summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* xshared: Do not omit all-wildcard interface spec when invertedPhil Sutter2024-07-314-1/+7
| | | | | | | | | | | The rule parses correctly, but the (never matching) part is lost on output. Looks like a day-1 bug, make it fix the change after which it applies cleanly. Fixes: b2197e7834f77 ("xshared: Entirely ignore interface masks when saving rules") Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Fix conditional opcode/proto-type printingPhil Sutter2024-07-311-2/+4
| | | | | | | | | | | The checks were wrong: nft_arp_init_cs() initializes masks to 65535, not 0. This went on unnoticed because nft_arp_add() does it right and init_cs callback was not used in e.g. nft_arp_print_rule(). The last patch adding init_cs() calls in potentially required spots exposed this though. Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Add potentially missing init_cs callsPhil Sutter2024-07-312-0/+14
| | | | | | | | | The callback is there for arptables only, so other family specific code does not need it. Not calling it from family-agnostic code is wrong though, as is ignoring it in arptables-specific code. Fixes: cfdda18044d81 ("nft-shared: Introduce init_cs family ops callback") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: cmd: Init struct nft_cmd::head earlyPhil Sutter2024-07-271-0/+1
| | | | | | | | | | | | Calling nft_cmd_free() in error case segfaults otherwise if the to be freed object is not part of a list yet. Exposed by commit eab75ed36a4f2 ("nft: Avoid memleak in error path of nft_cmd_new()"), but belongs to commit a7f1e208cdf9c (and may go well along with it). Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: conntrack: Use the right callbacksPhil Sutter2024-07-271-6/+6
| | | | | | | | | | | | These version-agnostic conntrack match aliases emulating the 'state' extension introduced by commit 0d70163162589 ("libxt_state: replace as an alias to xt_conntrack") had incompatible print and save callbacks assigned. These callbacks expected struct xt_state_info in match->data which is incompatible to any of the actual xt_conntrack_mtinfo* structs used. Fixes: b28d4dcc9f555 ("iptables: state match incompatibilty across versions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: recent: Fix format string for unsigned valuesPhil Sutter2024-07-271-4/+8
| | | | | | | | | | Both fields 'seconds' and 'hit_count' are unsigned, use '%u' accordingly. While being at it, also fix coding-style in those lines. Basically a day-1 bug, have Fixes: point at a reasonably old commit. Fixes: af1660fe0e88c ("Move libipt_recent to libxt_recent") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for zeroing existent builtin chainsPhil Sutter2024-07-271-1/+1
| | | | | | | | | | | | | | | | Previous attempt at fixing for non-existent chains actually broke functionality by adding a check for NFTNL_CHAIN_HANDLE right after unsetting the attribute. The approach was flawed for another reason, too: Base chains added in the same batch (cf. iptables-restore) have no handle either but zeroing them may still be sensible. Instead, make use of the new fake chain annotation which identifies fakes more reliably. Fixes: f462975fb8049 ("nft: Fix for zeroing non-existent builtin chains") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: cache: Annotate faked base chains as suchPhil Sutter2024-07-275-17/+28
| | | | | | | | | | | | To avoid pointless kernel ruleset modifications without too many workarounds in user space, code sometimes adds "fake" base chains to cache. Yet these fake entries happen to prevent base chain creation for a following command which actually requires them. Fix this by annotating the fake entries as such so *_builtin_init() functions may convert them into real ones. Fixes: fd4b9bf08b9eb ("nft: Avoid pointless table/chain creation") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: recent: New kernels support 999 hitsPhil Sutter2024-07-271-1/+1
| | | | | | | | | Since kernel commit f4ebd03496f6 ("netfilter: xt_recent: Lift restrictions on max hitcount value"), the max supported hitcount value has increased significantly. Adjust the test to use a value which fails on old as well as new kernels. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for zeroing non-existent builtin chainsPhil Sutter2024-07-272-2/+37
