iptables: xtables-eb: user-defined chains default policy is always RETURN

The RETURN default policy is mandatory in user-defined chains. Builtin chains must have one of ACCEPT or DROP.

So, with this patch, ebtables-compat ends with:

Command: Result:

(quoted diff) +0 -8

-L				Always RETURN for user-defined chains
-P builtin RETURN		Policy RETURN only allowed for user defined chains
-P builtin ACCEPT|DROP		ok
-P userdefined RETURN		Default policy in user-defined chains is mandatory RETURN
-P userdefined ACCEPT|DROP	Default policy in user-defined chains is mandatory RETURN
-N userdefined			ok
-N userdefined -P RETURN	Default policy in user-defined chains is mandatory RETURN
-N userdefined -P ACCEPT|DROP	Default policy in user-defined chains is mandatory RETURN

Signed-off-by Arturo Borrero Gonzalez <[email protected]>

---
v2: change some error messages, as requested by Pablo.

 iptables/nft-bridge.c |    3 ++-
 iptables/xtables-eb.c |    9 ++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

iptables/nft-bridge.c +2 -1

index b5aec00..a1bd906 100644
@@ -356,7 +356,8 @@ static void nft_bridge_print_header(unsigned int format, const char *chain,
 				    const struct xt_counters *counters,
 				    bool basechain, uint32_t refs)
 {
-	printf("Bridge chain: %s, entries: %u, policy: %s\n", chain, refs, pol);
+	printf("Bridge chain: %s, entries: %u, policy: %s\n",
+	       chain, refs, basechain ? pol : "RETURN");
 }
 
 static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num,

iptables/xtables-eb.c +1 -0

index 917bca2..e462dbf 100644
@@ -616,6 +616,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table)
 		case 'E': /* Rename chain */
 		case 'X': /* Delete chain */
 			/* We allow -N chainname -P policy */
+			/* XXX: Not in ebtables-compat */
 			if (command == 'N' && c == 'P') {
 				command = c;
 				optind--; /* No table specified */

Quoted 51 lines · Arturo Borrero Gonzalez

The RETURN default policy is mandatory in user-defined chains. Builtin chains must have one of ACCEPT or DROP.

So, with this patch, ebtables-compat ends with:

Command: Result:

(quoted diff) +0 -8

-L                            Always RETURN for user-defined chains
-P builtin RETURN             Policy RETURN only allowed for user defined chains
-P builtin ACCEPT|DROP                ok
-P userdefined RETURN         Default policy in user-defined chains is mandatory RETURN
-P userdefined ACCEPT|DROP    Default policy in user-defined chains is mandatory RETURN
-N userdefined                        ok
-N userdefined -P RETURN      Default policy in user-defined chains is mandatory RETURN
-N userdefined -P ACCEPT|DROP Default policy in user-defined chains is mandatory RETURN

Signed-off-by Arturo Borrero Gonzalez <[email protected]>

---
v2: change some error messages, as requested by Pablo.

 iptables/nft-bridge.c |    3 ++-
 iptables/xtables-eb.c |    9 ++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

iptables/nft-bridge.c +2 -1

index b5aec00..a1bd906 100644
@@ -356,7 +356,8 @@ static void nft_bridge_print_header(unsigned int format, const char *chain,
                                  const struct xt_counters *counters,
                                  bool basechain, uint32_t refs)
 {
-     printf("Bridge chain: %s, entries: %u, policy: %s\n", chain, refs, pol);
+     printf("Bridge chain: %s, entries: %u, policy: %s\n",
+            chain, refs, basechain ? pol : "RETURN");
 }
 
 static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num,

iptables/xtables-eb.c +1 -0

index 917bca2..e462dbf 100644
@@ -616,6 +616,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table)
              case 'E': /* Rename chain */
              case 'X': /* Delete chain */
                      /* We allow -N chainname -P policy */
+                     /* XXX: Not in ebtables-compat */
                      if (command == 'N' && c == 'P') {
                              command = c;
                              optind--; /* No table specified */

iptables/xtables-eb.c check_extension: */ · line 1153

Quoted 8 lines

iptables/xtables-eb.c +4 -1

@@ -1146,9 +1147,15 @@ check_extension: */
      cs.fw.ethproto = htons(cs.fw.ethproto);
 
      if (command == 'P') {
-             if (selected_chain < NF_BR_NUMHOOKS && strcmp(policy, "RETURN")==0)
+             if (selected_chain < 0) {
+                     xtables_error(PARAMETER_PROBLEM,
+                                   "Default policy in user-defined"
+                                   " chains is mandatory RETURN");

The intended error should something like:

... , "Policy %s only allowed from base chains", policy);

right? I can mangle the patch here. Thanks.

Quoted 22 lines · Pablo Neira Ayuso

Quoted 11 lines

iptables/xtables-eb.c +1 -0

@@ -616,6 +616,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table)
              case 'E': /* Rename chain */
              case 'X': /* Delete chain */
                      /* We allow -N chainname -P policy */
+                     /* XXX: Not in ebtables-compat */
                      if (command == 'N' && c == 'P') {
                              command = c;
                              optind--; /* No table specified */

iptables/xtables-eb.c check_extension: */ · line 1153

Quoted 8 lines

iptables/xtables-eb.c +4 -1

@@ -1146,9 +1147,15 @@ check_extension: */
      cs.fw.ethproto = htons(cs.fw.ethproto);
 
      if (command == 'P') {
-             if (selected_chain < NF_BR_NUMHOOKS && strcmp(policy, "RETURN")==0)
+             if (selected_chain < 0) {
+                     xtables_error(PARAMETER_PROBLEM,
+                                   "Default policy in user-defined"
+                                   " chains is mandatory RETURN");

The intended error should something like:

Quoted 3 lines

... , "Policy %s only allowed from base chains", policy);

right? I can mangle the patch here. Thanks.

Ok, thanks.