Skip to contentSkip to conversation

ebtables-compat: fix printing of extension

PATCH In review Arturo Borrero Gonzalez 2 participants 2 messages Dec 26, 2014 – Jan 5, 2015 netfilter

lore
Share & tools
lore

Arturo Borrero Gonzalez

author
#0 lore raw

PATCH 1/1 ebtables-compat: fix printing of extension

This patch fix printing of ebt extensions:

% sudo ebtables-compat -L
[...]
Bridge chain: FORWARD, entries: 1, policy: ACCEPT
--802_3-type 0x0012 -j ACCEPT
[...]

Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 iptables/nft-bridge.c |   23 +++++++----------------
 iptables/nft-bridge.h |    4 ++++
 iptables/nft-shared.c |   17 ++++++++++++++++-
 3 files changed, 27 insertions(+), 17 deletions(-)
iptables/nft-bridge.c +7 -16
index 807c4da..90bcd63 100644
@@ -370,6 +370,7 @@ static void nft_bridge_print_header(unsigned int format, const char *chain,
 static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num,
 				      unsigned int format)
 {
+	struct xtables_rule_match *matchp;
 	struct ebtables_command_state cs = {};
 	char *addr;
 

@@ -443,23 +444,13 @@ static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num,
 		print_iface(cs.fw.out);
 	}
 
-	/* old code to adapt
-	m_l = hlp->m_list;
-	while (m_l) {
-		m = ebt_find_match(m_l->m->u.name);
-		if (!m)
-			ebt_print_bug("Match not found");
-		m->print(hlp, m_l->m);
-		m_l = m_l->next;
+	for (matchp = cs.matches; matchp; matchp = matchp->next) {
+		if (matchp->match->print != NULL) {
+			matchp->match->print(&cs.fw, matchp->match->m,
+					     format & FMT_NUMERIC);
+		}
 	}
-	w_l = hlp->w_list;
-	while (w_l) {
-		w = ebt_find_watcher(w_l->w->u.name);
-		if (!w)
-			ebt_print_bug("Watcher not found");
-		w->print(hlp, w_l->w);
-		w_l = w_l->next;
-	}*/
+
 	printf("-j ");
 	if (!(format & FMT_NOTARGET))
 		printf("%s", cs.jumpto);
iptables/nft-bridge.h +4 -0
index fd8bc9f..fac172e 100644
@@ -15,6 +15,10 @@
 /* Be backwards compatible, so don't use '+' in kernel */
 #define IF_WILDCARD 1
 
+#ifndef ETH_ALEN
+#define ETH_ALEN 6
+#endif /* ETH_ALEN */
+
 extern unsigned char eb_mac_type_unicast[ETH_ALEN];
 extern unsigned char eb_msk_type_unicast[ETH_ALEN];
 extern unsigned char eb_mac_type_multicast[ETH_ALEN];
iptables/nft-shared.c +16 -1
index 71c4476..0ba9742 100644
@@ -26,6 +26,7 @@
 #include <libnftnl/expr.h>
 
 #include "nft-shared.h"
+#include "nft-bridge.h"
 #include "xshared.h"
 #include "nft.h"
 

@@ -326,9 +327,23 @@ void nft_parse_match(struct nft_xt_ctx *ctx, struct nft_rule_expr *e)
 	const char *mt_name = nft_rule_expr_get_str(e, NFT_EXPR_MT_NAME);
 	const void *mt_info = nft_rule_expr_get(e, NFT_EXPR_MT_INFO, &mt_len);
 	struct xtables_match *match;
+	struct xtables_rule_match **matches;
 	struct xt_entry_match *m;
 
-	match = xtables_find_match(mt_name, XTF_TRY_LOAD, &ctx->state.cs->matches);
+	switch (ctx->family) {
+	case NFPROTO_IPV4:
+	case NFPROTO_IPV6:
+		matches = &ctx->state.cs->matches;
+		break;
+	case NFPROTO_BRIDGE:
+		matches = &ctx->state.cs_eb->matches;
+		break;
+	default:
+		fprintf(stderr, "BUG: nft_parse_match() unhandled family\n");
+		break;
+	}
+
+	match = xtables_find_match(mt_name, XTF_TRY_LOAD, matches);
 	if (match == NULL)
 		return;
maintainer
#1 lore raw
Quoted 7 lines · Arturo Borrero Gonzalez

This patch fix printing of ebt extensions:

% sudo ebtables-compat -L
[...]
Bridge chain: FORWARD, entries: 1, policy: ACCEPT
--802_3-type 0x0012 -j ACCEPT
[...]

Applied with minor glitches, thanks Arturo.

Quoted 12 lines
Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 iptables/nft-bridge.c |   23 +++++++----------------
 iptables/nft-bridge.h |    4 ++++
 iptables/nft-shared.c |   17 ++++++++++++++++-
 3 files changed, 27 insertions(+), 17 deletions(-)
iptables/nft-bridge.h +0 -0
index fd8bc9f..fac172e 100644

iptables/nft-bridge.h line 20

Quoted 6 lines
iptables/nft-bridge.h +3 -0
@@ -15,6 +15,10 @@
 /* Be backwards compatible, so don't use '+' in kernel */
 #define IF_WILDCARD 1
 
+#ifndef ETH_ALEN
+#define ETH_ALEN 6
+#endif /* ETH_ALEN */

use header definitions whenever possible.

Quoted 23 lines
iptables/nft-bridge.h +0 -0
 extern unsigned char eb_mac_type_unicast[ETH_ALEN];
 extern unsigned char eb_msk_type_unicast[ETH_ALEN];
 extern unsigned char eb_mac_type_multicast[ETH_ALEN];
iptables/nft-shared.c +2 -1
index 71c4476..0ba9742 100644
@@ -26,6 +26,7 @@
 #include <libnftnl/expr.h>
 
 #include "nft-shared.h"
+#include "nft-bridge.h"
 #include "xshared.h"
 #include "nft.h"
 

@@ -326,9 +327,23 @@ void nft_parse_match(struct nft_xt_ctx *ctx, struct nft_rule_expr *e)
 	const char *mt_name = nft_rule_expr_get_str(e, NFT_EXPR_MT_NAME);
 	const void *mt_info = nft_rule_expr_get(e, NFT_EXPR_MT_INFO, &mt_len);
 	struct xtables_match *match;
+	struct xtables_rule_match **matches;
 	struct xt_entry_match *m;
 
-	match = xtables_find_match(mt_name, XTF_TRY_LOAD, &ctx->state.cs->matches);

iptables/nft-shared.c void nft_parse_match(struct nft_xt_ctx *ctx, struct nft_rule_expr *e) · line 342

Quoted 10 lines
iptables/nft-shared.c +10 -0
+	switch (ctx->family) {
+	case NFPROTO_IPV4:
+	case NFPROTO_IPV6:
+		matches = &ctx->state.cs->matches;
+		break;
+	case NFPROTO_BRIDGE:
+		matches = &ctx->state.cs_eb->matches;
+		break;
+	default:
+		fprintf(stderr, "BUG: nft_parse_match() unhandled family\n");

exitted here in case of bug. BTW, a BUG() macro similar to nft would be good to have, I guess we can replace several spots with it.