- * Key:
|
||||
- * + compulsory
|
||||
- * x illegal
|
||||
- * optional
|
||||
- */
|
||||
-
|
||||
-static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
|
||||
-/* Well, it's better than "Re: Linux vs FreeBSD" */
|
||||
-{
|
||||
- /* -n -s -d -p -j -v -x -i -o --line -c */
|
||||
-/*INSERT*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
|
||||
-/*DELETE*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x'},
|
||||
-/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x'},
|
||||
-/*REPLACE*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
|
||||
-/*APPEND*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
|
||||
-/*LIST*/ {' ','x','x','x','x',' ',' ','x','x',' ','x'},
|
||||
-/*FLUSH*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
|
||||
-/*ZERO*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
|
||||
-/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
|
||||
-/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
|
||||
-/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' '},
|
||||
-/*RENAME*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
|
||||
-/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x'},
|
||||
-/*ZERO_NUM*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
|
||||
-/*CHECK*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x'},
|
||||
-};
|
||||
-
|
||||
static const unsigned int inverse_for_options[NUMBER_OF_OPT] =
|
||||
{
|
||||
/* -n */ 0,
|
||||
@@ -264,51 +230,6 @@ ip6tables_exit_error(enum xtables_exittype status, const char *msg, ...)
|
||||
exit(status);
|
||||
}
|
||||
|
||||
-static void
|
||||
-generic_opt_check(int command, int options)
|
||||
-{
|
||||
- int i, j, legal = 0;
|
||||
-
|
||||
- /* Check that commands are valid with options. Complicated by the
|
||||
- * fact that if an option is legal with *any* command given, it is
|
||||
- * legal overall (ie. -z and -l).
|
||||
- */
|
||||
- for (i = 0; i < NUMBER_OF_OPT; i++) {
|
||||
- legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
|
||||
-
|
||||
- for (j = 0; j < NUMBER_OF_CMD; j++) {
|
||||
- if (!(command & (1<<j)))
|
||||
- continue;
|
||||
-
|
||||
- if (!(options & (1<<i))) {
|
||||
- if (commands_v_options[j][i] == '+')
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "You need to supply the `-%c' "
|
||||
- "option for this command\n",
|
||||
- optflags[i]);
|
||||
- } else {
|
||||
- if (commands_v_options[j][i] != 'x')
|
||||
- legal = 1;
|
||||
- else if (legal == 0)
|
||||
- legal = -1;
|
||||
- }
|
||||
- }
|
||||
- if (legal == -1)
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "Illegal option `-%c' with this command\n",
|
||||
- optflags[i]);
|
||||
- }
|
||||
-}
|
||||
-
|
||||
-static char
|
||||
-opt2char(int option)
|
||||
-{
|
||||
- const char *ptr;
|
||||
- for (ptr = optflags; option > 1; option >>= 1, ptr++);
|
||||
-
|
||||
- return *ptr;
|
||||
-}
|
||||
-
|
||||
/*
|
||||
* All functions starting with "parse" should succeed, otherwise
|
||||
* the program fails.
|
||||
diff --git a/iptables/iptables.c b/iptables/iptables.c
|
||||
index 88ef6cf666d4b..7d6183116d265 100644
|
||||
--- a/iptables/iptables.c
|
||||
+++ b/iptables/iptables.c
|
||||
@@ -41,11 +41,6 @@
|
||||
#include <fcntl.h>
|
||||
#include "xshared.h"
|
||||
|
||||
-#define OPT_FRAGMENT 0x00800U
|
||||
-#define NUMBER_OF_OPT ARRAY_SIZE(optflags)
|
||||
-static const char optflags[]
|
||||
-= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c', 'f'};
|
||||
-
|
||||
static const char unsupported_rev[] = " [unsupported revision]";
|
||||
|
||||
static struct option original_opts[] = {
|
||||
@@ -99,36 +94,6 @@ struct xtables_globals iptables_globals = {
|
||||
.compat_rev = xtables_compatible_revision,
|
||||
};
|
||||
|
||||
-/* Table of legal combinations of commands and options. If any of the
|
||||
- * given commands make an option legal, that option is legal (applies to
|
||||
- * CMD_LIST and CMD_ZERO only).
|
||||
- * Key:
|
||||
- * + compulsory
|
||||
- * x illegal
|
||||
- * optional
|
||||
- */
|
||||
-
|
||||
-static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
|
||||
-/* Well, it's better than "Re: Linux vs FreeBSD" */
|
||||
-{
|
||||
- /* -n -s -d -p -j -v -x -i -o --line -c -f */
|
||||
-/*INSERT*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
|
||||
-/*DELETE*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
|
||||
-/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*REPLACE*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
|
||||
-/*APPEND*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
|
||||
-/*LIST*/ {' ','x','x','x','x',' ',' ','x','x',' ','x','x'},
|
||||
-/*FLUSH*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*ZERO*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' ','x'},
|
||||
-/*RENAME*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*ZERO_NUM*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*CHECK*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
|
||||
-};
|
||||
-
|
||||
static const int inverse_for_options[NUMBER_OF_OPT] =
|
||||
{
|
||||
/* -n */ 0,
|
||||
@@ -263,51 +228,6 @@ iptables_exit_error(enum xtables_exittype status, const char *msg, ...)
|
||||
exit(status);
|
||||
}
|
||||
|
||||
-static void
|
||||
-generic_opt_check(int command, int options)
|
||||
-{
|
||||
- int i, j, legal = 0;
|
||||
-
|
||||
- /* Check that commands are valid with options. Complicated by the
|
||||
- * fact that if an option is legal with *any* command given, it is
|
||||
- * legal overall (ie. -z and -l).
|
||||
- */
|
||||
- for (i = 0; i < NUMBER_OF_OPT; i++) {
|
||||
- legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
|
||||
-
|
||||
- for (j = 0; j < NUMBER_OF_CMD; j++) {
|
||||
- if (!(command & (1<<j)))
|
||||
- continue;
|
||||
-
|
||||
- if (!(options & (1<<i))) {
|
||||
- if (commands_v_options[j][i] == '+')
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "You need to supply the `-%c' "
|
||||
- "option for this command\n",
|
||||
- optflags[i]);
|
||||
- } else {
|
||||
- if (commands_v_options[j][i] != 'x')
|
||||
- legal = 1;
|
||||
- else if (legal == 0)
|
||||
- legal = -1;
|
||||
- }
|
||||
- }
|
||||
- if (legal == -1)
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "Illegal option `-%c' with this command\n",
|
||||
- optflags[i]);
|
||||
- }
|
||||
-}
|
||||
-
|
||||
-static char
|
||||
-opt2char(int option)
|
||||
-{
|
||||
- const char *ptr;
|
||||
- for (ptr = optflags; option > 1; option >>= 1, ptr++);
|
||||
-
|
||||
- return *ptr;
|
||||
-}
|
||||
-
|
||||
/*
|
||||
* All functions starting with "parse" should succeed, otherwise
|
||||
* the program fails.
|
||||
diff --git a/iptables/xshared.c b/iptables/xshared.c
|
||||
index c1d1371a6d54a..fe37c30a085d6 100644
|
||||
--- a/iptables/xshared.c
|
||||
+++ b/iptables/xshared.c
|
||||
@@ -774,3 +774,77 @@ int parse_rulenumber(const char *rule)
|
||||
|
||||
return rulenum;
|
||||
}
|
||||
+
|
||||
+/* Table of legal combinations of commands and options. If any of the
|
||||
+ * given commands make an option legal, that option is legal (applies to
|
||||
+ * CMD_LIST and CMD_ZERO only).
|
||||
+ * Key:
|
||||
+ * + compulsory
|
||||
+ * x illegal
|
||||
+ * optional
|
||||
+ */
|
||||
+static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
|
||||
+/* Well, it's better than "Re: Linux vs FreeBSD" */
|
||||
+{
|
||||
+ /* -n -s -d -p -j -v -x -i -o --line -c -f 2 3 l 4 5 6 */
|
||||
+/*INSERT*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' ',' ',' ',' ',' ',' ',' '},
|
||||
+/*DELETE*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' ',' ',' ',' ',' ',' ',' '},
|
||||
+/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
|
||||
+/*REPLACE*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' ',' ',' ',' ',' ',' ',' '},
|
||||
+/*APPEND*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' ',' ',' ',' ',' ',' ',' '},
|
||||
+/*LIST*/ {' ','x','x','x','x',' ',' ','x','x',' ','x','x','x','x','x','x','x','x'},
|
||||
+/*FLUSH*/ {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
|
||||
+/*ZERO*/ {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
|
||||
+/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
|
||||
+/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
|
||||
+/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' ','x','x','x','x','x','x','x'},
|
||||
+/*RENAME*/ {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
|
||||
+/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
|
||||
+/*ZERO_NUM*/ {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
|
||||
+/*CHECK*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' ',' ',' ',' ',' ',' ',' '},
|
||||
+};
|
||||
+
|
||||
+void generic_opt_check(int command, int options)
|
||||
+{
|
||||
+ int i, j, legal = 0;
|
||||
+
|
||||
+ /* Check that commands are valid with options. Complicated by the
|
||||
+ * fact that if an option is legal with *any* command given, it is
|
||||
+ * legal overall (ie. -z and -l).
|
||||
+ */
|
||||
+ for (i = 0; i < NUMBER_OF_OPT; i++) {
|
||||
+ legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
|
||||
+
|
||||
+ for (j = 0; j < NUMBER_OF_CMD; j++) {
|
||||
+ if (!(command & (1<<j)))
|
||||
+ continue;
|
||||
+
|
||||
+ if (!(options & (1<<i))) {
|
||||
+ if (commands_v_options[j][i] == '+')
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "You need to supply the `-%c' "
|
||||
+ "option for this command\n",
|
||||
+ optflags[i]);
|
||||
+ } else {
|
||||
+ if (commands_v_options[j][i] != 'x')
|
||||
+ legal = 1;
|
||||
+ else if (legal == 0)
|
||||
+ legal = -1;
|
||||
+ }
|
||||
+ }
|
||||
+ if (legal == -1)
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "Illegal option `-%c' with this command\n",
|
||||
+ optflags[i]);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+char opt2char(int option)
|
||||
+{
|
||||
+ const char *ptr;
|
||||
+
|
||||
+ for (ptr = optflags; option > 1; option >>= 1, ptr++)
|
||||
+ ;
|
||||
+
|
||||
+ return *ptr;
|
||||
+}
|
||||
diff --git a/iptables/xshared.h b/iptables/xshared.h
|
||||
index c41bd054bf36f..9159b2b1f3768 100644
|
||||
--- a/iptables/xshared.h
|
||||
+++ b/iptables/xshared.h
|
||||
@@ -30,15 +30,20 @@ enum {
|
||||
OPT_VIANAMEOUT = 1 << 8,
|
||||
OPT_LINENUMBERS = 1 << 9,
|
||||
OPT_COUNTERS = 1 << 10,
|
||||
+ OPT_FRAGMENT = 1 << 11,
|
||||
/* below are for arptables only */
|
||||
- OPT_S_MAC = 1 << 11,
|
||||
- OPT_D_MAC = 1 << 12,
|
||||
- OPT_H_LENGTH = 1 << 13,
|
||||
- OPT_OPCODE = 1 << 14,
|
||||
- OPT_H_TYPE = 1 << 15,
|
||||
- OPT_P_TYPE = 1 << 16,
|
||||
+ OPT_S_MAC = 1 << 12,
|
||||
+ OPT_D_MAC = 1 << 13,
|
||||
+ OPT_H_LENGTH = 1 << 14,
|
||||
+ OPT_OPCODE = 1 << 15,
|
||||
+ OPT_H_TYPE = 1 << 16,
|
||||
+ OPT_P_TYPE = 1 << 17,
|
||||
};
|
||||
|
||||
+#define NUMBER_OF_OPT ARRAY_SIZE(optflags)
|
||||
+static const char optflags[]
|
||||
+= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c', 'f', 2, 3, 'l', 4, 5, 6 };
|
||||
+
|
||||
enum {
|
||||
CMD_NONE = 0,
|
||||
CMD_INSERT = 1 << 0,
|
||||
@@ -216,4 +221,7 @@ void add_command(unsigned int *cmd, const int newcmd,
|
||||
const int othercmds, int invert);
|
||||
int parse_rulenumber(const char *rule);
|
||||
|
||||
+void generic_opt_check(int command, int options);
|
||||
+char opt2char(int option);
|
||||
+
|
||||
#endif /* IPTABLES_XSHARED_H */
|
||||
diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
|
||||
index 3a35dcd107e19..0695504892b74 100644
|
||||
--- a/iptables/xtables-arp.c
|
||||
+++ b/iptables/xtables-arp.c
|
||||
@@ -53,10 +53,6 @@
|
||||
#include "nft-arp.h"
|
||||
#include <linux/netfilter_arp/arp_tables.h>
|
||||
|
||||
-#define NUMBER_OF_OPT 16
|
||||
-static const char optflags[NUMBER_OF_OPT]
|
||||
-= { 'n', 's', 'd', 2, 3, 7, 8, 4, 5, 6, 'j', 'v', 'i', 'o', '0', 'c'};
|
||||
-
|
||||
static struct option original_opts[] = {
|
||||
{ "append", 1, 0, 'A' },
|
||||
{ "delete", 1, 0, 'D' },
|
||||
@@ -123,6 +119,7 @@ static int inverse_for_options[] =
|
||||
/* -o */ IPT_INV_VIA_OUT,
|
||||
/*--line*/ 0,
|
||||
/* -c */ 0,
|
||||
+/* -f */ 0,
|
||||
/* 2 */ IPT_INV_SRCDEVADDR,
|
||||
/* 3 */ IPT_INV_TGTDEVADDR,
|
||||
/* -l */ IPT_INV_ARPHLN,
|
||||
@@ -327,15 +324,6 @@ printhelp(void)
|
||||
}
|
||||
}
|
||||
|
||||
-static char
|
||||
-opt2char(int option)
|
||||
-{
|
||||
- const char *ptr;
|
||||
- for (ptr = optflags; option > 1; option >>= 1, ptr++);
|
||||
-
|
||||
- return *ptr;
|
||||
-}
|
||||
-
|
||||
static int
|
||||
check_inverse(const char option[], int *invert, int *optidx, int argc)
|
||||
{
|
||||
diff --git a/iptables/xtables.c b/iptables/xtables.c
|
||||
index 9d2e441e0b773..9779bd83d53b3 100644
|
||||
--- a/iptables/xtables.c
|
||||
+++ b/iptables/xtables.c
|
||||
@@ -43,11 +43,6 @@
|
||||
#include "nft-shared.h"
|
||||
#include "nft.h"
|
||||
|
||||
-#define OPT_FRAGMENT 0x00800U
|
||||
-#define NUMBER_OF_OPT ARRAY_SIZE(optflags)
|
||||
-static const char optflags[]
|
||||
-= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c', 'f'};
|
||||
-
|
||||
static struct option original_opts[] = {
|
||||
{.name = "append", .has_arg = 1, .val = 'A'},
|
||||
{.name = "delete", .has_arg = 1, .val = 'D'},
|
||||
@@ -99,36 +94,6 @@ struct xtables_globals xtables_globals = {
|
||||
.compat_rev = nft_compatible_revision,
|
||||
};
|
||||
|
||||
-/* Table of legal combinations of commands and options. If any of the
|
||||
- * given commands make an option legal, that option is legal (applies to
|
||||
- * CMD_LIST and CMD_ZERO only).
|
||||
- * Key:
|
||||
- * + compulsory
|
||||
- * x illegal
|
||||
- * optional
|
||||
- */
|
||||
-
|
||||
-static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
|
||||
-/* Well, it's better than "Re: Linux vs FreeBSD" */
|
||||
-{
|
||||
- /* -n -s -d -p -j -v -x -i -o --line -c -f */
|
||||
-/*INSERT*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
|
||||
-/*DELETE*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
|
||||
-/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*REPLACE*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
|
||||
-/*APPEND*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
|
||||
-/*LIST*/ {' ','x','x','x','x',' ',' ','x','x',' ','x','x'},
|
||||
-/*FLUSH*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*ZERO*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*ZERO_NUM*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' ','x'},
|
||||
-/*RENAME*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
|
||||
-/*CHECK*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
|
||||
-};
|
||||
-
|
||||
static const int inverse_for_options[NUMBER_OF_OPT] =
|
||||
{
|
||||
/* -n */ 0,
|
||||
@@ -262,51 +227,6 @@ xtables_exit_error(enum xtables_exittype status, const char *msg, ...)
|
||||
exit(status);
|
||||
}
|
||||
|
||||
-static void
|
||||
-generic_opt_check(int command, int options)
|
||||
-{
|
||||
- int i, j, legal = 0;
|
||||
-
|
||||
- /* Check that commands are valid with options. Complicated by the
|
||||
- * fact that if an option is legal with *any* command given, it is
|
||||
- * legal overall (ie. -z and -l).
|
||||
- */
|
||||
- for (i = 0; i < NUMBER_OF_OPT; i++) {
|
||||
- legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
|
||||
-
|
||||
- for (j = 0; j < NUMBER_OF_CMD; j++) {
|
||||
- if (!(command & (1<<j)))
|
||||
- continue;
|
||||
-
|
||||
- if (!(options & (1<<i))) {
|
||||
- if (commands_v_options[j][i] == '+')
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "You need to supply the `-%c' "
|
||||
- "option for this command\n",
|
||||
- optflags[i]);
|
||||
- } else {
|
||||
- if (commands_v_options[j][i] != 'x')
|
||||
- legal = 1;
|
||||
- else if (legal == 0)
|
||||
- legal = -1;
|
||||
- }
|
||||
- }
|
||||
- if (legal == -1)
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "Illegal option `-%c' with this command\n",
|
||||
- optflags[i]);
|
||||
- }
|
||||
-}
|
||||
-
|
||||
-static char
|
||||
-opt2char(int option)
|
||||
-{
|
||||
- const char *ptr;
|
||||
- for (ptr = optflags; option > 1; option >>= 1, ptr++);
|
||||
-
|
||||
- return *ptr;
|
||||
-}
|
||||
-
|
||||
/*
|
||||
* All functions starting with "parse" should succeed, otherwise
|
||||
* the program fails.
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
From 8d0f11ea353caa254b65b4fde240e5d3a8fe12a7 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 4 Dec 2020 17:44:51 +0100
|
||||
Subject: [PATCH] tests/shell: Test for fixed extension registration
|
||||
|
||||
Use strace to look at iptables-restore behaviour with typically
|
||||
problematic input (conntrack revision 0 is no longer supported by
|
||||
current kernels) to make sure the fix in commit a1eaaceb0460b
|
||||
("libxtables: Simplify pending extension registration") is still
|
||||
effective.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 93d0c97e8b6713f51ba679e01a1338d4f9076e7c)
|
||||
---
|
||||
.../0017-pointless-compat-checks_0 | 25 +++++++++++++++++++
|
||||
1 file changed, 25 insertions(+)
|
||||
create mode 100755 iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0 b/iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0
|
||||
new file mode 100755
|
||||
index 0000000000000..cf73de32df409
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0
|
||||
@@ -0,0 +1,25 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+# A bug in extension registration would leave unsupported older extension
|
||||
+# revisions in pending list and get compatibility checked again for each rule
|
||||
+# using them. With SELinux enabled, the resulting socket() call per rule leads
|
||||
+# to significant slowdown (~50% performance in worst cases).
|
||||
+
|
||||
+set -e
|
||||
+
|
||||
+strace --version >/dev/null || { echo "skip for missing strace"; exit 0; }
|
||||
+
|
||||
+RULESET="$(
|
||||
+ echo "*filter"
|
||||
+ for ((i = 0; i < 100; i++)); do
|
||||
+ echo "-A FORWARD -m conntrack --ctstate NEW"
|
||||
+ done
|
||||
+ echo "COMMIT"
|
||||
+)"
|
||||
+
|
||||
+cmd="$XT_MULTI iptables-restore"
|
||||
+socketcount=$(strace -esocket $cmd <<< "$RULESET" 2>&1 | wc -l)
|
||||
+
|
||||
+# unpatched iptables-restore would open 111 sockets,
|
||||
+# patched only 12 but keep a certain margin for future changes
|
||||
+[[ $socketcount -lt 20 ]]
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,134 +0,0 @@
|
|||
From c9db6c26efce63e052b1a35ba1f4d529c2294c93 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:17 +0100
|
||||
Subject: [PATCH] xtables: Optimize user-defined chain deletion
|
||||
|
||||
Make use of nftnl_chain_list_lookup_byname() if a chain name was given.
|
||||
Move the actual chain deleting code into a callback suitable for passing
|
||||
to nftnl_chain_list_foreach().
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 0b950ed4549308ef23ffc7561567df86c90cfed9)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 89 ++++++++++++++++++++++++++------------------------
|
||||
1 file changed, 46 insertions(+), 43 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 9951bf3212197..162d91e82115b 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1642,63 +1642,66 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
|
||||
#define NLM_F_NONREC 0x100 /* Do not delete recursively */
|
||||
#endif
|
||||
|
||||
+struct chain_user_del_data {
|
||||
+ struct nft_handle *handle;
|
||||
+ bool verbose;
|
||||
+ int builtin_err;
|
||||
+};
|
||||
+
|
||||
+static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
|
||||
+{
|
||||
+ struct chain_user_del_data *d = data;
|
||||
+ struct nft_handle *h = d->handle;
|
||||
+ int ret;
|
||||
+
|
||||
+ /* don't delete built-in chain */
|
||||
+ if (nft_chain_builtin(c))
|
||||
+ return d->builtin_err;
|
||||
+
|
||||
+ if (d->verbose)
|
||||
+ fprintf(stdout, "Deleting chain `%s'\n",
|
||||
+ nftnl_chain_get_str(c, NFTNL_CHAIN_NAME));
|
||||
+
|
||||
+ ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_DEL, c);
|
||||
+ if (ret)
|
||||
+ return -1;
|
||||
+
|
||||
+ nftnl_chain_list_del(c);
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
int nft_chain_user_del(struct nft_handle *h, const char *chain,
|
||||
const char *table, bool verbose)
|
||||
{
|
||||
+ struct chain_user_del_data d = {
|
||||
+ .handle = h,
|
||||
+ .verbose = verbose,
|
||||
+ };
|
||||
struct nftnl_chain_list *list;
|
||||
- struct nftnl_chain_list_iter *iter;
|
||||
struct nftnl_chain *c;
|
||||
int ret = 0;
|
||||
- int deleted_ctr = 0;
|
||||
|
||||
nft_fn = nft_chain_user_del;
|
||||
|
||||
list = nft_chain_list_get(h, table);
|
||||
if (list == NULL)
|
||||
- goto err;
|
||||
-
|
||||
- iter = nftnl_chain_list_iter_create(list);
|
||||
- if (iter == NULL)
|
||||
- goto err;
|
||||
-
|
||||
- c = nftnl_chain_list_iter_next(iter);
|
||||
- while (c != NULL) {
|
||||
- const char *chain_name =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
-
|
||||
- /* don't delete built-in chain */
|
||||
- if (nft_chain_builtin(c))
|
||||
- goto next;
|
||||
-
|
||||
- if (chain != NULL && strcmp(chain, chain_name) != 0)
|
||||
- goto next;
|
||||
-
|
||||
- if (verbose)
|
||||
- fprintf(stdout, "Deleting chain `%s'\n", chain);
|
||||
-
|
||||
- ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_DEL, c);
|
||||
-
|
||||
- if (ret < 0)
|
||||
- break;
|
||||
-
|
||||
- deleted_ctr++;
|
||||
- nftnl_chain_list_del(c);
|
||||
-
|
||||
- if (chain != NULL)
|
||||
- break;
|
||||
-next:
|
||||
- c = nftnl_chain_list_iter_next(iter);
|
||||
- }
|
||||
-
|
||||
- nftnl_chain_list_iter_destroy(iter);
|
||||
-err:
|
||||
+ return 0;
|
||||
|
||||
- /* chain not found */
|
||||
- if (chain != NULL && deleted_ctr == 0) {
|
||||
- ret = -1;
|
||||
- errno = ENOENT;
|
||||
+ if (chain) {
|
||||
+ c = nftnl_chain_list_lookup_byname(list, chain);
|
||||
+ if (!c) {
|
||||
+ errno = ENOENT;
|
||||
+ return 0;
|
||||
+ }
|
||||
+ d.builtin_err = -2;
|
||||
+ ret = __nft_chain_user_del(c, &d);
|
||||
+ if (ret == -2)
|
||||
+ errno = EINVAL;
|
||||
+ goto out;
|
||||
}
|
||||
|
||||
+ ret = nftnl_chain_list_foreach(list, __nft_chain_user_del, &d);
|
||||
+out:
|
||||
/* the core expects 1 for success and 0 for error */
|
||||
return ret == 0 ? 1 : 0;
|
||||
}
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,176 @@
|
|||
From 8a10ad0e149cf1c6d0c34bd554a8e0a35cdf3e8d Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 2 Dec 2020 13:37:06 +0100
|
||||
Subject: [PATCH] extensions: dccp: Fix for DCCP type 'INVALID'
|
||||
|
||||
Support for matching on invalid DCCP type field values was pretty
|
||||
broken: While RFC4340 declares any type value from 10 to 15 invalid, the
|
||||
extension's type name 'INVALID' mapped to type value 10 only. Fix this
|
||||
by introduction of INVALID_OTHER_TYPE_MASK which has the remaining
|
||||
invalid type's bits set and apply it if bit 10 is set after parsing the
|
||||
type list. When printing, stop searching type names after printing
|
||||
'INVALID' - unless numeric output was requested. The latter prints all
|
||||
actual type values. Since parsing types in numeric form is not
|
||||
supported, changing the output should not break existing scripts.
|
||||
|
||||
When translating into nftables syntax, the code returned prematurely if
|
||||
'INVALID' was among the list of types - thereby emitting invalid syntax.
|
||||
Instead print a real match for invalid types by use of a range
|
||||
expression.
|
||||
|
||||
While being at it, fix syntax of translator output: If only
|
||||
'--dccp-types' was translated, the output contained an extra 'dccp'. On
|
||||
the other hand, if '--sport' and '--dport' was present, a required
|
||||
'dccp' between the translations of both was missing.
|
||||
|
||||
Fixes: e40b11d7ef827 ("add support for new 'dccp' protocol match")
|
||||
Fixes: c94a998724143 ("extensions: libxt_dccp: Add translation to nft")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 4bcbc8e11a2764f4537dc405962f83cd072cccfe)
|
||||
---
|
||||
extensions/libxt_dccp.c | 58 ++++++++++++++++++++++--------------
|
||||
extensions/libxt_dccp.txlate | 12 ++++++--
|
||||
2 files changed, 45 insertions(+), 25 deletions(-)
|
||||
|
||||
diff --git a/extensions/libxt_dccp.c b/extensions/libxt_dccp.c
|
||||
index 5e67c264db2a9..aea3e20be4818 100644
|
||||
--- a/extensions/libxt_dccp.c
|
||||
+++ b/extensions/libxt_dccp.c
|
||||
@@ -76,6 +76,9 @@ static const char *const dccp_pkt_types[] = {
|
||||
[DCCP_PKT_INVALID] = "INVALID",
|
||||
};
|
||||
|
||||
+/* Bits for type values 11-15 */
|
||||
+#define INVALID_OTHER_TYPE_MASK 0xf800
|
||||
+
|
||||
static uint16_t
|
||||
parse_dccp_types(const char *typestring)
|
||||
{
|
||||
@@ -95,6 +98,9 @@ parse_dccp_types(const char *typestring)
|
||||
xtables_error(PARAMETER_PROBLEM,
|
||||
"Unknown DCCP type `%s'", ptr);
|
||||
}
|
||||
+ if (typemask & (1 << DCCP_PKT_INVALID))
|
||||
+ typemask |= INVALID_OTHER_TYPE_MASK;
|
||||
+
|
||||
|
||||
free(buffer);
|
||||
return typemask;
|
||||
@@ -193,9 +199,13 @@ print_types(uint16_t types, int inverted, int numeric)
|
||||
|
||||
if (numeric)
|
||||
printf("%u", i);
|
||||
- else
|
||||
+ else {
|
||||
printf("%s", dccp_pkt_types[i]);
|
||||
|
||||
+ if (i == DCCP_PKT_INVALID)
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
types &= ~(1 << i);
|
||||
}
|
||||
}
|
||||
@@ -288,6 +298,7 @@ static const char *const dccp_pkt_types_xlate[] = {
|
||||
[DCCP_PKT_RESET] = "reset",
|
||||
[DCCP_PKT_SYNC] = "sync",
|
||||
[DCCP_PKT_SYNCACK] = "syncack",
|
||||
+ [DCCP_PKT_INVALID] = "10-15",
|
||||
};
|
||||
|
||||
static int dccp_type_xlate(const struct xt_dccp_info *einfo,
|
||||
@@ -296,10 +307,10 @@ static int dccp_type_xlate(const struct xt_dccp_info *einfo,
|
||||
bool have_type = false, set_need = false;
|
||||
uint16_t types = einfo->typemask;
|
||||
|
||||
- if (types & (1 << DCCP_PKT_INVALID))
|
||||
- return 0;
|
||||
-
|
||||
- xt_xlate_add(xl, " dccp type%s ", einfo->invflags ? " !=" : "");
|
||||
+ if (types & INVALID_OTHER_TYPE_MASK) {
|
||||
+ types &= ~INVALID_OTHER_TYPE_MASK;
|
||||
+ types |= 1 << DCCP_PKT_INVALID;
|
||||
+ }
|
||||
|
||||
if ((types != 0) && !(types == (types & -types))) {
|
||||
xt_xlate_add(xl, "{");
|
||||
@@ -335,34 +346,37 @@ static int dccp_xlate(struct xt_xlate *xl,
|
||||
char *space = "";
|
||||
int ret = 1;
|
||||
|
||||
- xt_xlate_add(xl, "dccp ");
|
||||
-
|
||||
if (einfo->flags & XT_DCCP_SRC_PORTS) {
|
||||
+ xt_xlate_add(xl, "dccp sport%s %u",
|
||||
+ einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
|
||||
+ einfo->spts[0]);
|
||||
+
|
||||
if (einfo->spts[0] != einfo->spts[1])
|
||||
- xt_xlate_add(xl, "sport%s %u-%u",
|
||||
- einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
|
||||
- einfo->spts[0], einfo->spts[1]);
|
||||
- else
|
||||
- xt_xlate_add(xl, "sport%s %u",
|
||||
- einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
|
||||
- einfo->spts[0]);
|
||||
+ xt_xlate_add(xl, "-%u", einfo->spts[1]);
|
||||
+
|
||||
space = " ";
|
||||
}
|
||||
|
||||
if (einfo->flags & XT_DCCP_DEST_PORTS) {
|
||||
+ xt_xlate_add(xl, "%sdccp dport%s %u", space,
|
||||
+ einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
|
||||
+ einfo->dpts[0]);
|
||||
+
|
||||
if (einfo->dpts[0] != einfo->dpts[1])
|
||||
- xt_xlate_add(xl, "%sdport%s %u-%u", space,
|
||||
- einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
|
||||
- einfo->dpts[0], einfo->dpts[1]);
|
||||
- else
|
||||
- xt_xlate_add(xl, "%sdport%s %u", space,
|
||||
- einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
|
||||
- einfo->dpts[0]);
|
||||
+ xt_xlate_add(xl, "-%u", einfo->dpts[1]);
|
||||
+
|
||||
+ space = " ";
|
||||
}
|
||||
|
||||
- if (einfo->flags & XT_DCCP_TYPE)
|
||||
+ if (einfo->flags & XT_DCCP_TYPE && einfo->typemask) {
|
||||
+ xt_xlate_add(xl, "%sdccp type%s ", space,
|
||||
+ einfo->invflags & XT_DCCP_TYPE ? " !=" : "");
|
||||
ret = dccp_type_xlate(einfo, xl);
|
||||
|
||||
+ space = " ";
|
||||
+ }
|
||||
+
|
||||
+ /* FIXME: no dccp option support in nftables yet */
|
||||
if (einfo->flags & XT_DCCP_OPTION)
|
||||
ret = 0;
|
||||
|
||||
diff --git a/extensions/libxt_dccp.txlate b/extensions/libxt_dccp.txlate
|
||||
index b47dc65f5bc4f..ea853f6acf627 100644
|
||||
--- a/extensions/libxt_dccp.txlate
|
||||
+++ b/extensions/libxt_dccp.txlate
|
||||
@@ -7,8 +7,14 @@ nft add rule ip filter INPUT dccp dport 100-200 counter
|
||||
iptables-translate -A INPUT -p dccp -m dccp ! --dport 100
|
||||
nft add rule ip filter INPUT dccp dport != 100 counter
|
||||
|
||||
-iptables-translate -A INPUT -p dccp -m dccp --dport 100 --dccp-types REQUEST,RESPONSE,DATA,ACK,DATAACK,CLOSEREQ,CLOSE,SYNC,SYNCACK
|
||||
-nft add rule ip filter INPUT dccp dport 100 dccp type {request, response, data, ack, dataack, closereq, close, sync, syncack} counter
|
||||
+iptables-translate -A INPUT -p dccp -m dccp --dccp-types CLOSE
|
||||
+nft add rule ip filter INPUT dccp type close counter
|
||||
+
|
||||
+iptables-translate -A INPUT -p dccp -m dccp --dccp-types INVALID
|
||||
+nft add rule ip filter INPUT dccp type 10-15 counter
|
||||
+
|
||||
+iptables-translate -A INPUT -p dccp -m dccp --dport 100 --dccp-types REQUEST,RESPONSE,DATA,ACK,DATAACK,CLOSEREQ,CLOSE,SYNC,SYNCACK,INVALID
|
||||
+nft add rule ip filter INPUT dccp dport 100 dccp type {request, response, data, ack, dataack, closereq, close, sync, syncack, 10-15} counter
|
||||
|
||||
iptables-translate -A INPUT -p dccp -m dccp --sport 200 --dport 100
|
||||
-nft add rule ip filter INPUT dccp sport 200 dport 100 counter
|
||||
+nft add rule ip filter INPUT dccp sport 200 dccp dport 100 counter
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,139 +0,0 @@
|
|||
From 8b38ab8ead7829569ab6a3c9fa7a193d568b707a Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:18 +0100
|
||||
Subject: [PATCH] xtables: Optimize list command with given chain
|
||||
|
||||
Make use of nftnl_chain_list_lookup_byname() even if not listing a
|
||||
specific rule. Introduce __nft_print_header() to consolidate chain value
|
||||
extraction for printing with ops->print_header().
