Skip to contentSkip to conversation

ebtables: Allow RETURN target rules in user defined chains

PATCH In review Alin Nastac 3 participants 5 messages Oct 22, 2015 – Oct 28, 2015 netfilter

lore
Share & tools
lore

Alin Nastac

author
#0 lore raw

PATCH 1/1 ebtables: Allow RETURN target rules in user defined chains

ebtables has a bug that prevents creation of rules with RETURN target, any attempt will result in an
RETURN not allowed on base chain
error even if the chain where you want to create the rule is a user defined chain.

Reproduction scenario:

   root@OpenWrt:~# ebtables -N foo
   root@OpenWrt:~# ebtables -A OUTPUT -j foo
   root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN
   --mark-target RETURN not allowed on base chain.

My email client will probably replace tabs in the patch below, but it is a one-liner patch after all, easy to spot the actual change.

libebtc.c +1 -1
@@ -1102,7 +1102,7 @@ void ebt_check_for_loops(struct ebt_u_replace *replace)
                        /* check if we've dealt with this chain already */
                        if (entries2->hook_mask & (1<<i))
                                goto letscontinue;
-                       entries2->hook_mask |= entries->hook_mask;
+                       entries2->hook_mask |= entries->hook_mask & ~(1 << NF_BR_NUMHOOKS);
                        /* Jump to the chain, make sure we know how to get back */
                        stack[sp].chain_nr = chain_nr;
                        stack[sp].n = j;
maintainer
#1 lore raw
Quoted 11 lines · Alin Nastac

ebtables has a bug that prevents creation of rules with RETURN target, any attempt will result in an
RETURN not allowed on base chain
error even if the chain where you want to create the rule is a user defined chain.

Reproduction scenario:

   root@OpenWrt:~# ebtables -N foo
   root@OpenWrt:~# ebtables -A OUTPUT -j foo
   root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN
   --mark-target RETURN not allowed on base chain.

My email client will probably replace tabs in the patch below, but

Yes, I applied this manually (with minor edits to commit message).

Thanks.

maintainer
#2 lore raw
Quoted 11 lines · Florian Westphal
Quoted 10 lines · Alin Nastac

ebtables has a bug that prevents creation of rules with RETURN target, any attempt will result in an
RETURN not allowed on base chain
error even if the chain where you want to create the rule is a user defined chain.

Reproduction scenario:

   root@OpenWrt:~# ebtables -N foo
   root@OpenWrt:~# ebtables -A OUTPUT -j foo
   root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN
   --mark-target RETURN not allowed on base chain.
Quoted 3 lines
Quoted 1 line

My email client will probably replace tabs in the patch below, but

Yes, I applied this manually (with minor edits to commit message).

Thanks, I wonder since then this has been broken BTW.

maintainer
#3 lore raw
Quoted 12 lines · Pablo Neira Ayuso
Quoted 11 lines · Florian Westphal
Quoted 10 lines · Alin Nastac

ebtables has a bug that prevents creation of rules with RETURN target, any attempt will result in an
RETURN not allowed on base chain
error even if the chain where you want to create the rule is a user defined chain.

Reproduction scenario:

   root@OpenWrt:~# ebtables -N foo
   root@OpenWrt:~# ebtables -A OUTPUT -j foo
   root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN
   --mark-target RETURN not allowed on base chain.
Quoted 5 lines
Quoted 3 lines
Quoted 1 line

My email client will probably replace tabs in the patch below, but

Yes, I applied this manually (with minor edits to commit message).

Thanks, I wonder since then this has been broken BTW.

s/then/when/

maintainer
#4 lore raw
Quoted 13 lines · Pablo Neira Ayuso
Quoted 12 lines · Pablo Neira Ayuso
Quoted 11 lines · Florian Westphal
Quoted 10 lines · Alin Nastac

ebtables has a bug that prevents creation of rules with RETURN target, any attempt will result in an
RETURN not allowed on base chain
error even if the chain where you want to create the rule is a user defined chain.

Reproduction scenario:

   root@OpenWrt:~# ebtables -N foo
   root@OpenWrt:~# ebtables -A OUTPUT -j foo
   root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN
   --mark-target RETURN not allowed on base chain.
Quoted 7 lines
Quoted 5 lines
Quoted 3 lines
Quoted 1 line

My email client will probably replace tabs in the patch below, but

Yes, I applied this manually (with minor edits to commit message).

Thanks, I wonder since then this has been broken BTW.

s/then/when/

Seems it never worked.

I hacked 'allow checking for --xxxx--target RETURN rules on base chains' commit from 2002 to build and it rejects RETURN unconditionally.