From da871de2a6efb576b6378a66222c0871f4282e96 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 9 Oct 2014 15:02:02 +0200 Subject: nft: bootstrap ebtables-compat This patch bootstraps ebtables-compat, the ebtables compatibility software upon nf_tables. [ Original patches: http://patchwork.ozlabs.org/patch/395544/ http://patchwork.ozlabs.org/patch/395545/ http://patchwork.ozlabs.org/patch/395546/ I have also forward port them on top of the current git HEAD, otherwise compilation breaks. This bootstrap is experimental, this still needs more work. --Pablo ] Signed-off-by: Giuseppe Longo Signed-off-by: Pablo Neira Ayuso --- iptables/nft-shared.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'iptables/nft-shared.h') diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h index 1b16d4e0..97d41df8 100644 --- a/iptables/nft-shared.h +++ b/iptables/nft-shared.h @@ -48,6 +48,7 @@ struct nft_xt_ctx { union { struct iptables_command_state *cs; struct arptables_command_state *cs_arp; + struct xtables_ebt_entry *ebfw; } state; struct nft_rule_expr_iter *iter; int family; @@ -122,7 +123,7 @@ bool is_same_interfaces(const char *a_iniface, const char *a_outiface, unsigned const char *b_iniface_mask, unsigned const char *b_outiface_mask); -void parse_meta(struct nft_rule_expr *e, uint8_t key, char *iniface, +int parse_meta(struct nft_rule_expr *e, uint8_t key, char *iniface, unsigned char *iniface_mask, char *outiface, unsigned char *outiface_mask, uint8_t *invflags); void print_proto(uint16_t proto, int invert); @@ -165,6 +166,7 @@ struct nft_handle; bool nft_ipv46_rule_find(struct nft_family_ops *ops, struct nft_rule *r, struct iptables_command_state *cs); +bool compare_matches(struct xtables_rule_match *mt1, struct xtables_rule_match *mt2); bool compare_targets(struct xtables_target *tg1, struct xtables_target *tg2); struct addr_mask { -- cgit v1.2.3 From 902e92ceedba96d3241fa8ff701c061cd53a197d Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 9 Oct 2014 20:11:16 +0200 Subject: ebtables-compat: use ebtables_command_state in bootstrap code And introduce fake ebt_entry. This gets the code in sync in other existing compat tools. This will likely allow to consolidate common infrastructure. This code is still quite experimental. Signed-off-by: Pablo Neira Ayuso --- iptables/nft-shared.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'iptables/nft-shared.h') diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h index 97d41df8..361e9566 100644 --- a/iptables/nft-shared.h +++ b/iptables/nft-shared.h @@ -48,7 +48,7 @@ struct nft_xt_ctx { union { struct iptables_command_state *cs; struct arptables_command_state *cs_arp; - struct xtables_ebt_entry *ebfw; + struct ebtables_command_state *cs_eb; } state; struct nft_rule_expr_iter *iter; int family; @@ -130,6 +130,7 @@ void print_proto(uint16_t proto, int invert); void get_cmp_data(struct nft_rule_expr *e, void *data, size_t dlen, bool *inv); void nft_parse_bitwise(struct nft_xt_ctx *ctx, struct nft_rule_expr *e); void nft_parse_cmp(struct nft_xt_ctx *ctx, struct nft_rule_expr *e); +void nft_parse_match(struct nft_xt_ctx *ctx, struct nft_rule_expr *e); void nft_parse_target(struct nft_xt_ctx *ctx, struct nft_rule_expr *e); void nft_parse_meta(struct nft_xt_ctx *ctx, struct nft_rule_expr *e); void nft_parse_payload(struct nft_xt_ctx *ctx, struct nft_rule_expr *e); -- cgit v1.2.3 From 51e83a4deb4849152a29c160893f0823846d47a0 Mon Sep 17 00:00:00 2001 From: Giuseppe Longo Date: Thu, 16 Oct 2014 16:29:51 +0200 Subject: ebtables-compat: fix print_header This prints the header like ebtables. Signed-off-by: Giuseppe Longo Signed-off-by: Pablo Neira Ayuso --- iptables/nft-shared.h | 1 + 1 file changed, 1 insertion(+) (limited to 'iptables/nft-shared.h') diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h index 361e9566..feef24f9 100644 --- a/iptables/nft-shared.h +++ b/iptables/nft-shared.h @@ -84,6 +84,7 @@ struct nft_family_ops { void *data); void (*parse_immediate)(const char *jumpto, bool nft_goto, void *data); + void (*print_table_header)(const char *tablename); void (*print_header)(unsigned int format, const char *chain, const char *pol, const struct xt_counters *counters, bool basechain, -- cgit v1.2.3 From 8acf8315a44fbee8227433daabb262b6de1e70f6 Mon Sep 17 00:00:00 2001 From: Arturo Borrero Date: Mon, 19 Jan 2015 14:28:02 +0100 Subject: ebtables-compat: fix nft payload bases ebtables should use NFT_PAYLOAD_LL_HEADER to fetch basic payload information from packets in the bridge family. Let's allow the add_payload() function to know in which base it should work. Signed-off-by: Arturo Borrero Gonzalez Signed-off-by: Pablo Neira Ayuso --- iptables/nft-shared.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'iptables/nft-shared.h') diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h index feef24f9..33582aaa 100644 --- a/iptables/nft-shared.h +++ b/iptables/nft-shared.h @@ -103,7 +103,7 @@ struct nft_family_ops { }; void add_meta(struct nft_rule *r, uint32_t key); -void add_payload(struct nft_rule *r, int offset, int len); +void add_payload(struct nft_rule *r, int offset, int len, uint32_t base); void add_bitwise_u16(struct nft_rule *r, int mask, int xor); void add_cmp_ptr(struct nft_rule *r, uint32_t op, void *data, size_t len); void add_cmp_u8(struct nft_rule *r, uint8_t val, uint32_t op); -- cgit v1.2.3 From fe97f60e5d2a968638286036db67e3a4e17f095d Mon Sep 17 00:00:00 2001 From: Arturo Borrero Date: Mon, 9 Feb 2015 13:16:12 +0100 Subject: ebtables-compat: add watchers support ebtables watchers are targets which always return EBT_CONTINUE. Signed-off-by: Arturo Borrero Gonzalez Signed-off-by: Pablo Neira Ayuso --- iptables/nft-shared.h | 1 + 1 file changed, 1 insertion(+) (limited to 'iptables/nft-shared.h') diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h index 33582aaa..fbce5b5d 100644 --- a/iptables/nft-shared.h +++ b/iptables/nft-shared.h @@ -97,6 +97,7 @@ struct nft_family_ops { struct xtables_args *args); void (*post_parse)(int command, struct iptables_command_state *cs, struct xtables_args *args); + void (*parse_match)(struct xtables_match *m, void *data); void (*parse_target)(struct xtables_target *t, void *data); bool (*rule_find)(struct nft_family_ops *ops, struct nft_rule *r, void *data); -- cgit v1.2.3