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 11cbd7291f37fbfd5ebe6ffa1730f7d198ed2ac0)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 78 +++++++++++++++++++++-----------------------------
|
||||
1 file changed, 32 insertions(+), 46 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 162d91e82115b..e1c997836cb97 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -2247,6 +2247,24 @@ static int nft_rule_count(struct nft_handle *h, struct nftnl_chain *c)
|
||||
return rule_ctr;
|
||||
}
|
||||
|
||||
+static void __nft_print_header(struct nft_handle *h,
|
||||
+ const struct nft_family_ops *ops,
|
||||
+ struct nftnl_chain *c, unsigned int format)
|
||||
+{
|
||||
+ const char *chain_name = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
+ uint32_t policy = nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
|
||||
+ bool basechain = !!nftnl_chain_get(c, NFTNL_CHAIN_HOOKNUM);
|
||||
+ uint32_t refs = nftnl_chain_get_u32(c, NFTNL_CHAIN_USE);
|
||||
+ uint32_t entries = nft_rule_count(h, c);
|
||||
+ struct xt_counters ctrs = {
|
||||
+ .pcnt = nftnl_chain_get_u64(c, NFTNL_CHAIN_PACKETS),
|
||||
+ .bcnt = nftnl_chain_get_u64(c, NFTNL_CHAIN_BYTES),
|
||||
+ };
|
||||
+
|
||||
+ ops->print_header(format, chain_name, policy_name[policy],
|
||||
+ &ctrs, basechain, refs - entries, entries);
|
||||
+}
|
||||
+
|
||||
int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
||||
int rulenum, unsigned int format)
|
||||
{
|
||||
@@ -2275,75 +2293,43 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
||||
return 0;
|
||||
}
|
||||
|
||||
- if (chain && rulenum) {
|
||||
- c = nft_chain_find(h, table, chain);
|
||||
+ list = nft_chain_list_get(h, table);
|
||||
+ if (!list)
|
||||
+ return 0;
|
||||
+
|
||||
+ if (chain) {
|
||||
+ c = nftnl_chain_list_lookup_byname(list, chain);
|
||||
if (!c)
|
||||
return 0;
|
||||
|
||||
+ if (!rulenum) {
|
||||
+ if (ops->print_table_header)
|
||||
+ ops->print_table_header(table);
|
||||
+ __nft_print_header(h, ops, c, format);
|
||||
+ }
|
||||
__nft_rule_list(h, c, rulenum, format, ops->print_rule);
|
||||
return 1;
|
||||
}
|
||||
|
||||
- list = nft_chain_list_get(h, table);
|
||||
- if (!list)
|
||||
- return 0;
|
||||
-
|
||||
iter = nftnl_chain_list_iter_create(list);
|
||||
if (iter == NULL)
|
||||
- goto err;
|
||||
+ return 0;
|
||||
|
||||
- if (!chain && ops->print_table_header)
|
||||
+ if (ops->print_table_header)
|
||||
ops->print_table_header(table);
|
||||
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
while (c != NULL) {
|
||||
- const char *chain_name =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
- uint32_t policy =
|
||||
- nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
|
||||
- uint32_t refs =
|
||||
- nftnl_chain_get_u32(c, NFTNL_CHAIN_USE);
|
||||
- struct xt_counters ctrs = {
|
||||
- .pcnt = nftnl_chain_get_u64(c, NFTNL_CHAIN_PACKETS),
|
||||
- .bcnt = nftnl_chain_get_u64(c, NFTNL_CHAIN_BYTES),
|
||||
- };
|
||||
- bool basechain = false;
|
||||
- uint32_t entries;
|
||||
-
|
||||
- if (nftnl_chain_get(c, NFTNL_CHAIN_HOOKNUM))
|
||||
- basechain = true;
|
||||
-
|
||||
- if (chain) {
|
||||
- if (strcmp(chain, chain_name) != 0)
|
||||
- goto next;
|
||||
- else if (ops->print_table_header)
|
||||
- ops->print_table_header(table);
|
||||
- }
|
||||
-
|
||||
if (found)
|
||||
printf("\n");
|
||||
|
||||
- entries = nft_rule_count(h, c);
|
||||
- ops->print_header(format, chain_name, policy_name[policy],
|
||||
- &ctrs, basechain, refs - entries, entries);
|
||||
-
|
||||
+ __nft_print_header(h, ops, c, format);
|
||||
__nft_rule_list(h, c, rulenum, format, ops->print_rule);
|
||||
|
||||
found = true;
|
||||
-
|
||||
- /* we printed the chain we wanted, stop processing. */
|
||||
- if (chain)
|
||||
- break;
|
||||
-
|
||||
-next:
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
}
|
||||
-
|
||||
nftnl_chain_list_iter_destroy(iter);
|
||||
-err:
|
||||
- if (chain && !found)
|
||||
- return 0;
|
||||
-
|
||||
return 1;
|
||||
}
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -1,158 +0,0 @@
|
|||
From 23ef58d88034cdd5c972b9392944a772cccd61f9 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:19 +0100
|
||||
Subject: [PATCH] xtables: Optimize list rules command with given chain
|
||||
|
||||
If a chain name was given, make use of nftnl_chain_list_lookup_byname().
|
||||
|
||||
Likewise in nftnl_rule_list_chain_save(), but introduce
|
||||
__nftnl_rule_list_chain_save() suitable for passing to
|
||||
nftnl_chain_list_foreach().
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 6b1871914e4f3717c7e6324727b80cf1d5d985b1)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 93 +++++++++++++++++++++++---------------------------
|
||||
1 file changed, 43 insertions(+), 50 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index e1c997836cb97..e0455eabda77a 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -2339,46 +2339,44 @@ list_save(struct nftnl_rule *r, unsigned int num, unsigned int format)
|
||||
nft_rule_print_save(r, NFT_RULE_APPEND, format);
|
||||
}
|
||||
|
||||
+static int __nftnl_rule_list_chain_save(struct nftnl_chain *c, void *data)
|
||||
+{
|
||||
+ const char *chain_name = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
+ uint32_t policy = nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
|
||||
+ int *counters = data;
|
||||
+
|
||||
+ if (!nft_chain_builtin(c)) {
|
||||
+ printf("-N %s\n", chain_name);
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
+ /* this is a base chain */
|
||||
+
|
||||
+ printf("-P %s %s", chain_name, policy_name[policy]);
|
||||
+ if (*counters)
|
||||
+ printf(" -c %"PRIu64" %"PRIu64,
|
||||
+ nftnl_chain_get_u64(c, NFTNL_CHAIN_PACKETS),
|
||||
+ nftnl_chain_get_u64(c, NFTNL_CHAIN_BYTES));
|
||||
+ printf("\n");
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
static int
|
||||
nftnl_rule_list_chain_save(struct nft_handle *h, const char *chain,
|
||||
struct nftnl_chain_list *list, int counters)
|
||||
{
|
||||
- struct nftnl_chain_list_iter *iter;
|
||||
struct nftnl_chain *c;
|
||||
|
||||
- iter = nftnl_chain_list_iter_create(list);
|
||||
- if (iter == NULL)
|
||||
- return 0;
|
||||
-
|
||||
- c = nftnl_chain_list_iter_next(iter);
|
||||
- while (c != NULL) {
|
||||
- const char *chain_name =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
- uint32_t policy =
|
||||
- nftnl_chain_get_u32(c, NFTNL_CHAIN_POLICY);
|
||||
-
|
||||
- if (chain && strcmp(chain, chain_name) != 0)
|
||||
- goto next;
|
||||
+ if (chain) {
|
||||
+ c = nftnl_chain_list_lookup_byname(list, chain);
|
||||
+ if (!c)
|
||||
+ return 0;
|
||||
|
||||
- /* this is a base chain */
|
||||
- if (nft_chain_builtin(c)) {
|
||||
- printf("-P %s %s", chain_name, policy_name[policy]);
|
||||
-
|
||||
- if (counters) {
|
||||
- printf(" -c %"PRIu64" %"PRIu64"\n",
|
||||
- nftnl_chain_get_u64(c, NFTNL_CHAIN_PACKETS),
|
||||
- nftnl_chain_get_u64(c, NFTNL_CHAIN_BYTES));
|
||||
- } else
|
||||
- printf("\n");
|
||||
- } else {
|
||||
- printf("-N %s\n", chain_name);
|
||||
- }
|
||||
-next:
|
||||
- c = nftnl_chain_list_iter_next(iter);
|
||||
+ __nftnl_rule_list_chain_save(c, &counters);
|
||||
+ return 1;
|
||||
}
|
||||
|
||||
- nftnl_chain_list_iter_destroy(iter);
|
||||
-
|
||||
+ nftnl_chain_list_foreach(list, __nftnl_rule_list_chain_save, &counters);
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -2410,41 +2408,36 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain,
|
||||
|
||||
list = nft_chain_list_get(h, table);
|
||||
if (!list)
|
||||
- goto err;
|
||||
+ return 0;
|
||||
|
||||
/* Dump policies and custom chains first */
|
||||
if (!rulenum)
|
||||
nftnl_rule_list_chain_save(h, chain, list, counters);
|
||||
|
||||
- /* Now dump out rules in this table */
|
||||
- iter = nftnl_chain_list_iter_create(list);
|
||||
- if (iter == NULL)
|
||||
- goto err;
|
||||
-
|
||||
if (counters < 0)
|
||||
format = FMT_C_COUNTS;
|
||||
else if (counters == 0)
|
||||
format = FMT_NOCOUNTS;
|
||||
|
||||
- c = nftnl_chain_list_iter_next(iter);
|
||||
- while (c != NULL) {
|
||||
- const char *chain_name =
|
||||
- nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
+ if (chain) {
|
||||
+ c = nftnl_chain_list_lookup_byname(list, chain);
|
||||
+ if (!c)
|
||||
+ return 0;
|
||||
|
||||
- if (chain && strcmp(chain, chain_name) != 0)
|
||||
- goto next;
|
||||
+ return __nft_rule_list(h, c, rulenum, format, list_save);
|
||||
+ }
|
||||
|
||||
- ret = __nft_rule_list(h, c, rulenum, format, list_save);
|
||||
+ /* Now dump out rules in this table */
|
||||
+ iter = nftnl_chain_list_iter_create(list);
|
||||
+ if (iter == NULL)
|
||||
+ return 0;
|
||||
|
||||
- /* we printed the chain we wanted, stop processing. */
|
||||
- if (chain)
|
||||
- break;
|
||||
-next:
|
||||
+ c = nftnl_chain_list_iter_next(iter);
|
||||
+ while (c != NULL) {
|
||||
+ ret = __nft_rule_list(h, c, rulenum, format, list_save);
|
||||
c = nftnl_chain_list_iter_next(iter);
|
||||
}
|
||||
-
|
||||
nftnl_chain_list_iter_destroy(iter);
|
||||
-err:
|
||||
return ret;
|
||||
}
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,85 @@
|
|||
From 524f17b1027cb3b6bd5484c644d4dc226d137d91 Mon Sep 17 00:00:00 2001
|
||||
From: Florian Westphal <fw@strlen.de>
|
||||
Date: Sat, 12 Dec 2020 16:15:32 +0100
|
||||
Subject: [PATCH] xtables-monitor: fix rule printing
|
||||
|
||||
trace_print_rule does a rule dump. This prints unrelated rules
|
||||
in the same chain. Instead the function should only request the
|
||||
specific handle.
|
||||
|
||||
Furthermore, flush output buffer afterwards so this plays nice when
|
||||
output isn't a terminal.
|
||||
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 07af4da52ab3002c9cb510863b4eb7aaca4fb43b)
|
||||
---
|
||||
iptables/xtables-monitor.c | 32 +++++++++++++++-----------------
|
||||
1 file changed, 15 insertions(+), 17 deletions(-)
|
||||
|
||||
diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
|
||||
index 4008cc00d4694..364e600e1b38a 100644
|
||||
--- a/iptables/xtables-monitor.c
|
||||
+++ b/iptables/xtables-monitor.c
|
||||
@@ -227,12 +227,12 @@ static void trace_print_rule(const struct nftnl_trace *nlt, struct cb_arg *args)
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
- nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, family, NLM_F_DUMP, 0);
|
||||
+ nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, family, 0, 0);
|
||||
|
||||
nftnl_rule_set_u32(r, NFTNL_RULE_FAMILY, family);
|
||||
nftnl_rule_set_str(r, NFTNL_RULE_CHAIN, chain);
|
||||
nftnl_rule_set_str(r, NFTNL_RULE_TABLE, table);
|
||||
- nftnl_rule_set_u64(r, NFTNL_RULE_POSITION, handle);
|
||||
+ nftnl_rule_set_u64(r, NFTNL_RULE_HANDLE, handle);
|
||||
nftnl_rule_nlmsg_build_payload(nlh, r);
|
||||
nftnl_rule_free(r);
|
||||
|
||||
@@ -248,24 +248,21 @@ static void trace_print_rule(const struct nftnl_trace *nlt, struct cb_arg *args)
|
||||
}
|
||||
|
||||
portid = mnl_socket_get_portid(nl);
|
||||
- if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
|
||||
- perror("mnl_socket_send");
|
||||
- exit(EXIT_FAILURE);
|
||||
- }
|
||||
+ if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
|
||||
+ perror("mnl_socket_send");
|
||||
+ exit(EXIT_FAILURE);
|
||||
+ }
|
||||
|
||||
ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
|
||||
- while (ret > 0) {
|
||||
+ if (ret > 0) {
|
||||
args->is_event = false;
|
||||
- ret = mnl_cb_run(buf, ret, 0, portid, rule_cb, args);
|
||||
- if (ret <= 0)
|
||||
- break;
|
||||
- ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
|
||||
- }
|
||||
- if (ret == -1) {
|
||||
- perror("error");
|
||||
- exit(EXIT_FAILURE);
|
||||
- }
|
||||
- mnl_socket_close(nl);
|
||||
+ ret = mnl_cb_run(buf, ret, 0, portid, rule_cb, args);
|
||||
+ }
|
||||
+ if (ret == -1) {
|
||||
+ perror("error");
|
||||
+ exit(EXIT_FAILURE);
|
||||
+ }
|
||||
+ mnl_socket_close(nl);
|
||||
}
|
||||
|
||||
static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *args)
|
||||
@@ -531,6 +528,7 @@ static int trace_cb(const struct nlmsghdr *nlh, struct cb_arg *arg)
|
||||
err_free:
|
||||
nftnl_trace_free(nlt);
|
||||
err:
|
||||
+ fflush(stdout);
|
||||
return MNL_CB_OK;
|
||||
}
|
||||
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,76 +0,0 @@
|
|||
From 4af07f53926f4bf65caa3804adbadb726e3dc301 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 20 Dec 2018 16:09:20 +0100
|
||||
Subject: [PATCH] nft: Make use of nftnl_rule_lookup_byindex()
|
||||
|
||||
Use the function where suitable to potentially speedup rule cache lookup
|
||||
by rule number.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 039b04896521026d1cb52d60dbacb6ee5226c02d)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 31 ++++++++++++++++++-------------
|
||||
1 file changed, 18 insertions(+), 13 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index e0455eabda77a..1fd3837f2d334 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1976,27 +1976,21 @@ nft_rule_find(struct nft_handle *h, struct nftnl_chain *c, void *data, int rulen
|
||||
{
|
||||
struct nftnl_rule *r;
|
||||
struct nftnl_rule_iter *iter;
|
||||
- int rule_ctr = 0;
|
||||
bool found = false;
|
||||
|
||||
+ if (rulenum >= 0)
|
||||
+ /* Delete by rule number case */
|
||||
+ return nftnl_rule_lookup_byindex(c, rulenum);
|
||||
+
|
||||
iter = nftnl_rule_iter_create(c);
|
||||
if (iter == NULL)
|
||||
return 0;
|
||||
|
||||
r = nftnl_rule_iter_next(iter);
|
||||
while (r != NULL) {
|
||||
- if (rulenum >= 0) {
|
||||
- /* Delete by rule number case */
|
||||
- if (rule_ctr == rulenum) {
|
||||
- found = true;
|
||||
- break;
|
||||
- }
|
||||
- } else {
|
||||
- found = h->ops->rule_find(h->ops, r, data);
|
||||
- if (found)
|
||||
- break;
|
||||
- }
|
||||
- rule_ctr++;
|
||||
+ found = h->ops->rule_find(h->ops, r, data);
|
||||
+ if (found)
|
||||
+ break;
|
||||
r = nftnl_rule_iter_next(iter);
|
||||
}
|
||||
|
||||
@@ -2202,6 +2196,17 @@ __nft_rule_list(struct nft_handle *h, struct nftnl_chain *c,
|
||||
struct nftnl_rule *r;
|
||||
int rule_ctr = 0;
|
||||
|
||||
+ if (rulenum > 0) {
|
||||
+ r = nftnl_rule_lookup_byindex(c, rulenum - 1);
|
||||
+ if (!r)
|
||||
+ /* iptables-legacy returns 0 when listing for
|
||||
+ * valid chain but invalid rule number
|
||||
+ */
|
||||
+ return 1;
|
||||
+ cb(r, rulenum, format);
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
iter = nftnl_rule_iter_create(c);
|
||||
if (iter == NULL)
|
||||
return 0;
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
From 7de2651bdbbabfc08ef040d2cb9867c8375e3984 Mon Sep 17 00:00:00 2001
|
||||
From: Florian Westphal <fw@strlen.de>
|
||||
Date: Sat, 12 Dec 2020 16:15:33 +0100
|
||||
Subject: [PATCH] xtables-monitor: fix packet family protocol
|
||||
|
||||
This prints the family passed on the command line (which might be 0).
|
||||
Print the table family instead.
|
||||
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 946923b640afc2249cf98743ff60a97291108701)
|
||||
---
|
||||
iptables/xtables-monitor.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
|
||||
index 364e600e1b38a..8850a12032d26 100644
|
||||
--- a/iptables/xtables-monitor.c
|
||||
+++ b/iptables/xtables-monitor.c
|
||||
@@ -273,14 +273,14 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
|
||||
uint32_t mark;
|
||||
char name[IFNAMSIZ];
|
||||
|
||||
- printf("PACKET: %d %08x ", args->nfproto, nftnl_trace_get_u32(nlt, NFTNL_TRACE_ID));
|
||||
+ family = nftnl_trace_get_u32(nlt, NFTNL_TRACE_FAMILY);
|
||||
+ printf("PACKET: %d %08x ", family, nftnl_trace_get_u32(nlt, NFTNL_TRACE_ID));
|
||||
|
||||
if (nftnl_trace_is_set(nlt, NFTNL_TRACE_IIF))
|
||||
printf("IN=%s ", if_indextoname(nftnl_trace_get_u32(nlt, NFTNL_TRACE_IIF), name));
|
||||
if (nftnl_trace_is_set(nlt, NFTNL_TRACE_OIF))
|
||||
printf("OUT=%s ", if_indextoname(nftnl_trace_get_u32(nlt, NFTNL_TRACE_OIF), name));
|
||||
|
||||
- family = nftnl_trace_get_u32(nlt, NFTNL_TRACE_FAMILY);
|
||||
nfproto = family;
|
||||
if (nftnl_trace_is_set(nlt, NFTNL_TRACE_NFPROTO)) {
|
||||
nfproto = nftnl_trace_get_u32(nlt, NFTNL_TRACE_NFPROTO);
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,80 +0,0 @@
|
|||
From b8d3fdae853c391312b2a0be533fd4a91bf80e8e Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Sun, 30 Dec 2018 20:06:08 +0100
|
||||
Subject: [PATCH] nft: Simplify nft_is_chain_compatible()
|
||||
|
||||
Make use of nft_{table,chain}_builtin_find() instead of open-coding the
|
||||
list traversal. Since code is pretty obvious now, drop the comments
|
||||
added earlier.
|
||||
|
||||
Fixes: e774b15299c27 ("nft: Review is_*_compatible() routines")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit fae77a24634365b18687a5f09357dbf4aaee2bc0)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 34 +++++++++-------------------------
|
||||
1 file changed, 9 insertions(+), 25 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 1fd3837f2d334..25e538b7e35d7 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -3077,11 +3077,12 @@ static int nft_is_rule_compatible(struct nftnl_rule *rule, void *data)
|
||||
|
||||
static int nft_is_chain_compatible(struct nftnl_chain *c, void *data)
|
||||
{
|
||||
- const struct builtin_chain *chains = NULL, *chain = NULL;
|
||||
- const char *table, *name, *type;
|
||||
+ const struct builtin_table *table;
|
||||
+ const struct builtin_chain *chain;
|
||||
+ const char *tname, *cname, *type;
|
||||
struct nft_handle *h = data;
|
||||
enum nf_inet_hooks hook;
|
||||
- int i, prio;
|
||||
+ int prio;
|
||||
|
||||
if (nftnl_rule_foreach(c, nft_is_rule_compatible, NULL))
|
||||
return -1;
|
||||
@@ -3089,33 +3090,16 @@ static int nft_is_chain_compatible(struct nftnl_chain *c, void *data)
|
||||
if (!nft_chain_builtin(c))
|
||||
return 0;
|
||||
|
||||
- /* find chain's table in builtin tables */
|
||||
- table = nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
||||
- for (i = 0; i < NFT_TABLE_MAX; i++) {
|
||||
- const char *cur_table = h->tables[i].name;
|
||||
-
|
||||
- if (!cur_table || strcmp(cur_table, table))
|
||||
- continue;
|
||||
-
|
||||
- chains = h->tables[i].chains;
|
||||
- break;
|
||||
- }
|
||||
- if (!chains)
|
||||
+ tname = nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
||||
+ table = nft_table_builtin_find(h, tname);
|
||||
+ if (!table)
|
||||
return -1;
|
||||
|
||||
- /* find chain in builtin chain list */
|
||||
- name = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
- for (i = 0; i < NF_INET_NUMHOOKS && chains[i].name; i++) {
|
||||
- if (strcmp(name, chains[i].name))
|
||||
- continue;
|
||||
-
|
||||
- chain = &chains[i];
|
||||
- break;
|
||||
- }
|
||||
+ cname = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
||||
+ chain = nft_chain_builtin_find(table, cname);
|
||||
if (!chain)
|
||||
return -1;
|
||||
|
||||
- /* compare properties */
|
||||
type = nftnl_chain_get_str(c, NFTNL_CHAIN_TYPE);
|
||||
prio = nftnl_chain_get_u32(c, NFTNL_CHAIN_PRIO);
|
||||
hook = nftnl_chain_get_u32(c, NFTNL_CHAIN_HOOKNUM);
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,101 @@
|
|||
From 46fffddb8ae11d3e46f55ca0bb356a2549671652 Mon Sep 17 00:00:00 2001
|
||||
From: Florian Westphal <fw@strlen.de>
|
||||
Date: Sat, 12 Dec 2020 16:15:34 +0100
|
||||
Subject: [PATCH] xtables-monitor: print packet first
|
||||
|
||||
The trace mode should first print the packet that was received and
|
||||
then the rule/verdict.
|
||||
|
||||
Furthermore, the monitor did sometimes print an extra newline.
|
||||
|
||||
After this patch, output is more consistent with nft monitor.
|
||||
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 180ba723d0b305fab9287d3bc5f845a43d9eb793)
|
||||
---
|
||||
iptables/xtables-monitor.c | 34 +++++++++++++++++++++++-----------
|
||||
1 file changed, 23 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
|
||||
index 8850a12032d26..e6b6e76b9fdc9 100644
|
||||
--- a/iptables/xtables-monitor.c
|
||||
+++ b/iptables/xtables-monitor.c
|
||||
@@ -106,6 +106,7 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
|
||||
printf("-0 ");
|
||||
break;
|
||||
default:
|
||||
+ puts("");
|
||||
goto err_free;
|
||||
}
|
||||
|
||||
@@ -433,9 +434,18 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
|
||||
mark = nftnl_trace_get_u32(nlt, NFTNL_TRACE_MARK);
|
||||
if (mark)
|
||||
printf("MARK=0x%x ", mark);
|
||||
+ puts("");
|
||||
+}
|
||||
+
|
||||
+static void trace_print_hdr(const struct nftnl_trace *nlt)
|
||||
+{
|
||||
+ printf(" TRACE: %d %08x %s:%s", nftnl_trace_get_u32(nlt, NFTNL_TABLE_FAMILY),
|
||||
+ nftnl_trace_get_u32(nlt, NFTNL_TRACE_ID),
|
||||
+ nftnl_trace_get_str(nlt, NFTNL_TRACE_TABLE),
|
||||
+ nftnl_trace_get_str(nlt, NFTNL_TRACE_CHAIN));
|
||||
}
|
||||
|
||||
-static void print_verdict(struct nftnl_trace *nlt, uint32_t verdict)
|
||||
+static void print_verdict(const struct nftnl_trace *nlt, uint32_t verdict)
|
||||
{
|
||||
const char *chain;
|
||||
|
||||
@@ -496,35 +506,37 @@ static int trace_cb(const struct nlmsghdr *nlh, struct cb_arg *arg)
|
||||
arg->nfproto != nftnl_trace_get_u32(nlt, NFTNL_TABLE_FAMILY))
|
||||
goto err_free;
|
||||
|
||||
- printf(" TRACE: %d %08x %s:%s", nftnl_trace_get_u32(nlt, NFTNL_TABLE_FAMILY),
|
||||
- nftnl_trace_get_u32(nlt, NFTNL_TRACE_ID),
|
||||
- nftnl_trace_get_str(nlt, NFTNL_TRACE_TABLE),
|
||||
- nftnl_trace_get_str(nlt, NFTNL_TRACE_CHAIN));
|
||||
-
|
||||
switch (nftnl_trace_get_u32(nlt, NFTNL_TRACE_TYPE)) {
|
||||
case NFT_TRACETYPE_RULE:
|
||||
verdict = nftnl_trace_get_u32(nlt, NFTNL_TRACE_VERDICT);
|
||||
- printf(":rule:0x%llx:", (unsigned long long)nftnl_trace_get_u64(nlt, NFTNL_TRACE_RULE_HANDLE));
|
||||
- print_verdict(nlt, verdict);
|
||||
|
||||
- if (nftnl_trace_is_set(nlt, NFTNL_TRACE_RULE_HANDLE))
|
||||
- trace_print_rule(nlt, arg);
|
||||
if (nftnl_trace_is_set(nlt, NFTNL_TRACE_LL_HEADER) ||
|
||||
nftnl_trace_is_set(nlt, NFTNL_TRACE_NETWORK_HEADER))
|
||||
trace_print_packet(nlt, arg);
|
||||
+
|
||||
+ if (nftnl_trace_is_set(nlt, NFTNL_TRACE_RULE_HANDLE)) {
|
||||
+ trace_print_hdr(nlt);
|
||||
+ printf(":rule:0x%" PRIx64":", nftnl_trace_get_u64(nlt, NFTNL_TRACE_RULE_HANDLE));
|
||||
+ print_verdict(nlt, verdict);
|
||||
+ printf(" ");
|
||||
+ trace_print_rule(nlt, arg);
|
||||
+ }
|
||||
break;
|
||||
case NFT_TRACETYPE_POLICY:
|
||||
+ trace_print_hdr(nlt);
|
||||
printf(":policy:");
|
||||
verdict = nftnl_trace_get_u32(nlt, NFTNL_TRACE_POLICY);
|
||||
|
||||
print_verdict(nlt, verdict);
|
||||
+ puts("");
|
||||
break;
|
||||
case NFT_TRACETYPE_RETURN:
|
||||
+ trace_print_hdr(nlt);
|
||||
printf(":return:");
|
||||
trace_print_return(nlt);
|
||||
+ puts("");
|
||||
break;
|
||||
}
|
||||
- puts("");
|
||||
err_free:
|
||||
nftnl_trace_free(nlt);
|
||||
err:
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,66 +0,0 @@
|
|||
From 1ad5112b216c46fdf799fa7c8fbf6508f0f4afc9 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Sun, 30 Dec 2018 20:06:09 +0100
|
||||
Subject: [PATCH] nft: Simplify flush_chain_cache()
|
||||
|
||||
With all the checks for 'tablename' being non-NULL, this code was rather
|
||||
stupid and really hard to read. And the fix is indeed quite simple: If a
|
||||
table name was given, use nft_table_builtin_find() and just flush its
|
||||
chain cache. Otherwise iterate over all builtin tables without any
|
||||
conditionals for 'tablename'.
|
||||
|
||||
Fixes: d4b0d248cc057 ("nft: Reduce indenting level in flush_chain_cache()")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 4441b7da7995ed87741164ef39e99f1065eb9637)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 24 +++++++++++-------------
|
||||
1 file changed, 11 insertions(+), 13 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 25e538b7e35d7..dafb879ebd6f0 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -793,27 +793,25 @@ static int __flush_chain_cache(struct nftnl_chain *c, void *data)
|
||||
|
||||
static void flush_chain_cache(struct nft_handle *h, const char *tablename)
|
||||
{
|
||||
+ const struct builtin_table *table;
|
||||
int i;
|
||||
|
||||
+ if (tablename) {
|
||||
+ table = nft_table_builtin_find(h, tablename);
|
||||
+ if (!table || !h->table[table->type].chain_cache)
|
||||
+ return;
|
||||
+ nftnl_chain_list_foreach(h->table[table->type].chain_cache,
|
||||
+ __flush_chain_cache, NULL);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
for (i = 0; i < NFT_TABLE_MAX; i++) {
|
||||
if (h->tables[i].name == NULL)
|
||||
continue;
|
||||
|
||||
- if (tablename && strcmp(h->tables[i].name, tablename))
|
||||
+ if (!h->table[i].chain_cache)
|
||||
continue;
|
||||
|
||||
- if (!h->table[i].chain_cache) {
|
||||
- if (tablename)
|
||||
- return;
|
||||
- continue;
|
||||
- }
|
||||
-
|
||||
- if (tablename) {
|
||||
- nftnl_chain_list_foreach(h->table[i].chain_cache,
|
||||
- __flush_chain_cache, NULL);
|
||||
- return;
|
||||
- }
|
||||
-
|
||||
nftnl_chain_list_free(h->table[i].chain_cache);
|
||||
h->table[i].chain_cache = NULL;
|
||||
}
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
From bc9b418dc22fb7d81bfded431c74ea84f62340bd Mon Sep 17 00:00:00 2001
|
||||
From: Florian Westphal <fw@strlen.de>
|
||||
Date: Mon, 14 Dec 2020 17:11:23 +0100
|
||||
Subject: [PATCH] xtables-monitor:
|
||||
|
||||
'LL=0x304' is not very convenient, print LOOPBACK instead.
|
||||
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 98ed6f6fc6d97663a33de67afff60196052880b1)
|
||||
---
|
||||
iptables/xtables-monitor.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
|
||||
index e6b6e76b9fdc9..4b9809805fb5b 100644
|
||||
--- a/iptables/xtables-monitor.c
|
||||
+++ b/iptables/xtables-monitor.c
|
||||
@@ -306,6 +306,9 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
|
||||
printf("MACDST=%s ", ether_ntoa((const void *)eh->h_dest));
|
||||
printf("MACPROTO=%04x ", ntohs(eh->h_proto));
|
||||
break;
|
||||
+ case ARPHRD_LOOPBACK:
|
||||
+ printf("LOOPBACK ");
|
||||
+ break;
|
||||
default:
|
||||
printf("LL=0x%x ", type);
|
||||
for (i = 0 ; i < len; i++)
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
From 06bf588263f81b0d254d49b584b26445a788638d Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 23 Sep 2020 19:13:45 +0200
|
||||
Subject: [PATCH] nft: Fix selective chain compatibility checks
|
||||
|
||||
Since commit 80251bc2a56ed ("nft: remove cache build calls"), 'chain'
|
||||
parameter passed to nft_chain_list_get() is no longer effective.
|
||||
Before, it was used to fetch only that single chain from kernel when
|
||||
populating the cache. So the returned list of chains for which
|
||||
compatibility checks are done would contain only that single chain.
|
||||
|
||||
Re-establish the single chain compat checking by introducing a dedicated
|
||||
code path to nft_is_chain_compatible() doing so.
|
||||
|
||||
Fixes: 80251bc2a56ed ("nft: remove cache build calls")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 694612adf87fb614f16a2b678f32745d5c9d7876)
|
||||
---
|
||||
iptables/nft.c | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index bdf252198f155..7f87d46dcc44c 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -3575,6 +3575,12 @@ bool nft_is_table_compatible(struct nft_handle *h,
|
||||
{
|
||||
struct nftnl_chain_list *clist;
|
||||
|
||||
+ if (chain) {
|
||||
+ struct nftnl_chain *c = nft_chain_find(h, table, chain);
|
||||
+
|
||||
+ return c && !nft_is_chain_compatible(c, h);
|
||||
+ }
|
||||
+
|
||||
clist = nft_chain_list_get(h, table, chain);
|
||||
if (clist == NULL)
|
||||
return false;
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,68 +0,0 @@
|
|||
From 276b4dba9aa9d52cafe8df2546050d4591ac5b01 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Sun, 30 Dec 2018 20:06:10 +0100
|
||||
Subject: [PATCH] xtables: Set errno in nft_rule_check() if chain not found
|
||||
|
||||
With this, the explicit check for chain existence can be removed from
|
||||
xtables.c since all related commands do this now.
|
||||
|
||||
Note that this effectively changes the error message printed by
|
||||
iptables-nft when given a non-existing chain, but the new error
|
||||
message(s) conform with those printed by legacy iptables.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 41358d474357a39d616302c03cd7f943e19969a2)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 12 +++++++-----
|
||||
iptables/xtables.c | 4 ----
|
||||
2 files changed, 7 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index dafb879ebd6f0..1ce1ecdd276be 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -2007,17 +2007,19 @@ int nft_rule_check(struct nft_handle *h, const char *chain,
|
||||
|
||||
c = nft_chain_find(h, table, chain);
|
||||
if (!c)
|
||||
- return 0;
|
||||
+ goto fail_enoent;
|
||||
|
||||
r = nft_rule_find(h, c, data, -1);
|
||||
- if (r == NULL) {
|
||||
- errno = ENOENT;
|
||||
- return 0;
|
||||
- }
|
||||
+ if (r == NULL)
|
||||
+ goto fail_enoent;
|
||||
+
|
||||
if (verbose)
|
||||
h->ops->print_rule(r, 0, FMT_PRINT_RULE);
|
||||
|
||||
return 1;
|
||||
+fail_enoent:
|
||||
+ errno = ENOENT;
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
int nft_rule_delete(struct nft_handle *h, const char *chain,
|
||||
diff --git a/iptables/xtables.c b/iptables/xtables.c
|
||||
index 24a6e234bcf4b..da11e8cc159a0 100644
|
||||
--- a/iptables/xtables.c
|
||||
+++ b/iptables/xtables.c
|
||||
@@ -1064,10 +1064,6 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
|
||||
p->chain);
|
||||
}
|
||||
|
||||
- if (!p->xlate && !nft_chain_exists(h, p->table, p->chain))
|
||||
- xtables_error(OTHER_PROBLEM,
|
||||
- "Chain '%s' does not exist", p->chain);
|
||||
-
|
||||
if (!p->xlate && !cs->target && strlen(cs->jumpto) > 0 &&
|
||||
!nft_chain_exists(h, p->table, cs->jumpto))
|
||||
xtables_error(PARAMETER_PROBLEM,
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,104 @@
|
|||
From 4f52c310cf3854a64ef9a518c223e0581ec9a308 Mon Sep 17 00:00:00 2001
|
||||
From: Florian Westphal <fw@strlen.de>
|
||||
Date: Wed, 24 Feb 2021 11:08:02 +0100
|
||||
Subject: [PATCH] iptables-nft: fix -Z option
|
||||
|
||||
it zeroes the rule counters, so it needs fully populated cache.
