summaryrefslogtreecommitdiffstats
path: root/iptables/nft-bridge.c
Commit message (Collapse)AuthorAgeFilesLines
* ebtables: Default to extrapositioned negationsPhil Sutter2024-01-101-7/+3
| | | | | | | | | | | | | | | ebtables-nft has always supported both intra- and extrapositioned negations but defaulted to intrapositioned when printing/saving rules. With commit 58d364c7120b5 ("ebtables: Use do_parse() from xshared") though, it started to warn about intrapositioned negations. So change the default to avoid mandatory warnings when e.g. loading previously dumped rulesets. Also adjust test cases, help texts and ebtables-nft.8 accordingly. Cc: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Use do_parse() from xsharedPhil Sutter2023-12-051-0/+121
| | | | | | | | | | | | | | | | | | | Drop the custom commandline parsers from ebtables and ebtables-translate, extend and use the shared one instead. ebtables gains a few new features from doing this: - Rule counters may be specified in the '-c N,M' syntax - Support for --replace command - Support for --list-rules command - Zero individual rules There is one known regression in this patch, namely maximum chain name length shrinks to 28 characters (from 32). Since this limit changed for iptables in the past as well (e.g. with commit 5429b41c2bb4a), assume nobody really relies upon it anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Align line number formatting with legacyPhil Sutter2023-11-231-1/+1
| | | | | | | | Legacy ebtables appends a dot to the number printed in first column if --Ln flag was given. Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: nft_bridge_add() uses wrong flagsPhil Sutter2023-11-231-2/+2
| | | | | | | | | When checking whether -s or -d was given, invflags were used by accident. This change has no functional effect since the values remain the same, but this way it's clear where the previously assigned flags are used. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for useless meta expressions in rulePhil Sutter2023-09-141-34/+4
| | | | | | | | | | | | | | | | | | | A relict of legacy iptables' mandatory matching on interfaces and IP addresses is support for the '-i +' notation, basically a "match any input interface". Trying to make things better than its predecessor, iptables-nft boldly optimizes that nop away - not entirely though, the meta expression loading the interface name was left in place. While not a problem (apart from pointless overhead) in current HEAD, v1.8.7 would trip over this as a following cmp expression (for another match) was incorrectly linked to that stale meta expression, loading strange values into the respective interface name field. While being at it, merge and generalize the functions into a common one for use with ebtables' NFT_META_BRI_(I|O)IFNAME matches, too. Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1702 Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert --compat option related commitsPhil Sutter2023-09-011-5/+4
| | | | | | | | | | | | | | | | | | | This reverts the following commits: b14c971db6db0 ("tests: Test compat mode") 11c464ed015b5 ("Add --compat option to *tables-nft and *-nft-restore commands") ca709b5784c98 ("nft: Introduce and use bool nft_handle::compat") 402b9b3c07c81 ("nft: Pass nft_handle to add_{target,action}()") This implementation of a compatibility mode implements rules using xtables extensions if possible and thus relies upon existence of those in kernel space. Assuming no viable replacement for the internal mechanics of this mode will be found in foreseeable future, it will effectively block attempts at deprecating and removing of these xtables extensions in favor of nftables expressions and thus hinder upstream's future plans for iptables. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Pass nft_handle to add_{target,action}()Phil Sutter2023-08-111-4/+5
| | | | | | Prepare for varying rule content based on a global flag. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: pass context structure to ops->add() to improve anonymous set ↵Pablo Neira Ayuso2023-07-121-4/+5
| | | | | | | | | | | | | | | | | support Add context structure to improve bridge among support which creates an anonymous set. This context structure specifies the command and it allows to optionally store a anonymous set. Use this context to generate native bytecode only if this is an add/insert/replace command. This fixes a dangling anonymous set that is created on rule removal. Fixes: 26753888720d ("nft: bridge: Rudimental among extension support") Reported-and-tested-by: Igor Raits <igor@gooddata.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: check for source and destination address in first placePablo Neira Ayuso2023-06-021-14/+14
