@@ -603,6 +603,17 @@ static void *load_extension(const char *search_path, const char *af_prefix,
}
#endif
+static bool extension_cmp(const char *name1, const char *name2,
+ uint32_t family)
+{
+ if ((strcmp(name1, name2) == 0) &&
+ ((family == afinfo->family) ||
+ (family == NFPROTO_UNSPEC)))
+ return true;
+
+ return false;
+}
+
struct xtables_match *
xtables_find_match(const char *name, enum xtables_tryload tryload,
struct xtables_rule_match **matches)
@@ -625,7 +636,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
/* Trigger delayed initialization */
for (dptr = &xtables_pending_matches; *dptr; ) {
- if (strcmp(name, (*dptr)->name) == 0) {
+ if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
ptr = *dptr;
*dptr = (*dptr)->next;
ptr->next = NULL;
@@ -636,7 +647,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
}
for (ptr = xtables_matches; ptr; ptr = ptr->next) {
- if (strcmp(name, ptr->name) == 0) {
+ if (extension_cmp(name, ptr->name, ptr->family)) {
struct xtables_match *clone;
/* First match of this type: */
@@ -686,7 +697,8 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
newentry = xtables_malloc(sizeof(struct xtables_rule_match));
for (i = matches; *i; i = &(*i)->next) {
- if (strcmp(name, (*i)->match->name) == 0)
+ if (extension_cmp(name, (*i)->match->name,
+ (*i)->match->family))
(*i)->completed = true;
}
newentry->match = ptr;
@@ -714,7 +726,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
/* Trigger delayed initialization */
for (dptr = &xtables_pending_targets; *dptr; ) {
- if (strcmp(name, (*dptr)->name) == 0) {
+ if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
ptr = *dptr;
*dptr = (*dptr)->next;
ptr->next = NULL;
@@ -725,7 +737,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
}
for (ptr = xtables_targets; ptr; ptr = ptr->next) {
- if (strcmp(name, ptr->name) == 0)
+ if (extension_cmp(name, ptr->name, ptr->family))
break;
}
When using libxtables with an external program (nft) which switches family contexts (using xtables_set_nfproto()), the extensions finding proccess needs to be smarter and also know about the family. We want to avoid this situation: 1) user first sets context to IPv6 2) xtables_find_target() finds & load ip6t_REJECT and uses it 3) context switch to IPv4 4) user then tries to use ipt_REJECT 5) xtables_find_target() will find ip6t_REJECT instead (same target name) 6) using ip6t_REJECT as ipt_REJECT can cause a lot of troubles Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> --- libxtables/xtables.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html