|
||||
Add a test case to cover this.
|
||||
|
||||
Fixes: 9d07514ac5c7a ("nft: calculate cache requirements from list of commands")
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
Acked-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 5f1fcacebf9b4529950b6e3f88327049a0ea7cd2)
|
||||
---
|
||||
iptables/nft-cmd.c | 2 +-
|
||||
.../testcases/iptables/0007-zero-counters_0 | 64 +++++++++++++++++++
|
||||
2 files changed, 65 insertions(+), 1 deletion(-)
|
||||
create mode 100755 iptables/tests/shell/testcases/iptables/0007-zero-counters_0
|
||||
|
||||
diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
|
||||
index 9c0901e78703a..ed53c061edc6f 100644
|
||||
--- a/iptables/nft-cmd.c
|
||||
+++ b/iptables/nft-cmd.c
|
||||
@@ -185,7 +185,7 @@ int nft_cmd_chain_zero_counters(struct nft_handle *h, const char *chain,
|
||||
if (!cmd)
|
||||
return 0;
|
||||
|
||||
- nft_cache_level_set(h, NFT_CL_CHAINS, cmd);
|
||||
+ nft_cache_level_set(h, NFT_CL_RULES, cmd);
|
||||
|
||||
return 1;
|
||||
}
|
||||
diff --git a/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0
|
||||
new file mode 100755
|
||||
index 0000000000000..36da1907e3b22
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0
|
||||
@@ -0,0 +1,64 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+RC=0
|
||||
+COUNTR=$RANDOM$RANDOM
|
||||
+
|
||||
+$XT_MULTI iptables-restore -c <<EOF
|
||||
+*filter
|
||||
+:INPUT ACCEPT [1:23]
|
||||
+:FOO - [0:0]
|
||||
+[12:345] -A INPUT -i lo -p icmp -m comment --comment "$COUNTR"
|
||||
+[22:123] -A FOO -m comment --comment one
|
||||
+[44:123] -A FOO -m comment --comment two
|
||||
+COMMIT
|
||||
+EOF
|
||||
+EXPECT="*filter
|
||||
+:INPUT ACCEPT [0:0]
|
||||
+:FORWARD ACCEPT [0:0]
|
||||
+:OUTPUT ACCEPT [0:0]
|
||||
+:FOO - [0:0]
|
||||
+[0:0] -A INPUT -i lo -p icmp -m comment --comment "$COUNTR"
|
||||
+[0:0] -A FOO -m comment --comment one
|
||||
+[0:0] -A FOO -m comment --comment two
|
||||
+COMMIT"
|
||||
+
|
||||
+COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
|
||||
+if [ $COUNTER != "[12:345]" ]; then
|
||||
+ echo "Counter $COUNTER is wrong, expected 12:345"
|
||||
+ RC=1
|
||||
+fi
|
||||
+
|
||||
+$XT_MULTI iptables -Z FOO
|
||||
+COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
|
||||
+if [ $COUNTER = "[0:0]" ]; then
|
||||
+ echo "Counter $COUNTER is wrong, should not have been zeroed"
|
||||
+ RC=1
|
||||
+fi
|
||||
+
|
||||
+for c in one two; do
|
||||
+ COUNTER=$($XT_MULTI iptables-save -c |grep "comment $c"| cut -f 1 -d " ")
|
||||
+ if [ $COUNTER != "[0:0]" ]; then
|
||||
+ echo "Counter $COUNTER is wrong, should have been zeroed at rule $c"
|
||||
+ RC=1
|
||||
+ fi
|
||||
+done
|
||||
+
|
||||
+$XT_MULTI iptables -Z
|
||||
+COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
|
||||
+
|
||||
+if [ $COUNTER != "[0:0]" ]; then
|
||||
+ echo "Counter $COUNTER is wrong, expected 0:0 after -Z"
|
||||
+ RC=1
|
||||
+fi
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables-save -c | grep -v '^#')
|
||||
+if [ $? -ne 0 ]; then
|
||||
+ echo "Diff error: counters were not zeroed"
|
||||
+ RC=1
|
||||
+fi
|
||||
+
|
||||
+$XT_MULTI iptables -D INPUT -i lo -p icmp -m comment --comment "$COUNTR"
|
||||
+$XT_MULTI iptables -D FOO -m comment --comment one
|
||||
+$XT_MULTI iptables -D FOO -m comment --comment two
|
||||
+$XT_MULTI iptables -X FOO
|
||||
+exit $RC
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,34 +0,0 @@
|
|||
From 27bc424993e8138e26d7db1d7f902baaf269dd7c Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 12 Dec 2018 20:04:12 +0100
|
||||
Subject: [PATCH] xtables: Speed up chain deletion in large rulesets
|
||||
|
||||
Kernel prefers to identify chain by handle if it was given which causes
|
||||
manual traversal of the chain list. In contrast, chain lookup by name in
|
||||
kernel makes use of a hash table so is considerably faster. Force this
|
||||
code path by removing the cached chain's handle when removing it.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit a5f517a41d72794fae3d1332e6e0e413a5cd16c1)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 1ce1ecdd276be..9c0ad9a2d054f 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1660,6 +1660,8 @@ static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
|
||||
fprintf(stdout, "Deleting chain `%s'\n",
|
||||
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME));
|
||||
|
||||
+ /* XXX This triggers a fast lookup from the kernel. */
|
||||
+ nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
|
||||
ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_DEL, c);
|
||||
if (ret)
|
||||
return -1;
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
From 922b572f262469c9332ea9a7f18808033129b017 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 31 Jan 2019 16:12:50 +0100
|
||||
Subject: [PATCH] arptables-nft: Fix listing rules without target
|
||||
|
||||
Don't try to print cs.jumpto if it is an empty string, otherwise listing
|
||||
(and verbose output) contains '-j' flag without argument.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 043bf38bc9ee020bbf1a9789773050d47f83b807)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-arp.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
|
||||
index 37850bd328b71..56021223bdbe6 100644
|
||||
--- a/iptables/nft-arp.c
|
||||
+++ b/iptables/nft-arp.c
|
||||
@@ -598,7 +598,7 @@ nft_arp_print_rule(struct nftnl_rule *r, unsigned int num, unsigned int format)
|
||||
|
||||
nft_rule_to_iptables_command_state(r, &cs);
|
||||
|
||||
- if (cs.jumpto)
|
||||
+ if (strlen(cs.jumpto))
|
||||
printf("-j %s ", cs.jumpto);
|
||||
nft_arp_print_rule_details(&cs.arp, format);
|
||||
print_matches_and_target(&cs, format);
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
From 7b60fadf23fd4b712dd7522c06b6e7b4f3190fc6 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 19 Feb 2021 16:54:57 +0100
|
||||
Subject: [PATCH] nft: Fix bitwise expression avoidance detection
|
||||
|
||||
Byte-boundary prefix detection was too sloppy: Any data following the
|
||||
first zero-byte was ignored. Add a follow-up loop making sure there are
|
||||
no stray bits in the designated host part.
|
||||
|
||||
Fixes: 323259001d617 ("nft: Optimize class-based IP prefix matches")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 330f5df03ad589b46865ceedf2a54cf10a4225ba)
|
||||
---
|
||||
iptables/nft-shared.c | 4 +++-
|
||||
.../testcases/ip6tables/0004-address-masks_0 | 24 +++++++++++++++++++
|
||||
2 files changed, 27 insertions(+), 1 deletion(-)
|
||||
create mode 100755 iptables/tests/shell/testcases/ip6tables/0004-address-masks_0
|
||||
|
||||
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
||||
index 10553ab26823b..c1664b50f9383 100644
|
||||
--- a/iptables/nft-shared.c
|
||||
+++ b/iptables/nft-shared.c
|
||||
@@ -166,7 +166,7 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
|
||||
{
|
||||
const unsigned char *m = mask;
|
||||
bool bitwise = false;
|
||||
- int i;
|
||||
+ int i, j;
|
||||
|
||||
for (i = 0; i < len; i++) {
|
||||
if (m[i] != 0xff) {
|
||||
@@ -174,6 +174,8 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
|
||||
break;
|
||||
}
|
||||
}
|
||||
+ for (j = i + 1; !bitwise && j < len; j++)
|
||||
+ bitwise = !!m[j];
|
||||
|
||||
if (!bitwise)
|
||||
len = i;
|
||||
diff --git a/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0
|
||||
new file mode 100755
|
||||
index 0000000000000..7eb42f08da975
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0
|
||||
@@ -0,0 +1,24 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+set -e
|
||||
+
|
||||
+$XT_MULTI ip6tables-restore <<EOF
|
||||
+*filter
|
||||
+-A FORWARD -s feed:babe::/ffff::0
|
||||
+-A FORWARD -s feed:babe::/ffff:ff00::0
|
||||
+-A FORWARD -s feed:babe::/ffff:fff0::0
|
||||
+-A FORWARD -s feed:babe::/ffff:ffff::0
|
||||
+-A FORWARD -s feed:babe::/0:ffff::0
|
||||
+-A FORWARD -s feed:c0ff::babe:f00/ffff::ffff:0
|
||||
+COMMIT
|
||||
+EOF
|
||||
+
|
||||
+EXPECT='-P FORWARD ACCEPT
|
||||
+-A FORWARD -s feed::/16
|
||||
+-A FORWARD -s feed:ba00::/24
|
||||
+-A FORWARD -s feed:bab0::/28
|
||||
+-A FORWARD -s feed:babe::/32
|
||||
+-A FORWARD -s 0:babe::/0:ffff::
|
||||
+-A FORWARD -s feed::babe:0/ffff::ffff:0'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD)
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,155 +0,0 @@
|
|||
From 0b6b93e52f2a862c23206f9ad9fc48aadc06fbd2 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 31 Jan 2019 16:12:51 +0100
|
||||
Subject: [PATCH] arptables-nft: Fix MARK target parsing and printing
|
||||
|
||||
Legacy arptables parses mark values in hex no matter if prefixed with
|
||||
'0x' or not. Sadly, this is not easily achievable with guided option
|
||||
parser. Hence fall back to the old 'parse' callback. The introduced
|
||||
target definition is valid only for revision 2, but that's consistent
|
||||
with legacy arptables.
|
||||
|
||||
When printing, use --set-mark option instead of --set-xmark.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit f7fa88020f3bc4ec646ce2a48731a1f5fa2aa0a9)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libxt_MARK.c | 95 +++++++++++++++++++
|
||||
.../arptables/0001-arptables-save-restore_0 | 2 +-
|
||||
2 files changed, 96 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c
|
||||
index 43aa977924b12..b765af6c35304 100644
|
||||
--- a/extensions/libxt_MARK.c
|
||||
+++ b/extensions/libxt_MARK.c
|
||||
@@ -1,3 +1,4 @@
|
||||
+#include <getopt.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdio.h>
|
||||
#include <xtables.h>
|
||||
@@ -245,6 +246,87 @@ static void mark_tg_save(const void *ip, const struct xt_entry_target *target)
|
||||
printf(" --set-xmark 0x%x/0x%x", info->mark, info->mask);
|
||||
}
|
||||
|
||||
+static void mark_tg_arp_save(const void *ip, const struct xt_entry_target *target)
|
||||
+{
|
||||
+ const struct xt_mark_tginfo2 *info = (const void *)target->data;
|
||||
+
|
||||
+ if (info->mark == 0)
|
||||
+ printf(" --and-mark %x", (unsigned int)(uint32_t)~info->mask);
|
||||
+ else if (info->mark == info->mask)
|
||||
+ printf(" --or-mark %x", info->mark);
|
||||
+ else
|
||||
+ printf(" --set-mark %x", info->mark);
|
||||
+}
|
||||
+
|
||||
+static void mark_tg_arp_print(const void *ip,
|
||||
+ const struct xt_entry_target *target, int numeric)
|
||||
+{
|
||||
+ mark_tg_arp_save(ip, target);
|
||||
+}
|
||||
+
|
||||
+#define MARK_OPT 1
|
||||
+#define AND_MARK_OPT 2
|
||||
+#define OR_MARK_OPT 3
|
||||
+
|
||||
+static struct option mark_tg_arp_opts[] = {
|
||||
+ { .name = "set-mark", .has_arg = required_argument, .flag = 0, .val = MARK_OPT },
|
||||
+ { .name = "and-mark", .has_arg = required_argument, .flag = 0, .val = AND_MARK_OPT },
|
||||
+ { .name = "or-mark", .has_arg = required_argument, .flag = 0, .val = OR_MARK_OPT },
|
||||
+ { .name = NULL}
|
||||
+};
|
||||
+
|
||||
+static int
|
||||
+mark_tg_arp_parse(int c, char **argv, int invert, unsigned int *flags,
|
||||
+ const void *entry, struct xt_entry_target **target)
|
||||
+{
|
||||
+ struct xt_mark_tginfo2 *info =
|
||||
+ (struct xt_mark_tginfo2 *)(*target)->data;
|
||||
+ int i;
|
||||
+
|
||||
+ switch (c) {
|
||||
+ case MARK_OPT:
|
||||
+ if (sscanf(argv[optind-1], "%x", &i) != 1) {
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "Bad mark value `%s'", optarg);
|
||||
+ return 0;
|
||||
+ }
|
||||
+ info->mark = i;
|
||||
+ if (*flags)
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "MARK: Can't specify --set-mark twice");
|
||||
+ *flags = 1;
|
||||
+ break;
|
||||
+ case AND_MARK_OPT:
|
||||
+ if (sscanf(argv[optind-1], "%x", &i) != 1) {
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "Bad mark value `%s'", optarg);
|
||||
+ return 0;
|
||||
+ }
|
||||
+ info->mark = 0;
|
||||
+ info->mask = ~i;
|
||||
+ if (*flags)
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "MARK: Can't specify --and-mark twice");
|
||||
+ *flags = 1;
|
||||
+ break;
|
||||
+ case OR_MARK_OPT:
|
||||
+ if (sscanf(argv[optind-1], "%x", &i) != 1) {
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "Bad mark value `%s'", optarg);
|
||||
+ return 0;
|
||||
+ }
|
||||
+ info->mark = info->mask = i;
|
||||
+ if (*flags)
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "MARK: Can't specify --or-mark twice");
|
||||
+ *flags = 1;
|
||||
+ break;
|
||||
+ default:
|
||||
+ return 0;
|
||||
+ }
|
||||
+ return 1;
|
||||
+}
|
||||
+
|
||||
static int mark_tg_xlate(struct xt_xlate *xl,
|
||||
const struct xt_xlate_tg_params *params)
|
||||
{
|
||||
@@ -335,6 +417,19 @@ static struct xtables_target mark_tg_reg[] = {
|
||||
.x6_options = mark_tg_opts,
|
||||
.xlate = mark_tg_xlate,
|
||||
},
|
||||
+ {
|
||||
+ .version = XTABLES_VERSION,
|
||||
+ .name = "MARK",
|
||||
+ .revision = 2,
|
||||
+ .family = NFPROTO_ARP,
|
||||
+ .size = XT_ALIGN(sizeof(struct xt_mark_tginfo2)),
|
||||
+ .userspacesize = XT_ALIGN(sizeof(struct xt_mark_tginfo2)),
|
||||
+ .help = mark_tg_help,
|
||||
+ .print = mark_tg_arp_print,
|
||||
+ .save = mark_tg_arp_save,
|
||||
+ .parse = mark_tg_arp_parse,
|
||||
+ .extra_opts = mark_tg_arp_opts,
|
||||
+ },
|
||||
};
|
||||
|
||||
void _init(void)
|
||||
diff --git a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0 b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
index 73b3b0cf88e18..f8629551b0ba9 100755
|
||||
--- a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
+++ b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
@@ -47,7 +47,7 @@ DUMP='*filter
|
||||
-A OUTPUT -o eth432 --h-length 6 --opcode 1 --h-type 1 -j CLASSIFY --set-class feed:babe
|
||||
-A foo -i lo --h-length 6 --h-type 1 -j ACCEPT
|
||||
-A foo --h-length 6 --h-type 1 -j ACCEPT
|
||||
--A foo --h-length 6 --h-type 1 -j MARK --set-xmark 0x3039/0xffffffff
|
||||
+-A foo --h-length 6 --h-type 1 -j MARK --set-mark 12345
|
||||
-A foo --h-length 6 --opcode 1 --h-type 1 -j ACCEPT
|
||||
-A foo --h-length 6 --h-type 1 --proto-type 0x800 -j ACCEPT
|
||||
-A foo -i lo --h-length 6 --opcode 1 --h-type 1 --proto-type 0x800 -j ACCEPT
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,196 @@
|
|||
From 810da6ff3a0a0b9bdb608edc0b68fc5cedac97e0 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 2 Mar 2021 14:50:07 +0100
|
||||
Subject: [PATCH] xtables-translate: Fix translation of odd netmasks
|
||||
|
||||
Iptables supports netmasks which are not prefixes to match on (or
|
||||
ignore) arbitrary bits in an address. Yet nftables' prefix notation is
|
||||
available for real prefixes only, so translation is not as trivial -
|
||||
print bitmask syntax for those cases.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 46f9d3a9a61ee80fa94b7fa7b3b36045c92606ae)
|
||||
---
|
||||
extensions/generic.txlate | 48 +++++++++++++++++++++++++++++++++++++
|
||||
extensions/libxt_standard.t | 12 ++++++++++
|
||||
iptables/nft-ipv4.c | 42 ++++++++++++++++++++++----------
|
||||
iptables/nft-ipv6.c | 19 ++++++++++++---
|
||||
4 files changed, 106 insertions(+), 15 deletions(-)
|
||||
|
||||
diff --git a/extensions/generic.txlate b/extensions/generic.txlate
|
||||
index 0e256c3727559..9ae9a5b54c1b9 100644
|
||||
--- a/extensions/generic.txlate
|
||||
+++ b/extensions/generic.txlate
|
||||
@@ -10,6 +10,54 @@ nft insert rule ip filter INPUT iifname "iifname" ip saddr 10.0.0.0/8 counter
|
||||
iptables-translate -A INPUT -i iif+ ! -d 10.0.0.0/8
|
||||
nft add rule ip filter INPUT iifname "iif*" ip daddr != 10.0.0.0/8 counter
|
||||
|
||||
+iptables-translate -I INPUT -s 10.11.12.13/255.255.0.0
|
||||
+nft insert rule ip filter INPUT ip saddr 10.11.0.0/16 counter
|
||||
+
|
||||
+iptables-translate -I INPUT -s 10.11.12.13/255.0.255.0
|
||||
+nft insert rule ip filter INPUT ip saddr & 255.0.255.0 == 10.0.12.0 counter
|
||||
+
|
||||
+iptables-translate -I INPUT -s 10.11.12.13/0.255.0.255
|
||||
+nft insert rule ip filter INPUT ip saddr & 0.255.0.255 == 0.11.0.13 counter
|
||||
+
|
||||
+iptables-translate -I INPUT ! -s 10.11.12.13/0.255.0.255
|
||||
+nft insert rule ip filter INPUT ip saddr & 0.255.0.255 != 0.11.0.13 counter
|
||||
+
|
||||
+iptables-translate -I INPUT -s 0.0.0.0/16
|
||||
+nft insert rule ip filter INPUT ip saddr 0.0.0.0/16 counter
|
||||
+
|
||||
+iptables-translate -I INPUT -s 0.0.0.0/0
|
||||
+nft insert rule ip filter INPUT counter
|
||||
+
|
||||
+iptables-translate -I INPUT ! -s 0.0.0.0/0
|
||||
+nft insert rule ip filter INPUT ip saddr != 0.0.0.0/0 counter
|
||||
+
|
||||
+ip6tables-translate -I INPUT -i iifname -s feed::/16
|
||||
+nft insert rule ip6 filter INPUT iifname "iifname" ip6 saddr feed::/16 counter
|
||||
+
|
||||
+ip6tables-translate -A INPUT -i iif+ ! -d feed::/16
|
||||
+nft add rule ip6 filter INPUT iifname "iif*" ip6 daddr != feed::/16 counter
|
||||
+
|
||||
+ip6tables-translate -I INPUT -s feed:babe::1/ffff:ff00::
|
||||
+nft insert rule ip6 filter INPUT ip6 saddr feed:ba00::/24 counter
|
||||
+
|
||||
+ip6tables-translate -I INPUT -s feed:babe:c0ff:ee00:c0be:1234:5678:90ab/ffff:0:ffff:0:ffff:0:ffff:0
|
||||
+nft insert rule ip6 filter INPUT ip6 saddr & ffff:0:ffff:0:ffff:0:ffff:0 == feed:0:c0ff:0:c0be:0:5678:0 counter
|
||||
+
|
||||
+ip6tables-translate -I INPUT -s feed:babe:c0ff:ee00:c0be:1234:5678:90ab/0:ffff:0:ffff:0:ffff:0:ffff
|
||||
+nft insert rule ip6 filter INPUT ip6 saddr & 0:ffff:0:ffff:0:ffff:0:ffff == 0:babe:0:ee00:0:1234:0:90ab counter
|
||||
+
|
||||
+ip6tables-translate -I INPUT ! -s feed:babe:c0ff:ee00:c0be:1234:5678:90ab/0:ffff:0:ffff:0:ffff:0:ffff
|
||||
+nft insert rule ip6 filter INPUT ip6 saddr & 0:ffff:0:ffff:0:ffff:0:ffff != 0:babe:0:ee00:0:1234:0:90ab counter
|
||||
+
|
||||
+ip6tables-translate -I INPUT -s ::/16
|
||||
+nft insert rule ip6 filter INPUT ip6 saddr ::/16 counter
|
||||
+
|
||||
+ip6tables-translate -I INPUT -s ::/0
|
||||
+nft insert rule ip6 filter INPUT counter
|
||||
+
|
||||
+ip6tables-translate -I INPUT ! -s ::/0
|
||||
+nft insert rule ip6 filter INPUT ip6 saddr != ::/0 counter
|
||||
+
|
||||
ebtables-translate -I INPUT -i iname --logical-in ilogname -s 0:0:0:0:0:0
|
||||
nft insert rule bridge filter INPUT iifname "iname" meta ibrname "ilogname" ether saddr 00:00:00:00:00:00 counter
|
||||
|
||||
diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t
|
||||
index 4313f7b7bac9d..56d6da2e5884e 100644
|
||||
--- a/extensions/libxt_standard.t
|
||||
+++ b/extensions/libxt_standard.t
|
||||
@@ -9,3 +9,15 @@
|
||||
-j ACCEPT;=;OK
|
||||
-j RETURN;=;OK
|
||||
! -p 0 -j ACCEPT;=;FAIL
|
||||
+-s 10.11.12.13/8;-s 10.0.0.0/8;OK
|
||||
+-s 10.11.12.13/9;-s 10.0.0.0/9;OK
|
||||
+-s 10.11.12.13/10;-s 10.0.0.0/10;OK
|
||||
+-s 10.11.12.13/11;-s 10.0.0.0/11;OK
|
||||
+-s 10.11.12.13/12;-s 10.0.0.0/12;OK
|
||||
+-s 10.11.12.13/30;-s 10.11.12.12/30;OK
|
||||
+-s 10.11.12.13/31;-s 10.11.12.12/31;OK
|
||||
+-s 10.11.12.13/32;-s 10.11.12.13/32;OK
|
||||
+-s 10.11.12.13/255.0.0.0;-s 10.0.0.0/8;OK
|
||||
+-s 10.11.12.13/255.128.0.0;-s 10.0.0.0/9;OK
|
||||
+-s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK
|
||||
+-s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK
|
||||
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
|
||||
index fdc15c6f04066..0d32a30010519 100644
|
||||
--- a/iptables/nft-ipv4.c
|
||||
+++ b/iptables/nft-ipv4.c
|
||||
@@ -383,6 +383,32 @@ static void nft_ipv4_post_parse(int command,
|
||||
" source or destination IP addresses");
|
||||
}
|
||||
|
||||
+static void xlate_ipv4_addr(const char *selector, const struct in_addr *addr,
|
||||
+ const struct in_addr *mask,
|
||||
+ bool inv, struct xt_xlate *xl)
|
||||
+{
|
||||
+ const char *op = inv ? "!= " : "";
|
||||
+ int cidr;
|
||||
+
|
||||
+ if (!inv && !addr->s_addr && !mask->s_addr)
|
||||
+ return;
|
||||
+
|
||||
+ cidr = xtables_ipmask_to_cidr(mask);
|
||||
+ switch (cidr) {
|
||||
+ case -1:
|
||||
+ /* inet_ntoa() is not reentrant */
|
||||
+ xt_xlate_add(xl, "%s & %s ", selector, inet_ntoa(*mask));
|
||||
+ xt_xlate_add(xl, "%s %s ", inv ? "!=" : "==", inet_ntoa(*addr));
|
||||
+ break;
|
||||
+ case 32:
|
||||
+ xt_xlate_add(xl, "%s %s%s ", selector, op, inet_ntoa(*addr));
|
||||
+ break;
|
||||
+ default:
|
||||
+ xt_xlate_add(xl, "%s %s%s/%d ", selector, op, inet_ntoa(*addr),
|
||||
+ cidr);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
|
||||
{
|
||||
const struct iptables_command_state *cs = data;
|
||||
@@ -417,18 +443,10 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
|
||||
}
|
||||
}
|
||||
|
||||
- if (cs->fw.ip.src.s_addr != 0) {
|
||||
- xt_xlate_add(xl, "ip saddr %s%s%s ",
|
||||
- cs->fw.ip.invflags & IPT_INV_SRCIP ? "!= " : "",
|
||||
- inet_ntoa(cs->fw.ip.src),
|
||||
- xtables_ipmask_to_numeric(&cs->fw.ip.smsk));
|
||||
- }
|
||||
- if (cs->fw.ip.dst.s_addr != 0) {
|
||||
- xt_xlate_add(xl, "ip daddr %s%s%s ",
|
||||
- cs->fw.ip.invflags & IPT_INV_DSTIP ? "!= " : "",
|
||||
- inet_ntoa(cs->fw.ip.dst),
|
||||
- xtables_ipmask_to_numeric(&cs->fw.ip.dmsk));
|
||||
- }
|
||||
+ xlate_ipv4_addr("ip saddr", &cs->fw.ip.src, &cs->fw.ip.smsk,
|
||||
+ cs->fw.ip.invflags & IPT_INV_SRCIP, xl);
|
||||
+ xlate_ipv4_addr("ip daddr", &cs->fw.ip.dst, &cs->fw.ip.dmsk,
|
||||
+ cs->fw.ip.invflags & IPT_INV_DSTIP, xl);
|
||||
|
||||
ret = xlate_matches(cs, xl);
|
||||
if (!ret)
|
||||
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
|
||||
index 130ad3e6e7c44..46008fc5e762a 100644
|
||||
--- a/iptables/nft-ipv6.c
|
||||
+++ b/iptables/nft-ipv6.c
|
||||
@@ -337,14 +337,27 @@ static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr,
|
||||
const struct in6_addr *mask,
|
||||
int invert, struct xt_xlate *xl)
|
||||
{
|
||||
+ const char *op = invert ? "!= " : "";
|
||||
char addr_str[INET6_ADDRSTRLEN];
|
||||
+ int cidr;
|
||||
|
||||
- if (!invert && IN6_IS_ADDR_UNSPECIFIED(addr))
|
||||
+ if (!invert && IN6_IS_ADDR_UNSPECIFIED(addr) && IN6_IS_ADDR_UNSPECIFIED(mask))
|
||||
return;
|
||||
|
||||
inet_ntop(AF_INET6, addr, addr_str, INET6_ADDRSTRLEN);
|
||||
- xt_xlate_add(xl, "%s %s%s%s ", selector, invert ? "!= " : "", addr_str,
|
||||
- xtables_ip6mask_to_numeric(mask));
|
||||
+ cidr = xtables_ip6mask_to_cidr(mask);
|
||||
+ switch (cidr) {
|
||||
+ case -1:
|
||||
+ xt_xlate_add(xl, "%s & %s %s %s ", selector,
|
||||
+ xtables_ip6addr_to_numeric(mask),
|
||||
+ invert ? "!=" : "==", addr_str);
|
||||
+ break;
|
||||
+ case 128:
|
||||
+ xt_xlate_add(xl, "%s %s%s ", selector, op, addr_str);
|
||||
+ break;
|
||||
+ default:
|
||||
+ xt_xlate_add(xl, "%s %s%s/%d ", selector, op, addr_str, cidr);
|
||||
+ }
|
||||
}
|
||||
|
||||
static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,99 +0,0 @@
|
|||
From fabed9f23311cdf42180613123309307b5c6add5 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 31 Jan 2019 16:12:52 +0100
|
||||
Subject: [PATCH] arptables-nft: Fix CLASSIFY target printing
|
||||
|
||||
In legacy arptables, CLASSIFY target is not printed with fixed hex
|
||||
number lengths. Counter this by introducing a dedicated target
|
||||
definition for NFPROTO_ARP only having own print/save callbacks.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 756bea26a3dad89c467c703725ce6d3c6b29c871)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libxt_CLASSIFY.c | 59 +++++++++++++++++++++++++++++--------
|
||||
1 file changed, 46 insertions(+), 13 deletions(-)
|
||||
|
||||
diff --git a/extensions/libxt_CLASSIFY.c b/extensions/libxt_CLASSIFY.c
|
||||
index f90082dc7c50e..75aaf0c41b61a 100644
|
||||
--- a/extensions/libxt_CLASSIFY.c
|
||||
+++ b/extensions/libxt_CLASSIFY.c
|
||||
@@ -73,6 +73,24 @@ CLASSIFY_save(const void *ip, const struct xt_entry_target *target)
|
||||
TC_H_MAJ(clinfo->priority)>>16, TC_H_MIN(clinfo->priority));
|
||||
}
|
||||
|
||||
+static void
|
||||
+CLASSIFY_arp_save(const void *ip, const struct xt_entry_target *target)
|
||||
+{
|
||||
+ const struct xt_classify_target_info *clinfo =
|
||||
+ (const struct xt_classify_target_info *)target->data;
|
||||
+
|
||||
+ printf(" --set-class %x:%x",
|
||||
+ TC_H_MAJ(clinfo->priority)>>16, TC_H_MIN(clinfo->priority));
|
||||
+}
|
||||
+
|
||||
+static void
|
||||
+CLASSIFY_arp_print(const void *ip,
|
||||
+ const struct xt_entry_target *target,
|
||||
+ int numeric)
|
||||
+{
|
||||
+ CLASSIFY_arp_save(ip, target);
|
||||
+}
|
||||
+
|
||||
static int CLASSIFY_xlate(struct xt_xlate *xl,
|
||||
const struct xt_xlate_tg_params *params)
|
||||
{
|
||||
@@ -98,21 +116,36 @@ static int CLASSIFY_xlate(struct xt_xlate *xl,
|
||||
return 1;
|
||||
}
|
||||
|
||||
-static struct xtables_target classify_target = {
|
||||
- .family = NFPROTO_UNSPEC,
|
||||
- .name = "CLASSIFY",
|
||||
- .version = XTABLES_VERSION,
|
||||
- .size = XT_ALIGN(sizeof(struct xt_classify_target_info)),
|
||||
- .userspacesize = XT_ALIGN(sizeof(struct xt_classify_target_info)),
|
||||
- .help = CLASSIFY_help,
|
||||
- .print = CLASSIFY_print,
|
||||
- .save = CLASSIFY_save,
|
||||
- .x6_parse = CLASSIFY_parse,
|
||||
- .x6_options = CLASSIFY_opts,
|
||||
- .xlate = CLASSIFY_xlate,
|
||||
+static struct xtables_target classify_tg_reg[] = {
|
||||
+ {
|
||||
+ .family = NFPROTO_UNSPEC,
|
||||
+ .name = "CLASSIFY",
|
||||
+ .version = XTABLES_VERSION,
|
||||
+ .size = XT_ALIGN(sizeof(struct xt_classify_target_info)),
|
||||
+ .userspacesize = XT_ALIGN(sizeof(struct xt_classify_target_info)),
|
||||
+ .help = CLASSIFY_help,
|
||||
+ .print = CLASSIFY_print,
|
||||
+ .save = CLASSIFY_save,
|
||||
+ .x6_parse = CLASSIFY_parse,
|
||||
+ .x6_options = CLASSIFY_opts,
|
||||
+ .xlate = CLASSIFY_xlate,
|
||||
+ },
|
||||
+ {
|
||||
+ .family = NFPROTO_ARP,
|
||||
+ .name = "CLASSIFY",
|
||||
+ .version = XTABLES_VERSION,
|
||||
+ .size = XT_ALIGN(sizeof(struct xt_classify_target_info)),
|
||||
+ .userspacesize = XT_ALIGN(sizeof(struct xt_classify_target_info)),
|
||||
+ .help = CLASSIFY_help,
|
||||
+ .print = CLASSIFY_arp_print,
|
||||
+ .save = CLASSIFY_arp_save,
|
||||
+ .x6_parse = CLASSIFY_parse,
|
||||
+ .x6_options = CLASSIFY_opts,
|
||||
+ .xlate = CLASSIFY_xlate,
|
||||
+ }
|
||||
};
|
||||
|
||||
void _init(void)
|
||||
{
|
||||
- xtables_register_target(&classify_target);
|
||||
+ xtables_register_targets(classify_tg_reg, ARRAY_SIZE(classify_tg_reg));
|
||||
}
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,129 @@
|
|||
From db7d25c14b8db7f7ea514e1f81acb82fafb3c9d7 Mon Sep 17 00:00:00 2001
|
||||
From: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
|
||||
Date: Thu, 1 Apr 2021 16:47:07 +0300
|
||||
Subject: [PATCH] extensions: libxt_conntrack: use bitops for state negation
|
||||
|
||||
Currently, state_xlate_print function prints statemask as comma-separated sequence of enabled
|
||||
statemask flags. But if we have inverted conntrack ctstate condition then we have to use more
|
||||
complex expression because nft not supports syntax like "ct state != related,established".
|
||||
|
||||
Reproducer:
|
||||
$ iptables -A INPUT -d 127.0.0.1/32 -p tcp -m conntrack ! --ctstate RELATED,ESTABLISHED -j DROP
|
||||
$ nft list ruleset
|
||||
...
|
||||
meta l4proto tcp ip daddr 127.0.0.1 ct state != related,established counter packets 0 bytes 0 drop
|
||||
...