| | | | | | | | | | | | | | | | | | | | | | When generating bytecode, check for source and destination address in first place, then, check for the input and output device. In general, the first expression in the rule is the most evaluated during the evaluation process. These selectors are likely to show more variability in rulesets. # iptables-nft -vv -I INPUT -s 1.2.3.4 -p tcp tcp opt -- in * out * 1.2.3.4 -> 0.0.0.0/0 table filter ip flags 0 use 0 handle 0 ip filter INPUT use 0 type filter hook input prio 0 policy accept packets 0 bytes 0 ip filter INPUT [ payload load 4b @ network header + 12 => reg 1 ] [ cmp eq reg 1 0x04030201 ] [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ counter pkts 0 bytes 0 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: ruleparse: Create family-specific source filesPhil Sutter2023-05-031-392/+0
| | | | | | | Extract the remaining nftnl rule parsing code from nft-<family>.c sources into dedicated ones to complete the separation. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Extract rule parsing callbacks from nft_family_opsPhil Sutter2023-05-031-7/+11
| | | | | | | Introduce struct nft_ruleparse_ops holding the family-specific expression parsers and integrate it into nft_family_ops for now. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-nft: add broute table emulationFlorian Westphal2023-04-041-0/+36
| | | | | | | | | | | | | | Use new 'meta broute set 1' to emulate -t broute. If '-t broute' is given, automatically translate -j DROP to 'meta broute set 1 accept' internally. Reverse translation zaps the broute and pretends verdict was DROP. Note that BROUTING is internally handled via PREROUTING, i.e. 'redirect' and 'nat' targets are not available, they will need to be emulated via nft expressions. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: ip and ip6 matches depend on protocol matchPhil Sutter2023-02-171-2/+9
| | | | | | | This is consistent with legacy ebtables, also avoids invalid combinations like '-p IPv6 --ip-source 1.2.3.4'. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Increase rule parser strictnessPhil Sutter2022-12-201-0/+4
| | | | | | Catch more unexpected conditions. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix MAC address match translationPhil Sutter2022-12-021-3/+3
| | | | | | | If a mask was present, ebtables-translate would emit illegal syntax. Fixes: 5e2b473a64bc7 ("xtables-compat: extend generic tests for masks and wildcards") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: work around recent "among" decode breakageFlorian Westphal2022-12-011-0/+5
| | | | | | | | | | | | | | | | ebtables-nft-save will fail with "unknown meta key" when decoding "among" emulation with ipv4 or ipv6 addresses included. This is because "meta protocol ip" is used as a dependency, but its never decoded anywhere. Skip this for now to restore the "ebtables/0006-flush_0" test case. Fixes: 25883ce88bfb ("nft: check for unknown meta keys") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* xlate: get rid of escape_quotesFlorian Westphal2022-11-301-2/+0
| | | | | | | | | | | | | | | | Its not necessary to escape " characters, we can let xtables-translate print the entire translation/command enclosed in '' chracters, i.e. nft 'add rule ...', this also takes care of [, { and other special characters that some shells might parse otherwise (when copy-pasting translated output). The escape_quotes struct member is retained to avoid an ABI breakage. This breaks all xlate test cases, fixup in followup patches. v3: no need to escape ', replace strcmp(x, "") with x[0] (Phil Sutter) Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Leverage xlate auto-spacingPhil Sutter2022-11-291-3/+0
| | | | | | Drop code which is used explicitly to deal with spacing. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-nft: exit nonzero when iptables-save cannot decode all expressionsFlorian Westphal2022-11-231-2/+2
| | | | | | | | | | | | We always return 0, even if we printed some error message half-way. Increment an error counter whenever an error message was printed so that the chain-loop can exit with an error if this counter is nonzero. Another effect is that iptables-save will no longer print the COMMIT line anmore. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* nft: check for unknown meta keysFlorian Westphal2022-11-231-1/+5
| | | | | | | | | | | | | Set ->errmsg when the meta key isn't supported by iptables-nft instead of pretending everything is fine. The old code is good enough to handle rules added by iptables-nft, but its not enough to handle rules added by native nft. At least make sure that there is a an error message telling that iptables-nft could not decode the entire ruleset. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Fix compile with -DDEBUGPhil Sutter2022-10-071-4/+4
| | | | | | | Conversion from 'ctx' to 'reg' missed some of the DEBUGP() calls. Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: Drop 'sreg_count' variablePhil Sutter2022-09-281-4/+2
| | | | | | | | It is not needed, one can just use 'reg' function parameter in its place. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* ebtables: Fix among matchPhil Sutter2022-09-281-2/+2
