From 11c464ed015b52a28d90c63c69e10e5f7d4053d4 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 5 May 2023 20:04:41 +0200 Subject: Add --compat option to *tables-nft and *-nft-restore commands The flag sets nft_handle::compat boolean, indicating a compatible rule implementation is wanted. Users expecting their created rules to be fetched from kernel by an older version of *tables-nft may use this to avoid potential compatibility issues. Changes since v1: - Expect short option '-C' in {ip,ip6,eb}tables-nft-restore command line parser - Support -C/--compat in arptables-nft-restore, too - Update man pages with the new flag Signed-off-by: Phil Sutter --- iptables/arptables-nft-restore.8 | 15 +++++++++----- iptables/arptables-nft.8 | 8 ++++++++ iptables/ebtables-nft.8 | 6 ++++++ iptables/iptables-restore.8.in | 11 ++++++++-- iptables/iptables.8.in | 7 +++++++ iptables/xshared.c | 7 ++++++- iptables/xshared.h | 1 + iptables/xtables-arp.c | 1 + iptables/xtables-eb.c | 7 ++++++- iptables/xtables-restore.c | 43 ++++++++++++++++++++++++++++++++++++---- iptables/xtables.c | 2 ++ 11 files changed, 95 insertions(+), 13 deletions(-) diff --git a/iptables/arptables-nft-restore.8 b/iptables/arptables-nft-restore.8 index 09d9082c..12ac9ebd 100644 --- a/iptables/arptables-nft-restore.8 +++ b/iptables/arptables-nft-restore.8 @@ -22,18 +22,23 @@ .SH NAME arptables-restore \- Restore ARP Tables (nft-based) .SH SYNOPSIS -\fBarptables\-restore +.BR arptables\-restore " [" --compat ] .SH DESCRIPTION -.PP .B arptables-restore is used to restore ARP Tables from data specified on STDIN or via a file as first argument. -Use I/O redirection provided by your shell to read from a file -.TP +Use I/O redirection provided by your shell to read from a file. +.P .B arptables-restore flushes (deletes) all previous contents of the respective ARP Table. +.TP +.BR -C , " --compat" +Create rules in a mostly compatible way, enabling older versions of +\fBarptables\-nft\fP to correctly parse the rules received from kernel. This +mode is only useful in very specific situations and will likely impact packet +filtering performance. + .SH AUTHOR Jesper Dangaard Brouer .SH SEE ALSO \fBarptables\-save\fP(8), \fBarptables\fP(8) -.PP diff --git a/iptables/arptables-nft.8 b/iptables/arptables-nft.8 index ea31e084..673a7bd5 100644 --- a/iptables/arptables-nft.8 +++ b/iptables/arptables-nft.8 @@ -220,6 +220,14 @@ counters of a rule (during .B APPEND, .B REPLACE operations). +.SS "OTHER OPTIONS" +The following additional options can be specified: +.TP +\fB\-\-compat\fP +Create rules in a mostly compatible way, enabling older versions of +\fBarptables\-nft\fP to correctly parse the rules received from kernel. This +mode is only useful in very specific situations and will likely impact packet +filtering performance. .SS RULE-SPECIFICATIONS The following command line arguments make up a rule specification (as used diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8 index 0304b508..baada6c6 100644 --- a/iptables/ebtables-nft.8 +++ b/iptables/ebtables-nft.8 @@ -359,6 +359,12 @@ to try to automatically load missing kernel modules. .TP .B --concurrent Use a file lock to support concurrent scripts updating the ebtables kernel tables. +.TP +.B --compat +Create rules in a mostly compatible way, enabling older versions of +\fBebtables\-nft\fP to correctly parse the rules received from kernel. This +mode is only useful in very specific situations and will likely impact packet +filtering performance. .SS RULE SPECIFICATIONS diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in index aa816f79..38309992 100644 --- a/iptables/iptables-restore.8.in +++ b/iptables/iptables-restore.8.in @@ -23,11 +23,11 @@ iptables-restore \(em Restore IP Tables .P ip6tables-restore \(em Restore IPv6 Tables .SH SYNOPSIS -\fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] +\fBiptables\-restore\fP [\fB\-cChntvV\fP] [\fB\-w\fP \fIseconds\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] [\fIfile\fP] .P -\fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] +\fBip6tables\-restore\fP [\fB\-cChntvV\fP] [\fB\-w\fP \fIseconds\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] [\fIfile\fP] .SH DESCRIPTION @@ -74,6 +74,13 @@ determine the executable's path. .TP \fB\-T\fP, \fB\-\-table\fP \fIname\fP Restore only the named table even if the input stream contains other ones. +.TP +\fB\-C\fP, \fB\-\-compat\fP +This flag is only relevant with \fBnft\fP-variants and ignored otherwise. If +set, rules will be created in a mostly compatible way, enabling older versions +of \fBiptables\-nft\fP to correctly parse the rules received from kernel. This +mode is only useful in very specific situations and will likely impact packet +filtering performance. .SH BUGS None known as of iptables-1.2.1 release .SH AUTHORS diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in index ecaa5553..c0e92f27 100644 --- a/iptables/iptables.8.in +++ b/iptables/iptables.8.in @@ -397,6 +397,13 @@ corresponding to that rule's position in the chain. \fB\-\-modprobe=\fP\fIcommand\fP When adding or inserting rules into a chain, use \fIcommand\fP to load any necessary modules (targets, match extensions, etc). +.TP +\fB\-\-compat\fP +This flag is only relevant with \fBnft\fP-variants and ignored otherwise. If +set, rules will be created in a mostly compatible way, enabling older versions +of \fBiptables\-nft\fP to correctly parse the rules received from kernel. This +mode is only useful in very specific situations and will likely impact packet +filtering performance. .SH LOCK FILE iptables uses the \fI@XT_LOCK_NAME@\fP file to take an exclusive lock at diff --git a/iptables/xshared.c b/iptables/xshared.c index 5f75a0a5..74b7a041 100644 --- a/iptables/xshared.c +++ b/iptables/xshared.c @@ -1263,7 +1263,8 @@ xtables_printhelp(const struct xtables_rule_match *matches) printf( " --modprobe= try to insert modules using this command\n" " --set-counters -c PKTS BYTES set the counter during insert/append\n" -"[!] --version -V print package version.\n"); +"[!] --version -V print package version\n" +" --compat create rules compatible for parsing with old binaries\n"); if (afinfo->family == NFPROTO_ARP) { int i; @@ -1787,6 +1788,10 @@ void do_parse(int argc, char *argv[], exit_tryhelp(2, p->line); + case 15: /* --compat */ + p->compat = true; + break; + case 1: /* non option */ if (optarg[0] == '!' && optarg[1] == '\0') { if (invert) diff --git a/iptables/xshared.h b/iptables/xshared.h index a200e0d6..f69a7b43 100644 --- a/iptables/xshared.h +++ b/iptables/xshared.h @@ -283,6 +283,7 @@ struct xt_cmd_parse { int line; int verbose; bool xlate; + bool compat; struct xt_cmd_parse_ops *ops; }; diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c index 71518a9c..c6a9c6d6 100644 --- a/iptables/xtables-arp.c +++ b/iptables/xtables-arp.c @@ -78,6 +78,7 @@ static struct option original_opts[] = { { "line-numbers", 0, 0, '0' }, { "modprobe", 1, 0, 'M' }, { "set-counters", 1, 0, 'c' }, + { "compat", 0, 0, 15 }, { 0 } }; diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c index 08eec79d..ffd51efa 100644 --- a/iptables/xtables-eb.c +++ b/iptables/xtables-eb.c @@ -223,6 +223,7 @@ struct option ebt_original_options[] = { "init-table" , no_argument , 0, 11 }, { "concurrent" , no_argument , 0, 13 }, { "check" , required_argument, 0, 14 }, + { "compat" , no_argument , 0, 15 }, { 0 } }; @@ -335,7 +336,8 @@ static void print_help(const struct xtables_target *t, "--modprobe -M program : try to insert modules using this program\n" "--concurrent : use a file lock to support concurrent scripts\n" "--verbose -v : verbose mode\n" -"--version -V : print package version\n\n" +"--version -V : print package version\n" +"--compat : create rules compatible for parsing with old binaries\n\n" "Environment variable:\n" /*ATOMIC_ENV_VARIABLE " : if set (see above) will equal its value"*/ "\n\n"); @@ -1097,6 +1099,9 @@ print_zero: return 1; case 13 : break; + case 15: + h->compat = true; + break; case 1 : if (!strcmp(optarg, "!")) ebt_check_inverse2(optarg, argc, argv); diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c index 23cd3498..bd8c6bc1 100644 --- a/iptables/xtables-restore.c +++ b/iptables/xtables-restore.c @@ -26,6 +26,7 @@ static int