extensions: add ebt 802_3 extension
RFC PATCH v2 1/1 extensions: add ebt 802_3 extension
This patch adds the first ebtables extension to ebtables-compat. The original 802_3 code is adapted to the xtables environment.
I tried to mimic as much as possible the original ebtables code paths.
With this patch, ebtables-compat is able to send the 802_3 match to the kernel, but the kernel-to-userspace path is not tested and should be adjusted in follow-up patches.
Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
v2: address comments by Pablo.
extensions/GNUmakefile.in | 12 +- extensions/libebt_802_3.c | 160 +++++++++++++++++++++++++++++ iptables/Makefile.am | 4 - iptables/nft-bridge.c | 6 + iptables/nft-bridge.h | 6 + iptables/xtables-eb-standalone.c | 32 +----- iptables/xtables-eb.c | 208 +++++++++++++++++++++++++++----------- libxtables/xtables.c | 13 ++ 8 files changed, 350 insertions(+), 91 deletions(-) create mode 100644 extensions/libebt_802_3.c
extensions/GNUmakefile.in +6 -6
@@ -60,10 +60,10 @@ pf6_solibs := $(patsubst %,libip6t_%.so,${pf6_build_mod}) # # Building blocks # -targets := libext.a libext4.a libext6.a matches.man targets.man +targets := libext.a libext4.a libext6.a libext_ebt.a matches.man targets.man targets_install := @ENABLE_STATIC_TRUE@ libext_objs := ${pfx_objs} -@ENABLE_STATIC_TRUE@ libextb_objs := ${pfb_objs} +@ENABLE_STATIC_TRUE@ libext_ebt_objs := ${pfb_objs} @ENABLE_STATIC_TRUE@ libext4_objs := ${pf4_objs} @ENABLE_STATIC_TRUE@ libext6_objs := ${pf6_objs} @ENABLE_STATIC_FALSE@ targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs}
@@ -80,7 +80,7 @@ install: ${targets_install} if test -n "${targets_install}"; then install -pm0755 $^ "${DESTDIR}${xtlibdir}/"; fi; clean: - rm -f *.o *.oo *.so *.a {matches,targets}.man initext.c initext4.c initext6.c; + rm -f *.o *.oo *.so *.a {matches,targets}.man initext.c initext4.c initext6.c initextb.c; rm -f .*.d .*.dd; distclean: clean
@@ -123,7 +123,7 @@ lib%.o: ${srcdir}/lib%.c libext.a: initext.o ${libext_objs} ${AM_VERBOSE_AR} ${AR} crs $@ $^; -libextb.a: initextb.o ${libextb_objs} +libext_ebt.a: initextb.o ${libext_ebt_objs} ${AM_VERBOSE_AR} ${AR} crs $@ $^; libext4.a: initext4.o ${libext4_objs}
@@ -180,8 +180,8 @@ initextb.c: .initextb.dd for i in ${initextb_func}; do \ echo "extern void lib$${i}_init(void);" >>$@; \ done; \ - echo "void init_extensions(void);" >>$@; \ - echo "void init_extensions(void)" >>$@; \ + echo "void init_extensionsb(void);" >>$@; \ + echo "void init_extensionsb(void)" >>$@; \ echo "{" >>$@; \ for i in ${initextb_func}; do \ echo " ""lib$${i}_init();" >>$@; \
extensions/libebt_802_3.c new file +160 -0
160 lines not on this page · raw message
iptables/Makefile.am +2 -2
@@ -29,7 +29,7 @@ xtables_multi_LDADD += ../libxtables/libxtables.la -lm if ENABLE_NFTABLES xtables_compat_multi_SOURCES = xtables-compat-multi.c iptables-xml.c xtables_compat_multi_CFLAGS = ${AM_CFLAGS} -xtables_compat_multi_LDADD = ../extensions/libext.a +xtables_compat_multi_LDADD = ../extensions/libext.a ../extensions/libext_ebt.a if ENABLE_STATIC xtables_compat_multi_CFLAGS += -DALL_INCLUSIVE endif
@@ -42,7 +42,7 @@ xtables_compat_multi_SOURCES += xtables-save.c xtables-restore.c \ xtables-arp-standalone.c xtables-arp.c \ getethertype.c nft-bridge.c \ xtables-eb-standalone.c xtables-eb.c -xtables_compat_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ../extensions/libext4.a ../extensions/libext6.a +xtables_compat_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ../extensions/libext4.a ../extensions/libext6.a ../extensions/libext_ebt.a # yacc and lex generate dirty code xtables_compat_multi-xtables-config-parser.o xtables_compat_multi-xtables-config-syntax.o: AM_CFLAGS += -Wno-missing-prototypes -Wno-missing-declarations -Wno-implicit-function-declaration -Wno-nested-externs -Wno-undef -Wno-redundant-decls xtables_compat_multi_SOURCES += xshared.c
iptables/nft-bridge.c +6 -0
@@ -135,6 +135,7 @@ static int _add_action(struct nft_rule *r, struct ebtables_command_state *cs)static int nft_bridge_add (struct nft_rule *r,void *data) {struct ebtables_command_state *cs = data; +struct xtables_rule_match *matchp;struct ebt_entry *fw = &cs->fw;uint32_t op;char *addr;
@@ -179,6 +180,11 @@ static int nft_bridge_add(struct nft_rule *r, void *data)add_cmp_u16 (r, fw->ethproto, op); } +for (matchp = cs->matches; matchp; matchp = matchp->next) { +if (add_match (r, matchp->match->m) <0 ) +break ; + } +return _add_action (r, cs); }
iptables/nft-bridge.h +6 -0
@@ -90,6 +90,12 @@ struct ebtables_command_state {struct xtables_rule_match *matches;const char *jumpto;struct xt_counters counters; +int invert; +int c; +char **argv; +int proto_used; +char *protocol; +unsigned int options; }; void nft_rule_to_ebtables_command_state(struct nft_rule *r,
iptables/xtables-eb-standalone.c +8 -24
@@ -36,22 +36,12 @@#include <errno.h> #include <string.h> #include <xtables.h> +#include <iptables.h> #include "nft.h" #include "xtables-multi.h" -extern struct xtables_globals xtables_globals; -extern const char *program_version, *program_name; - -static const struct xtables_afinfo afinfo_bridge = { - .kmod ="eb_tables" , - .proc_exists ="/proc/net/eb_tables_names" , - .libprefix ="libeb_" , - .family =NFPROTO_BRIDGE , - .ipproto =IPPROTO_IP , - .so_rev_match =-1 , - .so_rev_target =-1 , -}; +extern struct xtables_globals ebtables_globals;int xtables_eb_main (int argc,char *argv[]) {
@@ -61,24 +51,18 @@ int xtables_eb_main(int argc, char *argv[]) .family = NFPROTO_BRIDGE, }; - xtables_globals.program_name ="ebtables" ; -/* This code below could be replaced by xtables_init_all, which -* doesn't support NFPROTO_BRIDGE yet. -*/ -xtables_init (); - afinfo = &afinfo_bridge; - ret =xtables_set_params (&xtables_globals); + ebtables_globals.program_name ="ebtables" ; + ret =xtables_init_all (&ebtables_globals,NFPROTO_BRIDGE );if (ret <0 ) { -fprintf (stderr,"%s/%s Failed to initialize xtables\n" , - xtables_globals.program_name, - xtables_globals.program_version); +fprintf (stderr,"%s/%s Failed to initialize ebtables-compat\n" , + ebtables_globals.program_name, + ebtables_globals.program_version);exit (1 ); }#if defined(ALL_INCLUSIVE ) || defined(NO_SHARED_LIBS ) -init_extensions (); +init_extensionsb ();#endif - ret =do_commandeb (&h, argc, argv, &table);if (ret) ret =nft_commit (&h);
iptables/xtables-eb.c +149 -59
287 lines not on this page · raw message
libxtables/xtables.c +13 -0
@@ -168,6 +168,16 @@ static const struct xtables_afinfo afinfo_ipv6 = { .so_rev_target = IP6T_SO_GET_REVISION_TARGET, }; +static const struct xtables_afinfo afinfo_bridge = { + .kmod ="eb_tables" , + .proc_exists ="/proc/net/eb_tables_names" , + .libprefix ="libebt_" , + .family =NFPROTO_BRIDGE , + .ipproto =IPPROTO_IP , + .so_rev_match =-1 , + .so_rev_target =-1 , +}; +const struct xtables_afinfo *afinfo;/* Search path for Xtables .so files */
@@ -224,6 +234,9 @@ void xtables_set_nfproto(uint8_t nfproto)case NFPROTO_IPV6 : afinfo = &afinfo_ipv6;break ; +case NFPROTO_BRIDGE : + afinfo = &afinfo_bridge; +break ;default :fprintf (stderr,"libxtables: unhandled NFPROTO in %s\n" , __func__);
Quoted 8 lines · Arturo Borrero Gonzalez
This patch adds the first ebtables extension to ebtables-compat. The original 802_3 code is adapted to the xtables environment.
I tried to mimic as much as possible the original ebtables code paths.
With this patch, ebtables-compat is able to send the 802_3 match to the kernel, but the kernel-to-userspace path is not tested and should be adjusted in follow-up patches.
Applied this to the ebtables-compat-experimental branch, just to make it easier for you in case you have the chance to give this another spin.
I'm aware the kernel bits for nft_compat are still missing (it would bre great to get those scheduled for 3.20).
Thanks.