| | | | | | | | | | | | | | | | | | Fixed commit broke among match in two ways: 1) The two lookup sizes are 12 and 6, not 12 and 4 - among supports either ether+IP or ether only, not IP only. 2) Adding two to sreg_count to get the second register is too simple: It works only for four byte regs, not the 16 byte ones. The first register is always a 16 byte one, though. Fixing (1) is trivial, fix (2) by introduction of nft_get_next_reg() doing the right thing. For consistency, use it for among match creation, too. Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Support '-p Length'Phil Sutter2022-09-281-10/+36
| | | | | | | | | | | | | | | | | | To match on Ethernet frames using the etherproto field as length value, ebtables accepts the special protocol name "LENGTH". Implement this in ebtables-nft using a native match for 'ether type < 0x0600'. Since extension 802_3 matches are valid only with such Ethernet frames, add a local add_match() wrapper which complains if the extension is used without '-p Length' parameter. Legacy ebtables does this within the extension's final_check callback, but it's not possible here due for lack of fw->bitmask field access. While being at it, add xlate support, adjust tests and make ebtables-nft print the case-insensitive argument with capital 'L' like legacy ebtables does. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: track each register individuallyFlorian Westphal2022-09-281-38/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of assuming only one register is used, track all 16 regs individually. This avoids need for the 'PREV_PAYLOAD' hack and also avoids the need to clear out old flags: When we see that register 'x' will be written to, that register state is reset automatically. Existing dissector decodes ip saddr 1.2.3.4 meta l4proto tcp ... as -s 6.0.0.0 -p tcp iptables-nft -s 1.2.3.4 -p tcp is decoded correctly because the expressions are ordered like: meta l4proto tcp ip saddr 1.2.3.4 | ... and 'meta l4proto' did clear the PAYLOAD flag. The simpler fix is: ctx->flags &= ~NFT_XT_CTX_PAYLOAD; in nft_parse_cmp(), but that breaks dissection of '1-42', because the second compare ('cmp lte 42') will not find the payload expression anymore. Link: https://lore.kernel.org/netfilter-devel/20220922143544.GA22541@breakpoint.cc/T/#t Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Phil Sutter <phil@nwl.cc>
* nft: prepare for dynamic register allocationPablo Neira Ayuso2022-05-021-8/+12
| | | | | | | | | Store the register that has been allocated and pass it on to the next expression. NFT_REG_1 is still used. No functional changes are expected. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass handle to helper functions to build netlink payloadPablo Neira Ayuso2022-05-021-11/+13
| | | | | | | Pass struct nft_handle to helper functions in preparation for the dynamic register allocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass struct nft_xt_ctx to parse_meta()Pablo Neira Ayuso2022-05-021-1/+1
| | | | | | In preparation for native mark match support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Don't pass command state opaque to family ops callbacksPhil Sutter2022-03-101-23/+22
| | | | | | | | | | | There are no family-specific versions of struct iptables_command_state anymore, so no need to hide it behind void pointer. Pass the type as-is and save a few casts. While at it, drop unused callbacks parse_bitwise and parse_cmp. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Speed up immediate parsingPhil Sutter2022-03-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Parsing of rules which jump to a chain pointlessly causes a call to xtables_find_target() despite the code already knowing the outcome. Avoid the significant delay for rulesets with many chain jumps by performing the (standard) target lookup only for accept/drop/return verdicts. From a biased test-case on my VM: | # iptables-nft-save | grep -c -- '-j' | 133943 | # time ./old/iptables-nft-save >/dev/null | real 0m45.566s | user 0m1.308s | sys 0m8.430s | # time ./new/iptables-nft-save >/dev/null | real 0m3.547s | user 0m0.762s | sys 0m2.476s Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Simplify immediate parsingPhil Sutter2022-03-101-9/+0
| | | | | | | | | | Implementations of parse_immediate callback are mostly trivial, the only relevant part is access to family-specific parts of struct iptables_command_state when setting goto flag for iptables and ip6tables. Refactor them into simple set_goto_flag callbacks. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* xtables: Do not pass nft_handle to do_parse()Phil Sutter2022-01-121-1/+0
| | | | | | | | | Make it fit for sharing with legacy iptables, drop nft-specific parameter. This requires to mirror proto_parse and post_parse callbacks from family_ops somewhere reachable - use xt_cmd_parse, it holds other "parser setup data" as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share print_header() with legacy iptablesPhil Sutter2021-11-231-1/+1
