diff mbox series

[xtables,03/10] xtables-compat: pass correct table skeleton

Message ID 20180509185926.3333-4-fw@strlen.de
State Accepted
Delegated to: Pablo Neira
Headers show
Series xtables: ebtables fixes | expand

Commit Message

Florian Westphal May 9, 2018, 6:59 p.m. UTC 
This always uses xtables_ipv4 (which is same as _ipv6).
Pass the correct skeleton instead, this is needed to handle ebtables
correctly from xt-translate, as it doesn't use ip/ip6 tables.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 iptables/xtables-restore.c   | 41 +++++++++++++++++++++++++++++------------
 iptables/xtables-save.c      | 41 ++++++++++++++++++++++++++++++-----------
 iptables/xtables-translate.c | 18 +++++++++++++++++-
 3 files changed, 76 insertions(+), 24 deletions(-)
diff mbox series

Patch

diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
index ac753c43bc91..2ba0565da40d 100644
--- a/iptables/xtables-restore.c
+++ b/iptables/xtables-restore.c
@@ -455,6 +455,7 @@  void xtables_restore_parse(struct nft_handle *h,
 static int
 xtables_restore_main(int family, const char *progname, int argc, char *argv[])
 {
+	struct builtin_table *tables;
 	struct nft_handle h = {
 		.family = family,
 		.restore = true,
@@ -472,18 +473,6 @@  xtables_restore_main(int family, const char *progname, int argc, char *argv[])
 				xtables_globals.program_version);
 		exit(1);
 	}
-#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-	init_extensions();
-	init_extensions4();
-#endif
-
-	if (nft_init(&h, xtables_ipv4) < 0) {
-		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
-				xtables_globals.program_name,
-				xtables_globals.program_version,
-				strerror(errno));
-		exit(EXIT_FAILURE);
-	}
 
 	while ((c = getopt_long(argc, argv, "bcvVthnM:T:46wW", options, NULL)) != -1) {
 		switch (c) {
@@ -546,6 +535,34 @@  xtables_restore_main(int family, const char *progname, int argc, char *argv[])
 		p.in = stdin;
 	}
 
+	switch (family) {
+	case NFPROTO_IPV4:
+	case NFPROTO_IPV6: /* fallthough, same table */
+		tables = xtables_ipv4;
+#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
+		init_extensions();
+		init_extensions4();
+#endif
+		break;
+	case NFPROTO_ARP:
+		tables = xtables_arp;
+		break;
+	case NFPROTO_BRIDGE:
+		tables = xtables_bridge;
+		break;
+	default:
+		fprintf(stderr, "Unknown family %d\n", family);
+		return 1;
+	}
+
+	if (nft_init(&h, tables) < 0) {
+		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
+				xtables_globals.program_name,
+				xtables_globals.program_version,
+				strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+
 	xtables_restore_parse(&h, &p, &restore_cb, argc, argv);
 
 	nft_fini(&h);
diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c
index e5401daf7f54..1f643593debf 100644
--- a/iptables/xtables-save.c
+++ b/iptables/xtables-save.c
@@ -83,6 +83,7 @@  do_output(struct nft_handle *h, const char *tablename, bool counters)
 static int
 xtables_save_main(int family, const char *progname, int argc, char *argv[])
 {
+	struct builtin_table *tables;
 	const char *tablename = NULL;
 	bool dump = false;
 	struct nft_handle h = {
@@ -99,17 +100,6 @@  xtables_save_main(int family, const char *progname, int argc, char *argv[])
 				xtables_globals.program_version);
 		exit(1);
 	}
-#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-	init_extensions();
-	init_extensions4();
-#endif
-	if (nft_init(&h, xtables_ipv4) < 0) {
-		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
-				xtables_globals.program_name,
-				xtables_globals.program_version,
-				strerror(errno));
-		exit(EXIT_FAILURE);
-	}
 
 	while ((c = getopt_long(argc, argv, "bcdt:M:f:46", options, NULL)) != -1) {
 		switch (c) {
@@ -164,6 +154,35 @@  xtables_save_main(int family, const char *progname, int argc, char *argv[])
 		exit(1);
 	}
 
+	switch (family) {
+	case NFPROTO_IPV4:
+	case NFPROTO_IPV6: /* fallthough, same table */
+#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
+		init_extensions();
+		init_extensions4();
+#endif
+		tables = xtables_ipv4;
+		break;
+	case NFPROTO_ARP:
+		tables = xtables_arp;
+		break;
+	case NFPROTO_BRIDGE:
+		tables = xtables_bridge;
+		break;
+	default:
+		fprintf(stderr, "Unknown family %d\n", family);
+		return 1;
+	}
+
+	if (nft_init(&h, tables) < 0) {
+		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
+				xtables_globals.program_name,
+				xtables_globals.program_version,
+				strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+
+
 	ret = nft_is_ruleset_compatible(&h);
 	if (ret) {
 		printf("ERROR: You're using nft features that cannot be mapped to iptables, please keep using nft.\n");
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
index 78cc60e83def..b08ac354dd73 100644
--- a/iptables/xtables-translate.c
+++ b/iptables/xtables-translate.c
@@ -424,6 +424,7 @@  static int xtables_xlate_main_common(struct nft_handle *h,
 				     int family,
 				     const char *progname)
 {
+	struct builtin_table *tables;
 	int ret;
 
 	xtables_globals.program_name = progname;
@@ -435,12 +436,27 @@  static int xtables_xlate_main_common(struct nft_handle *h,
 			xtables_globals.program_version);
 		return 1;
 	}
+	switch (family) {
+	case NFPROTO_IPV4:
+	case NFPROTO_IPV6: /* fallthrough: same table */
 #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
 	init_extensions();
 	init_extensions4();
 #endif
+		tables = xtables_ipv4;
+		break;
+	case NFPROTO_ARP:
+		tables = xtables_arp;
+		break;
+	case NFPROTO_BRIDGE:
+		tables = xtables_bridge;
+		break;
+	default:
+		fprintf(stderr, "Unknown family %d\n", family);
+		return 1;
+	}
 
-	if (nft_init(h, xtables_ipv4) < 0) {
+	if (nft_init(h, tables) < 0) {
 		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
 				xtables_globals.program_name,
 				xtables_globals.program_version,