From dd43527cb6bdf3d469100850ca10dcd2fb761304 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Sun, 7 Oct 2012 14:32:36 +0000 Subject: iptables: restore NOTRACK functionality, target aliasing Commit v1.4.16-1-g2aaa7ec is testing for real_name (not) being NULL which was always false (true). real_name was never NULL, so cs->jumpto would always be used, which rendered -j NOTRACK unusable, since the chosen real name.revision is for example NOTRACK.1, which does not exist at the kernel side. # ./iptables/xtables-multi main4 -t raw -A foo -j NOTRACK dbg: Using NOTRACK.1 WARNING: The NOTRACK target is obsolete. Use CT instead. iptables: Protocol wrong type for socket. To reasonably support the extra-special verdict names, make it so that real_name remains NULL when an extension defined no alias, which we can then use to determine whether the user entered an alias name (which needs to be followed) or not. [ I have mangled this patch to remove a comment unnecessarily large. BTW, this patch gets this very close to the initial target aliasing proposal --pablo ] Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- iptables/ip6tables.c | 17 ++++++++++------- iptables/iptables.c | 19 +++++++++++-------- libxtables/xtables.c | 26 ++++++++++++++------------ 3 files changed, 35 insertions(+), 27 deletions(-) diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c index faddb71b..0e11a9e1 100644 --- a/iptables/ip6tables.c +++ b/iptables/ip6tables.c @@ -1286,15 +1286,15 @@ static void command_jump(struct iptables_command_state *cs) cs->target->t = xtables_calloc(1, size); cs->target->t->u.target_size = size; - if (cs->target->real_name != NULL) + if (cs->target->real_name == NULL) { strcpy(cs->target->t->u.user.name, cs->jumpto); - else + } else { strcpy(cs->target->t->u.user.name, cs->target->real_name); - cs->target->t->u.user.revision = cs->target->revision; - if (cs->target->real_name != cs->target->name) fprintf(stderr, "WARNING: The %s target is obsolete. " "Use %s instead.\n", cs->jumpto, cs->target->real_name); + } + cs->target->t->u.user.revision = cs->target->revision; xs_init_target(cs->target); if (cs->target->x6_options != NULL) @@ -1322,11 +1322,14 @@ static void command_match(struct iptables_command_state *cs) size = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size; m->m = xtables_calloc(1, size); m->m->u.match_size = size; - strcpy(m->m->u.user.name, m->real_name); - m->m->u.user.revision = m->revision; - if (m->real_name != m->name) + if (m->real_name == NULL) { + strcpy(m->m->u.user.name, m->name); + } else { + strcpy(m->m->u.user.name, m->real_name); fprintf(stderr, "WARNING: The %s match is obsolete. " "Use %s instead.\n", m->name, m->real_name); + } + m->m->u.user.revision = m->revision; xs_init_match(m); if (m == m->next) diff --git a/iptables/iptables.c b/iptables/iptables.c index 96cea64d..f765cf98 100644 --- a/iptables/iptables.c +++ b/iptables/iptables.c @@ -1295,16 +1295,16 @@ static void command_jump(struct iptables_command_state *cs) cs->target->t = xtables_calloc(1, size); cs->target->t->u.target_size = size; - if (cs->target->real_name != NULL) + if (cs->target->real_name == NULL) { strcpy(cs->target->t->u.user.name, cs->jumpto); - else - strcpy(cs->target->t->u.user.name, cs->target->real_name); - cs->target->t->u.user.revision = cs->target->revision; - if (cs->target->real_name != cs->target->name) + } else { /* Alias support for userspace side */ + strcpy(cs->target->t->u.user.name, cs->target->real_name); fprintf(stderr, "WARNING: The %s target is obsolete. " "Use %s instead.\n", cs->jumpto, cs->target->real_name); + } + cs->target->t->u.user.revision = cs->target->revision; xs_init_target(cs->target); @@ -1333,11 +1333,14 @@ static void command_match(struct iptables_command_state *cs) size = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size; m->m = xtables_calloc(1, size); m->m->u.match_size = size; - strcpy(m->m->u.user.name, m->real_name); - m->m->u.user.revision = m->revision; - if (m->real_name != m->name) + if (m->real_name == NULL) { + strcpy(m->m->u.user.name, m->name); + } else { + strcpy(m->m->u.user.name, m->real_name); fprintf(stderr, "WARNING: The %s match is obsolete. " "Use %s instead.\n", m->name, m->real_name); + } + m->m->u.user.revision = m->revision; xs_init_match(m); if (m == m->next) diff --git a/libxtables/xtables.c b/libxtables/xtables.c index 82c3643b..4c912860 100644 --- a/libxtables/xtables.c +++ b/libxtables/xtables.c @@ -848,8 +848,6 @@ void xtables_register_match(struct xtables_match *me) exit(1); } - if (me->real_name == NULL) - me->real_name = me->name; if (me->x6_options != NULL) xtables_option_metavalidate(me->name, me->x6_options); if (me->extra_opts != NULL) @@ -905,9 +903,9 @@ xtables_mt_prefer(bool a_alias, unsigned int a_rev, unsigned int a_fam, static int xtables_match_prefer(const struct xtables_match *a, const struct xtables_match *b) { - return xtables_mt_prefer(a->name != a->real_name, + return xtables_mt_prefer(a->real_name != NULL, a->revision, a->family, - b->name != b->real_name, + b->real_name != NULL, b->revision, b->family); } @@ -919,15 +917,16 @@ static int xtables_target_prefer(const struct xtables_target *a, * xtables_register_*; the direct pointer comparison here is therefore * legitimate to detect an alias. */ - return xtables_mt_prefer(a->name != a->real_name, + return xtables_mt_prefer(a->real_name != NULL, a->revision, a->family, - b->name != b->real_name, + b->real_name != NULL, b->revision, b->family); } static void xtables_fully_register_pending_match(struct xtables_match *me) { struct xtables_match **i, *old; + const char *rn; int compare; old = xtables_find_match(me->name, XTF_DURING_LOAD, NULL); @@ -941,12 +940,14 @@ static void xtables_fully_register_pending_match(struct xtables_match *me) } /* Now we have two (or more) options, check compatibility. */ + rn = (old->real_name != NULL) ? old->real_name : old->name; if (compare > 0 && - compatible_match_revision(old->real_name, old->revision)) + compatible_match_revision(rn, old->revision)) return; /* See if new match can be used. */ - if (!compatible_match_revision(me->real_name, me->revision)) + rn = (me->real_name != NULL) ? me->real_name : me->name; + if (!compatible_match_revision(rn, me->revision)) return; /* Delete old one. */ @@ -1005,8 +1006,6 @@ void xtables_register_target(struct xtables_target *me) exit(1); } - if (me->real_name == NULL) - me->real_name = me->name; if (me->x6_options != NULL) xtables_option_metavalidate(me->name, me->x6_options); if (me->extra_opts != NULL) @@ -1024,6 +1023,7 @@ void xtables_register_target(struct xtables_target *me) static void xtables_fully_register_pending_target(struct xtables_target *me) { struct xtables_target *old; + const char *rn; int compare; old = xtables_find_target(me->name, XTF_DURING_LOAD); @@ -1039,12 +1039,14 @@ static void xtables_fully_register_pending_target(struct xtables_target *me) } /* Now we have two (or more) options, check compatibility. */ + rn = (old->real_name != NULL) ? old->real_name : old->name; if (compare > 0 && - compatible_target_revision(old->real_name, old->revision)) + compatible_target_revision(rn, old->revision)) return; /* See if new target can be used. */ - if (!compatible_target_revision(me->real_name, me->revision)) + rn = (me->real_name != NULL) ? me->real_name : me->name; + if (!compatible_target_revision(rn, me->revision)) return; /* Delete old one. */ -- cgit v1.2.3