| | | | | | | | | | | | | | | Legacy iptables fetches the relevant data via libiptc before calling the shared routine which merely prints data as requested. Drop the 'basechain' parameter, instead make sure a policy name is passed only with base chains. Since the function is not shared with ebtables (which uses a very rudimental header instead), this is safe. In order to support legacy iptables' checking of iptc_get_references() return code (printing an error message instead of the reference count), make refs parameter signed and print the error message if it's negative. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Change whitespace printing in save_rule callbackPhil Sutter2021-11-231-2/+8
| | | | | | | This aligns whitespace printing with legacy iptables' print_rule4() in order to prepare for further code-sharing. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Use xtables_{m,c}alloc() everywherePhil Sutter2021-08-311-5/+1
| | | | | | | | | | Make use of libxtables allocators where sensible to have implicit error checking. Leave library-internal calls in place to not create unexpected program exit points for users, apart from xt_xlate_alloc() as that function called xtables_error() in error case which exits by itself already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Extend MAC address printing/parsing supportPhil Sutter2020-12-031-35/+2
| | | | | | | | | | | | | | | Adding a parser which supports common names for special MAC/mask combinations and a print routine detecting those special addresses and printing the respective name allows to consolidate all the various duplicated implementations. The side-effects of this change are manageable: * arptables now accepts "BGA" as alias for the bridge group address * "mac" match now prints MAC addresses in lower-case which is consistent with the remaining code at least Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Optimize masked MAC address matchesPhil Sutter2020-11-041-12/+10
| | | | | | | | | | Just like with class-based prefix matches in iptables-nft, optimize masked MAC address matches if the mask is on a byte-boundary. To reuse the logic in add_addr(), extend it to accept the payload base value via parameter. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Drop save_counters callback from family_opsPhil Sutter2020-05-181-1/+0
| | | | | | | All families use the same callback function, just fold it into the sole place it's called. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Merge nft_*_rule_find() functionsPhil Sutter2020-05-181-38/+0
| | | | | | | | | Both ebtables and arptables are fine with using nft_ipv46_rule_find() instead of their own implementations. Take the chance and move the former into nft.c as a static helper since it is used in a single place, only. Then get rid of the callback from family_ops. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: restore among supportPablo Neira Ayuso2020-05-111-2/+11
| | | | | | | Update among support to work again with the new parser and cache logic. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: split parsing from netlink commandsPablo Neira Ayuso2020-05-111-2/+4
| | | | | | | | | | | | | | This patch updates the parser to generate a list of command objects. This list of commands is then transformed to a list of netlink jobs. This new command object stores the rule using the nftnl representation via nft_rule_new(). To reduce the number of updates in this patch, the nft_*_rule_find() functions have been updated to restore the native representation to skip the update of the rule comparison code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: bridge: Rudimental among extension supportPhil Sutter2019-11-251-0/+210
| | | | | | | | | Support among match as far as possible given the limitations of nftables sets, namely limited to homogeneous MAC address only or MAC and IP address only matches. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'rule_to_cs' callbackPhil Sutter2019-11-251-4/+5
| | | | | | | | | | | This is the actual callback used to parse nftables rules. Pass nft_handle to it so it can access the cache (and possible sets therein). Having to pass nft_handle to nft_rule_print_save() allows to simplify it a bit since no family ops lookup has to be done anymore. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'print_rule' callbackPhil Sutter2019-11-251-2/+2
| | | | | | | | Prepare for 'rule_to_cs' callback to receive nft_handle pointer so it is able to access cache for set lookups. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'rule_find' callbackPhil Sutter2019-11-251-2/+2
| | | | | | | | | In order to prepare for rules containing set references, nft handle has to be passed to nft_rule_to_iptables_command_state() in order to let it access the set in cache. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: family_ops: Pass nft_handle to 'add' callbackPhil Sutter2019-11-251-2/+3
