From b2197e7834f779e8b28b80bc58bb58179360f66b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 15 Nov 2023 13:55:08 +0100 Subject: xshared: Entirely ignore interface masks when saving rules Rule printing code does this for more than 20 years now, assume it's safe to rely upon the wildcard interface name to contain a '+' suffix. Signed-off-by: Phil Sutter --- iptables/ip6tables.c | 3 +-- iptables/iptables.c | 3 +-- iptables/nft-ipv4.c | 3 +-- iptables/nft-ipv6.c | 3 +-- iptables/xshared.c | 32 ++++++-------------------------- iptables/xshared.h | 6 ++---- 6 files changed, 12 insertions(+), 38 deletions(-) diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c index 08da04b4..21cd8018 100644 --- a/iptables/ip6tables.c +++ b/iptables/ip6tables.c @@ -509,8 +509,7 @@ void print_rule6(const struct ip6t_entry *e, save_ipv6_addr('d', &e->ipv6.dst, &e->ipv6.dmsk, e->ipv6.invflags & IP6T_INV_DSTIP); - save_rule_details(e->ipv6.iniface, e->ipv6.iniface_mask, - e->ipv6.outiface, e->ipv6.outiface_mask, + save_rule_details(e->ipv6.iniface, e->ipv6.outiface, e->ipv6.proto, 0, e->ipv6.invflags); #if 0 diff --git a/iptables/iptables.c b/iptables/iptables.c index a73e8eed..ce65c30a 100644 --- a/iptables/iptables.c +++ b/iptables/iptables.c @@ -516,8 +516,7 @@ void print_rule4(const struct ipt_entry *e, save_ipv4_addr('d', &e->ip.dst, &e->ip.dmsk, e->ip.invflags & IPT_INV_DSTIP); - save_rule_details(e->ip.iniface, e->ip.iniface_mask, - e->ip.outiface, e->ip.outiface_mask, + save_rule_details(e->ip.iniface, e->ip.outiface, e->ip.proto, e->ip.flags & IPT_F_FRAG, e->ip.invflags); diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 7fb71ed4..c140ffde 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -161,8 +161,7 @@ static void nft_ipv4_save_rule(const struct iptables_command_state *cs, save_ipv4_addr('d', &cs->fw.ip.dst, &cs->fw.ip.dmsk, cs->fw.ip.invflags & IPT_INV_DSTIP); - save_rule_details(cs->fw.ip.iniface, cs->fw.ip.iniface_mask, - cs->fw.ip.outiface, cs->fw.ip.outiface_mask, + save_rule_details(cs->fw.ip.iniface, cs->fw.ip.outiface, cs->fw.ip.proto, cs->fw.ip.flags & IPT_F_FRAG, cs->fw.ip.invflags); diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index bb417356..4bf4f54f 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -147,8 +147,7 @@ static void nft_ipv6_save_rule(const struct iptables_command_state *cs, save_ipv6_addr('d', &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk, cs->fw6.ipv6.invflags & IP6T_INV_DSTIP); - save_rule_details(cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask, - cs->fw6.ipv6.outiface, cs->fw6.ipv6.outiface_mask, + save_rule_details(cs->fw6.ipv6.iniface, cs->fw6.ipv6.outiface, cs->fw6.ipv6.proto, 0, cs->fw6.ipv6.invflags); save_matches_and_target(cs, cs->fw6.ipv6.flags & IP6T_F_GOTO, diff --git a/iptables/xshared.c b/iptables/xshared.c index ca174798..839a5bb6 100644 --- a/iptables/xshared.c +++ b/iptables/xshared.c @@ -757,29 +757,12 @@ void print_ifaces(const char *iniface, const char *outiface, uint8_t invflags, printf(FMT("%-6s ", "out %s "), iface); } -/* This assumes that mask is contiguous, and byte-bounded. */ -void save_iface(char letter, const char *iface, - const unsigned char *mask, int invert) +void save_iface(char letter, const char *iface, int invert) { - unsigned int i; - - if (mask[0] == 0) + if (!strlen(iface) || !strcmp(iface, "+")) return; - printf("%s -%c ", invert ? " !" : "", letter); - - for (i = 0; i < IFNAMSIZ; i++) { - if (mask[i] != 0) { - if (iface[i] != '\0') - printf("%c", iface[i]); - } else { - /* we can access iface[i-1] here, because - * a few lines above we make sure that mask[0] != 0 */ - if (iface[i-1] != '\0') - printf("+"); - break; - } - } + printf("%s -%c %s", invert ? " !" : "", letter, iface); } static void command_match(struct iptables_command_state *cs, bool invert) @@ -1066,17 +1049,14 @@ void print_rule_details(unsigned int linenum, const struct xt_counters *ctrs, printf(FMT("%-4s ", "%s "), pname); } -void save_rule_details(const char *iniface, unsigned const char *iniface_mask, - const char *outiface, unsigned const char *outiface_mask, +void save_rule_details(const char *iniface, const char *outiface, uint16_t proto, int frag, uint8_t invflags) { if (iniface != NULL) { - save_iface('i', iniface, iniface_mask, - invflags & IPT_INV_VIA_IN); + save_iface('i', iniface, invflags & IPT_INV_VIA_IN); } if (outiface != NULL) { - save_iface('o', outiface, outiface_mask, - invflags & IPT_INV_VIA_OUT); + save_iface('o', outiface, invflags & IPT_INV_VIA_OUT); } if (proto > 0) { diff --git a/iptables/xshared.h b/iptables/xshared.h index 28efd73c..952fa8ab 100644 --- a/iptables/xshared.h +++ b/iptables/xshared.h @@ -212,8 +212,7 @@ void save_ipv6_addr(char letter, const struct in6_addr *addr, void print_ifaces(const char *iniface, const char *outiface, uint8_t invflags, unsigned int format); -void save_iface(char letter, const char *iface, - const unsigned char *mask, int invert); +void save_iface(char letter, const char *iface, int invert); void print_fragment(unsigned int flags, unsigned int invflags, unsigned int format, bool fake); @@ -225,8 +224,7 @@ void assert_valid_chain_name(const char *chainname); void print_rule_details(unsigned int linenum, const struct xt_counters *ctrs, const char *targname, uint8_t proto, uint8_t flags, uint8_t invflags, unsigned int format); -void save_rule_details(const char *iniface, unsigned const char *iniface_mask, - const char *outiface, unsigned const char *outiface_mask, +void save_rule_details(const char *iniface, const char *outiface, uint16_t proto, int frag, uint8_t invflags); int print_match_save(const struct xt_entry_match *e, const void *ip); -- cgit v1.2.3