ebtables: Review match/target lookup once more

This is a partial revert of my previous commit with similar subject - it
missed to apply the needed changes to ebtables-translate as well and on
top of that still left some leaks and use-after-frees in place. The new
strategy is to make ebtables extension loading compatible with that of
xtables, because otherwise the heavy code sharing between
ebtables-translate and iptables-translate will cause trouble.

Basically, ebt_add_match() and ebt_add_watcher() copy what xtables'
command_match() does, but after the actual extension argument parsing
has already happened. Therefore they duplicate the loaded match along
with its data and reset the original one to default state for being
reused (e.g., by ebtables-restore). Since mflags/tflags are cleared
while doing so, clearing them for all loaded extensions in
do_commandeb() is not necessary anymore.

In ebt_command_default() (where extension parameter parsing happens),
the list of added extensions to the current rule are consolidated first
so no duplicate extension loading happens.

With the above in place, ebt_cs_clean() can be reverted to its old
state.

Apart from sharing command_jump() function with ebtables-translate, make
use of nft_init_eb() there, as well.

Fixes: aa7fb04fcf72c ("ebtables: Review match/target lookup")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 8 insertions, 28 deletions

diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
index 6854d5b6..7e659bb5 100644
--- a/iptables/nft-bridge.c
+++ b/iptables/nft-bridge.c
@@ -25,45 +25,25 @@
 void ebt_cs_clean(struct iptables_command_state *cs)
 {
 	struct ebt_match *m, *nm;
-	struct xtables_rule_match *matchp, *tmp;
 
-	for (matchp = cs->matches; matchp;) {
-		tmp = matchp->next;
-
-		if (matchp->match == matchp->match->next) {
-			free(matchp->match);
-			matchp->match = NULL;
-		}
-		free(matchp);
-		matchp = tmp;
-	}
+	xtables_rule_matches_free(&cs->matches);
 
 	for (m = cs->match_list; m;) {
-		if (m->ismatch) {
-			struct xtables_match *match = m->u.match;
-
-			memset(match->m->data, 0,
-			       match->m->u.match_size - sizeof(*match->m));
-			if (match->init)
-				match->init(match->m);
-		} else {
+		if (!m->ismatch) {
 			struct xtables_target *target = m->u.watcher;
 
-			memset(target->t->data, 0,
-			       target->t->u.target_size - sizeof(*target->t));
-			if (target->init)
-				target->init(target->t);
+			if (target->t) {
+				free(target->t);
+				target->t = NULL;
+			}
+			if (target == target->next)
+				free(target);
 		}
 
 		nm = m->next;
 		free(m);
 		m = nm;
 	}
-
-	if (cs->target) {
-		if (cs->target->udata_size)
-			free(cs->target->udata);
-	}
 }
 
 /* 0: default, print only 2 digits if necessary