|
||||
|
||||
it will fail if we try to load this rule:
|
||||
$ nft -f nft_test
|
||||
../nft_test:6:97-97: Error: syntax error, unexpected comma, expecting newline or semicolon
|
||||
|
||||
Cc: Florian Westphal <fw@strlen.de>
|
||||
Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 18e334da7363ba186edb1700056e26ded27ca5ba)
|
||||
---
|
||||
extensions/libxt_conntrack.c | 38 ++++++++++++++++++++-----------
|
||||
extensions/libxt_conntrack.txlate | 5 +++-
|
||||
2 files changed, 29 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
|
||||
index 7734509c9af84..91f9e4aa994f8 100644
|
||||
--- a/extensions/libxt_conntrack.c
|
||||
+++ b/extensions/libxt_conntrack.c
|
||||
@@ -1148,30 +1148,43 @@ static void state_save(const void *ip, const struct xt_entry_match *match)
|
||||
state_print_state(sinfo->statemask);
|
||||
}
|
||||
|
||||
-static void state_xlate_print(struct xt_xlate *xl, unsigned int statemask)
|
||||
+static void state_xlate_print(struct xt_xlate *xl, unsigned int statemask, int inverted)
|
||||
{
|
||||
const char *sep = "";
|
||||
+ int one_flag_set;
|
||||
+
|
||||
+ one_flag_set = !(statemask & (statemask - 1));
|
||||
+
|
||||
+ if (inverted && !one_flag_set)
|
||||
+ xt_xlate_add(xl, "& (");
|
||||
+ else if (inverted)
|
||||
+ xt_xlate_add(xl, "& ");
|
||||
|
||||
if (statemask & XT_CONNTRACK_STATE_INVALID) {
|
||||
xt_xlate_add(xl, "%s%s", sep, "invalid");
|
||||
- sep = ",";
|
||||
+ sep = inverted && !one_flag_set ? "|" : ",";
|
||||
}
|
||||
if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_NEW)) {
|
||||
xt_xlate_add(xl, "%s%s", sep, "new");
|
||||
- sep = ",";
|
||||
+ sep = inverted && !one_flag_set ? "|" : ",";
|
||||
}
|
||||
if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_RELATED)) {
|
||||
xt_xlate_add(xl, "%s%s", sep, "related");
|
||||
- sep = ",";
|
||||
+ sep = inverted && !one_flag_set ? "|" : ",";
|
||||
}
|
||||
if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_ESTABLISHED)) {
|
||||
xt_xlate_add(xl, "%s%s", sep, "established");
|
||||
- sep = ",";
|
||||
+ sep = inverted && !one_flag_set ? "|" : ",";
|
||||
}
|
||||
if (statemask & XT_CONNTRACK_STATE_UNTRACKED) {
|
||||
xt_xlate_add(xl, "%s%s", sep, "untracked");
|
||||
- sep = ",";
|
||||
+ sep = inverted && !one_flag_set ? "|" : ",";
|
||||
}
|
||||
+
|
||||
+ if (inverted && !one_flag_set)
|
||||
+ xt_xlate_add(xl, ") == 0");
|
||||
+ else if (inverted)
|
||||
+ xt_xlate_add(xl, " == 0");
|
||||
}
|
||||
|
||||
static int state_xlate(struct xt_xlate *xl,
|
||||
@@ -1180,9 +1193,9 @@ static int state_xlate(struct xt_xlate *xl,
|
||||
const struct xt_conntrack_mtinfo3 *sinfo =
|
||||
(const void *)params->match->data;
|
||||
|
||||
- xt_xlate_add(xl, "ct state %s", sinfo->invert_flags & XT_CONNTRACK_STATE ?
|
||||
- "!= " : "");
|
||||
- state_xlate_print(xl, sinfo->state_mask);
|
||||
+ xt_xlate_add(xl, "ct state ");
|
||||
+ state_xlate_print(xl, sinfo->state_mask,
|
||||
+ sinfo->invert_flags & XT_CONNTRACK_STATE);
|
||||
xt_xlate_add(xl, " ");
|
||||
return 1;
|
||||
}
|
||||
@@ -1256,10 +1269,9 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
|
||||
sinfo->state_mask & XT_CONNTRACK_STATE_SNAT ? "snat" : "dnat");
|
||||
space = " ";
|
||||
} else {
|
||||
- xt_xlate_add(xl, "%sct state %s", space,
|
||||
- sinfo->invert_flags & XT_CONNTRACK_STATE ?
|
||||
- "!= " : "");
|
||||
- state_xlate_print(xl, sinfo->state_mask);
|
||||
+ xt_xlate_add(xl, "%sct state ", space);
|
||||
+ state_xlate_print(xl, sinfo->state_mask,
|
||||
+ sinfo->invert_flags & XT_CONNTRACK_STATE);
|
||||
space = " ";
|
||||
}
|
||||
}
|
||||
diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate
|
||||
index d374f8a035f00..5ab85b177c396 100644
|
||||
--- a/extensions/libxt_conntrack.txlate
|
||||
+++ b/extensions/libxt_conntrack.txlate
|
||||
@@ -2,7 +2,10 @@ iptables-translate -t filter -A INPUT -m conntrack --ctstate NEW,RELATED -j ACCE
|
||||
nft add rule ip filter INPUT ct state new,related counter accept
|
||||
|
||||
ip6tables-translate -t filter -A INPUT -m conntrack ! --ctstate NEW,RELATED -j ACCEPT
|
||||
-nft add rule ip6 filter INPUT ct state != new,related counter accept
|
||||
+nft add rule ip6 filter INPUT ct state & (new|related) == 0 counter accept
|
||||
+
|
||||
+ip6tables-translate -t filter -A INPUT -m conntrack ! --ctstate NEW -j ACCEPT
|
||||
+nft add rule ip6 filter INPUT ct state & new == 0 counter accept
|
||||
|
||||
iptables-translate -t filter -A INPUT -m conntrack --ctproto UDP -j ACCEPT
|
||||
nft add rule ip filter INPUT ct original protocol 17 counter accept
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -0,0 +1,120 @@
|
|||
From ca4b90e5fc460fe522ceff2206ae5d32d32d2b40 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 27 Apr 2021 09:12:53 +0200
|
||||
Subject: [PATCH] Eliminate inet_aton() and inet_ntoa()
|
||||
|
||||
Both functions are obsolete, replace them by equivalent calls to
|
||||
inet_pton() and inet_ntop().
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit acac2dbe64e5120394fa715bb5fe95c42d08b8b3)
|
||||
---
|
||||
extensions/libebt_among.c | 6 ++++--
|
||||
iptables/nft-ipv4.c | 23 ++++++++++++++---------
|
||||
2 files changed, 18 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c
|
||||
index 2b9a1b6566684..7eb898f984bba 100644
|
||||
--- a/extensions/libebt_among.c
|
||||
+++ b/extensions/libebt_among.c
|
||||
@@ -66,7 +66,7 @@ parse_nft_among_pair(char *buf, struct nft_among_pair *pair, bool have_ip)
|
||||
if (sep) {
|
||||
*sep = '\0';
|
||||
|
||||
- if (!inet_aton(sep + 1, &pair->in))
|
||||
+ if (!inet_pton(AF_INET, sep + 1, &pair->in))
|
||||
xtables_error(PARAMETER_PROBLEM,
|
||||
"Invalid IP address '%s'\n", sep + 1);
|
||||
}
|
||||
@@ -194,6 +194,7 @@ static void __bramong_print(struct nft_among_pair *pairs,
|
||||
int cnt, bool inv, bool have_ip)
|
||||
{
|
||||
const char *isep = inv ? "! " : "";
|
||||
+ char abuf[INET_ADDRSTRLEN];
|
||||
int i;
|
||||
|
||||
for (i = 0; i < cnt; i++) {
|
||||
@@ -202,7 +203,8 @@ static void __bramong_print(struct nft_among_pair *pairs,
|
||||
|
||||
printf("%s", ether_ntoa(&pairs[i].ether));
|
||||
if (pairs[i].in.s_addr != INADDR_ANY)
|
||||
- printf("=%s", inet_ntoa(pairs[i].in));
|
||||
+ printf("=%s", inet_ntop(AF_INET, &pairs[i].in,
|
||||
+ abuf, sizeof(abuf)));
|
||||
}
|
||||
printf(" ");
|
||||
}
|
||||
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
|
||||
index 0d32a30010519..a5b835b1f681d 100644
|
||||
--- a/iptables/nft-ipv4.c
|
||||
+++ b/iptables/nft-ipv4.c
|
||||
@@ -136,7 +136,7 @@ static void get_frag(struct nft_xt_ctx *ctx, struct nftnl_expr *e, bool *inv)
|
||||
|
||||
static const char *mask_to_str(uint32_t mask)
|
||||
{
|
||||
- static char mask_str[sizeof("255.255.255.255")];
|
||||
+ static char mask_str[INET_ADDRSTRLEN];
|
||||
uint32_t bits, hmask = ntohl(mask);
|
||||
struct in_addr mask_addr = {
|
||||
.s_addr = mask,
|
||||
@@ -155,7 +155,7 @@ static const char *mask_to_str(uint32_t mask)
|
||||
if (i >= 0)
|
||||
sprintf(mask_str, "%u", i);
|
||||
else
|
||||
- sprintf(mask_str, "%s", inet_ntoa(mask_addr));
|
||||
+ inet_ntop(AF_INET, &mask_addr, mask_str, sizeof(mask_str));
|
||||
|
||||
return mask_str;
|
||||
}
|
||||
@@ -298,10 +298,13 @@ static void nft_ipv4_print_rule(struct nft_handle *h, struct nftnl_rule *r,
|
||||
static void save_ipv4_addr(char letter, const struct in_addr *addr,
|
||||
uint32_t mask, int invert)
|
||||
{
|
||||
+ char addrbuf[INET_ADDRSTRLEN];
|
||||
+
|
||||
if (!mask && !invert && !addr->s_addr)
|
||||
return;
|
||||
|
||||
- printf("%s-%c %s/%s ", invert ? "! " : "", letter, inet_ntoa(*addr),
|
||||
+ printf("%s-%c %s/%s ", invert ? "! " : "", letter,
|
||||
+ inet_ntop(AF_INET, addr, addrbuf, sizeof(addrbuf)),
|
||||
mask_to_str(mask));
|
||||
}
|
||||
|
||||
@@ -387,25 +390,27 @@ static void xlate_ipv4_addr(const char *selector, const struct in_addr *addr,
|
||||
const struct in_addr *mask,
|
||||
bool inv, struct xt_xlate *xl)
|
||||
{
|
||||
+ char mbuf[INET_ADDRSTRLEN], abuf[INET_ADDRSTRLEN];
|
||||
const char *op = inv ? "!= " : "";
|
||||
int cidr;
|
||||
|
||||
if (!inv && !addr->s_addr && !mask->s_addr)
|
||||
return;
|
||||
|
||||
+ inet_ntop(AF_INET, addr, abuf, sizeof(abuf));
|
||||
+
|
||||
cidr = xtables_ipmask_to_cidr(mask);
|
||||
switch (cidr) {
|
||||
case -1:
|
||||
- /* inet_ntoa() is not reentrant */
|
||||
- xt_xlate_add(xl, "%s & %s ", selector, inet_ntoa(*mask));
|
||||
- xt_xlate_add(xl, "%s %s ", inv ? "!=" : "==", inet_ntoa(*addr));
|
||||
+ xt_xlate_add(xl, "%s & %s %s %s ", selector,
|
||||
+ inet_ntop(AF_INET, mask, mbuf, sizeof(mbuf)),
|
||||
+ inv ? "!=" : "==", abuf);
|
||||
break;
|
||||
case 32:
|
||||
- xt_xlate_add(xl, "%s %s%s ", selector, op, inet_ntoa(*addr));
|
||||
+ xt_xlate_add(xl, "%s %s%s ", selector, op, abuf);
|
||||
break;
|
||||
default:
|
||||
- xt_xlate_add(xl, "%s %s%s/%d ", selector, op, inet_ntoa(*addr),
|
||||
- cidr);
|
||||
+ xt_xlate_add(xl, "%s %s%s/%d ", selector, op, abuf, cidr);
|
||||
}
|
||||
}
|
||||
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,35 +0,0 @@
|
|||
From 44e633b17e257f1915c4b33d9249f2e45f0a39cc Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 31 Jan 2019 16:12:53 +0100
|
||||
Subject: [PATCH] arptables-nft: Remove space between *cnt= and value
|
||||
|
||||
When printing rule counters, call xtables_print_num() with FMT_NOTABLE
|
||||
bit set to avoid spaces between equal sign and value.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 9421327926a529ec8300d37f3be8a6cfab701786)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-arp.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
|
||||
index 56021223bdbe6..f357fc4a43c4c 100644
|
||||
--- a/iptables/nft-arp.c
|
||||
+++ b/iptables/nft-arp.c
|
||||
@@ -605,9 +605,9 @@ nft_arp_print_rule(struct nftnl_rule *r, unsigned int num, unsigned int format)
|
||||
|
||||
if (!(format & FMT_NOCOUNTS)) {
|
||||
printf(", pcnt=");
|
||||
- xtables_print_num(cs.counters.pcnt, format);
|
||||
+ xtables_print_num(cs.counters.pcnt, format | FMT_NOTABLE);
|
||||
printf("-- bcnt=");
|
||||
- xtables_print_num(cs.counters.bcnt, format);
|
||||
+ xtables_print_num(cs.counters.bcnt, format | FMT_NOTABLE);
|
||||
}
|
||||
|
||||
if (!(format & FMT_NONEWLINE))
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -1,296 +0,0 @@
|
|||
From f521f424e5ab298d0dd2146677ea4f0170a9dfd0 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 31 Jan 2019 16:12:54 +0100
|
||||
Subject: [PATCH] arptables-nft-save: Fix position of -j option
|
||||
|
||||
Legacy arptables-save (just like arptables itself) prints verdict as
|
||||
first option, then matches and finally any target options.
|
||||
|
||||
To achieve this without introducing double/trailing spaces everywhere,
|
||||
integrate target ('-j') option printing into
|
||||
nft_arp_print_rule_details() and make it print separating whitespace
|
||||
before each option.
|
||||
|
||||
In nft_arp_save_rule(), replace the call to save_matches_and_target() by
|
||||
by a direct call to cs->target->save() since the former prints '-j'
|
||||
option itself. Since there are no match extensions in arptables, any
|
||||
other code from that function is not needed.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 2c3f7a2cd6fd8325b3a84e280cce945c6c20b87f)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-arp.c | 65 +++++++++++--------
|
||||
.../arptables/0001-arptables-save-restore_0 | 32 ++++-----
|
||||
.../0002-arptables-restore-defaults_0 | 6 +-
|
||||
3 files changed, 58 insertions(+), 45 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
|
||||
index f357fc4a43c4c..2cbdf23214049 100644
|
||||
--- a/iptables/nft-arp.c
|
||||
+++ b/iptables/nft-arp.c
|
||||
@@ -434,14 +434,21 @@ static void nft_arp_print_header(unsigned int format, const char *chain,
|
||||
}
|
||||
}
|
||||
|
||||
-static void nft_arp_print_rule_details(const struct arpt_entry *fw,
|
||||
+static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
unsigned int format)
|
||||
{
|
||||
+ const struct arpt_entry *fw = &cs->arp;
|
||||
char buf[BUFSIZ];
|
||||
char iface[IFNAMSIZ+2];
|
||||
+ const char *sep = "";
|
||||
int print_iface = 0;
|
||||
int i;
|
||||
|
||||
+ if (strlen(cs->jumpto)) {
|
||||
+ printf("%s-j %s", sep, cs->jumpto);
|
||||
+ sep = " ";
|
||||
+ }
|
||||
+
|
||||
iface[0] = '\0';
|
||||
|
||||
if (fw->arp.iniface[0] != '\0') {
|
||||
@@ -453,9 +460,11 @@ static void nft_arp_print_rule_details(const struct arpt_entry *fw,
|
||||
if (format & FMT_NUMERIC) strcat(iface, "*");
|
||||
else strcat(iface, "any");
|
||||
}
|
||||
- if (print_iface)
|
||||
- printf("%s-i %s ", fw->arp.invflags & ARPT_INV_VIA_IN ?
|
||||
+ if (print_iface) {
|
||||
+ printf("%s%s-i %s", sep, fw->arp.invflags & ARPT_INV_VIA_IN ?
|
||||
"! " : "", iface);
|
||||
+ sep = " ";
|
||||
+ }
|
||||
|
||||
print_iface = 0;
|
||||
iface[0] = '\0';
|
||||
@@ -469,12 +478,14 @@ static void nft_arp_print_rule_details(const struct arpt_entry *fw,
|
||||
if (format & FMT_NUMERIC) strcat(iface, "*");
|
||||
else strcat(iface, "any");
|
||||
}
|
||||
- if (print_iface)
|
||||
- printf("%s-o %s ", fw->arp.invflags & ARPT_INV_VIA_OUT ?
|
||||
+ if (print_iface) {
|
||||
+ printf("%s%s-o %s", sep, fw->arp.invflags & ARPT_INV_VIA_OUT ?
|
||||
"! " : "", iface);
|
||||
+ sep = " ";
|
||||
+ }
|
||||
|
||||
if (fw->arp.smsk.s_addr != 0L) {
|
||||
- printf("%s", fw->arp.invflags & ARPT_INV_SRCIP
|
||||
+ printf("%s%s", sep, fw->arp.invflags & ARPT_INV_SRCIP
|
||||
? "! " : "");
|
||||
if (format & FMT_NUMERIC)
|
||||
sprintf(buf, "%s", addr_to_dotted(&(fw->arp.src)));
|
||||
@@ -482,7 +493,8 @@ static void nft_arp_print_rule_details(const struct arpt_entry *fw,
|
||||
sprintf(buf, "%s", addr_to_anyname(&(fw->arp.src)));
|
||||
strncat(buf, mask_to_dotted(&(fw->arp.smsk)),
|
||||
sizeof(buf) - strlen(buf) - 1);
|
||||
- printf("-s %s ", buf);
|
||||
+ printf("-s %s", buf);
|
||||
+ sep = " ";
|
||||
}
|
||||
|
||||
for (i = 0; i < ARPT_DEV_ADDR_LEN_MAX; i++)
|
||||
@@ -490,16 +502,16 @@ static void nft_arp_print_rule_details(const struct arpt_entry *fw,
|
||||
break;
|
||||
if (i == ARPT_DEV_ADDR_LEN_MAX)
|
||||
goto after_devsrc;
|
||||
- printf("%s", fw->arp.invflags & ARPT_INV_SRCDEVADDR
|
||||
+ printf("%s%s", sep, fw->arp.invflags & ARPT_INV_SRCDEVADDR
|
||||
? "! " : "");
|
||||
printf("--src-mac ");
|
||||
print_mac_and_mask((unsigned char *)fw->arp.src_devaddr.addr,
|
||||
(unsigned char *)fw->arp.src_devaddr.mask, ETH_ALEN);
|
||||
- printf(" ");
|
||||
+ sep = " ";
|
||||
after_devsrc:
|
||||
|
||||
if (fw->arp.tmsk.s_addr != 0L) {
|
||||
- printf("%s", fw->arp.invflags & ARPT_INV_TGTIP
|
||||
+ printf("%s%s", sep, fw->arp.invflags & ARPT_INV_TGTIP
|
||||
? "! " : "");
|
||||
if (format & FMT_NUMERIC)
|
||||
sprintf(buf, "%s", addr_to_dotted(&(fw->arp.tgt)));
|
||||
@@ -507,7 +519,8 @@ after_devsrc:
|
||||
sprintf(buf, "%s", addr_to_anyname(&(fw->arp.tgt)));
|
||||
strncat(buf, mask_to_dotted(&(fw->arp.tmsk)),
|
||||
sizeof(buf) - strlen(buf) - 1);
|
||||
- printf("-d %s ", buf);
|
||||
+ printf("-d %s", buf);
|
||||
+ sep = " ";
|
||||
}
|
||||
|
||||
for (i = 0; i <ARPT_DEV_ADDR_LEN_MAX; i++)
|
||||
@@ -515,28 +528,28 @@ after_devsrc:
|
||||
break;
|
||||
if (i == ARPT_DEV_ADDR_LEN_MAX)
|
||||
goto after_devdst;
|
||||
- printf("%s", fw->arp.invflags & ARPT_INV_TGTDEVADDR
|
||||
+ printf("%s%s", sep, fw->arp.invflags & ARPT_INV_TGTDEVADDR
|
||||
? "! " : "");
|
||||
printf("--dst-mac ");
|
||||
print_mac_and_mask((unsigned char *)fw->arp.tgt_devaddr.addr,
|
||||
(unsigned char *)fw->arp.tgt_devaddr.mask, ETH_ALEN);
|
||||
- printf(" ");
|
||||
+ sep = " ";
|
||||
|
||||
after_devdst:
|
||||
|
||||
if (fw->arp.arhln_mask != 0) {
|
||||
- printf("%s", fw->arp.invflags & ARPT_INV_ARPHLN
|
||||
+ printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPHLN
|
||||
? "! " : "");
|
||||
printf("--h-length %d", fw->arp.arhln);
|
||||
if (fw->arp.arhln_mask != 255)
|
||||
printf("/%d", fw->arp.arhln_mask);
|
||||
- printf(" ");
|
||||
+ sep = " ";
|
||||
}
|
||||
|
||||
if (fw->arp.arpop_mask != 0) {
|
||||
int tmp = ntohs(fw->arp.arpop);
|
||||
|
||||
- printf("%s", fw->arp.invflags & ARPT_INV_ARPOP
|
||||
+ printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPOP
|
||||
? "! " : "");
|
||||
if (tmp <= NUMOPCODES && !(format & FMT_NUMERIC))
|
||||
printf("--opcode %s", opcodes[tmp-1]);
|
||||
@@ -545,13 +558,13 @@ after_devdst:
|
||||
|
||||
if (fw->arp.arpop_mask != 65535)
|
||||
printf("/%d", ntohs(fw->arp.arpop_mask));
|
||||
- printf(" ");
|
||||
+ sep = " ";
|
||||
}
|
||||
|
||||
if (fw->arp.arhrd_mask != 0) {
|
||||
uint16_t tmp = ntohs(fw->arp.arhrd);
|
||||
|
||||
- printf("%s", fw->arp.invflags & ARPT_INV_ARPHRD
|
||||
+ printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPHRD
|
||||
? "! " : "");
|
||||
if (tmp == 1 && !(format & FMT_NUMERIC))
|
||||
printf("--h-type %s", "Ethernet");
|
||||
@@ -559,13 +572,13 @@ after_devdst:
|
||||
printf("--h-type %u", tmp);
|
||||
if (fw->arp.arhrd_mask != 65535)
|
||||
printf("/%d", ntohs(fw->arp.arhrd_mask));
|
||||
- printf(" ");
|
||||
+ sep = " ";
|
||||
}
|
||||
|
||||
if (fw->arp.arpro_mask != 0) {
|
||||
int tmp = ntohs(fw->arp.arpro);
|
||||
|
||||
- printf("%s", fw->arp.invflags & ARPT_INV_ARPPRO
|
||||
+ printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPPRO
|
||||
? "! " : "");
|
||||
if (tmp == 0x0800 && !(format & FMT_NUMERIC))
|
||||
printf("--proto-type %s", "IPv4");
|
||||
@@ -573,7 +586,7 @@ after_devdst:
|
||||
printf("--proto-type 0x%x", tmp);
|
||||
if (fw->arp.arpro_mask != 65535)
|
||||
printf("/%x", ntohs(fw->arp.arpro_mask));
|
||||
- printf(" ");
|
||||
+ sep = " ";
|
||||
}
|
||||
}
|
||||
|
||||
@@ -584,8 +597,10 @@ nft_arp_save_rule(const void *data, unsigned int format)
|
||||
|
||||
format |= FMT_NUMERIC;
|
||||
|
||||
- nft_arp_print_rule_details(&cs->arp, format);
|
||||
- save_matches_and_target(cs, false, &cs->arp, format);
|
||||
+ nft_arp_print_rule_details(cs, format);
|
||||
+ if (cs->target && cs->target->save)
|
||||
+ cs->target->save(&cs->fw, cs->target->t);
|
||||
+ printf("\n");
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -598,9 +613,7 @@ nft_arp_print_rule(struct nftnl_rule *r, unsigned int num, unsigned int format)
|
||||
|
||||
nft_rule_to_iptables_command_state(r, &cs);
|
||||
|
||||
- if (strlen(cs.jumpto))
|
||||
- printf("-j %s ", cs.jumpto);
|
||||
- nft_arp_print_rule_details(&cs.arp, format);
|
||||
+ nft_arp_print_rule_details(&cs, format);
|
||||
print_matches_and_target(&cs, format);
|
||||
|
||||
if (!(format & FMT_NOCOUNTS)) {
|
||||
diff --git a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0 b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
index f8629551b0ba9..0664e3b38d5e8 100755
|
||||
--- a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
+++ b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
@@ -35,22 +35,22 @@ DUMP='*filter
|
||||
:INPUT ACCEPT
|
||||
:OUTPUT DROP
|
||||
:foo -
|
||||
--A INPUT -s 10.0.0.0/8 --h-length 6 --h-type 1 -j ACCEPT
|
||||
--A INPUT -d 192.168.123.1 --h-length 6 --h-type 1 -j ACCEPT
|
||||
--A INPUT --src-mac fe:ed:ba:be:00:01 --h-length 6 --h-type 1 -j ACCEPT
|
||||
--A INPUT --dst-mac fe:ed:ba:be:00:01 --h-length 6 --h-type 1 -j ACCEPT
|
||||
--A INPUT --h-length 6 --h-type 1 -j foo
|
||||
--A INPUT --h-length 6 --h-type 1
|
||||
--A OUTPUT -o lo --h-length 6 --h-type 1 -j ACCEPT
|
||||
--A OUTPUT -o eth134 --h-length 6 --h-type 1 -j mangle --mangle-ip-s 10.0.0.1
|
||||
--A OUTPUT -o eth432 --h-length 6 --h-type 1 -j CLASSIFY --set-class feed:babe
|
||||
--A OUTPUT -o eth432 --h-length 6 --opcode 1 --h-type 1 -j CLASSIFY --set-class feed:babe
|
||||
--A foo -i lo --h-length 6 --h-type 1 -j ACCEPT
|
||||
--A foo --h-length 6 --h-type 1 -j ACCEPT
|
||||
--A foo --h-length 6 --h-type 1 -j MARK --set-mark 12345
|
||||
--A foo --h-length 6 --opcode 1 --h-type 1 -j ACCEPT
|
||||
--A foo --h-length 6 --h-type 1 --proto-type 0x800 -j ACCEPT
|
||||
--A foo -i lo --h-length 6 --opcode 1 --h-type 1 --proto-type 0x800 -j ACCEPT
|
||||
+-A INPUT -j ACCEPT -s 10.0.0.0/8 --h-length 6 --h-type 1
|
||||
+-A INPUT -j ACCEPT -d 192.168.123.1 --h-length 6 --h-type 1
|
||||
+-A INPUT -j ACCEPT --src-mac fe:ed:ba:be:00:01 --h-length 6 --h-type 1
|
||||
+-A INPUT -j ACCEPT --dst-mac fe:ed:ba:be:00:01 --h-length 6 --h-type 1
|
||||
+-A INPUT -j foo --h-length 6 --h-type 1
|
||||
+-A INPUT --h-length 6 --h-type 1
|
||||
+-A OUTPUT -j ACCEPT -o lo --h-length 6 --h-type 1
|
||||
+-A OUTPUT -j mangle -o eth134 --h-length 6 --h-type 1 --mangle-ip-s 10.0.0.1
|
||||
+-A OUTPUT -j CLASSIFY -o eth432 --h-length 6 --h-type 1 --set-class feed:babe
|
||||
+-A OUTPUT -j CLASSIFY -o eth432 --h-length 6 --opcode 1 --h-type 1 --set-class feed:babe
|
||||
+-A foo -j ACCEPT -i lo --h-length 6 --h-type 1
|
||||
+-A foo -j ACCEPT --h-length 6 --h-type 1
|
||||
+-A foo -j MARK --h-length 6 --h-type 1 --set-mark 12345
|
||||
+-A foo -j ACCEPT --h-length 6 --opcode 1 --h-type 1
|
||||
+-A foo -j ACCEPT --h-length 6 --h-type 1 --proto-type 0x800
|
||||
+-A foo -j ACCEPT -i lo --h-length 6 --opcode 1 --h-type 1 --proto-type 0x800
|
||||
'
|
||||
|
||||
diff -u <(echo -e "$DUMP") <($XT_MULTI arptables-save)
|
||||
diff --git a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0 b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
|
||||
index ee17da0023b82..d742c3d506305 100755
|
||||
--- a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
|
||||
+++ b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
|
||||
@@ -11,7 +11,7 @@ set -e
|
||||
DUMP='*filter
|
||||
:OUTPUT ACCEPT
|
||||
-A OUTPUT -j mangle --mangle-ip-s 10.0.0.1
|
||||
--A OUTPUT --h-length 6 --h-type 1 -j mangle --mangle-ip-d 10.0.0.2
|
||||
+-A OUTPUT -j mangle --h-length 6 --h-type 1 --mangle-ip-d 10.0.0.2
|
||||
'
|
||||
|
||||
# note how mangle-ip-s is unset in second rule
|
||||
@@ -19,8 +19,8 @@ DUMP='*filter
|
||||
EXPECT='*filter
|
||||
:INPUT ACCEPT
|
||||
:OUTPUT ACCEPT
|
||||
--A OUTPUT --h-length 6 --h-type 1 -j mangle --mangle-ip-s 10.0.0.1
|
||||
--A OUTPUT --h-length 6 --h-type 1 -j mangle --mangle-ip-d 10.0.0.2
|
||||
+-A OUTPUT -j mangle --h-length 6 --h-type 1 --mangle-ip-s 10.0.0.1
|
||||
+-A OUTPUT -j mangle --h-length 6 --h-type 1 --mangle-ip-d 10.0.0.2
|
||||
'
|
||||
|
||||
$XT_MULTI arptables -F
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,181 @@
|
|||
From ab2ec9ca900843d6cb9fa839a9afe0ea968ce263 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 27 Apr 2021 10:02:34 +0200
|
||||
Subject: [PATCH] nft-arp: Make use of ipv4_addr_to_string()
|
||||
|
||||
This eliminates quite a bit of redundant code apart from also dropping
|
||||
use of obsolete function gethostbyaddr().