| | | | | | | | | | | | | | | | | | | | | | | Trying to zero a specific rule in an entirely empty ruleset caused an error: | # nft flush ruleset | # iptables-nft -Z INPUT | iptables v1.8.10 (nf_tables): CHAIN_ZERO failed (No such file or directory): chain INPUT To fix this, start by faking any non-existing builtin chains so verbose mode prints all the would-be-flushed chains. Later set 'skip' flag if given chain is a fake one (indicated by missing HANDLE attribute). Finally cover for concurrent ruleset updates by checking whether the chain exists. This bug seems to exist for a long time already, Fixes tag identified via git-bisect. This patch won't apply to such old trees though, but calling nft_xt_builtin_init() from nft_chain_zero_counters() should work there. Fixes: a6ce0c65d3a39 ("xtables: Optimize nft_chain_zero_counters()") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-monitor: Print commands instead of -4/-6/-0 flagsPhil Sutter2024-07-272-56/+50
| | | | | | | | | | | The '-4' and '-6' flags are a rarely used feature of iptables-restore. The '-0' flag is purely artificial and not recognized anywhere (at least not as an arptables rule prefix in this sense). Finally, there is no such flag for ebtables in the first place. Go with a more intuitively clear approach and instead print the typical command which added the rule being printed. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-monitor: Ignore ebtables policy rules unless tracingPhil Sutter2024-07-274-10/+11
| | | | | | | | | | Do not expose this implementation detail to users, otherwise new user-defined chains are followed by a new rule event. When tracing, they are useful as they potentially terminate rule traversal. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-monitor: Fix for ebtables rule eventsPhil Sutter2024-07-272-9/+9
| | | | | | | | | Bridge family wasn't recognized in rule_cb(), so merely an empty "EVENT:" line was printed for ebtables rule changes. For lack of a well-known family modifier flag for bridge family, simply prefix rules by "ebtables". Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: New xtables-monitor testPhil Sutter2024-07-271-0/+149
| | | | | | Only events monitoring for now. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-monitor: Support arptables chain eventsPhil Sutter2024-07-271-0/+3
| | | | | | | Print arptables NEWCHAIN/DELCHAIN events just like for iptables, using the '-0' prefix rule callback already uses. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-monitor: Align builtin chain and table outputPhil Sutter2024-07-271-1/+2
| | | | | | Drop the leading hash sign and add "NEW/DEL chain" annotation. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-monitor: Flush stdout after all lines of outputPhil Sutter2024-07-271-1/+1
| | | | | | | | | Writing an xtables-monitor testsuite is pretty much impossible without this due to unreliable output flushing. Just move the fflush() call from trace_cb() to its caller so monitor events benefit from it as well. Fixes: 07af4da52ab30 ("xtables-monitor: fix rule printing") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-monitor: Proper re-init for rule's familyPhil Sutter2024-07-271-0/+2
| | | | | | | | | | | | | | | | | | | | When not running for a specific family only (via -4/-6 flags), xtables-monitor potentially sees events/traces for all families. To correctly parse rules when printing for NEWRULE, DELRULE or TRACE messages, nft_handle has to be reinitialized for the rule's family. It is not sufficient to reset nft_handle::ops: Some expression parsers rely upon nft_handle::family to be properly set, too (cf. references to 'ctx->h->family in nft-ruleparse.c). Adjusting the 'afinfo' pointer provided by libxtables is even more crucial, as e.g. do_parse() in xshared.c relies upon it for the proper optstring. This is actually a day-1 bug in xtables-monitor which surfaced due to commit 9075c3aa983d9 ("nft: Increase rule parser strictness"). Therefore make this fix the commit it is following-up. Fixes: ca69b0290dc50 ("xtables-monitor: Fix ip6tables rule printing") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: recent: Adjust to changes around ip_pkt_list_tot parameterPhil Sutter2024-07-051-5/+5
| | | | | | | | | | The parameter became obsolete in kernel commit abc86d0f9924 ("netfilter: xt_recent: relax ip_pkt_list_tot restrictions"). Reported-by: Fabio <pedretti.fabio@gmail.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1745 Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Include 'bitmask' value when comparing rulesPhil Sutter2024-06-121-2/+2