| | | | | | | | | In order for add_match() to create anonymous sets when converting xtables matches it needs access to nft handle. So pass it along from callers of family ops' add callback. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-save: Fix counter formattingPhil Sutter2019-07-231-28/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The initial problem was 'ebtables-save -c' printing iptables-style counters but at the same time not disabling ebtables-style counter output (which was even printed in wrong format for ebtables-save). The code around counter output was complicated enough to motivate a larger rework: * Make FMT_C_COUNTS indicate the appended counter style for ebtables. * Use FMT_EBT_SAVE to distinguish between '-c' style counters and the legacy pcnt/bcnt ones. Consequently, ebtables-save sets format to: FMT_NOCOUNTS - for no counters FMT_EBT_SAVE - for iptables-style counters FMT_EBT_SAVE | FMT_C_COUNTS - for '-c' style counters For regular ebtables, list_rules() always sets FMT_C_COUNTS (iptables-style counters are never used there) and FMT_NOCOUNTS if no counters are requested. The big plus is if neither FMT_NOCOUNTS nor FMT_C_COUNTS is set, iptables-style counters are to be printed - both in iptables and ebtables. This allows to drop the ebtables-specific 'save_counters' callback. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-nft: Support user-defined chain policiesPhil Sutter2019-02-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Legacy ebtables supports policies for user-defined chains - and what's worse, they default to ACCEPT unlike anywhere else. So lack of support for this braindead feature in ebtables-nft is actually a change of behaviour which very likely affects all ebtables users out there. The solution implemented here uses an implicit (and transparent) last rule in all user-defined ebtables-nft chains with policy other than RETURN. This rule is identified by an nft comment "XTABLES_EB_INTERNAL_POLICY_RULE" (since commit ccf154d7420c0 ("xtables: Don't use native nftables comments") nft comments are not used otherwise). To minimize interference with existing code, this policy rule is removed from chains during cache population and the policy is saved in NFTNL_CHAIN_POLICY attribute. When committing changes to the kernel, nft_commit() traverses through the list of chains and (re-)creates policy rules if required. In ebtables-nft-restore, table flushes are problematic. To avoid weird kernel error responses, introduce a custom 'table_flush' callback which removes any pending policy rule add/remove jobs prior to creating the NFT_COMPAT_TABLE_FLUSH one. I've hidden all this mess behind checks for h->family, so hopefully impact on {ip,ip6,arp}tables-nft should be negligible. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* Revert "ebtables: use extrapositioned negation consistently"Phil Sutter2019-02-051-3/+3
| | | | | | | | | | | | | | | | | | | | | | | This reverts commit 5f508b76a0cebaf91965ffa678089222e2d47964. While attempts at unifying syntax between arp-, eb- and iptables-nft increase the opportunity for more code-sharing, they are problematic when it comes to compatibility. Accepting the old syntax on input helps, but due to the fact that neither arptables nor ebtables support --check command we must expect for users to test existence of a rule by comparing input with output. If that happens in a script, deviating from the old syntax in output has a high chance of breaking it. Therefore revert Florian's patch changing inversion character position in output and review the old code for consistency - the only thing changed on top of the actual revert is ebtables' own copy of print_iface() to make it adhere to the intrapositioned negation scheme used throughout ebtables. Added extension tests by the reverted commit have been kept. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for false-positive rule matchingPhil Sutter2019-02-051-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | When comparing two rules with non-standard targets, differences in targets' payloads wasn't respected. The cause is a rather hideous one: Unlike xtables_find_match(), xtables_find_target() did not care whether the found target was already in use or not, so the same target instance was assigned to both rules and therefore payload comparison happened over the same memory location. With legacy iptables it is not possible to reuse a target: The only case where two rules (i.e., iptables_command_state instances) could exist at the same time is when comparing rules, but that's handled using libiptc. The above change clashes with ebtables-nft's reuse of target objects: While input parsing still just assigns the object from xtables_targets list, rule conversion from nftnl to iptables_command_state allocates new data. To fix this, make ebtables-nft input parsing use the common command_jump() routine instead of its own simplified copy. In turn, this also eliminates the ebtables-nft-specific variants of parse_target(), though with a slight change of behaviour: Names of user-defined chains are no longer allowed to contain up to 31 but merely 28 characters. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>