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 1e984079817a3c804eae25dea937d63d18c57a6c)
|
||||
---
|
||||
iptables/nft-arp.c | 99 ++++------------------------------------------
|
||||
iptables/xshared.c | 6 +--
|
||||
iptables/xshared.h | 3 ++
|
||||
3 files changed, 14 insertions(+), 94 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
|
||||
index c82ffdc95e300..2a9387a18dffe 100644
|
||||
--- a/iptables/nft-arp.c
|
||||
+++ b/iptables/nft-arp.c
|
||||
@@ -42,78 +42,6 @@ char *arp_opcodes[] =
|
||||
"ARP_NAK",
|
||||
};
|
||||
|
||||
-static char *
|
||||
-addr_to_dotted(const struct in_addr *addrp)
|
||||
-{
|
||||
- static char buf[20];
|
||||
- const unsigned char *bytep;
|
||||
-
|
||||
- bytep = (const unsigned char *) &(addrp->s_addr);
|
||||
- sprintf(buf, "%d.%d.%d.%d", bytep[0], bytep[1], bytep[2], bytep[3]);
|
||||
- return buf;
|
||||
-}
|
||||
-
|
||||
-static char *
|
||||
-addr_to_host(const struct in_addr *addr)
|
||||
-{
|
||||
- struct hostent *host;
|
||||
-
|
||||
- if ((host = gethostbyaddr((char *) addr,
|
||||
- sizeof(struct in_addr), AF_INET)) != NULL)
|
||||
- return (char *) host->h_name;
|
||||
-
|
||||
- return (char *) NULL;
|
||||
-}
|
||||
-
|
||||
-static char *
|
||||
-addr_to_network(const struct in_addr *addr)
|
||||
-{
|
||||
- struct netent *net;
|
||||
-
|
||||
- if ((net = getnetbyaddr((long) ntohl(addr->s_addr), AF_INET)) != NULL)
|
||||
- return (char *) net->n_name;
|
||||
-
|
||||
- return (char *) NULL;
|
||||
-}
|
||||
-
|
||||
-static char *
|
||||
-addr_to_anyname(const struct in_addr *addr)
|
||||
-{
|
||||
- char *name;
|
||||
-
|
||||
- if ((name = addr_to_host(addr)) != NULL ||
|
||||
- (name = addr_to_network(addr)) != NULL)
|
||||
- return name;
|
||||
-
|
||||
- return addr_to_dotted(addr);
|
||||
-}
|
||||
-
|
||||
-static char *
|
||||
-mask_to_dotted(const struct in_addr *mask)
|
||||
-{
|
||||
- int i;
|
||||
- static char buf[22];
|
||||
- u_int32_t maskaddr, bits;
|
||||
-
|
||||
- maskaddr = ntohl(mask->s_addr);
|
||||
-
|
||||
- if (maskaddr == 0xFFFFFFFFL)
|
||||
- /* we don't want to see "/32" */
|
||||
- return "";
|
||||
-
|
||||
- i = 32;
|
||||
- bits = 0xFFFFFFFEL;
|
||||
- while (--i >= 0 && maskaddr != bits)
|
||||
- bits <<= 1;
|
||||
- if (i >= 0)
|
||||
- sprintf(buf, "/%d", i);
|
||||
- else
|
||||
- /* mask was not a decent combination of 1's and 0's */
|
||||
- snprintf(buf, sizeof(buf), "/%s", addr_to_dotted(mask));
|
||||
-
|
||||
- return buf;
|
||||
-}
|
||||
-
|
||||
static bool need_devaddr(struct arpt_devaddr_info *info)
|
||||
{
|
||||
int i;
|
||||
@@ -403,7 +331,6 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
unsigned int format)
|
||||
{
|
||||
const struct arpt_entry *fw = &cs->arp;
|
||||
- char buf[BUFSIZ];
|
||||
char iface[IFNAMSIZ+2];
|
||||
const char *sep = "";
|
||||
int print_iface = 0;
|
||||
@@ -450,15 +377,10 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
}
|
||||
|
||||
if (fw->arp.smsk.s_addr != 0L) {
|
||||
- printf("%s%s", sep, fw->arp.invflags & IPT_INV_SRCIP
|
||||
- ? "! " : "");
|
||||
- if (format & FMT_NUMERIC)
|
||||
- sprintf(buf, "%s", addr_to_dotted(&(fw->arp.src)));
|
||||
- else
|
||||
- sprintf(buf, "%s", addr_to_anyname(&(fw->arp.src)));
|
||||
- strncat(buf, mask_to_dotted(&(fw->arp.smsk)),
|
||||
- sizeof(buf) - strlen(buf) - 1);
|
||||
- printf("-s %s", buf);
|
||||
+ printf("%s%s-s %s", sep,
|
||||
+ fw->arp.invflags & IPT_INV_SRCIP ? "! " : "",
|
||||
+ ipv4_addr_to_string(&fw->arp.src,
|
||||
+ &fw->arp.smsk, format));
|
||||
sep = " ";
|
||||
}
|
||||
|
||||
@@ -476,15 +398,10 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
|
||||
after_devsrc:
|
||||
|
||||
if (fw->arp.tmsk.s_addr != 0L) {
|
||||
- printf("%s%s", sep, fw->arp.invflags & IPT_INV_DSTIP
|
||||
- ? "! " : "");
|
||||
- if (format & FMT_NUMERIC)
|
||||
- sprintf(buf, "%s", addr_to_dotted(&(fw->arp.tgt)));
|
||||
- else
|
||||
- sprintf(buf, "%s", addr_to_anyname(&(fw->arp.tgt)));
|
||||
- strncat(buf, mask_to_dotted(&(fw->arp.tmsk)),
|
||||
- sizeof(buf) - strlen(buf) - 1);
|
||||
- printf("-d %s", buf);
|
||||
+ printf("%s%s-d %s", sep,
|
||||
+ fw->arp.invflags & IPT_INV_DSTIP ? "! " : "",
|
||||
+ ipv4_addr_to_string(&fw->arp.tgt,
|
||||
+ &fw->arp.tmsk, format));
|
||||
sep = " ";
|
||||
}
|
||||
|
||||
diff --git a/iptables/xshared.c b/iptables/xshared.c
|
||||
index fe37c30a085d6..3bcf24735c8fb 100644
|
||||
--- a/iptables/xshared.c
|
||||
+++ b/iptables/xshared.c
|
||||
@@ -545,9 +545,9 @@ void debug_print_argv(struct argv_store *store)
|
||||
}
|
||||
#endif
|
||||
|
||||
-static const char *ipv4_addr_to_string(const struct in_addr *addr,
|
||||
- const struct in_addr *mask,
|
||||
- unsigned int format)
|
||||
+const char *ipv4_addr_to_string(const struct in_addr *addr,
|
||||
+ const struct in_addr *mask,
|
||||
+ unsigned int format)
|
||||
{
|
||||
static char buf[BUFSIZ];
|
||||
|
||||
diff --git a/iptables/xshared.h b/iptables/xshared.h
|
||||
index 9159b2b1f3768..1e86aba8b2375 100644
|
||||
--- a/iptables/xshared.h
|
||||
+++ b/iptables/xshared.h
|
||||
@@ -206,6 +206,9 @@ void debug_print_argv(struct argv_store *store);
|
||||
# define debug_print_argv(...) /* nothing */
|
||||
#endif
|
||||
|
||||
+const char *ipv4_addr_to_string(const struct in_addr *addr,
|
||||
+ const struct in_addr *mask,
|
||||
+ unsigned int format);
|
||||
void print_ipv4_addresses(const struct ipt_entry *fw, unsigned int format);
|
||||
void print_ipv6_addresses(const struct ip6t_entry *fw6, unsigned int format);
|
||||
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,116 +0,0 @@
|
|||
From 3013545255719fcda031c227570c498c4fc7cc35 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 31 Jan 2019 16:12:55 +0100
|
||||
Subject: [PATCH] arptables-nft: Don't print default h-len/h-type values
|
||||
|
||||
Default values for --h-len and --h-type being printed for rules where
|
||||
user didn't provide them is unexpected and confusing. The drawback is
|
||||
the opposite: If user provided either of them with their default value,
|
||||
they are later omitted when listing rules. Though since unlike legacy
|
||||
arptables we can't distinguish between not specified and specified with
|
||||
default value, we can't fix both - so choose to optimize for the more
|
||||
likely case.
|
||||
|
||||
Fixes: 5aecb2d8bfdda ("arptables: pre-init hlen and ethertype")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 84331e3ed3f8eb9d53c00c221113ad16b209968a)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-arp.c | 4 +--
|
||||
.../arptables/0001-arptables-save-restore_0 | 32 +++++++++----------
|
||||
.../0002-arptables-restore-defaults_0 | 6 ++--
|
||||
3 files changed, 21 insertions(+), 21 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
|
||||
index 2cbdf23214049..37b0985377bef 100644
|
||||
--- a/iptables/nft-arp.c
|
||||
+++ b/iptables/nft-arp.c
|
||||
@@ -537,7 +537,7 @@ after_devsrc:
|
||||
|
||||
after_devdst:
|
||||
|
||||
- if (fw->arp.arhln_mask != 0) {
|
||||
+ if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) {
|
||||
printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPHLN
|
||||
? "! " : "");
|
||||
printf("--h-length %d", fw->arp.arhln);
|
||||
@@ -561,7 +561,7 @@ after_devdst:
|
||||
sep = " ";
|
||||
}
|
||||
|
||||
- if (fw->arp.arhrd_mask != 0) {
|
||||
+ if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) {
|
||||
uint16_t tmp = ntohs(fw->arp.arhrd);
|
||||
|
||||
printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPHRD
|
||||
diff --git a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0 b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
index 0664e3b38d5e8..e10f61cc8f95b 100755
|
||||
--- a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
+++ b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
@@ -35,22 +35,22 @@ DUMP='*filter
|
||||
:INPUT ACCEPT
|
||||
:OUTPUT DROP
|
||||
:foo -
|
||||
--A INPUT -j ACCEPT -s 10.0.0.0/8 --h-length 6 --h-type 1
|
||||
--A INPUT -j ACCEPT -d 192.168.123.1 --h-length 6 --h-type 1
|
||||
--A INPUT -j ACCEPT --src-mac fe:ed:ba:be:00:01 --h-length 6 --h-type 1
|
||||
--A INPUT -j ACCEPT --dst-mac fe:ed:ba:be:00:01 --h-length 6 --h-type 1
|
||||
--A INPUT -j foo --h-length 6 --h-type 1
|
||||
--A INPUT --h-length 6 --h-type 1
|
||||
--A OUTPUT -j ACCEPT -o lo --h-length 6 --h-type 1
|
||||
--A OUTPUT -j mangle -o eth134 --h-length 6 --h-type 1 --mangle-ip-s 10.0.0.1
|
||||
--A OUTPUT -j CLASSIFY -o eth432 --h-length 6 --h-type 1 --set-class feed:babe
|
||||
--A OUTPUT -j CLASSIFY -o eth432 --h-length 6 --opcode 1 --h-type 1 --set-class feed:babe
|
||||
--A foo -j ACCEPT -i lo --h-length 6 --h-type 1
|
||||
--A foo -j ACCEPT --h-length 6 --h-type 1
|
||||
--A foo -j MARK --h-length 6 --h-type 1 --set-mark 12345
|
||||
--A foo -j ACCEPT --h-length 6 --opcode 1 --h-type 1
|
||||
--A foo -j ACCEPT --h-length 6 --h-type 1 --proto-type 0x800
|
||||
--A foo -j ACCEPT -i lo --h-length 6 --opcode 1 --h-type 1 --proto-type 0x800
|
||||
+-A INPUT -j ACCEPT -s 10.0.0.0/8
|
||||
+-A INPUT -j ACCEPT -d 192.168.123.1
|
||||
+-A INPUT -j ACCEPT --src-mac fe:ed:ba:be:00:01
|
||||
+-A INPUT -j ACCEPT --dst-mac fe:ed:ba:be:00:01
|
||||
+-A INPUT -j foo
|
||||
+-A INPUT
|
||||
+-A OUTPUT -j ACCEPT -o lo
|
||||
+-A OUTPUT -j mangle -o eth134 --mangle-ip-s 10.0.0.1
|
||||
+-A OUTPUT -j CLASSIFY -o eth432 --set-class feed:babe
|
||||
+-A OUTPUT -j CLASSIFY -o eth432 --opcode 1 --set-class feed:babe
|
||||
+-A foo -j ACCEPT -i lo
|
||||
+-A foo -j ACCEPT
|
||||
+-A foo -j MARK --set-mark 12345
|
||||
+-A foo -j ACCEPT --opcode 1
|
||||
+-A foo -j ACCEPT --proto-type 0x800
|
||||
+-A foo -j ACCEPT -i lo --opcode 1 --proto-type 0x800
|
||||
'
|
||||
|
||||
diff -u <(echo -e "$DUMP") <($XT_MULTI arptables-save)
|
||||
diff --git a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0 b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
|
||||
index d742c3d506305..b2ed95e87bb40 100755
|
||||
--- a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
|
||||
+++ b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
|
||||
@@ -11,7 +11,7 @@ set -e
|
||||
DUMP='*filter
|
||||
:OUTPUT ACCEPT
|
||||
-A OUTPUT -j mangle --mangle-ip-s 10.0.0.1
|
||||
--A OUTPUT -j mangle --h-length 6 --h-type 1 --mangle-ip-d 10.0.0.2
|
||||
+-A OUTPUT -j mangle --mangle-ip-d 10.0.0.2
|
||||
'
|
||||
|
||||
# note how mangle-ip-s is unset in second rule
|
||||
@@ -19,8 +19,8 @@ DUMP='*filter
|
||||
EXPECT='*filter
|
||||
:INPUT ACCEPT
|
||||
:OUTPUT ACCEPT
|
||||
--A OUTPUT -j mangle --h-length 6 --h-type 1 --mangle-ip-s 10.0.0.1
|
||||
--A OUTPUT -j mangle --h-length 6 --h-type 1 --mangle-ip-d 10.0.0.2
|
||||
+-A OUTPUT -j mangle --mangle-ip-s 10.0.0.1
|
||||
+-A OUTPUT -j mangle --mangle-ip-d 10.0.0.2
|
||||
'
|
||||
|
||||
$XT_MULTI arptables -F
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,177 @@
|
|||
From b16a9bc7fa224139763686d3ecc1741b891ac6ce Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 29 Apr 2021 15:28:59 +0200
|
||||
Subject: [PATCH] extensions: SECMARK: Implement revision 1
|
||||
|
||||
The changed data structure for communication with kernel allows to
|
||||
exclude the field 'secid' which is populated on kernel side. Thus
|
||||
this fixes the formerly always failing extension comparison breaking
|
||||
rule check and rule delete by content.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 616800af0da86d151cb695f1376d5ec6ede6fa72)
|
||||
---
|
||||
extensions/libxt_SECMARK.c | 90 +++++++++++++++++++++-------
|
||||
extensions/libxt_SECMARK.t | 4 ++
|
||||
include/linux/netfilter/xt_SECMARK.h | 6 ++
|
||||
3 files changed, 80 insertions(+), 20 deletions(-)
|
||||
create mode 100644 extensions/libxt_SECMARK.t
|
||||
|
||||
diff --git a/extensions/libxt_SECMARK.c b/extensions/libxt_SECMARK.c
|
||||
index 6ba8606355daa..24249bd618ffe 100644
|
||||
--- a/extensions/libxt_SECMARK.c
|
||||
+++ b/extensions/libxt_SECMARK.c
|
||||
@@ -29,6 +29,13 @@ static const struct xt_option_entry SECMARK_opts[] = {
|
||||
XTOPT_TABLEEND,
|
||||
};
|
||||
|
||||
+static const struct xt_option_entry SECMARK_opts_v1[] = {
|
||||
+ {.name = "selctx", .id = O_SELCTX, .type = XTTYPE_STRING,
|
||||
+ .flags = XTOPT_MAND | XTOPT_PUT,
|
||||
+ XTOPT_POINTER(struct xt_secmark_target_info_v1, secctx)},
|
||||
+ XTOPT_TABLEEND,
|
||||
+};
|
||||
+
|
||||
static void SECMARK_parse(struct xt_option_call *cb)
|
||||
{
|
||||
struct xt_secmark_target_info *info = cb->data;
|
||||
@@ -37,15 +44,23 @@ static void SECMARK_parse(struct xt_option_call *cb)
|
||||
info->mode = SECMARK_MODE_SEL;
|
||||
}
|
||||
|
||||
-static void print_secmark(const struct xt_secmark_target_info *info)
|
||||
+static void SECMARK_parse_v1(struct xt_option_call *cb)
|
||||
+{
|
||||
+ struct xt_secmark_target_info_v1 *info = cb->data;
|
||||
+
|
||||
+ xtables_option_parse(cb);
|
||||
+ info->mode = SECMARK_MODE_SEL;
|
||||
+}
|
||||
+
|
||||
+static void print_secmark(__u8 mode, const char *secctx)
|
||||
{
|
||||
- switch (info->mode) {
|
||||
+ switch (mode) {
|
||||
case SECMARK_MODE_SEL:
|
||||
- printf("selctx %s", info->secctx);
|
||||
+ printf("selctx %s", secctx);
|
||||
break;
|
||||
-
|
||||
+
|
||||
default:
|
||||
- xtables_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
|
||||
+ xtables_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", mode);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -56,7 +71,17 @@ static void SECMARK_print(const void *ip, const struct xt_entry_target *target,
|
||||
(struct xt_secmark_target_info*)(target)->data;
|
||||
|
||||
printf(" SECMARK ");
|
||||
- print_secmark(info);
|
||||
+ print_secmark(info->mode, info->secctx);
|
||||
+}
|
||||
+
|
||||
+static void SECMARK_print_v1(const void *ip,
|
||||
+ const struct xt_entry_target *target, int numeric)
|
||||
+{
|
||||
+ const struct xt_secmark_target_info_v1 *info =
|
||||
+ (struct xt_secmark_target_info_v1 *)(target)->data;
|
||||
+
|
||||
+ printf(" SECMARK ");
|
||||
+ print_secmark(info->mode, info->secctx);
|
||||
}
|
||||
|
||||
static void SECMARK_save(const void *ip, const struct xt_entry_target *target)
|
||||
@@ -65,24 +90,49 @@ static void SECMARK_save(const void *ip, const struct xt_entry_target *target)
|
||||
(struct xt_secmark_target_info*)target->data;
|
||||
|
||||
printf(" --");
|
||||
- print_secmark(info);
|
||||
+ print_secmark(info->mode, info->secctx);
|
||||
}
|
||||
|
||||
-static struct xtables_target secmark_target = {
|
||||
- .family = NFPROTO_UNSPEC,
|
||||
- .name = "SECMARK",
|
||||
- .version = XTABLES_VERSION,
|
||||
- .revision = 0,
|
||||
- .size = XT_ALIGN(sizeof(struct xt_secmark_target_info)),
|
||||
- .userspacesize = XT_ALIGN(sizeof(struct xt_secmark_target_info)),
|
||||
- .help = SECMARK_help,
|
||||
- .print = SECMARK_print,
|
||||
- .save = SECMARK_save,
|
||||
- .x6_parse = SECMARK_parse,
|
||||
- .x6_options = SECMARK_opts,
|
||||
+static void SECMARK_save_v1(const void *ip,
|
||||
+ const struct xt_entry_target *target)
|
||||
+{
|
||||
+ const struct xt_secmark_target_info_v1 *info =
|
||||
+ (struct xt_secmark_target_info_v1 *)target->data;
|
||||
+
|
||||
+ printf(" --");
|
||||
+ print_secmark(info->mode, info->secctx);
|
||||
+}
|
||||
+
|
||||
+static struct xtables_target secmark_tg_reg[] = {
|
||||
+ {
|
||||
+ .family = NFPROTO_UNSPEC,
|
||||
+ .name = "SECMARK",
|
||||
+ .version = XTABLES_VERSION,
|
||||
+ .revision = 0,
|
||||
+ .size = XT_ALIGN(sizeof(struct xt_secmark_target_info)),
|
||||
+ .userspacesize = XT_ALIGN(sizeof(struct xt_secmark_target_info)),
|
||||
+ .help = SECMARK_help,
|
||||
+ .print = SECMARK_print,
|
||||
+ .save = SECMARK_save,
|
||||
+ .x6_parse = SECMARK_parse,
|
||||
+ .x6_options = SECMARK_opts,
|
||||
+ },
|
||||
+ {
|
||||
+ .family = NFPROTO_UNSPEC,
|
||||
+ .name = "SECMARK",
|
||||
+ .version = XTABLES_VERSION,
|
||||
+ .revision = 1,
|
||||
+ .size = XT_ALIGN(sizeof(struct xt_secmark_target_info_v1)),
|
||||
+ .userspacesize = XT_ALIGN(offsetof(struct xt_secmark_target_info_v1, secid)),
|
||||
+ .help = SECMARK_help,
|
||||
+ .print = SECMARK_print_v1,
|
||||
+ .save = SECMARK_save_v1,
|
||||
+ .x6_parse = SECMARK_parse_v1,
|
||||
+ .x6_options = SECMARK_opts_v1,
|
||||
+ }
|
||||
};
|
||||
|
||||
void _init(void)
|
||||
{
|
||||
- xtables_register_target(&secmark_target);
|
||||
+ xtables_register_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
|
||||
}
|
||||
diff --git a/extensions/libxt_SECMARK.t b/extensions/libxt_SECMARK.t
|
||||
new file mode 100644
|
||||
index 0000000000000..39d4c09348bf4
|
||||
--- /dev/null
|
||||
+++ b/extensions/libxt_SECMARK.t
|
||||
@@ -0,0 +1,4 @@
|
||||
+:INPUT,FORWARD,OUTPUT
|
||||
+*security
|
||||
+-j SECMARK --selctx system_u:object_r:firewalld_exec_t:s0;=;OK
|
||||
+-j SECMARK;;FAIL
|
||||
diff --git a/include/linux/netfilter/xt_SECMARK.h b/include/linux/netfilter/xt_SECMARK.h
|
||||
index 989092bd6274b..31760a286a854 100644
|
||||
--- a/include/linux/netfilter/xt_SECMARK.h
|
||||
+++ b/include/linux/netfilter/xt_SECMARK.h
|
||||
@@ -19,4 +19,10 @@ struct xt_secmark_target_info {
|
||||
char secctx[SECMARK_SECCTX_MAX];
|
||||
};
|
||||
|
||||
+struct xt_secmark_target_info_v1 {
|
||||
+ __u8 mode;
|
||||
+ char secctx[SECMARK_SECCTX_MAX];
|
||||
+ __u32 secid;
|
||||
+};
|
||||
+
|
||||
#endif /*_XT_SECMARK_H_target */
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -0,0 +1,156 @@
|
|||
From adc559b69fc2b8d95a7c3bae96ca12faa0ba5d1d Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 17 Nov 2020 00:57:10 +0100
|
||||
Subject: [PATCH] Use proto_to_name() from xshared in more places
|
||||
|
||||
Share the common proto name lookup code. While being at it, make proto
|
||||
number variable 16bit, values may exceed 256.
|
||||
|
||||
This aligns iptables-nft '-p' argument printing with legacy iptables. In
|
||||
practice, this should make a difference only in corner cases.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 556f704458cdb509d395ddb7d2629987d60e762e)
|
||||
---
|
||||
include/xtables.h | 2 +-
|
||||
iptables/ip6tables.c | 22 +++++-----------------
|
||||
iptables/iptables.c | 20 +++++---------------
|
||||
iptables/nft-shared.c | 6 +++---
|
||||
iptables/xshared.c | 2 +-
|
||||
iptables/xshared.h | 2 +-
|
||||
6 files changed, 16 insertions(+), 38 deletions(-)
|
||||
|
||||
diff --git a/include/xtables.h b/include/xtables.h
|
||||
index 5044dd08e86d3..a7b36979398ba 100644
|
||||
--- a/include/xtables.h
|
||||
+++ b/include/xtables.h
|
||||
@@ -395,7 +395,7 @@ struct xtables_rule_match {
|
||||
*/
|
||||
struct xtables_pprot {
|
||||
const char *name;
|
||||
- uint8_t num;
|
||||
+ uint16_t num;
|
||||
};
|
||||
|
||||
enum xtables_tryload {
|
||||
diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
|
||||
index c95355b091568..ce01ce8c04af6 100644
|
||||
--- a/iptables/ip6tables.c
|
||||
+++ b/iptables/ip6tables.c
|
||||
@@ -796,28 +796,16 @@ print_iface(char letter, const char *iface, const unsigned char *mask,
|
||||
}
|
||||
}
|
||||
|
||||
-/* The ip6tables looks up the /etc/protocols. */
|
||||
static void print_proto(uint16_t proto, int invert)
|
||||
{
|
||||
if (proto) {
|
||||
- unsigned int i;
|
||||
+ const char *pname = proto_to_name(proto, 0);
|
||||
const char *invertstr = invert ? " !" : "";
|
||||
|
||||
- const struct protoent *pent = getprotobynumber(proto);
|
||||
- if (pent) {
|
||||
- printf("%s -p %s",
|
||||
- invertstr, pent->p_name);
|
||||
- return;
|
||||
- }
|
||||
-
|
||||
- for (i = 0; xtables_chain_protos[i].name != NULL; ++i)
|
||||
- if (xtables_chain_protos[i].num == proto) {
|
||||
- printf("%s -p %s",
|
||||
- invertstr, xtables_chain_protos[i].name);
|
||||
- return;
|
||||
- }
|
||||
-
|
||||
- printf("%s -p %u", invertstr, proto);
|
||||
+ if (pname)
|
||||
+ printf("%s -p %s", invertstr, pname);
|
||||
+ else
|
||||
+ printf("%s -p %u", invertstr, proto);
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/iptables/iptables.c b/iptables/iptables.c
|
||||
index 7d6183116d265..514238d924780 100644
|
||||
--- a/iptables/iptables.c
|
||||
+++ b/iptables/iptables.c
|
||||
@@ -764,23 +764,13 @@ list_entries(const xt_chainlabel chain, int rulenum, int verbose, int numeric,
|
||||
static void print_proto(uint16_t proto, int invert)
|
||||
{
|
||||
if (proto) {
|
||||
- unsigned int i;
|
||||
+ const char *pname = proto_to_name(proto, 0);
|
||||
const char *invertstr = invert ? " !" : "";
|
||||
|
||||
- const struct protoent *pent = getprotobynumber(proto);
|
||||
- if (pent) {
|
||||
- printf("%s -p %s", invertstr, pent->p_name);
|
||||
- return;
|
||||
- }
|
||||
-
|
||||
- for (i = 0; xtables_chain_protos[i].name != NULL; ++i)
|
||||
- if (xtables_chain_protos[i].num == proto) {
|
||||
- printf("%s -p %s",
|
||||
- invertstr, xtables_chain_protos[i].name);
|
||||
- return;
|
||||
- }
|
||||
-
|
||||
- printf("%s -p %u", invertstr, proto);
|
||||
+ if (pname)
|
||||
+ printf("%s -p %s", invertstr, pname);
|
||||
+ else
|
||||
+ printf("%s -p %u", invertstr, proto);
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
||||
index c1664b50f9383..4253b08196d29 100644
|
||||
--- a/iptables/nft-shared.c
|
||||
+++ b/iptables/nft-shared.c
|
||||
@@ -826,13 +826,13 @@ void save_rule_details(const struct iptables_command_state *cs,
|
||||
}
|
||||
|
||||
if (proto > 0) {
|
||||
- const struct protoent *pent = getprotobynumber(proto);
|
||||
+ const char *pname = proto_to_name(proto, 0);
|
||||
|
||||
if (invflags & XT_INV_PROTO)
|
||||
printf("! ");
|
||||
|
||||
- if (pent)
|
||||
- printf("-p %s ", pent->p_name);
|
||||
+ if (pname)
|
||||
+ printf("-p %s ", pname);
|
||||
else
|
||||
printf("-p %u ", proto);
|
||||
}
|
||||
diff --git a/iptables/xshared.c b/iptables/xshared.c
|
||||
index 3bcf24735c8fb..9a17a8fdf11cd 100644
|
||||
--- a/iptables/xshared.c
|
||||
+++ b/iptables/xshared.c
|
||||
@@ -48,7 +48,7 @@ void print_extension_helps(const struct xtables_target *t,
|
||||
}
|
||||
|
||||
const char *
|
||||
-proto_to_name(uint8_t proto, int nolookup)
|
||||
+proto_to_name(uint16_t proto, int nolookup)
|
||||
{
|
||||
unsigned int i;
|
||||
|
||||
diff --git a/iptables/xshared.h b/iptables/xshared.h
|
||||
index 1e86aba8b2375..7c881c56a25da 100644
|
||||
--- a/iptables/xshared.h
|
||||
+++ b/iptables/xshared.h
|
||||
@@ -152,7 +152,7 @@ enum {
|
||||
|
||||
extern void print_extension_helps(const struct xtables_target *,
|
||||
const struct xtables_rule_match *);
|
||||
-extern const char *proto_to_name(uint8_t, int);
|
||||
+extern const char *proto_to_name(uint16_t, int);
|
||||
extern int command_default(struct iptables_command_state *,
|
||||
struct xtables_globals *);
|
||||
extern struct xtables_match *load_proto(struct iptables_command_state *);
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,90 +0,0 @@
|
|||
From bf2b28732579e44bf4c77869be586ee7d73bdabb Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 31 Jan 2019 16:12:56 +0100
|
||||
Subject: [PATCH] tests: shell: Add arptables-nft verbose output test
|
||||
|
||||
With arptables-nft output being in a very good state now, add a test to
|
||||
ensure it stays that way.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 3d8f261c565a024c13d627b18a0fcafc76de8f2c)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
.../arptables/0003-arptables-verbose-output_0 | 64 +++++++++++++++++++
|
||||
1 file changed, 64 insertions(+)
|
||||
create mode 100755 iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0 b/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
|
||||
new file mode 100755
|
||||
index 0000000000000..35126fa7d717c
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
|
||||
@@ -0,0 +1,64 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+set -e
|
||||
+set -x
|
||||
+
|
||||
+# there is no legacy backend to test
|
||||
+[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+
|
||||
+$XT_MULTI arptables -N foo
|
||||
+
|
||||
+# check verbose output matches expectations
|
||||
+
|
||||
+RULE1='-i eth23 -j ACCEPT'
|
||||
+VOUT1='-j ACCEPT -i eth23 -o *'
|
||||
+
|
||||
+RULE2='-i eth23'
|
||||
+VOUT2='-i eth23 -o *'
|
||||
+
|
||||
+RULE3='-i eth23 -j MARK --set-mark 42'
|
||||
+VOUT3='-j MARK -i eth23 -o * --set-mark 42'
|
||||
+
|
||||
+RULE4='-o eth23 -j CLASSIFY --set-class 23:42'
|
||||
+VOUT4='-j CLASSIFY -i * -o eth23 --set-class 23:42'
|
||||
+
|
||||
+RULE5='-o eth23 -j foo'
|
||||
+VOUT5='-j foo -i * -o eth23'
|
||||
+
|
||||
+RULE6='-o eth23 -j mangle --mangle-ip-s 10.0.0.1'
|
||||
+VOUT6='-j mangle -i * -o eth23 --mangle-ip-s 10.0.0.1'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$VOUT1") <($XT_MULTI arptables -v -A INPUT $RULE1)
|
||||
+diff -u -Z <(echo -e "$VOUT2") <($XT_MULTI arptables -v -A INPUT $RULE2)
|
||||
+diff -u -Z <(echo -e "$VOUT3") <($XT_MULTI arptables -v -A INPUT $RULE3)
|
||||
+diff -u -Z <(echo -e "$VOUT4") <($XT_MULTI arptables -v -A OUTPUT $RULE4)
|
||||
+diff -u -Z <(echo -e "$VOUT5") <($XT_MULTI arptables -v -A OUTPUT $RULE5)
|
||||
+diff -u -Z <(echo -e "$VOUT6") <($XT_MULTI arptables -v -A foo $RULE6)
|
||||
+
|
||||
+EXPECT='Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
|
||||
+-j ACCEPT -i eth23 -o *, pcnt=0 -- bcnt=0
|
||||
+-i eth23 -o *, pcnt=0 -- bcnt=0
|
||||
+-j MARK -i eth23 -o * --set-mark 42, pcnt=0 -- bcnt=0
|
||||
+
|
||||
+Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
|
||||
+-j CLASSIFY -i * -o eth23 --set-class 23:42, pcnt=0 -- bcnt=0
|
||||
+-j foo -i * -o eth23, pcnt=0 -- bcnt=0
|
||||
+
|
||||
+Chain foo (1 references)
|
||||
+-j mangle -i * -o eth23 --mangle-ip-s 10.0.0.1, pcnt=0 -- bcnt=0'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI arptables -v -n -L)
|
||||
+
|
||||
+EXPECT='*filter
|
||||
+:INPUT ACCEPT
|
||||
+:OUTPUT ACCEPT
|
||||
+:foo -
|
||||
+-A INPUT -j ACCEPT -i eth23
|
||||
+-A INPUT -i eth23
|
||||
+-A INPUT -j MARK -i eth23 --set-mark 42
|
||||
+-A OUTPUT -j CLASSIFY -o eth23 --set-class 23:42
|
||||
+-A OUTPUT -j foo -o eth23
|
||||
+-A foo -j mangle -o eth23 --mangle-ip-s 10.0.0.1
|
||||
+'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI arptables-save)
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
From 2fb13e8bdc9649c3910c6c1341dc4dd483767c0c Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 1 Feb 2019 17:06:18 +0100
|
||||
Subject: [PATCH] arptables-nft: Set h-type/h-length masks by default, too
|
||||
|
||||
These masks are not used in nftables backend, but mangle extension
|
||||
checks arhln_mask value to make sure --h-length was given (which is
|
||||
implicitly the case).
|
||||
|
||||
Fixes: 5aecb2d8bfdda ("arptables: pre-init hlen and ethertype")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit a1da179b0ff3783badca352a42808f4398dd1a98)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/xtables-arp.c | 8 ++++++--
|
||||
1 file changed, 6 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
|
||||
index 819e7e6c94034..2dce1a52f16fd 100644
|
||||
--- a/iptables/xtables-arp.c
|
||||
+++ b/iptables/xtables-arp.c
|
||||
@@ -909,8 +909,12 @@ int do_commandarp(struct nft_handle *h, int argc, char *argv[], char **table,
|
||||
{
|
||||
struct iptables_command_state cs = {
|
||||
.jumpto = "",
|
||||
- .arp.arp.arhln = 6,
|
||||
- .arp.arp.arhrd = htons(ARPHRD_ETHER),
|
||||
+ .arp.arp = {
|
||||
+ .arhln = 6,
|
||||
+ .arhln_mask = 255,
|
||||
+ .arhrd = htons(ARPHRD_ETHER),
|
||||
+ .arhrd_mask = 65535,
|
||||
+ },
|
||||
};
|
||||
int invert = 0;
|
||||
unsigned int nsaddrs = 0, ndaddrs = 0;
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
From 867ccfc5a9394b8a0957db9f2828befb7efabd7c Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 4 May 2021 16:03:24 +0200
|
||||
Subject: [PATCH] extensions: sctp: Fix nftables translation
|
||||
|
||||
If both sport and dport was present, incorrect nft syntax was generated.
