path: root/iptables/nft-shared.c
diff options
authorPhil Sutter <>2018-08-23 17:43:26 +0200
committerPablo Neira Ayuso <>2018-08-24 10:05:51 +0200
commit9771d067ef349460a3ea138370432d355da26ba8 (patch)
tree2afa297cdef7df42219e69760e6cf7c6e5b0b94d /iptables/nft-shared.c
parent85ed1ab6f3f1beb7ea0aee2af2bca70e14f72a9c (diff)
ebtables: Review match/target lookup once more
This is a partial revert of my previous commit with similar subject - it missed to apply the needed changes to ebtables-translate as well and on top of that still left some leaks and use-after-frees in place. The new strategy is to make ebtables extension loading compatible with that of xtables, because otherwise the heavy code sharing between ebtables-translate and iptables-translate will cause trouble. Basically, ebt_add_match() and ebt_add_watcher() copy what xtables' command_match() does, but after the actual extension argument parsing has already happened. Therefore they duplicate the loaded match along with its data and reset the original one to default state for being reused (e.g., by ebtables-restore). Since mflags/tflags are cleared while doing so, clearing them for all loaded extensions in do_commandeb() is not necessary anymore. In ebt_command_default() (where extension parameter parsing happens), the list of added extensions to the current rule are consolidated first so no duplicate extension loading happens. With the above in place, ebt_cs_clean() can be reverted to its old state. Apart from sharing command_jump() function with ebtables-translate, make use of nft_init_eb() there, as well. Fixes: aa7fb04fcf72c ("ebtables: Review match/target lookup") Signed-off-by: Phil Sutter <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'iptables/nft-shared.c')
0 files changed, 0 insertions, 0 deletions