diff options
| -rw-r--r-- | iptables/nft-arp.c | 30 | ||||
| -rw-r--r-- | iptables/nft-ipv4.c | 15 | ||||
| -rw-r--r-- | iptables/nft-ipv6.c | 15 | ||||
| -rw-r--r-- | iptables/nft.c | 120 | ||||
| -rw-r--r-- | iptables/nft.h | 2 |
5 files changed, 90 insertions, 92 deletions
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c index 0e6d9f98..10c7b63e 100644 --- a/iptables/nft-arp.c +++ b/iptables/nft-arp.c @@ -1,10 +1,13 @@ /* + * (C) 2013 by Pablo Neira Ayuso <pablo@netfilter.org> * (C) 2013 by Giuseppe Longo <giuseppelng@gmail.com> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> */ #include <stdio.h> @@ -14,6 +17,7 @@ #include <net/if_arp.h> #include <xtables.h> +#include <libiptc/libxtc.h> #include <net/if_arp.h> #include <netinet/if_ether.h> @@ -161,6 +165,9 @@ static int nft_arp_add(struct nft_rule *r, void *data) { struct arpt_entry *fw = data; uint8_t flags = arpt_to_ipt_flags(fw->arp.invflags); + struct xt_entry_target *t; + char *targname; + int ret; if (fw->arp.iniface[0] != '\0') add_iniface(r, fw->arp.iniface, flags); @@ -207,7 +214,28 @@ static int nft_arp_add(struct nft_rule *r, void *data) add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr), &fw->arp.tgt.s_addr, 4, flags); - return 0; + /* Counters need to me added before the target, otherwise they are + * increased for each rule because of the way nf_tables works. + */ + if (add_counters(r, fw->counters.pcnt, fw->counters.bcnt) < 0) + return -1; + + t = nft_arp_get_target(fw); + targname = t->u.user.name; + + /* Standard target? */ + if (strcmp(targname, XTC_LABEL_ACCEPT) == 0) + ret = add_verdict(r, NF_ACCEPT); + else if (strcmp(targname, XTC_LABEL_DROP) == 0) + ret = add_verdict(r, NF_DROP); + else if (strcmp(targname, XTC_LABEL_RETURN) == 0) + ret = add_verdict(r, NFT_RETURN); + else if (xtables_find_target(targname, XTF_TRY_LOAD) != NULL) + ret = add_target(r, t); + else + ret = add_jumpto(r, targname, NFT_JUMP); + + return ret; } static uint16_t ipt_to_arpt_flags(uint8_t invflags) diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 2142a2e6..3be801d3 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -22,11 +22,13 @@ #include <linux/netfilter/nf_tables.h> +#include "nft.h" #include "nft-shared.h" static int nft_ipv4_add(struct nft_rule *r, void *data) { struct iptables_command_state *cs = data; + struct xtables_rule_match *matchp; uint32_t op; if (cs->fw.ip.iniface[0] != '\0') @@ -63,7 +65,18 @@ static int nft_ipv4_add(struct nft_rule *r, void *data) add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags); - return cs->fw.ip.flags; + for (matchp = cs->matches; matchp; matchp = matchp->next) { + if (add_match(r, matchp->match->m) < 0) + break; + } + + /* Counters need to me added before the target, otherwise they are + * increased for each rule because of the way nf_tables works. + */ + if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0) + return -1; + + return add_action(r, cs, cs->fw.ip.flags); } static bool nft_ipv4_is_same(const void *data_a, diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index dbb148ab..e3784a8b 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -20,11 +20,13 @@ #include <xtables.h> +#include "nft.h" #include "nft-shared.h" static int nft_ipv6_add(struct nft_rule *r, void *data) { struct iptables_command_state *cs = data; + struct xtables_rule_match *matchp; if (cs->fw6.ipv6.iniface[0] != '\0') add_iniface(r, cs->fw6.ipv6.iniface, cs->fw6.ipv6.invflags); @@ -46,7 +48,18 @@ static int nft_ipv6_add(struct nft_rule *r, void *data) add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags); - return cs->fw6.ipv6.flags; + for (matchp = cs->matches; matchp; matchp = matchp->next) { + if (add_match(r, matchp->match->m) < 0) + break; + } + + /* Counters need to me added before the target, otherwise they are + * increased for each rule because of the way nf_tables works. + */ + if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0) + return -1; + + return add_action(r, cs, cs->fw6.ipv6.flags); } static bool nft_ipv6_is_same(const void *data_a, diff --git a/iptables/nft.c b/iptables/nft.c index d08a513b..c3784c07 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -589,7 +589,7 @@ static int __add_match(struct nft_rule_expr *e, struct xt_entry_match *m) return 0; } -static int add_match(struct nft_rule *r, struct xt_entry_match *m) +int add_match(struct nft_rule *r, struct xt_entry_match *m) { struct nft_rule_expr *expr; int ret; @@ -671,6 +671,32 @@ int add_verdict(struct nft_rule *r, int verdict) return 0; } +int add_action(struct nft_rule *r, struct iptables_command_state *cs, + int ip_flags) +{ + int ret = 0; + + /* If no target at all, add nothing (default to continue) */ + if (cs->target != NULL) { + /* Standard target? */ + if (strcmp(cs->jumpto, XTC_LABEL_ACCEPT) == 0) + ret = add_verdict(r, NF_ACCEPT); + else