|
||||
|
||||
Fixes: defc7bd2bac89 ("extensions: libxt_sctp: Add translation to nft")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit a61282ec6a1697bfb40f19d13a28a74559050167)
|
||||
---
|
||||
extensions/libxt_sctp.c | 10 ++++------
|
||||
extensions/libxt_sctp.txlate | 10 +++++-----
|
||||
2 files changed, 9 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c
|
||||
index 140de2653b1ef..ee4e99ebf11bf 100644
|
||||
--- a/extensions/libxt_sctp.c
|
||||
+++ b/extensions/libxt_sctp.c
|
||||
@@ -495,15 +495,13 @@ static int sctp_xlate(struct xt_xlate *xl,
|
||||
if (!einfo->flags)
|
||||
return 0;
|
||||
|
||||
- xt_xlate_add(xl, "sctp ");
|
||||
-
|
||||
if (einfo->flags & XT_SCTP_SRC_PORTS) {
|
||||
if (einfo->spts[0] != einfo->spts[1])
|
||||
- xt_xlate_add(xl, "sport%s %u-%u",
|
||||
+ xt_xlate_add(xl, "sctp sport%s %u-%u",
|
||||
einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
|
||||
einfo->spts[0], einfo->spts[1]);
|
||||
else
|
||||
- xt_xlate_add(xl, "sport%s %u",
|
||||
+ xt_xlate_add(xl, "sctp sport%s %u",
|
||||
einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
|
||||
einfo->spts[0]);
|
||||
space = " ";
|
||||
@@ -511,11 +509,11 @@ static int sctp_xlate(struct xt_xlate *xl,
|
||||
|
||||
if (einfo->flags & XT_SCTP_DEST_PORTS) {
|
||||
if (einfo->dpts[0] != einfo->dpts[1])
|
||||
- xt_xlate_add(xl, "%sdport%s %u-%u", space,
|
||||
+ xt_xlate_add(xl, "%ssctp dport%s %u-%u", space,
|
||||
einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
|
||||
einfo->dpts[0], einfo->dpts[1]);
|
||||
else
|
||||
- xt_xlate_add(xl, "%sdport%s %u", space,
|
||||
+ xt_xlate_add(xl, "%ssctp dport%s %u", space,
|
||||
einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
|
||||
einfo->dpts[0]);
|
||||
}
|
||||
diff --git a/extensions/libxt_sctp.txlate b/extensions/libxt_sctp.txlate
|
||||
index 72f4641ab021c..0d6c59e183675 100644
|
||||
--- a/extensions/libxt_sctp.txlate
|
||||
+++ b/extensions/libxt_sctp.txlate
|
||||
@@ -23,16 +23,16 @@ iptables-translate -A INPUT -p sctp ! --dport 50:56 -j ACCEPT
|
||||
nft add rule ip filter INPUT sctp dport != 50-56 counter accept
|
||||
|
||||
iptables-translate -A INPUT -p sctp --dport 80 --sport 50 -j ACCEPT
|
||||
-nft add rule ip filter INPUT sctp sport 50 dport 80 counter accept
|
||||
+nft add rule ip filter INPUT sctp sport 50 sctp dport 80 counter accept
|
||||
|
||||
iptables-translate -A INPUT -p sctp --dport 80:100 --sport 50 -j ACCEPT
|
||||
-nft add rule ip filter INPUT sctp sport 50 dport 80-100 counter accept
|
||||
+nft add rule ip filter INPUT sctp sport 50 sctp dport 80-100 counter accept
|
||||
|
||||
iptables-translate -A INPUT -p sctp --dport 80 --sport 50:55 -j ACCEPT
|
||||
-nft add rule ip filter INPUT sctp sport 50-55 dport 80 counter accept
|
||||
+nft add rule ip filter INPUT sctp sport 50-55 sctp dport 80 counter accept
|
||||
|
||||
iptables-translate -A INPUT -p sctp ! --dport 80:100 --sport 50 -j ACCEPT
|
||||
-nft add rule ip filter INPUT sctp sport 50 dport != 80-100 counter accept
|
||||
+nft add rule ip filter INPUT sctp sport 50 sctp dport != 80-100 counter accept
|
||||
|
||||
iptables-translate -A INPUT -p sctp --dport 80 ! --sport 50:55 -j ACCEPT
|
||||
-nft add rule ip filter INPUT sctp sport != 50-55 dport 80 counter accept
|
||||
+nft add rule ip filter INPUT sctp sport != 50-55 sctp dport 80 counter accept
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -0,0 +1,159 @@
|
|||
From 448d1ff5807a52ec34759a6dddd348c5f3e96704 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 4 May 2021 16:26:42 +0200
|
||||
Subject: [PATCH] extensions: sctp: Translate --chunk-types option
|
||||
|
||||
The translation is not fully complete as it is not possible to map 'any'
|
||||
match type into nft syntax with a single rule. Also, 'only' match type
|
||||
translation is a bit poor as it explicitly lists all chunk types that
|
||||
are supposed to be missing.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 5818be177110a09120dd8fe4bd2533acbf8da301)
|
||||
---
|
||||
extensions/libxt_sctp.c | 91 ++++++++++++++++++++++++++++--------
|
||||
extensions/libxt_sctp.txlate | 6 +++
|
||||
2 files changed, 78 insertions(+), 19 deletions(-)
|
||||
|
||||
diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c
|
||||
index ee4e99ebf11bf..5d8ab85cacf42 100644
|
||||
--- a/extensions/libxt_sctp.c
|
||||
+++ b/extensions/libxt_sctp.c
|
||||
@@ -92,28 +92,29 @@ struct sctp_chunk_names {
|
||||
const char *name;
|
||||
unsigned int chunk_type;
|
||||
const char *valid_flags;
|
||||
+ const char *nftname;
|
||||
};
|
||||
|
||||
/*'ALL' and 'NONE' will be treated specially. */
|
||||
static const struct sctp_chunk_names sctp_chunk_names[]
|
||||
-= { { .name = "DATA", .chunk_type = 0, .valid_flags = "----IUBE"},
|
||||
- { .name = "INIT", .chunk_type = 1, .valid_flags = "--------"},
|
||||
- { .name = "INIT_ACK", .chunk_type = 2, .valid_flags = "--------"},
|
||||
- { .name = "SACK", .chunk_type = 3, .valid_flags = "--------"},
|
||||
- { .name = "HEARTBEAT", .chunk_type = 4, .valid_flags = "--------"},
|
||||
- { .name = "HEARTBEAT_ACK", .chunk_type = 5, .valid_flags = "--------"},
|
||||
- { .name = "ABORT", .chunk_type = 6, .valid_flags = "-------T"},
|
||||
- { .name = "SHUTDOWN", .chunk_type = 7, .valid_flags = "--------"},
|
||||
- { .name = "SHUTDOWN_ACK", .chunk_type = 8, .valid_flags = "--------"},
|
||||
- { .name = "ERROR", .chunk_type = 9, .valid_flags = "--------"},
|
||||
- { .name = "COOKIE_ECHO", .chunk_type = 10, .valid_flags = "--------"},
|
||||
- { .name = "COOKIE_ACK", .chunk_type = 11, .valid_flags = "--------"},
|
||||
- { .name = "ECN_ECNE", .chunk_type = 12, .valid_flags = "--------"},
|
||||
- { .name = "ECN_CWR", .chunk_type = 13, .valid_flags = "--------"},
|
||||
- { .name = "SHUTDOWN_COMPLETE", .chunk_type = 14, .valid_flags = "-------T"},
|
||||
- { .name = "ASCONF", .chunk_type = 193, .valid_flags = "--------"},
|
||||
- { .name = "ASCONF_ACK", .chunk_type = 128, .valid_flags = "--------"},
|
||||
- { .name = "FORWARD_TSN", .chunk_type = 192, .valid_flags = "--------"},
|
||||
+= { { .name = "DATA", .chunk_type = 0, .valid_flags = "----IUBE", .nftname = "data" },
|
||||
+ { .name = "INIT", .chunk_type = 1, .valid_flags = "--------", .nftname = "init" },
|
||||
+ { .name = "INIT_ACK", .chunk_type = 2, .valid_flags = "--------", .nftname = "init-ack" },
|
||||
+ { .name = "SACK", .chunk_type = 3, .valid_flags = "--------", .nftname = "sack" },
|
||||
+ { .name = "HEARTBEAT", .chunk_type = 4, .valid_flags = "--------", .nftname = "heartbeat" },
|
||||
+ { .name = "HEARTBEAT_ACK", .chunk_type = 5, .valid_flags = "--------", .nftname = "heartbeat-ack" },
|
||||
+ { .name = "ABORT", .chunk_type = 6, .valid_flags = "-------T", .nftname = "abort" },
|
||||
+ { .name = "SHUTDOWN", .chunk_type = 7, .valid_flags = "--------", .nftname = "shutdown" },
|
||||
+ { .name = "SHUTDOWN_ACK", .chunk_type = 8, .valid_flags = "--------", .nftname = "shutdown-ack" },
|
||||
+ { .name = "ERROR", .chunk_type = 9, .valid_flags = "--------", .nftname = "error" },
|
||||
+ { .name = "COOKIE_ECHO", .chunk_type = 10, .valid_flags = "--------", .nftname = "cookie-echo" },
|
||||
+ { .name = "COOKIE_ACK", .chunk_type = 11, .valid_flags = "--------", .nftname = "cookie-ack" },
|
||||
+ { .name = "ECN_ECNE", .chunk_type = 12, .valid_flags = "--------", .nftname = "ecne" },
|
||||
+ { .name = "ECN_CWR", .chunk_type = 13, .valid_flags = "--------", .nftname = "cwr" },
|
||||
+ { .name = "SHUTDOWN_COMPLETE", .chunk_type = 14, .valid_flags = "-------T", .nftname = "shutdown-complete" },
|
||||
+ { .name = "ASCONF", .chunk_type = 193, .valid_flags = "--------", .nftname = "asconf" },
|
||||
+ { .name = "ASCONF_ACK", .chunk_type = 128, .valid_flags = "--------", .nftname = "asconf-ack" },
|
||||
+ { .name = "FORWARD_TSN", .chunk_type = 192, .valid_flags = "--------", .nftname = "forward-tsn" },
|
||||
};
|
||||
|
||||
static void
|
||||
@@ -485,12 +486,52 @@ static void sctp_save(const void *ip, const struct xt_entry_match *match)
|
||||
}
|
||||
}
|
||||
|
||||
+static const char *sctp_xlate_chunk(struct xt_xlate *xl, const char *space,
|
||||
+ const struct xt_sctp_info *einfo,
|
||||
+ const struct sctp_chunk_names *scn)
|
||||
+{
|
||||
+ bool inv = einfo->invflags & XT_SCTP_CHUNK_TYPES;
|
||||
+ const struct xt_sctp_flag_info *flag_info = NULL;
|
||||
+ int i;
|
||||
+
|
||||
+ if (!scn->nftname)
|
||||
+ return space;
|
||||
+
|
||||
+ if (!SCTP_CHUNKMAP_IS_SET(einfo->chunkmap, scn->chunk_type)) {
|
||||
+ if (einfo->chunk_match_type != SCTP_CHUNK_MATCH_ONLY)
|
||||
+ return space;
|
||||
+
|
||||
+ xt_xlate_add(xl, "%ssctp chunk %s %s", space,
|
||||
+ scn->nftname, inv ? "exists" : "missing");
|
||||
+ return " ";
|
||||
+ }
|
||||
+
|
||||
+ for (i = 0; i < einfo->flag_count; i++) {
|
||||
+ if (einfo->flag_info[i].chunktype == scn->chunk_type) {
|
||||
+ flag_info = &einfo->flag_info[i];
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ if (!flag_info) {
|
||||
+ xt_xlate_add(xl, "%ssctp chunk %s %s", space,
|
||||
+ scn->nftname, inv ? "missing" : "exists");
|
||||
+ return " ";
|
||||
+ }
|
||||
+
|
||||
+ xt_xlate_add(xl, "%ssctp chunk %s flags & 0x%x %s 0x%x", space,
|
||||
+ scn->nftname, flag_info->flag_mask,
|
||||
+ inv ? "!=" : "==", flag_info->flag);
|
||||
+
|
||||
+ return " ";
|
||||
+}
|
||||
+
|
||||
static int sctp_xlate(struct xt_xlate *xl,
|
||||
const struct xt_xlate_mt_params *params)
|
||||
{
|
||||
const struct xt_sctp_info *einfo =
|
||||
(const struct xt_sctp_info *)params->match->data;
|
||||
- char *space = "";
|
||||
+ const char *space = "";
|
||||
|
||||
if (!einfo->flags)
|
||||
return 0;
|
||||
@@ -516,6 +557,18 @@ static int sctp_xlate(struct xt_xlate *xl,
|
||||
xt_xlate_add(xl, "%ssctp dport%s %u", space,
|
||||
einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
|
||||
einfo->dpts[0]);
|
||||
+ space = " ";
|
||||
+ }
|
||||
+
|
||||
+ if (einfo->flags & XT_SCTP_CHUNK_TYPES) {
|
||||
+ int i;
|
||||
+
|
||||
+ if (einfo->chunk_match_type == SCTP_CHUNK_MATCH_ANY)
|
||||
+ return 0;
|
||||
+
|
||||
+ for (i = 0; i < ARRAY_SIZE(sctp_chunk_names); i++)
|
||||
+ space = sctp_xlate_chunk(xl, space, einfo,
|
||||
+ &sctp_chunk_names[i]);
|
||||
}
|
||||
|
||||
return 1;
|
||||
diff --git a/extensions/libxt_sctp.txlate b/extensions/libxt_sctp.txlate
|
||||
index 0d6c59e183675..bb817525db8d8 100644
|
||||
--- a/extensions/libxt_sctp.txlate
|
||||
+++ b/extensions/libxt_sctp.txlate
|
||||
@@ -36,3 +36,9 @@ nft add rule ip filter INPUT sctp sport 50 sctp dport != 80-100 counter accept
|
||||
|
||||
iptables-translate -A INPUT -p sctp --dport 80 ! --sport 50:55 -j ACCEPT
|
||||
nft add rule ip filter INPUT sctp sport != 50-55 sctp dport 80 counter accept
|
||||
+
|
||||
+iptables-translate -A INPUT -p sctp --chunk-types all INIT,DATA:iUbE,SACK,ABORT:T -j ACCEPT
|
||||
+nft add rule ip filter INPUT sctp chunk data flags & 0xf == 0x5 sctp chunk init exists sctp chunk sack exists sctp chunk abort flags & 0x1 == 0x1 counter accept
|
||||
+
|
||||
+iptables-translate -A INPUT -p sctp --chunk-types only SHUTDOWN_COMPLETE -j ACCEPT
|
||||
+nft add rule ip filter INPUT sctp chunk data missing sctp chunk init missing sctp chunk init-ack missing sctp chunk sack missing sctp chunk heartbeat missing sctp chunk heartbeat-ack missing sctp chunk abort missing sctp chunk shutdown missing sctp chunk shutdown-ack missing sctp chunk error missing sctp chunk cookie-echo missing sctp chunk cookie-ack missing sctp chunk ecne missing sctp chunk cwr missing sctp chunk shutdown-complete exists sctp chunk asconf missing sctp chunk asconf-ack missing sctp chunk forward-tsn missing counter accept
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,95 +0,0 @@
|
|||
From e3dacaff9e1d6f5be93afeb705cd24b38c8ff6f2 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 15 Jan 2019 23:23:03 +0100
|
||||
Subject: [PATCH] nft: Add new builtin chains to cache immediately
|
||||
|
||||
Newly created builtin chains missing from cache was the sole reason for
|
||||
the immediate calls to nft_commit(). With nft_chain_builtin_add()
|
||||
inserting the new chain into the table's chain list, this is not needed
|
||||
anymore. Just make sure batch_obj_del() doesn't free the payload of
|
||||
NFT_COMPAT_CHAIN_ADD jobs since it contains the new chain which has
|
||||
been added to cache.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 2b801fc515ae094d04207e840ed191196292b968)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 30 +++++++++---------------------
|
||||
1 file changed, 9 insertions(+), 21 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 9c0ad9a2d054f..c2af1a6fd0985 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -644,6 +644,7 @@ static void nft_chain_builtin_add(struct nft_handle *h,
|
||||
return;
|
||||
|
||||
batch_chain_add(h, NFT_COMPAT_CHAIN_ADD, c);
|
||||
+ nftnl_chain_list_add_tail(c, h->table[table->type].chain_cache);
|
||||
}
|
||||
|
||||
/* find if built-in table already exists */
|
||||
@@ -1216,8 +1217,11 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
|
||||
h->ops->print_rule(r, 0, FMT_PRINT_RULE);
|
||||
|
||||
c = nft_chain_find(h, table, chain);
|
||||
- if (c)
|
||||
- nftnl_chain_rule_add_tail(r, c);
|
||||
+ if (!c) {
|
||||
+ errno = ENOENT;
|
||||
+ return 0;
|
||||
+ }
|
||||
+ nftnl_chain_rule_add_tail(r, c);
|
||||
|
||||
return 1;
|
||||
}
|
||||
@@ -2282,16 +2286,8 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
|
||||
bool found = false;
|
||||
|
||||
/* If built-in chains don't exist for this table, create them */
|
||||
- if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0) {
|
||||
+ if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
|
||||
nft_xt_builtin_init(h, table);
|
||||
- /* Force table and chain creation, otherwise first iptables -L
|
||||
- * lists no table/chains.
|
||||
- */
|
||||
- if (!list_empty(&h->obj_list)) {
|
||||
- nft_commit(h);
|
||||
- flush_chain_cache(h, NULL);
|
||||
- }
|
||||
- }
|
||||
|
||||
ops = nft_family_ops_lookup(h->family);
|
||||
|
||||
@@ -2397,16 +2393,8 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain,
|
||||
int ret = 0;
|
||||
|
||||
/* If built-in chains don't exist for this table, create them */
|
||||
- if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0) {
|
||||
+ if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
|
||||
nft_xt_builtin_init(h, table);
|
||||
- /* Force table and chain creation, otherwise first iptables -L
|
||||
- * lists no table/chains.
|
||||
- */
|
||||
- if (!list_empty(&h->obj_list)) {
|
||||
- nft_commit(h);
|
||||
- flush_chain_cache(h, NULL);
|
||||
- }
|
||||
- }
|
||||
|
||||
if (!nft_is_table_compatible(h, table)) {
|
||||
xtables_error(OTHER_PROBLEM, "table `%s' is incompatible, use 'nft' tool.\n", table);
|
||||
@@ -2525,8 +2513,8 @@ static void batch_obj_del(struct nft_handle *h, struct obj_update *o)
|
||||
break;
|
||||
case NFT_COMPAT_CHAIN_ZERO:
|
||||
case NFT_COMPAT_CHAIN_USER_ADD:
|
||||
- break;
|
||||
case NFT_COMPAT_CHAIN_ADD:
|
||||
+ break;
|
||||
case NFT_COMPAT_CHAIN_USER_DEL:
|
||||
case NFT_COMPAT_CHAIN_USER_FLUSH:
|
||||
case NFT_COMPAT_CHAIN_UPDATE:
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
From e9dd197e783556dcb514ec624c4f6efeb782e7c7 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 13 Nov 2020 21:04:39 +0100
|
||||
Subject: [PATCH] libxtables: Drop leftover variable in
|
||||
xtables_numeric_to_ip6addr()
|
||||
|
||||
Variable 'err' was only used in removed debug code, so drop it as well.
|
||||
|
||||
Fixes: 7f526c9373c17 ("libxtables: xtables: remove unnecessary debug code")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 97fabae738a74bd04a7793e1199cd2b8a69122bc)
|
||||
---
|
||||
libxtables/xtables.c | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
|
||||
index 7152c6576cd63..7f40b6f1b327b 100644
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -1812,9 +1812,8 @@ const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp)
|
||||
struct in6_addr *xtables_numeric_to_ip6addr(const char *num)
|
||||
{
|
||||
static struct in6_addr ap;
|
||||
- int err;
|
||||
|
||||
- if ((err = inet_pton(AF_INET6, num, &ap)) == 1)
|
||||
+ if (inet_pton(AF_INET6, num, &ap) == 1)
|
||||
return ≈
|
||||
|
||||
return NULL;
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,168 +0,0 @@
|
|||
From 892eaf39a4bd14ad25e55e5c0d4ef3dc163183da Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 15 Jan 2019 23:23:04 +0100
|
||||
Subject: [PATCH] xtables: Fix position of replaced rules in cache
|
||||
|
||||
When replacing a rule, the replacement was simply appended to the
|
||||
chain's rule list. Instead, insert it where the rule it replaces was.
|
||||
|
||||
This also fixes for zero counters command to remove the old rule from
|
||||
cache.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 5ca9acf51adf9dcc8e0d82cd8f5b9b2514f900ee)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 34 +++++++++++++++++-----------------
|
||||
iptables/nft.h | 2 +-
|
||||
iptables/xtables-arp.c | 2 +-
|
||||
iptables/xtables-eb.c | 2 +-
|
||||
iptables/xtables.c | 4 ++--
|
||||
5 files changed, 22 insertions(+), 22 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index c2af1a6fd0985..76764fde4e9fb 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1186,7 +1186,7 @@ nft_chain_find(struct nft_handle *h, const char *table, const char *chain);
|
||||
|
||||
int
|
||||
nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
|
||||
- void *data, uint64_t handle, bool verbose)
|
||||
+ void *data, struct nftnl_rule *ref, bool verbose)
|
||||
{
|
||||
struct nftnl_chain *c;
|
||||
struct nftnl_rule *r;
|
||||
@@ -1202,8 +1202,9 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
|
||||
if (r == NULL)
|
||||
return 0;
|
||||
|
||||
- if (handle > 0) {
|
||||
- nftnl_rule_set(r, NFTNL_RULE_HANDLE, &handle);
|
||||
+ if (ref) {
|
||||
+ nftnl_rule_set_u64(r, NFTNL_RULE_HANDLE,
|
||||
+ nftnl_rule_get_u64(ref, NFTNL_RULE_HANDLE));
|
||||
type = NFT_COMPAT_RULE_REPLACE;
|
||||
} else
|
||||
type = NFT_COMPAT_RULE_APPEND;
|
||||
@@ -1216,12 +1217,17 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
|
||||
if (verbose)
|
||||
h->ops->print_rule(r, 0, FMT_PRINT_RULE);
|
||||
|
||||
- c = nft_chain_find(h, table, chain);
|
||||
- if (!c) {
|
||||
- errno = ENOENT;
|
||||
- return 0;
|
||||
+ if (ref) {
|
||||
+ nftnl_chain_rule_insert_at(r, ref);
|
||||
+ nftnl_chain_rule_del(r);
|
||||
+ } else {
|
||||
+ c = nft_chain_find(h, table, chain);
|
||||
+ if (!c) {
|
||||
+ errno = ENOENT;
|
||||
+ return 0;
|
||||
+ }
|
||||
+ nftnl_chain_rule_add_tail(r, c);
|
||||
}
|
||||
- nftnl_chain_rule_add_tail(r, c);
|
||||
|
||||
return 1;
|
||||
}
|
||||
@@ -2109,7 +2115,7 @@ int nft_rule_insert(struct nft_handle *h, const char *chain,
|
||||
r = nft_rule_find(h, c, data, rulenum - 1);
|
||||
if (r != NULL)
|
||||
return nft_rule_append(h, chain, table, data,
|
||||
- 0, verbose);
|
||||
+ NULL, verbose);
|
||||
|
||||
errno = ENOENT;
|
||||
goto err;
|
||||
@@ -2181,11 +2187,7 @@ int nft_rule_replace(struct nft_handle *h, const char *chain,
|
||||
(unsigned long long)
|
||||
nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE));
|
||||
|
||||
- nftnl_rule_list_del(r);
|
||||
-
|
||||
- ret = nft_rule_append(h, chain, table, data,
|
||||
- nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE),
|
||||
- verbose);
|
||||
+ ret = nft_rule_append(h, chain, table, data, r, verbose);
|
||||
} else
|
||||
errno = ENOENT;
|
||||
|
||||
@@ -2461,9 +2463,7 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain,
|
||||
|
||||
cs.counters.pcnt = cs.counters.bcnt = 0;
|
||||
|
||||
- ret = nft_rule_append(h, chain, table, &cs,
|
||||
- nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE),
|
||||
- false);
|
||||
+ ret = nft_rule_append(h, chain, table, &cs, r, false);
|
||||
|
||||
error:
|
||||
return ret;
|
||||
diff --git a/iptables/nft.h b/iptables/nft.h
|
||||
index dfdffd69342db..97d73c8b534be 100644
|
||||
--- a/iptables/nft.h
|
||||
+++ b/iptables/nft.h
|
||||
@@ -98,7 +98,7 @@ bool nft_chain_exists(struct nft_handle *h, const char *table, const char *chain
|
||||
*/
|
||||
struct nftnl_rule;
|
||||
|
||||
-int nft_rule_append(struct nft_handle *h, const char *chain, const char *table, void *data, uint64_t handle, bool verbose);
|
||||
+int nft_rule_append(struct nft_handle *h, const char *chain, const char *table, void *data, struct nftnl_rule *ref, bool verbose);
|
||||
int nft_rule_insert(struct nft_handle *h, const char *chain, const char *table, void *data, int rulenum, bool verbose);
|
||||
int nft_rule_check(struct nft_handle *h, const char *chain, const char *table, void *data, bool verbose);
|
||||
int nft_rule_delete(struct nft_handle *h, const char *chain, const char *table, void *data, bool verbose);
|
||||
diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
|
||||
index 2dce1a52f16fd..18cdced627c55 100644
|
||||
--- a/iptables/xtables-arp.c
|
||||
+++ b/iptables/xtables-arp.c
|
||||
@@ -825,7 +825,7 @@ append_entry(struct nft_handle *h,
|
||||
for (j = 0; j < ndaddrs; j++) {
|
||||
cs->arp.arp.tgt.s_addr = daddrs[j].s_addr;
|
||||
if (append) {
|
||||
- ret = nft_rule_append(h, chain, table, cs, 0,
|
||||
+ ret = nft_rule_append(h, chain, table, cs, NULL,
|
||||
verbose);
|
||||
} else {
|
||||
ret = nft_rule_insert(h, chain, table, cs,
|
||||
diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
|
||||
index 871891442e431..4c52c29aa4817 100644
|
||||
--- a/iptables/xtables-eb.c
|
||||
+++ b/iptables/xtables-eb.c
|
||||
@@ -171,7 +171,7 @@ append_entry(struct nft_handle *h,
|
||||
int ret = 1;
|
||||
|
||||
if (append)
|
||||
- ret = nft_rule_append(h, chain, table, cs, 0, verbose);
|
||||
+ ret = nft_rule_append(h, chain, table, cs, NULL, verbose);
|
||||
else
|
||||
ret = nft_rule_insert(h, chain, table, cs, rule_nr, verbose);
|
||||
|
||||
diff --git a/iptables/xtables.c b/iptables/xtables.c
|
||||
index da11e8cc159a0..d0167e6396975 100644
|
||||
--- a/iptables/xtables.c
|
||||
+++ b/iptables/xtables.c
|
||||
@@ -406,7 +406,7 @@ add_entry(const char *chain,
|
||||
|
||||
if (append) {
|
||||
ret = nft_rule_append(h, chain, table,
|
||||
- cs, 0,
|
||||
+ cs, NULL,
|
||||
verbose);
|
||||
} else {
|
||||
ret = nft_rule_insert(h, chain, table,
|
||||
@@ -426,7 +426,7 @@ add_entry(const char *chain,
|
||||
&d.mask.v6[j], sizeof(struct in6_addr));
|
||||
if (append) {
|
||||
ret = nft_rule_append(h, chain, table,
|
||||
- cs, 0,
|
||||
+ cs, NULL,
|
||||
verbose);
|
||||
} else {
|
||||
ret = nft_rule_insert(h, chain, table,
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
From 89bd91cfdf6f81971324dca1b0df7c6c5537a2ab Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 13 Nov 2020 21:13:50 +0100
|
||||
Subject: [PATCH] extensions: libebt_ip6: Drop unused variables
|
||||
|
||||
They are being assigned to but never read.
|
||||
|
||||
Fixes: 5c8ce9c6aede0 ("ebtables-compat: add 'ip6' match extension")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 8bb5bcae57c83066c224efa5fd29ed4822a766fc)
|
||||
---
|
||||
extensions/libebt_ip6.c | 6 ++----
|
||||
1 file changed, 2 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/extensions/libebt_ip6.c b/extensions/libebt_ip6.c
|
||||
index b8a5a5d8c3a92..301bed9aadefd 100644
|
||||
--- a/extensions/libebt_ip6.c
|
||||
+++ b/extensions/libebt_ip6.c
|
||||
@@ -250,9 +250,8 @@ static void brip6_init(struct xt_entry_match *match)
|
||||
static struct in6_addr *numeric_to_addr(const char *num)
|
||||
{
|
||||
static struct in6_addr ap;
|
||||
- int err;
|
||||
|
||||
- if ((err=inet_pton(AF_INET6, num, &ap)) == 1)
|
||||
+ if (inet_pton(AF_INET6, num, &ap) == 1)
|
||||
return ≈
|
||||
return (struct in6_addr *)NULL;
|
||||
}
|
||||
@@ -292,7 +291,6 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i
|
||||
char buf[256];
|
||||
char *p;
|
||||
int i;
|
||||
- int err;
|
||||
|
||||
strncpy(buf, address, sizeof(buf) - 1);
|
||||
/* first the mask */
|
||||
@@ -309,7 +307,7 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i
|
||||
if (!memcmp(msk, &in6addr_any, sizeof(in6addr_any)))
|
||||
strcpy(buf, "::");
|
||||
|
||||
- if ((err=inet_pton(AF_INET6, buf, addr)) < 1) {
|
||||
+ if (inet_pton(AF_INET6, buf, addr) < 1) {
|
||||
xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 Address '%s' specified", buf);
|
||||
return;
|
||||
}
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,282 +0,0 @@
|
|||
From 3c0eab01c78ff0215cafc124fd76d67f39f2b4ca Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 15 Jan 2019 23:23:05 +0100
|
||||
Subject: [PATCH] xtables: Fix for inserting rule at wrong position
|
||||
|
||||
iptables-restore allows to insert rules at a certain position which is
|
||||
problematic for iptables-nft to realize since rule position is not
|
||||
determined by number but handle of previous or following rule and in
|
||||
case the rules surrounding the new one are new as well, they don't have
|
||||
a handle to refer to yet.
|
||||
|
||||
Fix this by making use of NFTNL_RULE_POSITION_ID attribute: When
|
||||
inserting before a rule which does not have a handle, refer to it using
|
||||
its NFTNL_RULE_ID value. If the latter doesn't exist either, assign a
|
||||
new one to it.
|
||||
|
||||
The last used rule ID value is tracked in a new field of struct
|
||||
nft_handle which is incremented before each use.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 7ea0b7d809229973d950ed99845bdd0b2eb4cbb7)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 30 +++--
|
||||
iptables/nft.h | 1 +
|
||||
.../ipt-restore/0003-restore-ordering_0 | 117 ++++++++++++++++++
|
||||
.../testcases/iptables/0005-rule-replace_0 | 38 ++++++
|
||||
4 files changed, 176 insertions(+), 10 deletions(-)
|
||||
create mode 100755 iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0
|
||||
create mode 100755 iptables/tests/shell/testcases/iptables/0005-rule-replace_0
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 76764fde4e9fb..2fa973cf03975 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -2065,16 +2065,30 @@ int nft_rule_delete(struct nft_handle *h, const char *chain,
|
||||
static struct nftnl_rule *
|
||||
nft_rule_add(struct nft_handle *h, const char *chain,
|
||||
const char *table, struct iptables_command_state *cs,
|
||||
- uint64_t handle, bool verbose)
|
||||
+ struct nftnl_rule *ref, bool verbose)
|
||||
{
|
||||
struct nftnl_rule *r;
|
||||
+ uint64_t ref_id;
|
||||
|
||||
r = nft_rule_new(h, chain, table, cs);
|
||||
if (r == NULL)
|
||||
return NULL;
|
||||
|
||||
- if (handle > 0)
|
||||
- nftnl_rule_set_u64(r, NFTNL_RULE_POSITION, handle);
|
||||
+ if (ref) {
|
||||
+ ref_id = nftnl_rule_get_u64(ref, NFTNL_RULE_HANDLE);
|
||||
+ if (ref_id > 0) {
|
||||
+ nftnl_rule_set_u64(r, NFTNL_RULE_POSITION, ref_id);
|
||||
+ DEBUGP("adding after rule handle %"PRIu64"\n", ref_id);
|
||||
+ } else {
|
||||
+ ref_id = nftnl_rule_get_u32(ref, NFTNL_RULE_ID);
|
||||
+ if (!ref_id) {
|
||||
+ ref_id = ++h->rule_id;
|
||||
+ nftnl_rule_set_u32(ref, NFTNL_RULE_ID, ref_id);
|
||||
+ }
|
||||
+ nftnl_rule_set_u32(r, NFTNL_RULE_POSITION_ID, ref_id);
|
||||
+ DEBUGP("adding after rule ID %"PRIu64"\n", ref_id);
|
||||
+ }
|
||||
+ }
|
||||
|
||||
if (batch_rule_add(h, NFT_COMPAT_RULE_INSERT, r) < 0) {
|
||||
nftnl_rule_free(r);
|
||||
@@ -2090,9 +2104,8 @@ nft_rule_add(struct nft_handle *h, const char *chain,
|
||||
int nft_rule_insert(struct nft_handle *h, const char *chain,
|
||||
const char *table, void *data, int rulenum, bool verbose)
|
||||
{
|
||||
- struct nftnl_rule *r, *new_rule;
|
||||
+ struct nftnl_rule *r = NULL, *new_rule;
|
||||
struct nftnl_chain *c;
|
||||
- uint64_t handle = 0;
|
||||
|
||||
/* If built-in chains don't exist for this table, create them */
|
||||
if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
|
||||
@@ -2120,16 +2133,13 @@ int nft_rule_insert(struct nft_handle *h, const char *chain,
|
||||
errno = ENOENT;
|
||||
goto err;
|
||||
}
|
||||
-
|
||||
- handle = nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE);
|
||||
- DEBUGP("adding after rule handle %"PRIu64"\n", handle);
|
||||
}
|
||||
|
||||
- new_rule = nft_rule_add(h, chain, table, data, handle, verbose);
|
||||
+ new_rule = nft_rule_add(h, chain, table, data, r, verbose);
|
||||
if (!new_rule)
|
||||
goto err;
|
||||
|
||||
- if (handle)
|
||||
+ if (r)
|
||||
nftnl_chain_rule_insert_at(new_rule, r);
|
||||
else
|
||||
nftnl_chain_rule_add(new_rule, c);
|
||||
diff --git a/iptables/nft.h b/iptables/nft.h
|
||||
index 97d73c8b534be..0726923a63dd4 100644
|
||||
--- a/iptables/nft.h
|
||||
+++ b/iptables/nft.h
|
||||
@@ -32,6 +32,7 @@ struct nft_handle {
|
||||
struct mnl_socket *nl;
|
||||
uint32_t portid;
|
||||
uint32_t seq;
|
||||
+ uint32_t rule_id;
|
||||
struct list_head obj_list;
|
||||
int obj_list_num;
|
||||
struct nftnl_batch *batch;
|
||||
diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0
|
||||
new file mode 100755
|
||||
index 0000000000000..51f2422e15259
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0
|
||||
@@ -0,0 +1,117 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+# Make sure iptables-restore does the right thing
|
||||
+# when encountering INSERT rules with index.
|
||||
+
|
||||
+set -e
|
||||
+
|
||||
+# show rules, drop uninteresting policy settings
|
||||
+ipt_show() {
|
||||
+ $XT_MULTI iptables -S | grep -v '^-P'
|
||||
+}
|
||||
+
|
||||
+# basic issue reproducer
|
||||
+
|
||||
+$XT_MULTI iptables-restore <<EOF
|
||||
+*filter
|
||||
+-A FORWARD -m comment --comment "appended rule" -j ACCEPT
|
||||
+-I FORWARD 1 -m comment --comment "rule 1" -j ACCEPT
|
||||
+-I FORWARD 2 -m comment --comment "rule 2" -j ACCEPT
|
||||
+-I FORWARD 3 -m comment --comment "rule 3" -j ACCEPT
|
||||
+COMMIT
|
||||
+EOF
|
||||
+
|
||||
+EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 2" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 3" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "appended rule" -j ACCEPT'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
|
||||
+
|
||||
+# insert rules into existing ruleset
|
||||
+
|
||||
+$XT_MULTI iptables-restore --noflush <<EOF
|
||||
+*filter
|
||||
+-I FORWARD 1 -m comment --comment "rule 0.5" -j ACCEPT
|
||||
+-I FORWARD 3 -m comment --comment "rule 1.5" -j ACCEPT
|
||||
+-I FORWARD 5 -m comment --comment "rule 2.5" -j ACCEPT
|
||||
+-I FORWARD 7 -m comment --comment "rule 3.5" -j ACCEPT
|
||||
+-I FORWARD 9 -m comment --comment "appended rule 2" -j ACCEPT
|
||||
+COMMIT
|
||||
+EOF
|
||||
+
|
||||
+EXPECT='-A FORWARD -m comment --comment "rule 0.5" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 1" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 1.5" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 2" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 2.5" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 3" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 3.5" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "appended rule" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "appended rule 2" -j ACCEPT'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
|
||||
+
|
||||
+# insert rules in between added ones
|
||||
+
|
||||
+$XT_MULTI iptables-restore <<EOF
|
||||
+*filter
|
||||
+-A FORWARD -m comment --comment "appended rule 1" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "appended rule 2" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "appended rule 3" -j ACCEPT
|
||||
+-I FORWARD 1 -m comment --comment "rule 1" -j ACCEPT
|
||||
+-I FORWARD 3 -m comment --comment "rule 2" -j ACCEPT
|
||||
+-I FORWARD 5 -m comment --comment "rule 3" -j ACCEPT
|
||||
+COMMIT
|
||||
+EOF
|
||||
+
|
||||
+EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "appended rule 1" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 2" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "appended rule 2" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 3" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "appended rule 3" -j ACCEPT'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
|
||||
+
|
||||
+# test rule deletion in dump files
|
||||
+
|
||||
+$XT_MULTI iptables-restore --noflush <<EOF
|
||||
+*filter
|
||||
+-D FORWARD -m comment --comment "appended rule 1" -j ACCEPT
|
||||
+-D FORWARD 3
|
||||
+-I FORWARD 3 -m comment --comment "manually replaced rule 2" -j ACCEPT
|
||||
+COMMIT
|
||||
+EOF
|
||||
+
|
||||
+EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 2" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "manually replaced rule 2" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 3" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "appended rule 3" -j ACCEPT'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
|
||||
+
|
||||
+# test rule replacement in dump files
|
||||
+
|
||||
+$XT_MULTI iptables-restore <<EOF
|
||||
+*filter
|
||||
+-A FORWARD -m comment --comment "rule 1" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule to be replaced" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 3" -j ACCEPT
|
||||
+COMMIT
|
||||
+EOF
|
||||
+
|
||||
+$XT_MULTI iptables-restore --noflush <<EOF
|
||||
+*filter
|
||||
+-R FORWARD 2 -m comment --comment "replacement" -j ACCEPT
|
||||
+-I FORWARD 2 -m comment --comment "insert referencing replaced rule" -j ACCEPT
|
||||
+COMMIT
|
||||
+EOF
|
||||
+
|
||||
+EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "insert referencing replaced rule" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment replacement -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 3" -j ACCEPT'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
|
||||
diff --git a/iptables/tests/shell/testcases/iptables/0005-rule-replace_0 b/iptables/tests/shell/testcases/iptables/0005-rule-replace_0
|
||||
new file mode 100755
|
||||
index 0000000000000..5a3e922e50672
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/iptables/0005-rule-replace_0
|
||||
@@ -0,0 +1,38 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+# test rule replacement
|
||||
+
|
||||
+set -e
|
||||
+
|
||||
+# show rules, drop uninteresting policy settings
|
||||
+ipt_show() {
|
||||
+ $XT_MULTI iptables -S | grep -v '^-P'
|
||||
+}
|
||||
+
|
||||
+$XT_MULTI iptables -A FORWARD -m comment --comment "rule 1" -j ACCEPT
|
||||
+$XT_MULTI iptables -A FORWARD -m comment --comment "rule 2" -j ACCEPT
|
||||
+$XT_MULTI iptables -A FORWARD -m comment --comment "rule 3" -j ACCEPT
|
||||
+
|
||||
+$XT_MULTI iptables -R FORWARD 2 -m comment --comment "replaced 2" -j ACCEPT
|
||||
+
|
||||
+EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "replaced 2" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 3" -j ACCEPT'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
|
||||
+
|
||||
+$XT_MULTI iptables -R FORWARD 1 -m comment --comment "replaced 1" -j ACCEPT
|
||||
+
|
||||
+EXPECT='-A FORWARD -m comment --comment "replaced 1" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "replaced 2" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "rule 3" -j ACCEPT'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
|
||||
+
|
||||
+$XT_MULTI iptables -R FORWARD 3 -m comment --comment "replaced 3" -j ACCEPT
|
||||
+
|
||||
+EXPECT='-A FORWARD -m comment --comment "replaced 1" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "replaced 2" -j ACCEPT
|
||||
+-A FORWARD -m comment --comment "replaced 3" -j ACCEPT'
|
||||
+
|
||||
+diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
From e672c567d978bf99652a8c3681e105d5a212552f Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 2 Jun 2021 11:04:30 +0200
|
||||
Subject: [PATCH] libxtables: Fix memleak in xtopt_parse_hostmask()
|
||||
|
||||
The allocated hostmask duplicate needs to be freed again.