| | | | | | | | | | | | | | | | | | The former FIXME comment pointed at the fact that struct ebt_entry does not have a 'flags' field (unlike struct ipt_ip). In fact, ebt_entry's equivalent is 'bitmask' field. Comparing that instead is the right thing to do, even though it does not seem to make a difference in practice: No rule options alter just the bitmask value, nor is it possible to fill an associated field with default values (e.g. all-zero MAC and mask). Since the situation described above might change and there is a slight performance improvement in some cases (e.g. comparing rules differing only by specified/omitted source/dest MAC address), add the check anyway. Suggested-by: Michael Estner <michaelestner@web.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libxt_sctp: Add an extra assert()Phil Sutter2024-06-121-0/+2
| | | | | | The code is sane, but this keeps popping up in static code analyzers. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: extensions: recent: Clarify default value of ip_list_hash_sizePhil Sutter2024-06-121-1/+3
| | | | | | | | The default value of 0 is a bit confusing. Reported-by: Fabio <pedretti.fabio@gmail.com> Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1745 Signed-off-by: Phil Sutter <phil@nwl.cc>
* configure: Add option to enable/disable libnfnetlinkMaxin B. John2024-04-251-2/+11
| | | | | | | | | | | | Default behavior (autodetecting) does not change, but specifying either option would explicitly disable or enable libnfnetlink support, and if the library is not found in the latter case, ./configure will error out. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Attenuate effects of functions' internal static buffersPhil Sutter2024-04-101-11/+9
| | | | | | | | | | | | | | | | | | | | While functions returning pointers to internal static buffers have obvious limitations, users are likely unaware how they call each other internally and thus won't notice unsafe use. One such case is calling both xtables_ipaddr_to_numeric() and xtables_ipmask_to_numeric() as parameters for a single printf() call. Defuse this trap by avoiding the internal calls to xtables_ip{,6}addr_to_numeric() which is easily doable since callers keep their own static buffers already. While being at it, make use of inet_ntop() everywhere and also use INET_ADDRSTRLEN/INET6_ADDRSTRLEN defines for correct (and annotated) static buffer sizes. Reported-by: Vitaly Chikunov <vt@altlinux.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Vitaly Chikunov <vt@altlinux.org>
* xshared: Fix parsing of empty string arg in '-c' optionPhil Sutter2024-04-102-1/+6
| | | | | | | | | | | | | | Calling iptables with '-c ""' resulted in a call to strchr() with an invalid pointer as 'optarg + 1' points to past the buffer. The most simple fix is to drop the offset: The global optstring part specifies a single colon after 'c', so getopt() enforces a valid pointer in optarg. If it contains a comma at first position, packet counter value parsing will fail so all cases are covered. Reported-by: gorbanev.es@gmail.com Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate: libip6t_mh: Fix and simplify plain '-m mh' matchPhil Sutter2024-04-092-4/+2
| | | | | | | | | | Since core xlate code now ignores '-p mh' if an mh extension is also present in the rule, mh extension has to emit the l4proto match itself. Therefore emit the exthdr match irrespective of '-p' argument value just like other IPv6 extension header matches do. Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate: Improve redundant l4proto match avoidancePhil Sutter2024-04-095-28/+42
| | | | | | | | | | | | | | | xtables-translate tries to avoid 'ip protocol'/'meta l4proto' matches if following expressions add this as dependency anyway. E.g.: | # iptables-translate -A FOO -p tcp -m tcp --dport 22 -j ACCEPT | nft 'add rule ip filter FOO tcp dport 22 counter accept' This worked by searching protocol name in loaded matches, but that approach is flawed as the protocol name and corresponding extension may differ ("mobility-header" vs. "mh"). Improve this by searching for all names (cached or resolved) for a given protocol number. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Do not combine inverted payload matchesSriram Rajagopalan2024-03-191-4/+2
| | | | | | | | Fixed the issue with combining the payload in case of invert filter for tcp src and dst ports. Signed-off-by: Sriram Rajagopalan <sriramr@arista.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: xt_TPROXY: add txlate supportFlorian Westphal2024-03-092-0/+79
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: xt_socket: add txlate support for socket matchFlorian Westphal2024-03-062-0/+51
| | | | | | | | | | | | | | | | | | | v2: document the match semantics of -m socket. Ignore --nowildcard if used with other options when translating and add "wildcard 0" if the option is missing. "-m socket" will ignore sockets bound to 0.0.0.0/:: by default, unless --nowildcard is given. So, xlate must always append "wildcard 0", can elide "wildcard" if other options are present along with --nowildcard. To emulate "-m socket --nowildcard", check for "wildcard <= 1" to get a "socket exists" type matching. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Leverage stored protocol namesPhil Sutter2024-02-295-30/+53
| | | | | | | | | | | Align output of ip(6)tables-translate for --protocol arguments with that of ip(6)tables -L/-S by calling proto_to_name() from xshared.c. The latter will consult xtables_chain_protos list first to make sure (the right) names are used for "common" protocol values and otherwise falls back to getprotobynumber() which it replaces here. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1738 Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for broken recover_rule_compat()Phil Sutter2024-02-272-4/+35
| | | | | | | | | | | | | | | When IPv4 rule generator was changed to emit payload instead of meta expressions for l4proto matches, the code reinserting NFTNL_RULE_COMPAT_* attributes into rules being reused for counter zeroing was broken by accident. Make rule compat recovery aware of the alternative match, basically reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules with NFTA_RULE_COMPAT") but add a test case this time to make sure things stay intact. Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-save: Avoid /etc/protocols lookupsPhil Sutter2024-02-072-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Instrument proto_to_name() to abort if given protocol number is not among the well-known ones in xtables_chain_protos. Along with xtables_parse_protocol() preferring said array for lookups as well, this ensures reliable dump'n'restore regardless of /etc/protocols contents. Another benefit is rule dump performance. A simple test-case dumping 100k rules matching on dccp protocol shows an 8s delta (2s vs. 10s for legacy, 0.5s vs. 8s for nft) with this patch applied. For reference: | for variant in nft legacy; do | ( | echo "*filter" | for ((i = 0; i < 100000; i++)); do | echo "-A FORWARD -p dccp -j ACCEPT" | done | echo "COMMIT" | ) | iptables-${variant}-restore | time iptables-${variant}-save | wc -l | iptables-${variant} -F | done Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Add dccp and ipcomp to xtables_chain_protosPhil Sutter2024-02-071-0/+2
| | | | | | | | | | | There are "protocol extensions" for both just like with TCP or UDP. Caching their values allows for implicit extension lookup after '-p' flag, for instance: | iptables -A FORWARD -p dccp --dport 1 | iptables -A FORWARD -p ipcomp --ipcompspi 18 Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert "xshared: Print protocol numbers if --numeric was given"Phil Sutter2024-02-074-11/+11
| | | | | | | | | | | | | | This reverts commit da8ecc62dd765b15df84c3aa6b83dcb7a81d4ffa. The patch's original intention is not entirely clear anymore. If it was to reduce delays involved by calling getprotobynumber() though, commit b6196c7504d4d ("xshared: Prefer xtables_chain_protos lookup over getprotoent") avoids those if --numeric flag was given already. Also, this numeric protocol output did not cover iptables-save which is a more relevant candidate for such optimizations anyway. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1729 Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Respect min/max values when completing rangesPhil Sutter2024-02-022-5/+8
| | | | | | | | If an extension defines a minimum/maximum valid value for an option's range argument, treat this as the lower/upper boundary to use when completing (half) open ranges. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: tcp/udp: Save/xlate inverted full rangesPhil Sutter2024-02-026-43/+64
| | | | | | | | Also translate a bare '-m tcp/udp' to 'meta l4proto' match. Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Do not omit full ranges if invertedPhil Sutter2024-02-023-6/+6
| | | | | | | Otherwise this turns a never matching rule into an always matching one. Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ipcomp: Save inverted full rangesPhil Sutter2024-02-022-4/+5
| | | | | Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: esp: Save/xlate inverted full rangesPhil Sutter2024-02-023-13/+23
| | | | | | | | | Also add a translation for plain '-m esp' match which depends on the address family: While ip6tables-translate may emit an exthdr exists match, iptables-translate must stick to meta l4proto. Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: rt: Save/xlate inverted full rangesPhil Sutter2024-02-023-11/+23
| | | | | | | Also translate plain '-m rt' match into an exthdr exists one. Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: mh: Save/xlate inverted full rangesPhil Sutter2024-02-023-7/+19
| | | | | | | | | Also translate '-m mh' into an exthdr exists match unless '-p mh' is also present. The latter is converted into 'meta l4proto mh' which might need fixing itself at a later point. Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: frag: Save/xlate inverted full rangesPhil Sutter2024-02-023-12/+21
| | | | | | | Also translate plain '-m frag' match into an exthdr exists one. Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ah: Save/xlate inverted full rangesPhil Sutter2024-02-026-23/+33
| | | | | | | | | | | While at it, fix xlate output for plain '-m ah' matches: With ip6tables-translate, one should emit an extdhr exists match since ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, a simple 'meta l4proto ah' was missing. Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Reject negative port rangesPhil Sutter2024-02-024-9/+14
| | | | | | | Analogous to XTTYPE_UINT*RC value parsing, assert consecutive port values are not lower than previous ones. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Assert ranges are monotonic increasingPhil Sutter2024-02-0211-28/+22
| | | | | | | | | | | Extensions commonly require the upper range value to be larger or equal to the lower one. Performing this check in the parser is easier and covers all extensions at once. One notable exception is NFQUEUE which requires strict monotonicity. Hence leave its checks in place. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: *.t/*.txlate: Test range corner-casesPhil Sutter2024-02-0226-0/+253
| | | | | | | | | | | For every extension option accepting a range, test open and half-open as well as single element and invalid (negative) ranges. The added tests merely reflect the status quo, not the expected outcome. Following patches will fix results and the already existing test cases highlight the fixes' effects. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix for memleak with change counters commandPhil Sutter2024-02-011-0/+1
| | | | | | | | | | Just like with check command, change counters command creates a temporary rule from rulespec on command line for a search by spec in rule cache. It is not used anymore afterwards, so nft_cmd_free() should free it. Fixes: f340b7b6816be ("ebtables: Implement --change-counters command") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xtables_clear_args()Phil Sutter2024-02-016-23/+14
| | | | | | | | | | | Perform struct xtables_args object deinit in a common place, even though it merely consists of freeing any IP addresses and masks. This fixes for a memleak in arptables-translate as the check for h->family didn't catch the value NFPROTO_ARP. Fixes: 5b7324e0675e3 ("nft-arp: add arptables-translate") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix for memleak in option merging with ebtablesPhil Sutter2024-02-013-19/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The crucial difference in ebtables is that all extensions are loaded up front instead of while parsing -m/-j flags. Since this loading of all extensions before every call to do_parse() is pointless overhead (cf. ebtables-restore), other tools' mechanism of freeing all merged options in xtables_free_opts() after handling each command and resetting xt_params->opts at the start of the parser loop is problematic. Fixed commit entailed a hack to defeat the xt_params->opts happening at start of do_parse() by assigning to xt_params->orig_opts after loading all extensions. This approach caused a memleak though since xtables_free_opts() called from xtables_merge_options() will free the opts pointer only if it differs from orig_opts. Resolve this via a different approach which eliminates the xt_params->opts reset at the start of do_parse(): Make xt_params->opts be NULL until the first extension is loaded. Option merging in command_match() and command_jump() tolerates a NULL pointer there after minimal adjustment. Deinit in xtables_free_opts() is already fine as it (re)turns xt_params->opts to a NULL pointer. With do_parse() expecting that and falling back to xt_params->orig_opts, no explicit initialization is required anymore and thus ebtables' init is not mangled by accident. A critical part is that do_parse() checks xt_params->opts pointer upon each call to getopt_long() as it may get assigned while parsing. Fixes: 58d364c7120b5 ("ebtables: Use do_parse() from xshared") Signed-off-by: Phil Sutter <phil@nwl.cc>
generated by cgit v1.2.3 (git 2.25.0) at 2025-08-03 10:00:03 +0000