counters, verbose; /* Keeping track of external matches and targets. */ static const struct option options[] = { {.name = "counters", .has_arg = false, .val = 'c'}, + {.name = "compat", .has_arg = false, .val = 'C'}, {.name = "verbose", .has_arg = false, .val = 'v'}, {.name = "version", .has_arg = 0, .val = 'V'}, {.name = "test", .has_arg = false, .val = 't'}, @@ -45,8 +46,9 @@ static const struct option options[] = { static void print_usage(const char *name, const char *version) { - fprintf(stderr, "Usage: %s [-c] [-v] [-V] [-t] [-h] [-n] [-T table] [-M command] [-4] [-6] [file]\n" + fprintf(stderr, "Usage: %s [-c] [-C] [-v] [-V] [-t] [-h] [-n] [-T table] [-M command] [-4] [-6] [file]\n" " [ --counters ]\n" + " [ --compat ]\n" " [ --verbose ]\n" " [ --version]\n" " [ --test ]\n" @@ -289,6 +291,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[]) .cb = &restore_cb, }; bool noflush = false; + bool compat = false; struct nft_handle h; int c; @@ -303,7 +306,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[]) exit(1); } - while ((c = getopt_long(argc, argv, "bcvVthnM:T:wW", options, NULL)) != -1) { + while ((c = getopt_long(argc, argv, "bcCvVthnM:T:wW", options, NULL)) != -1) { switch (c) { case 'b': fprintf(stderr, "-b/--binary option is not implemented\n"); @@ -311,6 +314,9 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[]) case 'c': counters = 1; break; + case 'C': + compat = true; + break; case 'v': verbose++; break; @@ -387,6 +393,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[]) } h.noflush = noflush; h.restore = true; + h.compat = compat; xtables_restore_parse(&h, &p); @@ -417,6 +424,7 @@ static const struct nft_xt_restore_cb ebt_restore_cb = { }; static const struct option ebt_restore_options[] = { + {.name = "compat", .has_arg = 0, .val = 'C'}, {.name = "noflush", .has_arg = 0, .val = 'n'}, {.name = "verbose", .has_arg = 0, .val = 'v'}, { 0 } @@ -429,12 +437,16 @@ int xtables_eb_restore_main(int argc, char *argv[]) .cb = &ebt_restore_cb, }; bool noflush = false; + bool compat = false; struct nft_handle h; int c; - while ((c = getopt_long(argc, argv, "nv", + while ((c = getopt_long(argc, argv, "Cnv", ebt_restore_options, NULL)) != -1) { switch(c) { + case 'C': + compat = true; + break; case 'n': noflush = 1; break; @@ -443,7 +455,7 @@ int xtables_eb_restore_main(int argc, char *argv[]) break; default: fprintf(stderr, - "Usage: ebtables-restore [ --verbose ] [ --noflush ]\n"); + "Usage: ebtables-restore [ --compat ] [ --verbose ] [ --noflush ]\n"); exit(1); break; } @@ -451,6 +463,7 @@ int xtables_eb_restore_main(int argc, char *argv[]) nft_init_eb(&h, "ebtables-restore"); h.noflush = noflush; + h.compat = compat; xtables_restore_parse(&h, &p); nft_fini_eb(&h); @@ -465,15 +478,37 @@ static const struct nft_xt_restore_cb arp_restore_cb = { .chain_restore = nft_cmd_chain_restore, }; +static const struct option arp_restore_options[] = { + {.name = "compat", .has_arg = 0, .val = 'C'}, + { 0 } +}; + int xtables_arp_restore_main(int argc, char *argv[]) { struct nft_xt_restore_parse p = { .in = stdin, .cb = &arp_restore_cb, }; + bool compat = false; struct nft_handle h; + int c; + + while ((c = getopt_long(argc, argv, "C", + arp_restore_options, NULL)) != -1) { + switch(c) { + case 'C': + compat = true; + break; + default: + fprintf(stderr, + "Usage: arptables-restore [ --compat ]\n"); + exit(1); + break; + } + } nft_init_arp(&h, "arptables-restore"); + h.compat = compat; xtables_restore_parse(&h, &p); nft_fini(&h); xtables_fini(); diff --git a/iptables/xtables.c b/iptables/xtables.c index 22d6ea58..25b4dbc6 100644 --- a/iptables/xtables.c +++ b/iptables/xtables.c @@ -82,6 +82,7 @@ static struct option original_opts[] = { {.name = "goto", .has_arg = 1, .val = 'g'}, {.name = "ipv4", .has_arg = 0, .val = '4'}, {.name = "ipv6", .has_arg = 0, .val = '6'}, + {.name = "compat", .has_arg = 0, .val = 15 }, {NULL}, }; @@ -161,6 +162,7 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table, do_parse(argc, argv, &p, &cs, &args); h->verbose = p.verbose; + h->compat = p.compat; if (!nft_table_builtin_find(h, p.table)) xtables_error(VERSION_PROBLEM, -- cgit v1.2.3