|
||||
|
||||
Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit ffe88f8f01263687e82ef4d3d2bdc0cb5444711e)
|
||||
---
|
||||
libxtables/xtoptions.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c
|
||||
index d329f2ff7979e..0dcdf607f4678 100644
|
||||
--- a/libxtables/xtoptions.c
|
||||
+++ b/libxtables/xtoptions.c
|
||||
@@ -763,6 +763,7 @@ static void xtopt_parse_hostmask(struct xt_option_call *cb)
|
||||
cb->arg = p;
|
||||
xtopt_parse_plenmask(cb);
|
||||
cb->arg = orig_arg;
|
||||
+ free(work);
|
||||
}
|
||||
|
||||
static void xtopt_parse_ethermac(struct xt_option_call *cb)
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,97 +0,0 @@
|
|||
From b029ccdc27297b60348492ab98376789ea53fa01 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 1 Feb 2019 19:17:50 +0100
|
||||
Subject: [PATCH] xtables: Fix for crash when comparing rules with standard
|
||||
target
|
||||
|
||||
When parsing an nftnl_rule with a standard verdict,
|
||||
nft_rule_to_iptables_command_state() initialized cs->target but didn't
|
||||
care about cs->target->t. When later comparing that rule to another,
|
||||
compare_targets() crashed due to unconditional access to t's fields.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit a880cc28358a32f96467e248266973b6ab83f080)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-shared.c | 23 +++++++++++++++----
|
||||
.../testcases/iptables/0005-delete-rules_0 | 7 ++++++
|
||||
iptables/xtables.c | 4 +++-
|
||||
3 files changed, 29 insertions(+), 5 deletions(-)
|
||||
create mode 100755 iptables/tests/shell/testcases/iptables/0005-delete-rules_0
|
||||
|
||||
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
||||
index 7b8ca5e4becaf..dfc1c803cb68d 100644
|
||||
--- a/iptables/nft-shared.c
|
||||
+++ b/iptables/nft-shared.c
|
||||
@@ -660,19 +660,34 @@ void nft_rule_to_iptables_command_state(const struct nftnl_rule *r,
|
||||
match->m = m;
|
||||
}
|
||||
|
||||
- if (cs->target != NULL)
|
||||
+ if (cs->target != NULL) {
|
||||
cs->jumpto = cs->target->name;
|
||||
- else if (cs->jumpto != NULL)
|
||||
+ } else if (cs->jumpto != NULL) {
|
||||
+ struct xt_entry_target *t;
|
||||
+ uint32_t size;
|
||||
+
|
||||
cs->target = xtables_find_target(cs->jumpto, XTF_TRY_LOAD);
|
||||
- else
|
||||
+ if (!cs->target)
|
||||
+ return;
|
||||
+
|
||||
+ size = XT_ALIGN(sizeof(struct xt_entry_target)) + cs->target->size;
|
||||
+ t = xtables_calloc(1, size);
|
||||
+ t->u.target_size = size;
|
||||
+ t->u.user.revision = cs->target->revision;
|
||||
+ strcpy(t->u.user.name, cs->jumpto);
|
||||
+ cs->target->t = t;
|
||||
+ } else {
|
||||
cs->jumpto = "";
|
||||
+ }
|
||||
}
|
||||
|
||||
void nft_clear_iptables_command_state(struct iptables_command_state *cs)
|
||||
{
|
||||
xtables_rule_matches_free(&cs->matches);
|
||||
- if (cs->target)
|
||||
+ if (cs->target) {
|
||||
free(cs->target->t);
|
||||
+ cs->target->t = NULL;
|
||||
+ }
|
||||
}
|
||||
|
||||
void print_header(unsigned int format, const char *chain, const char *pol,
|
||||
diff --git a/iptables/tests/shell/testcases/iptables/0005-delete-rules_0 b/iptables/tests/shell/testcases/iptables/0005-delete-rules_0
|
||||
new file mode 100755
|
||||
index 0000000000000..9312fd53c3437
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/iptables/0005-delete-rules_0
|
||||
@@ -0,0 +1,7 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+# test for crash when comparing rules with standard target
|
||||
+
|
||||
+$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j DROP
|
||||
+$XT_MULTI iptables -D FORWARD -i eth23 -o eth42 -j REJECT
|
||||
+[[ $? -eq 1 ]] || exit 1
|
||||
diff --git a/iptables/xtables.c b/iptables/xtables.c
|
||||
index d0167e6396975..eaa9fedeb03bb 100644
|
||||
--- a/iptables/xtables.c
|
||||
+++ b/iptables/xtables.c
|
||||
@@ -1185,8 +1185,10 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table,
|
||||
*table = p.table;
|
||||
|
||||
xtables_rule_matches_free(&cs.matches);
|
||||
- if (cs.target)
|
||||
+ if (cs.target) {
|
||||
free(cs.target->t);
|
||||
+ cs.target->t = NULL;
|
||||
+ }
|
||||
|
||||
if (h->family == AF_INET) {
|
||||
free(args.s.addr.v4);
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
From bee29f2820cafde1e04ebef049bc4c40c4dbbe18 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 2 Jun 2021 11:55:20 +0200
|
||||
Subject: [PATCH] nft: Avoid memleak in error path of nft_cmd_new()
|
||||
|
||||
If rule allocation fails, free the allocated 'cmd' before returning to
|
||||
caller.
|
||||
|
||||
Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit eab75ed36a4f204ddab0c40ba42c5a300634d5c3)
|
||||
---
|
||||
iptables/nft-cmd.c | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
|
||||
index ed53c061edc6f..fd038503d87e1 100644
|
||||
--- a/iptables/nft-cmd.c
|
||||
+++ b/iptables/nft-cmd.c
|
||||
@@ -35,8 +35,10 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command,
|
||||
|
||||
if (state) {
|
||||
rule = nft_rule_new(h, chain, table, state);
|
||||
- if (!rule)
|
||||
+ if (!rule) {
|
||||
+ nft_cmd_free(cmd);
|
||||
return NULL;
|
||||
+ }
|
||||
|
||||
cmd->obj.rule = rule;
|
||||
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,258 +0,0 @@
|
|||
From 27b68bd11b99429d1b830dbe76fc0148b5a24a16 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Mon, 4 Feb 2019 21:52:53 +0100
|
||||
Subject: [PATCH] xtables: Fix for false-positive rule matching
|
||||
|
||||
When comparing two rules with non-standard targets, differences in
|
||||
targets' payloads wasn't respected.
|
||||
|
||||
The cause is a rather hideous one: Unlike xtables_find_match(),
|
||||
xtables_find_target() did not care whether the found target was already
|
||||
in use or not, so the same target instance was assigned to both rules
|
||||
and therefore payload comparison happened over the same memory location.
|
||||
|
||||
With legacy iptables it is not possible to reuse a target: The only case
|
||||
where two rules (i.e., iptables_command_state instances) could exist at
|
||||
the same time is when comparing rules, but that's handled using libiptc.
|
||||
|
||||
The above change clashes with ebtables-nft's reuse of target objects:
|
||||
While input parsing still just assigns the object from xtables_targets
|
||||
list, rule conversion from nftnl to iptables_command_state allocates new
|
||||
data. To fix this, make ebtables-nft input parsing use the common
|
||||
command_jump() routine instead of its own simplified copy. In turn, this
|
||||
also eliminates the ebtables-nft-specific variants of parse_target(),
|
||||
though with a slight change of behaviour: Names of user-defined chains
|
||||
are no longer allowed to contain up to 31 but merely 28 characters.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 148131f20421046fea028e638581e938ec985783)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-bridge.c | 10 ++++
|
||||
iptables/nft-bridge.h | 2 -
|
||||
iptables/nft-shared.c | 5 ++
|
||||
.../testcases/iptables/0005-delete-rules_0 | 7 +++
|
||||
iptables/xtables-eb-translate.c | 24 +---------
|
||||
iptables/xtables-eb.c | 47 +------------------
|
||||
libxtables/xtables.c | 18 ++++++-
|
||||
7 files changed, 41 insertions(+), 72 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
|
||||
index ad583a60c424d..140fcf0a31b84 100644
|
||||
--- a/iptables/nft-bridge.c
|
||||
+++ b/iptables/nft-bridge.c
|
||||
@@ -45,6 +45,16 @@ void ebt_cs_clean(struct iptables_command_state *cs)
|
||||
free(m);
|
||||
m = nm;
|
||||
}
|
||||
+
|
||||
+ if (cs->target) {
|
||||
+ free(cs->target->t);
|
||||
+ cs->target->t = NULL;
|
||||
+
|
||||
+ if (cs->target == cs->target->next) {
|
||||
+ free(cs->target);
|
||||
+ cs->target = NULL;
|
||||
+ }
|
||||
+ }
|
||||
}
|
||||
|
||||
static void ebt_print_mac(const unsigned char *mac)
|
||||
diff --git a/iptables/nft-bridge.h b/iptables/nft-bridge.h
|
||||
index de52cd7195bbb..d90066f1030a2 100644
|
||||
--- a/iptables/nft-bridge.h
|
||||
+++ b/iptables/nft-bridge.h
|
||||
@@ -32,7 +32,6 @@ int ebt_get_mac_and_mask(const char *from, unsigned char *to, unsigned char *mas
|
||||
*/
|
||||
|
||||
#define EBT_TABLE_MAXNAMELEN 32
|
||||
-#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
|
||||
#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
|
||||
|
||||
/* verdicts >0 are "branches" */
|
||||
@@ -122,6 +121,5 @@ void ebt_add_match(struct xtables_match *m,
|
||||
void ebt_add_watcher(struct xtables_target *watcher,
|
||||
struct iptables_command_state *cs);
|
||||
int ebt_command_default(struct iptables_command_state *cs);
|
||||
-struct xtables_target *ebt_command_jump(const char *jumpto);
|
||||
|
||||
#endif
|
||||
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
||||
index dfc1c803cb68d..ce40787f92f7d 100644
|
||||
--- a/iptables/nft-shared.c
|
||||
+++ b/iptables/nft-shared.c
|
||||
@@ -687,6 +687,11 @@ void nft_clear_iptables_command_state(struct iptables_command_state *cs)
|
||||
if (cs->target) {
|
||||
free(cs->target->t);
|
||||
cs->target->t = NULL;
|
||||
+
|
||||
+ if (cs->target == cs->target->next) {
|
||||
+ free(cs->target);
|
||||
+ cs->target = NULL;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/iptables/0005-delete-rules_0 b/iptables/tests/shell/testcases/iptables/0005-delete-rules_0
|
||||
index 9312fd53c3437..5038cbce5a5cf 100755
|
||||
--- a/iptables/tests/shell/testcases/iptables/0005-delete-rules_0
|
||||
+++ b/iptables/tests/shell/testcases/iptables/0005-delete-rules_0
|
||||
@@ -5,3 +5,10 @@
|
||||
$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j DROP
|
||||
$XT_MULTI iptables -D FORWARD -i eth23 -o eth42 -j REJECT
|
||||
[[ $? -eq 1 ]] || exit 1
|
||||
+
|
||||
+# test incorrect deletion of rules with deviating payload
|
||||
+# in non-standard target
|
||||
+
|
||||
+$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j MARK --set-mark 23
|
||||
+$XT_MULTI iptables -D FORWARD -i eth23 -o eth42 -j MARK --set-mark 42
|
||||
+[[ $? -eq 1 ]] || exit 1
|
||||
diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c
|
||||
index f98c385555eb1..0fe14d2d0db32 100644
|
||||
--- a/iptables/xtables-eb-translate.c
|
||||
+++ b/iptables/xtables-eb-translate.c
|
||||
@@ -64,27 +64,6 @@ static int parse_rule_number(const char *rule)
|
||||
return rule_nr;
|
||||
}
|
||||
|
||||
-static const char *
|
||||
-parse_target(const char *targetname)
|
||||
-{
|
||||
- const char *ptr;
|
||||
-
|
||||
- if (strlen(targetname) < 1)
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "Invalid target name (too short)");
|
||||
-
|
||||
- if (strlen(targetname)+1 > EBT_CHAIN_MAXNAMELEN)
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "Invalid target '%s' (%d chars max)",
|
||||
- targetname, EBT_CHAIN_MAXNAMELEN);
|
||||
-
|
||||
- for (ptr = targetname; *ptr; ptr++)
|
||||
- if (isspace(*ptr))
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "Invalid target name `%s'", targetname);
|
||||
- return targetname;
|
||||
-}
|
||||
-
|
||||
static int get_current_chain(const char *chain)
|
||||
{
|
||||
if (strcmp(chain, "PREROUTING") == 0)
|
||||
@@ -411,8 +390,7 @@ print_zero:
|
||||
break;
|
||||
} else if (c == 'j') {
|
||||
ebt_check_option2(&flags, OPT_JUMP);
|
||||
- cs.jumpto = parse_target(optarg);
|
||||
- cs.target = ebt_command_jump(cs.jumpto);
|
||||
+ command_jump(&cs);
|
||||
break;
|
||||
} else if (c == 's') {
|
||||
ebt_check_option2(&flags, OPT_SOURCE);
|
||||
diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
|
||||
index 4c52c29aa4817..55cb0fe204748 100644
|
||||
--- a/iptables/xtables-eb.c
|
||||
+++ b/iptables/xtables-eb.c
|
||||
@@ -139,27 +139,6 @@ static int parse_rule_number(const char *rule)
|
||||
return rule_nr;
|
||||
}
|
||||
|
||||
-static const char *
|
||||
-parse_target(const char *targetname)
|
||||
-{
|
||||
- const char *ptr;
|
||||
-
|
||||
- if (strlen(targetname) < 1)
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "Invalid target name (too short)");
|
||||
-
|
||||
- if (strlen(targetname)+1 > EBT_CHAIN_MAXNAMELEN)
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "Invalid target '%s' (%d chars max)",
|
||||
- targetname, EBT_CHAIN_MAXNAMELEN);
|
||||
-
|
||||
- for (ptr = targetname; *ptr; ptr++)
|
||||
- if (isspace(*ptr))
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "Invalid target name `%s'", targetname);
|
||||
- return targetname;
|
||||
-}
|
||||
-
|
||||
static int
|
||||
append_entry(struct nft_handle *h,
|
||||
const char *chain,
|
||||
@@ -376,29 +355,6 @@ static struct option *merge_options(struct option *oldopts,
|
||||
return merge;
|
||||
}
|
||||
|
||||
-/*
|
||||
- * More glue code.
|
||||
- */
|
||||
-struct xtables_target *ebt_command_jump(const char *jumpto)
|
||||
-{
|
||||
- struct xtables_target *target;
|
||||
- unsigned int verdict;
|
||||
-
|
||||
- /* Standard target? */
|
||||
- if (!ebt_fill_target(jumpto, &verdict))
|
||||
- jumpto = "standard";
|
||||
-
|
||||
- /* For ebtables, all targets are preloaded. Hence it is either in
|
||||
- * xtables_targets or a custom chain to jump to, in which case
|
||||
- * returning NULL is fine. */
|
||||
- for (target = xtables_targets; target; target = target->next) {
|
||||
- if (!strcmp(target->name, jumpto))
|
||||
- break;
|
||||
- }
|
||||
-
|
||||
- return target;
|
||||
-}
|
||||
-
|
||||
static void print_help(const struct xtables_target *t,
|
||||
const struct xtables_rule_match *m, const char *table)
|
||||
{
|
||||
@@ -1066,8 +1022,7 @@ print_zero:
|
||||
} else if (c == 'j') {
|
||||
ebt_check_option2(&flags, OPT_JUMP);
|
||||
if (strcmp(optarg, "CONTINUE") != 0) {
|
||||
- cs.jumpto = parse_target(optarg);
|
||||
- cs.target = ebt_command_jump(cs.jumpto);
|
||||
+ command_jump(&cs);
|
||||
}
|
||||
break;
|
||||
} else if (c == 's') {
|
||||
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
|
||||
index ea9bb102c8eb4..895f6988eaf57 100644
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -756,8 +756,24 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
|
||||
}
|
||||
|
||||
for (ptr = xtables_targets; ptr; ptr = ptr->next) {
|
||||
- if (extension_cmp(name, ptr->name, ptr->family))
|
||||
+ if (extension_cmp(name, ptr->name, ptr->family)) {
|
||||
+ struct xtables_target *clone;
|
||||
+
|
||||
+ /* First target of this type: */
|
||||
+ if (ptr->t == NULL)
|
||||
+ break;
|
||||
+
|
||||
+ /* Second and subsequent clones */
|
||||
+ clone = xtables_malloc(sizeof(struct xtables_target));
|
||||
+ memcpy(clone, ptr, sizeof(struct xtables_target));
|
||||
+ clone->udata = NULL;
|
||||
+ clone->tflags = 0;
|
||||
+ /* This is a clone: */
|
||||
+ clone->next = clone;
|
||||
+
|
||||
+ ptr = clone;
|
||||
break;
|
||||
+ }
|
||||
}
|
||||
|
||||
#ifndef NO_SHARED_LIBS
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -1,75 +0,0 @@
|
|||
From b321a8af45e3040ae46091fef2c35d5533ab83bc Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Mon, 21 Jan 2019 17:43:34 +0100
|
||||
Subject: [PATCH] ebtables: Fix rule listing with counters
|
||||
|
||||
This is a partial revert of commit 583b27eabcad6 ("ebtables-save: add -c
|
||||
option, using xtables-style counters") which broke ruleset listing with
|
||||
'--Lc' flag turned on:
|
||||
|
||||
| # ebtables-nft -L --Lc
|
||||
| Bridge table: filter
|
||||
|
|
||||
| Bridge chain: INPUT, entries: 0, policy: ACCEPT
|
||||
|
|
||||
| Bridge chain: FORWARD, entries: 2, policy: ACCEPT
|
||||
| -j foo
|
||||
| , pcnt = 0 -- bcnt = 0-j ACCEPT
|
||||
| , pcnt = 0 -- bcnt = 0
|
||||
| Bridge chain: OUTPUT, entries: 0, policy: ACCEPT
|
||||
|
|
||||
| Bridge chain: foo, entries: 1, policy: RETURN
|
||||
| -j ACCEPT
|
||||
| , pcnt = 0 -- bcnt = 0%
|
||||
|
||||
(That percentage sign means no newline after last line of output and
|
||||
doesn't belong to ebtables-nft's output.)
|
||||
|
||||
Problem was that nft_bridge_print_rule() printed the counters after
|
||||
nft_bridge_save_rule() had already printed the newline character.
|
||||
|
||||
Note also that there is no need to remove FMT_EBT_SAVE bit from 'format'
|
||||
variable: It is set only by ebtables-nft-save which doesn't call
|
||||
nft_bridge_print_rule().
|
||||
|
||||
Fixes: 583b27eabcad6 ("ebtables-save: add -c option, using xtables-style counters")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 32ebc39f71e8107d6069a9f6fba8338a2823889d)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-bridge.c | 11 ++++++-----
|
||||
1 file changed, 6 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
|
||||
index 140fcf0a31b84..43b3e3e9649b8 100644
|
||||
--- a/iptables/nft-bridge.c
|
||||
+++ b/iptables/nft-bridge.c
|
||||
@@ -479,6 +479,11 @@ static void nft_bridge_save_rule(const void *data, unsigned int format)
|
||||
(uint64_t)cs->counters.pcnt,
|
||||
(uint64_t)cs->counters.bcnt);
|
||||
|
||||
+ if (!(format & FMT_NOCOUNTS))
|
||||
+ printf(" , pcnt = %"PRIu64" -- bcnt = %"PRIu64"",
|
||||
+ (uint64_t)cs->counters.pcnt,
|
||||
+ (uint64_t)cs->counters.bcnt);
|
||||
+
|
||||
if (!(format & FMT_NONEWLINE))
|
||||
fputc('\n', stdout);
|
||||
}
|
||||
@@ -492,11 +497,7 @@ static void nft_bridge_print_rule(struct nftnl_rule *r, unsigned int num,
|
||||
printf("%d ", num);
|
||||
|
||||
nft_rule_to_ebtables_command_state(r, &cs);
|
||||
- nft_bridge_save_rule(&cs, format & ~FMT_EBT_SAVE);
|
||||
- if (!(format & FMT_NOCOUNTS))
|
||||
- printf(" , pcnt = %"PRIu64" -- bcnt = %"PRIu64"",
|
||||
- (uint64_t)cs.counters.pcnt,
|
||||
- (uint64_t)cs.counters.bcnt);
|
||||
+ nft_bridge_save_rule(&cs, format);
|
||||
ebt_cs_clean(&cs);
|
||||
}
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
From 2f80e6d896590f42c932de32ae8c3d597cbf940b Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 2 Jun 2021 12:50:57 +0200
|
||||
Subject: [PATCH] iptables-apply: Drop unused variable
|
||||
|
||||
It was assigned to but never read.
|
||||
|
||||
Fixes: b45b4e3903414 ("iptables-apply: script and manpage update")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 084671d5acaaf749648e828c2ed3b319de651764)
|
||||
---
|
||||
iptables/iptables-apply | 1 -
|
||||
1 file changed, 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/iptables-apply b/iptables/iptables-apply
|
||||
index 4683b1b402d08..3a7df5e3cbc1f 100755
|
||||
--- a/iptables/iptables-apply
|
||||
+++ b/iptables/iptables-apply
|
||||
@@ -231,7 +231,6 @@ case "$MODE" in
|
||||
"$RUNCMD" &
|
||||
CMD_PID=$!
|
||||
( sleep "$TIMEOUT"; kill "$CMD_PID" 2>/dev/null; exit 0 ) &
|
||||
- CMDTIMEOUT_PID=$!
|
||||
if ! wait "$CMD_PID"; then
|
||||
echo "failed."
|
||||
echo "Error: unknown error running command: $RUNCMD" >&2
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,534 +0,0 @@
|
|||
From af890b239555d52c269d224ada6382381320585d Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 5 Feb 2019 18:18:02 +0100
|
||||
Subject: [PATCH] Revert "ebtables: use extrapositioned negation consistently"
|
||||
|
||||
This reverts commit 5f508b76a0cebaf91965ffa678089222e2d47964.
|
||||
|
||||
While attempts at unifying syntax between arp-, eb- and iptables-nft
|
||||
increase the opportunity for more code-sharing, they are problematic
|
||||
when it comes to compatibility. Accepting the old syntax on input helps,
|
||||
but due to the fact that neither arptables nor ebtables support --check
|
||||
command we must expect for users to test existence of a rule by
|
||||
comparing input with output. If that happens in a script, deviating from
|
||||
the old syntax in output has a high chance of breaking it.
|
||||
|
||||
Therefore revert Florian's patch changing inversion character position
|
||||
in output and review the old code for consistency - the only thing
|
||||
changed on top of the actual revert is ebtables' own copy of
|
||||
print_iface() to make it adhere to the intrapositioned negation scheme
|
||||
used throughout ebtables.