if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0) + ret = add_verdict(r, NF_DROP); + else if (strcmp(cs->jumpto, XTC_LABEL_RETURN) == 0) + ret = add_verdict(r, NFT_RETURN); + else + ret = add_target(r, cs->target->t); + } else if (strlen(cs->jumpto) > 0) { + /* Not standard, then it's a go / jump to chain */ + if (ip_flags & IPT_F_GOTO) + ret = add_jumpto(r, cs->jumpto, NFT_GOTO); + else + ret = add_jumpto(r, cs->jumpto, NFT_JUMP); + } + return ret; +} + static void nft_rule_print_debug(struct nft_rule *r, struct nlmsghdr *nlh) { #ifdef NLDEBUG @@ -707,11 +733,9 @@ void add_compat(struct nft_rule *r, uint32_t proto, bool inv) static struct nft_rule * nft_rule_new(struct nft_handle *h, const char *chain, const char *table, - struct iptables_command_state *cs) + void *data) { struct nft_rule *r; - int ret = 0, ip_flags = 0; - struct xtables_rule_match *matchp; r = nft_rule_alloc(); if (r == NULL) @@ -721,39 +745,7 @@ nft_rule_new(struct nft_handle *h, const char *chain, const char *table, nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, (char *)table); nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, (char *)chain); - ip_flags = h->ops->add(r, cs); - - for (matchp = cs->matches; matchp; matchp = matchp->next) { - if (add_match(r, matchp->match->m) < 0) - goto err; - } - - /* Counters need to me added before the target, otherwise they are - * increased for each rule because of the way nf_tables works. - */ - if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0) - goto err; - - /* If no target at all, add nothing (default to continue) */ - if (cs->target != NULL) { - /* Standard target? */ - if (strcmp(cs->jumpto, XTC_LABEL_ACCEPT) == 0) - ret = add_verdict(r, NF_ACCEPT); - else if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0) - ret = add_verdict(r, NF_DROP); - else if (strcmp(cs->jumpto, XTC_LABEL_RETURN) == 0) - ret = add_verdict(r, NFT_RETURN); - else - ret = add_target(r, cs->target->t); - } else if (strlen(cs->jumpto) > 0) { - /* Not standard, then it's a go / jump to chain */ - if (ip_flags & IPT_F_GOTO) - ret = add_jumpto(r, cs->jumpto, NFT_GOTO); - else - ret = add_jumpto(r, cs->jumpto, NFT_JUMP); - } - - if (ret < 0) + if (h->ops->add(r, data) < 0) goto err; return r; @@ -2393,56 +2385,6 @@ err: * to ARP. These functions should go away with some refactoring of the * existing infrastructure. */ -static struct nft_rule * -nft_arp_rule_new(struct nft_handle *h, const char *chain, const char *table, - struct arpt_entry *fw) -{ - struct xt_entry_target *t; - char *targname; - struct nft_rule *r; - int ret = 0; - - t = nft_arp_get_target(fw); - targname = t->u.user.name; - - r = nft_rule_alloc(); - if (r == NULL) - return NULL; - - nft_rule_attr_set_u32(r, NFT_RULE_ATTR_FAMILY, h->family); - nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, (char *)table); - nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, (char *)chain); - - h->ops->add(r, fw); - - /* Counters need to me added before the target, otherwise they are - * increased for each rule because of the way nf_tables works. - */ - if (add_counters(r, fw->counters.pcnt, fw->counters.bcnt) < 0) - goto err; - - /* Standard target? */ - if (strcmp(targname, XTC_LABEL_ACCEPT) == 0) - ret = add_verdict(r, NF_ACCEPT); - else if (strcmp(targname, XTC_LABEL_DROP) == 0) - ret = add_verdict(r, NF_DROP); - else if (strcmp(targname, XTC_LABEL_RETURN) == 0) - ret = add_verdict(r, NFT_RETURN); - else if (xtables_find_target(targname, XTF_TRY_LOAD) != NULL) - ret = add_target(r, t); - else - ret = add_jumpto(r, targname, NFT_JUMP); - - if (ret < 0) - goto err; - - return r; -err: - nft_rule_free(r); - return NULL; - -} - static void nft_arp_rule_print_debug(struct nft_rule *r, struct nlmsghdr *nlh) { #ifdef NLDEBUG @@ -2464,7 +2406,7 @@ nft_arp_rule_add(struct nft_handle *h, const char *chain, struct nft_rule *r; int ret = 1; - r = nft_arp_rule_new(h, chain, table, fw); + r = nft_rule_new(h, chain, table, fw); if (r == NULL) { ret = 0; goto err; @@ -2507,7 +2449,7 @@ int nft_arp_rule_append(struct nft_handle *h, const char *chain, nft_fn = nft_arp_rule_append; - r = nft_arp_rule_new(h, chain, table, fw); + r = nft_rule_new(h, chain, table, fw); if (r == NULL) { ret = 0; goto err; diff --git a/iptables/nft.h b/iptables/nft.h index 09d3e0c5..8ddde48d 100644 --- a/iptables/nft.h +++ b/iptables/nft.h @@ -100,8 +100,10 @@ void nft_rule_list_destroy(struct nft_rule_list *list); */ int add_counters(struct nft_rule *r, uint64_t packets, uint64_t bytes); int add_verdict(struct nft_rule *r, int verdict); +int add_match(struct nft_rule *r, struct xt_entry_match *m); int add_target(struct nft_rule *r, struct xt_entry_target *t); int add_jumpto(struct nft_rule *r, const char *name, int verdict); +int add_action(struct nft_rule *r, struct iptables_command_state *cs, int ip_flags); enum nft_rule_print { NFT_RULE_APPEND, |