From fd95f1f0223f8e2ecf91aa8d1a4ba84576861082 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 2 Nov 2018 14:36:54 +0100 Subject: ebtables: fix -j CONTINUE handling for add/delete -j CONTINUE can be added, but it can't be removed: extensions/libebt_standard.t: ERROR: line 5 (cannot find: ebtables -I INPUT -d de:ad:be:ef:00:00 -j CONTINUE) This problem stems from silly ambiguity in ebtables-nft vs. iptables. In iptables, you can do iptables -A INPUT (no -j) in ebtables, you can do either ebtables -A INPUT or ebtables -A INPUT -j CONTINUE both are *supposed* to be the same (and they do the same even in ebtables-nft on netlink side). However, the temprary binary representation within ebtables-nft is not the same: when parsing -j CONTINUE, we add a standard target, then omit it later in _add_target(). When translating netlink representation to ebt binary one, we do not add a standard target and instead just print '-j CONTINUE' when listing rules. So when doing -I INPUT -j CONTINUE -D INPUT -j CONTINUE the -D operation fails because it has a standard target in the binary representation, whereas the rule we obtained from translating nftables netlink back to ebtables' binary represenation doesn't. Fix it by ignoring 'CONTINUE' on parser side. Signed-off-by: Florian Westphal --- extensions/libebt_standard.t | 1 + 1 file changed, 1 insertion(+) (limited to 'extensions') diff --git a/extensions/libebt_standard.t b/extensions/libebt_standard.t index 59ca337a..04991e1f 100644 --- a/extensions/libebt_standard.t +++ b/extensions/libebt_standard.t @@ -2,5 +2,6 @@ -s 0:0:0:0:0:0;=;OK -d 00:00:0:00:00:00;-d 0:0:0:0:0:0;OK -s de:ad:be:ef:0:00 -j RETURN;-s de:ad:be:ef:0:0 -j RETURN;OK +-d de:ad:be:ef:00:00 -j CONTINUE;=;OK -d de:ad:be:ef:0:0;=;OK -d de:ad:be:ef:00:00/ff:ff:ff:ff:00:00 -j DROP;-d de:ad:be:ef:0:0/ff:ff:ff:ff:0:0 -j DROP;OK -- cgit v1.2.3