|
||||
|
||||
Added extension tests by the reverted commit have been kept.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit 35b22e82fa62e10950d8e0fa53a755d4abadf346)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libebt_802_3.c | 4 ++--
|
||||
extensions/libebt_802_3.t | 2 +-
|
||||
extensions/libebt_arp.c | 14 +++++++-------
|
||||
extensions/libebt_arp.t | 8 ++++----
|
||||
extensions/libebt_ip.c | 16 ++++++++--------
|
||||
extensions/libebt_ip.t | 6 +++---
|
||||
extensions/libebt_ip6.c | 14 +++++++-------
|
||||
extensions/libebt_ip6.t | 6 +++---
|
||||
extensions/libebt_mark_m.c | 2 +-
|
||||
extensions/libebt_mark_m.t | 4 ++--
|
||||
extensions/libebt_pkttype.c | 5 +----
|
||||
extensions/libebt_pkttype.t | 13 +++++++------
|
||||
extensions/libebt_standard.t | 4 ++--
|
||||
extensions/libebt_stp.c | 5 ++---
|
||||
extensions/libebt_vlan.c | 13 ++++---------
|
||||
extensions/libebt_vlan.t | 10 +++++-----
|
||||
iptables/nft-bridge.c | 6 +++---
|
||||
17 files changed, 62 insertions(+), 70 deletions(-)
|
||||
|
||||
diff --git a/extensions/libebt_802_3.c b/extensions/libebt_802_3.c
|
||||
index 9e91d05262591..f05d02ead5a4a 100644
|
||||
--- a/extensions/libebt_802_3.c
|
||||
+++ b/extensions/libebt_802_3.c
|
||||
@@ -98,15 +98,15 @@ static void br802_3_print(const void *ip, const struct xt_entry_match *match,
|
||||
struct ebt_802_3_info *info = (struct ebt_802_3_info *)match->data;
|
||||
|
||||
if (info->bitmask & EBT_802_3_SAP) {
|
||||
+ printf("--802_3-sap ");
|
||||
if (info->invflags & EBT_802_3_SAP)
|
||||
printf("! ");
|
||||
- printf("--802_3-sap ");
|
||||
printf("0x%.2x ", info->sap);
|
||||
}
|
||||
if (info->bitmask & EBT_802_3_TYPE) {
|
||||
+ printf("--802_3-type ");
|
||||
if (info->invflags & EBT_802_3_TYPE)
|
||||
printf("! ");
|
||||
- printf("--802_3-type ");
|
||||
printf("0x%.4x ", ntohs(info->type));
|
||||
}
|
||||
}
|
||||
diff --git a/extensions/libebt_802_3.t b/extensions/libebt_802_3.t
|
||||
index 61081bd6983a8..ddfb2f0a72baf 100644
|
||||
--- a/extensions/libebt_802_3.t
|
||||
+++ b/extensions/libebt_802_3.t
|
||||
@@ -1,3 +1,3 @@
|
||||
:INPUT,FORWARD,OUTPUT
|
||||
-! --802_3-sap 0x0a -j CONTINUE;=;OK
|
||||
+--802_3-sap ! 0x0a -j CONTINUE;=;OK
|
||||
--802_3-type 0x000a -j RETURN;=;OK
|
||||
diff --git a/extensions/libebt_arp.c b/extensions/libebt_arp.c
|
||||
index c1b0ab1db0cf1..a062b7e7e5864 100644
|
||||
--- a/extensions/libebt_arp.c
|
||||
+++ b/extensions/libebt_arp.c
|
||||
@@ -338,51 +338,51 @@ static void brarp_print(const void *ip, const struct xt_entry_match *match, int
|
||||
|
||||
if (arpinfo->bitmask & EBT_ARP_OPCODE) {
|
||||
int opcode = ntohs(arpinfo->opcode);
|
||||
+ printf("--arp-op ");
|
||||
if (arpinfo->invflags & EBT_ARP_OPCODE)
|
||||
printf("! ");
|
||||
- printf("--arp-op ");
|
||||
if (opcode > 0 && opcode <= ARRAY_SIZE(opcodes))
|
||||
printf("%s ", opcodes[opcode - 1]);
|
||||
else
|
||||
printf("%d ", opcode);
|
||||
}
|
||||
if (arpinfo->bitmask & EBT_ARP_HTYPE) {
|
||||
+ printf("--arp-htype ");
|
||||
if (arpinfo->invflags & EBT_ARP_HTYPE)
|
||||
printf("! ");
|
||||
- printf("--arp-htype ");
|
||||
printf("%d ", ntohs(arpinfo->htype));
|
||||
}
|
||||
if (arpinfo->bitmask & EBT_ARP_PTYPE) {
|
||||
+ printf("--arp-ptype ");
|
||||
if (arpinfo->invflags & EBT_ARP_PTYPE)
|
||||
printf("! ");
|
||||
- printf("--arp-ptype ");
|
||||
printf("0x%x ", ntohs(arpinfo->ptype));
|
||||
}
|
||||
if (arpinfo->bitmask & EBT_ARP_SRC_IP) {
|
||||
+ printf("--arp-ip-src ");
|
||||
if (arpinfo->invflags & EBT_ARP_SRC_IP)
|
||||
printf("! ");
|
||||
- printf("--arp-ip-src ");
|
||||
printf("%s%s ", xtables_ipaddr_to_numeric((const struct in_addr*) &arpinfo->saddr),
|
||||
xtables_ipmask_to_numeric((const struct in_addr*)&arpinfo->smsk));
|
||||
}
|
||||
if (arpinfo->bitmask & EBT_ARP_DST_IP) {
|
||||
+ printf("--arp-ip-dst ");
|
||||
if (arpinfo->invflags & EBT_ARP_DST_IP)
|
||||
printf("! ");
|
||||
- printf("--arp-ip-dst ");
|
||||
printf("%s%s ", xtables_ipaddr_to_numeric((const struct in_addr*) &arpinfo->daddr),
|
||||
xtables_ipmask_to_numeric((const struct in_addr*)&arpinfo->dmsk));
|
||||
}
|
||||
if (arpinfo->bitmask & EBT_ARP_SRC_MAC) {
|
||||
+ printf("--arp-mac-src ");
|
||||
if (arpinfo->invflags & EBT_ARP_SRC_MAC)
|
||||
printf("! ");
|
||||
- printf("--arp-mac-src ");
|
||||
xtables_print_mac_and_mask(arpinfo->smaddr, arpinfo->smmsk);
|
||||
printf(" ");
|
||||
}
|
||||
if (arpinfo->bitmask & EBT_ARP_DST_MAC) {
|
||||
+ printf("--arp-mac-dst ");
|
||||
if (arpinfo->invflags & EBT_ARP_DST_MAC)
|
||||
printf("! ");
|
||||
- printf("--arp-mac-dst ");
|
||||
xtables_print_mac_and_mask(arpinfo->dmaddr, arpinfo->dmmsk);
|
||||
printf(" ");
|
||||
}
|
||||
diff --git a/extensions/libebt_arp.t b/extensions/libebt_arp.t
|
||||
index a05ab12dc566f..14ff0f097cfd8 100644
|
||||
--- a/extensions/libebt_arp.t
|
||||
+++ b/extensions/libebt_arp.t
|
||||
@@ -1,11 +1,11 @@
|
||||
:INPUT,FORWARD,OUTPUT
|
||||
-p ARP --arp-op Request;=;OK
|
||||
--p ARP ! --arp-htype 1;=;OK
|
||||
+-p ARP --arp-htype ! 1;=;OK
|
||||
-p ARP --arp-ptype 0x2;=;OK
|
||||
-p ARP --arp-ip-src 1.2.3.4;=;OK
|
||||
--p ARP ! --arp-ip-dst 1.2.3.4;=;OK
|
||||
--p ARP ! --arp-ip-src 0.0.0.0;=;OK
|
||||
--p ARP ! --arp-ip-dst 0.0.0.0/8;=;OK
|
||||
+-p ARP ! --arp-ip-dst 1.2.3.4;-p ARP --arp-ip-dst ! 1.2.3.4 -j CONTINUE;OK
|
||||
+-p ARP --arp-ip-src ! 0.0.0.0;=;OK
|
||||
+-p ARP --arp-ip-dst ! 0.0.0.0/8;=;OK
|
||||
-p ARP --arp-mac-src 00:de:ad:be:ef:00;=;OK
|
||||
-p ARP --arp-mac-dst de:ad:be:ef:00:00/ff:ff:ff:ff:00:00;=;OK
|
||||
-p ARP --arp-gratuitous;=;OK
|
||||
diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c
|
||||
index d48704fe1c802..acb9bfcdbbd9f 100644
|
||||
--- a/extensions/libebt_ip.c
|
||||
+++ b/extensions/libebt_ip.c
|
||||
@@ -472,35 +472,35 @@ static void brip_print(const void *ip, const struct xt_entry_match *match,
|
||||
struct in_addr *addrp, *maskp;
|
||||
|
||||
if (info->bitmask & EBT_IP_SOURCE) {
|
||||
+ printf("--ip-src ");
|
||||
if (info->invflags & EBT_IP_SOURCE)
|
||||
printf("! ");
|
||||
- printf("--ip-src ");
|
||||
addrp = (struct in_addr *)&info->saddr;
|
||||
maskp = (struct in_addr *)&info->smsk;
|
||||
printf("%s%s ", xtables_ipaddr_to_numeric(addrp),
|
||||
xtables_ipmask_to_numeric(maskp));
|
||||
}
|
||||
if (info->bitmask & EBT_IP_DEST) {
|
||||
+ printf("--ip-dst ");
|
||||
if (info->invflags & EBT_IP_DEST)
|
||||
printf("! ");
|
||||
- printf("--ip-dst ");
|
||||
addrp = (struct in_addr *)&info->daddr;
|
||||
maskp = (struct in_addr *)&info->dmsk;
|
||||
printf("%s%s ", xtables_ipaddr_to_numeric(addrp),
|
||||
xtables_ipmask_to_numeric(maskp));
|
||||
}
|
||||
if (info->bitmask & EBT_IP_TOS) {
|
||||
+ printf("--ip-tos ");
|
||||
if (info->invflags & EBT_IP_TOS)
|
||||
printf("! ");
|
||||
- printf("--ip-tos ");
|
||||
printf("0x%02X ", info->tos);
|
||||
}
|
||||
if (info->bitmask & EBT_IP_PROTO) {
|
||||
struct protoent *pe;
|
||||
|
||||
+ printf("--ip-proto ");
|
||||
if (info->invflags & EBT_IP_PROTO)
|
||||
printf("! ");
|
||||
- printf("--ip-proto ");
|
||||
pe = getprotobynumber(info->protocol);
|
||||
if (pe == NULL) {
|
||||
printf("%d ", info->protocol);
|
||||
@@ -509,28 +509,28 @@ static void brip_print(const void *ip, const struct xt_entry_match *match,
|
||||
}
|
||||
}
|
||||
if (info->bitmask & EBT_IP_SPORT) {
|
||||
+ printf("--ip-sport ");
|
||||
if (info->invflags & EBT_IP_SPORT)
|
||||
printf("! ");
|
||||
- printf("--ip-sport ");
|
||||
print_port_range(info->sport);
|
||||
}
|
||||
if (info->bitmask & EBT_IP_DPORT) {
|
||||
+ printf("--ip-dport ");
|
||||
if (info->invflags & EBT_IP_DPORT)
|
||||
printf("! ");
|
||||
- printf("--ip-dport ");
|
||||
print_port_range(info->dport);
|
||||
}
|
||||
if (info->bitmask & EBT_IP_ICMP) {
|
||||
+ printf("--ip-icmp-type ");
|
||||
if (info->invflags & EBT_IP_ICMP)
|
||||
printf("! ");
|
||||
- printf("--ip-icmp-type ");
|
||||
ebt_print_icmp_type(icmp_codes, ARRAY_SIZE(icmp_codes),
|
||||
info->icmp_type, info->icmp_code);
|
||||
}
|
||||
if (info->bitmask & EBT_IP_IGMP) {
|
||||
+ printf("--ip-igmp-type ");
|
||||
if (info->invflags & EBT_IP_IGMP)
|
||||
printf("! ");
|
||||
- printf("--ip-igmp-type ");
|
||||
ebt_print_icmp_type(igmp_types, ARRAY_SIZE(igmp_types),
|
||||
info->igmp_type, NULL);
|
||||
}
|
||||
diff --git a/extensions/libebt_ip.t b/extensions/libebt_ip.t
|
||||
index 01a91a7385fcc..8be5dfbb22309 100644
|
||||
--- a/extensions/libebt_ip.t
|
||||
+++ b/extensions/libebt_ip.t
|
||||
@@ -1,13 +1,13 @@
|
||||
:INPUT,FORWARD,OUTPUT
|
||||
--p ip --ip-src ! 192.168.0.0/24 -j ACCEPT;-p IPv4 ! --ip-src 192.168.0.0/24 -j ACCEPT;OK
|
||||
+-p ip --ip-src ! 192.168.0.0/24 -j ACCEPT;-p IPv4 --ip-src ! 192.168.0.0/24 -j ACCEPT;OK
|
||||
-p IPv4 --ip-dst 10.0.0.1;=;OK
|
||||
-p IPv4 --ip-tos 0xFF;=;OK
|
||||
--p IPv4 ! --ip-tos 0xFF;=;OK
|
||||
+-p IPv4 --ip-tos ! 0xFF;=;OK
|
||||
-p IPv4 --ip-proto tcp --ip-dport 22;=;OK
|
||||
-p IPv4 --ip-proto udp --ip-sport 1024:65535;=;OK
|
||||
-p IPv4 --ip-proto 253;=;OK
|
||||
-p IPv4 --ip-proto icmp --ip-icmp-type echo-request;=;OK
|
||||
-p IPv4 --ip-proto icmp --ip-icmp-type 1/1;=;OK
|
||||
--p ip --ip-protocol icmp --ip-icmp-type ! 1:10;-p IPv4 --ip-proto icmp ! --ip-icmp-type 1:10/0:255 -j CONTINUE;OK
|
||||
+-p ip --ip-protocol icmp --ip-icmp-type ! 1:10;-p IPv4 --ip-proto icmp --ip-icmp-type ! 1:10/0:255 -j CONTINUE;OK
|
||||
--ip-proto icmp --ip-icmp-type 1/1;=;FAIL
|
||||
! -p ip --ip-proto icmp --ip-icmp-type 1/1;=;FAIL
|
||||
diff --git a/extensions/libebt_ip6.c b/extensions/libebt_ip6.c
|
||||
index b727764903ffa..b8a5a5d8c3a92 100644
|
||||
--- a/extensions/libebt_ip6.c
|
||||
+++ b/extensions/libebt_ip6.c
|
||||
@@ -399,31 +399,31 @@ static void brip6_print(const void *ip, const struct xt_entry_match *match,
|
||||
struct ebt_ip6_info *ipinfo = (struct ebt_ip6_info *)match->data;
|
||||
|
||||
if (ipinfo->bitmask & EBT_IP6_SOURCE) {
|
||||
+ printf("--ip6-src ");
|
||||
if (ipinfo->invflags & EBT_IP6_SOURCE)
|
||||
printf("! ");
|
||||
- printf("--ip6-src ");
|
||||
printf("%s", xtables_ip6addr_to_numeric(&ipinfo->saddr));
|
||||
printf("%s ", xtables_ip6mask_to_numeric(&ipinfo->smsk));
|
||||
}
|
||||
if (ipinfo->bitmask & EBT_IP6_DEST) {
|
||||
+ printf("--ip6-dst ");
|
||||
if (ipinfo->invflags & EBT_IP6_DEST)
|
||||
printf("! ");
|
||||
- printf("--ip6-dst ");
|
||||
printf("%s", xtables_ip6addr_to_numeric(&ipinfo->daddr));
|
||||
printf("%s ", xtables_ip6mask_to_numeric(&ipinfo->dmsk));
|
||||
}
|
||||
if (ipinfo->bitmask & EBT_IP6_TCLASS) {
|
||||
+ printf("--ip6-tclass ");
|
||||
if (ipinfo->invflags & EBT_IP6_TCLASS)
|
||||
printf("! ");
|
||||
- printf("--ip6-tclass ");
|
||||
printf("0x%02X ", ipinfo->tclass);
|
||||
}
|
||||
if (ipinfo->bitmask & EBT_IP6_PROTO) {
|
||||
struct protoent *pe;
|
||||
|
||||
+ printf("--ip6-proto ");
|
||||
if (ipinfo->invflags & EBT_IP6_PROTO)
|
||||
printf("! ");
|
||||
- printf("--ip6-proto ");
|
||||
pe = getprotobynumber(ipinfo->protocol);
|
||||
if (pe == NULL) {
|
||||
printf("%d ", ipinfo->protocol);
|
||||
@@ -432,21 +432,21 @@ static void brip6_print(const void *ip, const struct xt_entry_match *match,
|
||||
}
|
||||
}
|
||||
if (ipinfo->bitmask & EBT_IP6_SPORT) {
|
||||
+ printf("--ip6-sport ");
|
||||
if (ipinfo->invflags & EBT_IP6_SPORT)
|
||||
printf("! ");
|
||||
- printf("--ip6-sport ");
|
||||
print_port_range(ipinfo->sport);
|
||||
}
|
||||
if (ipinfo->bitmask & EBT_IP6_DPORT) {
|
||||
+ printf("--ip6-dport ");
|
||||
if (ipinfo->invflags & EBT_IP6_DPORT)
|
||||
printf("! ");
|
||||
- printf("--ip6-dport ");
|
||||
print_port_range(ipinfo->dport);
|
||||
}
|
||||
if (ipinfo->bitmask & EBT_IP6_ICMP6) {
|
||||
+ printf("--ip6-icmp-type ");
|
||||
if (ipinfo->invflags & EBT_IP6_ICMP6)
|
||||
printf("! ");
|
||||
- printf("--ip6-icmp-type ");
|
||||
print_icmp_type(ipinfo->icmpv6_type, ipinfo->icmpv6_code);
|
||||
}
|
||||
}
|
||||
diff --git a/extensions/libebt_ip6.t b/extensions/libebt_ip6.t
|
||||
index 6b3221ea58f62..fa1038af25649 100644
|
||||
--- a/extensions/libebt_ip6.t
|
||||
+++ b/extensions/libebt_ip6.t
|
||||
@@ -1,15 +1,15 @@
|
||||
:INPUT,FORWARD,OUTPUT
|
||||
--p ip6 ! --ip6-src dead::beef/64 -j ACCEPT;-p IPv6 ! --ip6-src dead::/64 -j ACCEPT;OK
|
||||
+-p ip6 --ip6-src ! dead::beef/64 -j ACCEPT;-p IPv6 --ip6-src ! dead::/64 -j ACCEPT;OK
|
||||
-p IPv6 --ip6-dst dead:beef::/64 -j ACCEPT;=;OK
|
||||
-p IPv6 --ip6-dst f00:ba::;=;OK
|
||||
-p IPv6 --ip6-tclass 0xFF;=;OK
|
||||
-p IPv6 --ip6-proto tcp --ip6-dport 22;=;OK
|
||||
--p IPv6 --ip6-proto tcp ! --ip6-dport 22;=;OK
|
||||
+-p IPv6 --ip6-proto tcp --ip6-dport ! 22;=;OK
|
||||
-p IPv6 --ip6-proto udp --ip6-sport 1024:65535;=;OK
|
||||
-p IPv6 --ip6-proto 253;=;OK
|
||||
-p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type echo-request -j CONTINUE;=;OK
|
||||
-p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type echo-request;=;OK
|
||||
-p ip6 --ip6-protocol icmpv6 --ip6-icmp-type 1/1;-p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type communication-prohibited -j CONTINUE;OK
|
||||
--p IPv6 --ip6-proto ipv6-icmp ! --ip6-icmp-type 1:10/0:255;=;OK
|
||||
+-p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type ! 1:10/0:255;=;OK
|
||||
--ip6-proto ipv6-icmp ! --ip6-icmp-type 1:10/0:255;=;FAIL
|
||||
! -p IPv6 --ip6-proto ipv6-icmp ! --ip6-icmp-type 1:10/0:255;=;FAIL
|
||||
diff --git a/extensions/libebt_mark_m.c b/extensions/libebt_mark_m.c
|
||||
index 64ad926f19959..2462d0af7d0bc 100644
|
||||
--- a/extensions/libebt_mark_m.c
|
||||
+++ b/extensions/libebt_mark_m.c
|
||||
@@ -86,9 +86,9 @@ static void brmark_m_print(const void *ip, const struct xt_entry_match *match,
|
||||
{
|
||||
struct ebt_mark_m_info *info = (struct ebt_mark_m_info *)match->data;
|
||||
|
||||
+ printf("--mark ");
|
||||
if (info->invert)
|
||||
printf("! ");
|
||||
- printf("--mark ");
|
||||
if (info->bitmask == EBT_MARK_OR)
|
||||
printf("/0x%lx ", info->mask);
|
||||
else if (info->mask != 0xffffffff)
|
||||
diff --git a/extensions/libebt_mark_m.t b/extensions/libebt_mark_m.t
|
||||
index 9ad41704fbb82..00035427f8b6e 100644
|
||||
--- a/extensions/libebt_mark_m.t
|
||||
+++ b/extensions/libebt_mark_m.t
|
||||
@@ -1,6 +1,6 @@
|
||||
:INPUT,FORWARD,OUTPUT
|
||||
--mark 42;--mark 0x2a;OK
|
||||
---mark ! 42;! --mark 0x2a;OK
|
||||
+--mark ! 42;--mark ! 0x2a;OK
|
||||
--mark 42/0xff;--mark 0x2a/0xff;OK
|
||||
-! --mark 0x1/0xff;=;OK
|
||||
+--mark ! 0x1/0xff;=;OK
|
||||
--mark /0x2;=;OK
|
||||
diff --git a/extensions/libebt_pkttype.c b/extensions/libebt_pkttype.c
|
||||
index 265674d19bde6..4e2d19de7983b 100644
|
||||
--- a/extensions/libebt_pkttype.c
|
||||
+++ b/extensions/libebt_pkttype.c
|
||||
@@ -75,10 +75,7 @@ static void brpkttype_print(const void *ip, const struct xt_entry_match *match,
|
||||
{
|
||||
struct ebt_pkttype_info *pt = (struct ebt_pkttype_info *)match->data;
|
||||
|
||||
- if (pt->invert)
|
||||
- printf("! ");
|
||||
-
|
||||
- printf("--pkttype-type ");
|
||||
+ printf("--pkttype-type %s", pt->invert ? "! " : "");
|
||||
|
||||
if (pt->pkt_type < ARRAY_SIZE(classes))
|
||||
printf("%s ", classes[pt->pkt_type]);
|
||||
diff --git a/extensions/libebt_pkttype.t b/extensions/libebt_pkttype.t
|
||||
index f870f5c7f05c4..e3b95ded4903e 100644
|
||||
--- a/extensions/libebt_pkttype.t
|
||||
+++ b/extensions/libebt_pkttype.t
|
||||
@@ -1,13 +1,14 @@
|
||||
:INPUT,FORWARD,OUTPUT
|
||||
+! --pkttype-type host;--pkttype-type ! host -j CONTINUE;OK
|
||||
--pkttype-type host;=;OK
|
||||
-! --pkttype-type host;=;OK
|
||||
+--pkttype-type ! host;=;OK
|
||||
--pkttype-type broadcast;=;OK
|
||||
-! --pkttype-type broadcast;=;OK
|
||||
+--pkttype-type ! broadcast;=;OK
|
||||
--pkttype-type multicast;=;OK
|
||||
-! --pkttype-type multicast;=;OK
|
||||
+--pkttype-type ! multicast;=;OK
|
||||
--pkttype-type otherhost;=;OK
|
||||
-! --pkttype-type otherhost;=;OK
|
||||
+--pkttype-type ! otherhost;=;OK
|
||||
--pkttype-type outgoing;=;OK
|
||||
-! --pkttype-type outgoing;=;OK
|
||||
+--pkttype-type ! outgoing;=;OK
|
||||
--pkttype-type loopback;=;OK
|
||||
-! --pkttype-type loopback;=;OK
|
||||
+--pkttype-type ! loopback;=;OK
|
||||
diff --git a/extensions/libebt_standard.t b/extensions/libebt_standard.t
|
||||
index 72081fd6575a0..0d678fb23c439 100644
|
||||
--- a/extensions/libebt_standard.t
|
||||
+++ b/extensions/libebt_standard.t
|
||||
@@ -6,6 +6,6 @@
|
||||
-d de:ad:be:ef:00:00 -j CONTINUE;=;OK
|
||||
-d de:ad:be:ef:0:00/ff:ff:ff:ff:0:0 -j DROP;-d de:ad:be:ef:00:00/ff:ff:ff:ff:00:00 -j DROP;OK
|
||||
-p ARP -j ACCEPT;=;OK
|
||||
-! -p ARP -j ACCEPT;=;OK
|
||||
+-p ! ARP -j ACCEPT;=;OK
|
||||
-p 0 -j ACCEPT;=;FAIL
|
||||
-! -p 0 -j ACCEPT;=;FAIL
|
||||
+-p ! 0 -j ACCEPT;=;FAIL
|
||||
diff --git a/extensions/libebt_stp.c b/extensions/libebt_stp.c
|
||||
index 33e4c8d9c615d..06cf93b8d8449 100644
|
||||
--- a/extensions/libebt_stp.c
|
||||
+++ b/extensions/libebt_stp.c
|
||||
@@ -307,9 +307,8 @@ static void brstp_print(const void *ip, const struct xt_entry_match *match,
|
||||
for (i = 0; i < STP_NUMOPS; i++) {
|
||||
if (!(stpinfo->bitmask & (1 << i)))
|
||||
continue;
|
||||
- if (stpinfo->invflags & (1 << i))
|
||||
- printf("! ");
|
||||
- printf("--%s ", brstp_opts[i].name);
|
||||
+ printf("--%s %s", brstp_opts[i].name,
|
||||
+ (stpinfo->invflags & (1 << i)) ? "! " : "");
|
||||
if (EBT_STP_TYPE == (1 << i)) {
|
||||
if (stpinfo->type == BPDU_TYPE_CONFIG)
|
||||
printf("%s", BPDU_TYPE_CONFIG_STRING);
|
||||
diff --git a/extensions/libebt_vlan.c b/extensions/libebt_vlan.c
|
||||
index 4a2eb7126895e..a2a9dcce531ce 100644
|
||||
--- a/extensions/libebt_vlan.c
|
||||
+++ b/extensions/libebt_vlan.c
|
||||
@@ -108,19 +108,14 @@ static void brvlan_print(const void *ip, const struct xt_entry_match *match,
|
||||
struct ebt_vlan_info *vlaninfo = (struct ebt_vlan_info *) match->data;
|
||||
|
||||
if (vlaninfo->bitmask & EBT_VLAN_ID) {
|
||||
- if (vlaninfo->invflags & EBT_VLAN_ID)
|
||||
- printf("! ");
|
||||
- printf("--vlan-id %d ", vlaninfo->id);
|
||||
+ printf("--vlan-id %s%d ", (vlaninfo->invflags & EBT_VLAN_ID) ? "! " : "", vlaninfo->id);
|
||||
}
|
||||
if (vlaninfo->bitmask & EBT_VLAN_PRIO) {
|
||||
- if (vlaninfo->invflags & EBT_VLAN_PRIO)
|
||||
- printf("! ");
|
||||
- printf("--vlan-prio %d ", vlaninfo->prio);
|
||||
+ printf("--vlan-prio %s%d ", (vlaninfo->invflags & EBT_VLAN_PRIO) ? "! " : "", vlaninfo->prio);
|
||||
}
|
||||
if (vlaninfo->bitmask & EBT_VLAN_ENCAP) {
|
||||
- if (vlaninfo->invflags & EBT_VLAN_ENCAP)
|
||||
- printf("! ");
|
||||
- printf("--vlan-encap %4.4X ", ntohs(vlaninfo->encap));
|
||||
+ printf("--vlan-encap %s", (vlaninfo->invflags & EBT_VLAN_ENCAP) ? "! " : "");
|
||||
+ printf("%4.4X ", ntohs(vlaninfo->encap));
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/extensions/libebt_vlan.t b/extensions/libebt_vlan.t
|
||||
index 106374cd9cb80..81c795854fca0 100644
|
||||
--- a/extensions/libebt_vlan.t
|
||||
+++ b/extensions/libebt_vlan.t
|
||||
@@ -1,13 +1,13 @@
|
||||
:INPUT,FORWARD,OUTPUT
|
||||
-p 802_1Q --vlan-id 42;=;OK
|
||||
--p 802_1Q ! --vlan-id 42;=;OK
|
||||
+-p 802_1Q --vlan-id ! 42;=;OK
|
||||
-p 802_1Q --vlan-prio 1;=;OK
|
||||
--p 802_1Q ! --vlan-prio 1;=;OK
|
||||
+-p 802_1Q --vlan-prio ! 1;=;OK
|
||||
-p 802_1Q --vlan-encap ip;-p 802_1Q --vlan-encap 0800 -j CONTINUE;OK
|
||||
-p 802_1Q --vlan-encap 0800 ;=;OK
|
||||
--p 802_1Q ! --vlan-encap 0800 ;=;OK
|
||||
--p 802_1Q --vlan-encap IPv6 ! --vlan-id 1;-p 802_1Q ! --vlan-id 1 --vlan-encap 86DD -j CONTINUE;OK
|
||||
--p 802_1Q ! --vlan-id 1 --vlan-encap 86DD;=;OK
|
||||
+-p 802_1Q --vlan-encap ! 0800 ;=;OK
|
||||
+-p 802_1Q --vlan-encap IPv6 ! --vlan-id 1;-p 802_1Q --vlan-id ! 1 --vlan-encap 86DD -j CONTINUE;OK
|
||||
+-p 802_1Q --vlan-id ! 1 --vlan-encap 86DD;=;OK
|
||||
--vlan-encap ip;=;FAIL
|
||||
--vlan-id 2;=;FAIL
|
||||
--vlan-prio 1;=;FAIL
|
||||
diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
|
||||
index 43b3e3e9649b8..2b79ca951cd92 100644
|
||||
--- a/iptables/nft-bridge.c
|
||||
+++ b/iptables/nft-bridge.c
|
||||
@@ -344,7 +344,7 @@ static void nft_rule_to_ebtables_command_state(const struct nftnl_rule *r,
|
||||
static void print_iface(const char *option, const char *name, bool invert)
|
||||
{
|
||||
if (*name)
|
||||
- printf("%s%s %s ", invert ? "! " : "", option, name);
|
||||
+ printf("%s%s %s ", option, invert ? " !" : "", name);
|
||||
}
|
||||
|
||||
static void nft_bridge_print_table_header(const char *tablename)
|
||||
@@ -389,9 +389,9 @@ static void print_mac(char option, const unsigned char *mac,
|
||||
const unsigned char *mask,
|
||||
bool invert)
|
||||
{
|
||||
+ printf("-%c ", option);
|
||||
if (invert)
|
||||
printf("! ");
|
||||
- printf("-%c ", option);
|
||||
ebt_print_mac_and_mask(mac, mask);
|
||||
printf(" ");
|
||||
}
|
||||
@@ -406,9 +406,9 @@ static void print_protocol(uint16_t ethproto, bool invert, unsigned int bitmask)
|
||||
if (bitmask & EBT_NOPROTO)
|
||||
return;
|
||||
|
||||
+ printf("-p ");
|
||||
if (invert)
|
||||
printf("! ");
|
||||
- printf("-p ");
|
||||
|
||||
if (bitmask & EBT_802_3) {
|
||||
printf("length ");
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,130 @@
|
|||
From 9a617399d5e0776b43f093b9d63d10f72e882fee Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 28 Jul 2021 17:53:53 +0200
|
||||
Subject: [PATCH] doc: ebtables-nft.8: Adjust for missing atomic-options
|
||||
|
||||
Drop any reference to them (and the environment variable) but list them
|
||||
in BUGS section hinting at ebtables-save and -restore tools.
|
||||
|
||||
Fixes: 1939cbc25e6f5 ("doc: Adjust ebtables man page")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 765bf04ecc228783cb88c810c85bc0c769579c39)
|
||||
---
|
||||
iptables/ebtables-nft.8 | 64 ++++++-----------------------------------
|
||||
1 file changed, 8 insertions(+), 56 deletions(-)
|
||||
|
||||
diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8
|
||||
index 1fa5ad9388cc0..08e9766f2cc74 100644
|
||||
--- a/iptables/ebtables-nft.8
|
||||
+++ b/iptables/ebtables-nft.8
|
||||
@@ -44,12 +44,6 @@ ebtables \- Ethernet bridge frame table administration (nft-based)
|
||||
.br
|
||||
.BR "ebtables " [ -t " table ] " --init-table
|
||||
.br
|
||||
-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit
|
||||
-.br
|
||||
-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init
|
||||
-.br
|
||||
-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save
|
||||
-.br
|
||||
|
||||
.SH DESCRIPTION
|
||||
.B ebtables
|
||||
@@ -149,11 +143,9 @@ a table, the commands apply to the default filter table.
|
||||
Only one command may be used on the command line at a time, except when
|
||||
the commands
|
||||
.BR -L " and " -Z
|
||||
-are combined, the commands
|
||||
+are combined or the commands
|
||||
.BR -N " and " -P
|
||||
-are combined, or when
|
||||
-.B --atomic-file
|
||||
-is used.
|
||||
+are combined.
|
||||
.TP
|
||||
.B "-A, --append"
|
||||
Append a rule to the end of the selected chain.
|
||||
@@ -313,39 +305,6 @@ of the ebtables kernel table.
|
||||
.TP
|
||||
.B "--init-table"
|
||||
Replace the current table data by the initial table data.
|
||||
-.TP
|
||||
-.B "--atomic-init"
|
||||
-Copy the kernel's initial data of the table to the specified
|
||||
-file. This can be used as the first action, after which rules are added
|
||||
-to the file. The file can be specified using the
|
||||
-.B --atomic-file
|
||||
-command or through the
|
||||
-.IR EBTABLES_ATOMIC_FILE " environment variable."
|
||||
-.TP
|
||||
-.B "--atomic-save"
|
||||
-Copy the kernel's current data of the table to the specified
|
||||
-file. This can be used as the first action, after which rules are added
|
||||
-to the file. The file can be specified using the
|
||||
-.B --atomic-file
|
||||
-command or through the
|
||||
-.IR EBTABLES_ATOMIC_FILE " environment variable."
|
||||
-.TP
|
||||
-.B "--atomic-commit"
|
||||
-Replace the kernel table data with the data contained in the specified
|
||||
-file. This is a useful command that allows you to load all your rules of a
|
||||
-certain table into the kernel at once, saving the kernel a lot of precious
|
||||
-time and allowing atomic updates of the tables. The file which contains
|
||||
-the table data is constructed by using either the
|
||||
-.B "--atomic-init"
|
||||
-or the
|
||||
-.B "--atomic-save"
|
||||
-command to generate a starting file. After that, using the
|
||||
-.B "--atomic-file"
|
||||
-command when constructing rules or setting the
|
||||
-.IR EBTABLES_ATOMIC_FILE " environment variable"
|
||||
-allows you to extend the file and build the complete table before
|
||||
-committing it to the kernel. This command can be very useful in boot scripts
|
||||
-to populate the ebtables tables in a fast way.
|
||||
.SS MISCELLANOUS COMMANDS
|
||||
.TP
|
||||
.B "-V, --version"
|
||||
@@ -371,16 +330,6 @@ a target extension (see
|
||||
.BR "TARGET EXTENSIONS" ")"
|
||||
or a user-defined chain name.
|
||||
.TP
|
||||
-.B --atomic-file "\fIfile\fP"
|
||||
-Let the command operate on the specified
|
||||
-.IR file .
|
||||
-The data of the table to
|
||||
-operate on will be extracted from the file and the result of the operation
|
||||
-will be saved back into the file. If specified, this option should come
|
||||
-before the command specification. An alternative that should be preferred,
|
||||
-is setting the
|
||||
-.IR EBTABLES_ATOMIC_FILE " environment variable."
|
||||
-.TP
|
||||
.B -M, --modprobe "\fIprogram\fP"
|
||||
When talking to the kernel, use this
|
||||
.I program
|
||||
@@ -1100,8 +1049,6 @@ arp message and the hardware address length in the arp header is 6 bytes.
|
||||
.br
|
||||
.SH FILES
|
||||
.I /etc/ethertypes
|
||||
-.SH ENVIRONMENT VARIABLES
|
||||
-.I EBTABLES_ATOMIC_FILE
|
||||
.SH MAILINGLISTS
|
||||
.BR "" "See " http://netfilter.org/mailinglists.html
|
||||
.SH BUGS
|
||||
@@ -1109,7 +1056,12 @@ The version of ebtables this man page ships with does not support the
|
||||
.B broute
|
||||
table. Also there is no support for
|
||||
.B string
|
||||
-match. And finally, this list is probably not complete.
|
||||
+match. Further, support for atomic-options
|
||||
+.RB ( --atomic-file ", " --atomic-init ", " --atomic-save ", " --atomic-commit )
|
||||
+has not been implemented, although
|
||||
+.BR ebtables-save " and " ebtables-restore
|
||||
+might replace them entirely given the inherent atomicity of nftables.
|
||||
+Finally, this list is probably not complete.
|
||||
.SH SEE ALSO
|
||||
.BR xtables-nft "(8), " iptables "(8), " ip (8)
|
||||
.PP
|
||||
--
|
||||
2.40.0
|
||||
|
|
@ -1,42 +0,0 @@
|
|||
From a4412aa91dff87ab27e4ad6e27f2a6c03ed0b5fb Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 22 Nov 2018 20:50:13 +0100
|
||||
Subject: [PATCH] arptables: Support --set-counters option
|
||||
|
||||
Relevant code for this was already present (short option '-c'), just the
|
||||
long option definition was missing.
|
||||
|
||||
While being at it, add '-c' to help text.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
(cherry picked from commit b0466ae6fbc0a93b69591171c54aa79063e23f3d)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/xtables-arp.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
|
||||
index 18cdced627c55..85bcc841b21f5 100644
|
||||
--- a/iptables/xtables-arp.c
|
||||
+++ b/iptables/xtables-arp.c
|
||||
@@ -144,6 +144,7 @@ static struct option original_opts[] = {
|
||||
{ "help", 2, 0, 'h' },
|
||||
{ "line-numbers", 0, 0, '0' },
|
||||
{ "modprobe", 1, 0, 'M' },
|
||||
+ { "set-counters", 1, 0, 'c' },
|
||||
{ 0 }
|
||||
};
|
||||
|
||||
@@ -481,7 +482,7 @@ exit_printhelp(void)
|
||||
" --line-numbers print line numbers when listing\n"
|
||||
" --exact -x expand numbers (display exact values)\n"
|
||||
" --modprobe=<command> try to insert modules using this command\n"
|
||||
-" --set-counters PKTS BYTES set the counter during insert/append\n"
|
||||
+" --set-counters -c PKTS BYTES set the counter during insert/append\n"
|
||||
"[!] --version -V print package version.\n");
|
||||
printf(" opcode strings: \n");
|
||||
for (i = 0; i < NUMOPCODES; i++)
|
||||
--
|
||||
2.21.0
|
||||
|
|
@ -0,0 +1,102 @@
|
|||
From ec0a69df9ac073b1a6e951c08c049fec47a12b5c Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 30 Jul 2021 12:25:10 +0200
|
||||
Subject: [PATCH] ebtables: Dump atomic waste
|
||||
|
||||
With ebtables-nft.8 now educating people about the missing
|
||||
functionality, get rid of atomic remains in source code. This eliminates
|
||||
mostly comments except for --atomic-commit which was treated as alias of
|
||||
--init-table. People not using the latter are probably trying to
|
||||
atomic-commit from an atomic-file which in turn is not supported, so no
|
||||
point keeping it.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 263186372dc4ae6a54a29bea644bcf1fc8dc3fc0)
|
||||
---
|
||||
iptables/xtables-eb.c | 53 -------------------------------------------
|
||||
1 file changed, 53 deletions(-)
|
||||
|
||||
diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
|
||||
index 6df5839f07436..d07adad2d73c3 100644
|
||||
--- a/iptables/xtables-eb.c
|
||||
+++ b/iptables/xtables-eb.c
|
||||
@@ -262,10 +262,6 @@ struct option ebt_original_options[] =
|
||||
{ "new-chain" , required_argument, 0, 'N' },
|
||||
{ "rename-chain" , required_argument, 0, 'E' },
|
||||
{ "delete-chain" , optional_argument, 0, 'X' },
|
||||
- { "atomic-init" , no_argument , 0, 7 },
|
||||
- { "atomic-commit" , no_argument , 0, 8 },
|
||||
- { "atomic-file" , required_argument, 0, 9 },
|
||||
- { "atomic-save" , no_argument , 0, 10 },
|
||||
{ "init-table" , no_argument , 0, 11 },
|
||||
{ "concurrent" , no_argument , 0, 13 },
|
||||
{ 0 }
|
||||
@@ -371,10 +367,6 @@ static void print_help(const struct xtables_target *t,
|
||||
"--new-chain -N chain : create a user defined chain\n"
|
||||
"--rename-chain -E old new : rename a chain\n"
|
||||
"--delete-chain -X [chain] : delete a user defined chain\n"
|
||||
-"--atomic-commit : update the kernel w/t table contained in <FILE>\n"
|
||||
-"--atomic-init : put the initial kernel table into <FILE>\n"
|
||||
-"--atomic-save : put the current kernel table into <FILE>\n"
|
||||
-"--atomic-file file : set <FILE> to file\n\n"
|
||||
"Options:\n"
|
||||
"--proto -p [!] proto : protocol hexadecimal, by name or LENGTH\n"
|
||||
"--src -s [!] address[/mask]: source mac address\n"
|
||||
@@ -1135,54 +1127,9 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
|
||||
"Use --Lmac2 with -L");
|
||||
flags |= LIST_MAC2;
|
||||
break;
|
||||
- case 8 : /* atomic-commit */
|
||||
-/*
|
||||
- replace->command = c;
|
||||
- if (OPT_COMMANDS)
|
||||
- ebt_print_error2("Multiple commands are not allowed");
|
||||
- replace->flags |= OPT_COMMAND;
|
||||
- if (!replace->filename)
|
||||
- ebt_print_error2("No atomic file specified");*/
|
||||
- /* Get the information from the file */
|
||||
- /*ebt_get_table(replace, 0);*/
|
||||
- /* We don't want the kernel giving us its counters,
|
||||
- * they would overwrite the counters extracted from
|
||||
- * the file */
|
||||
- /*replace->num_counters = 0;*/
|
||||
- /* Make sure the table will be written to the kernel */
|
||||
- /*free(replace->filename);
|
||||
- replace->filename = NULL;
|
||||
- break;*/
|
||||
- /*case 7 :*/ /* atomic-init */
|
||||
- /*case 10:*/ /* atomic-save */
|
||||
case 11: /* init-table */
|
||||
nft_cmd_table_flush(h, *table);
|
||||
return 1;
|
||||
- /*
|
||||
- replace->command = c;
|
||||
- if (OPT_COMMANDS)
|
||||
- ebt_print_error2("Multiple commands are not allowed");
|
||||
- if (c != 11 && !replace->filename)
|
||||
- ebt_print_error2("No atomic file specified");
|
||||
- replace->flags |= OPT_COMMAND;
|
||||
- {
|
||||
- char *tmp = replace->filename;*/
|
||||
-
|
||||
- /* Get the kernel table */
|
||||
- /*replace->filename = NULL;
|
||||
- ebt_get_kernel_table(replace, c == 10 ? 0 : 1);
|
||||
- replace->filename = tmp;
|
||||
- }
|
||||
- break;
|
||||
- case 9 :*/ /* atomic */
|
||||
- /*
|
||||
- if (OPT_COMMANDS)
|
||||
- ebt_print_error2("--atomic has to come before the command");*/
|
||||
- /* A possible memory leak here, but this is not
|
||||
- * executed in daemon mode */
|
||||
- /*replace->filename = (char *)malloc(strlen(optarg) + 1);
|
||||
- strcpy(replace->filename, optarg);
|
||||
- break; */
|
||||
case 13 :
|
||||
break;
|
||||
case 1 :
|
||||
--
|
||||
2.40.0
|
||||
|
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue