From patchwork Mon Nov 17 12:36:23 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arturo Borrero X-Patchwork-Id: 411673 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 4BBB514012F for ; Mon, 17 Nov 2014 23:36:35 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751862AbaKQMge (ORCPT ); Mon, 17 Nov 2014 07:36:34 -0500 Received: from smtp3.cica.es ([150.214.5.190]:57799 "EHLO smtp.cica.es" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751813AbaKQMge (ORCPT ); Mon, 17 Nov 2014 07:36:34 -0500 Received: from localhost (unknown [127.0.0.1]) by smtp.cica.es (Postfix) with ESMTP id 599B651F1F7; Mon, 17 Nov 2014 12:36:31 +0000 (UTC) X-Virus-Scanned: amavisd-new at cica.es Received: from smtp.cica.es ([127.0.0.1]) by localhost (mail.cica.es [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5OziR6tRkcUc; Mon, 17 Nov 2014 13:36:26 +0100 (CET) Received: from nfdev.cica.es (nfdev.cica.es [IPv6:2a00:9ac0:c1ca:31::220]) by smtp.cica.es (Postfix) with ESMTP id DDEC051F05B; Mon, 17 Nov 2014 13:36:25 +0100 (CET) Subject: [ebtables-compat-experimental5 PATCH] iptables: xtables-eb: adjust policy in user-defined chains From: Arturo Borrero Gonzalez To: netfilter-devel@vger.kernel.org Cc: giuseppelng@gmail.com, pablo@netfilter.org Date: Mon, 17 Nov 2014 13:36:23 +0100 Message-ID: <20141117123622.11349.43033.stgit@nfdev.cica.es> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org The ebtables-compat tool doesn't support default policy in custom chains. RETURN is the default policy in this case, and is mandatory (this is the behaviour of nf_tables). While at it, fix the error message when trying to change the default policy to RETURN in builtin chains to match the original ebtables message. Signed-off-by: Arturo Borrero Gonzalez --- iptables/nft-bridge.c | 7 ++++++- iptables/xtables-eb.c | 19 ++++++++++++------- 2 files changed, 18 insertions(+), 8 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c index b5aec00..dc26bfd 100644 --- a/iptables/nft-bridge.c +++ b/iptables/nft-bridge.c @@ -356,7 +356,12 @@ static void nft_bridge_print_header(unsigned int format, const char *chain, const struct xt_counters *counters, bool basechain, uint32_t refs) { - printf("Bridge chain: %s, entries: %u, policy: %s\n", chain, refs, pol); + if (basechain) + printf("Bridge chain: %s, entries: %u, policy: %s\n", + chain, refs, pol); + else + printf("Bridge chain: %s, entries: %u, policy: RETURN\n", + chain, refs); } static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num, diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c index 917bca2..bf9f264 100644 --- a/iptables/xtables-eb.c +++ b/iptables/xtables-eb.c @@ -615,11 +615,10 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table) case 'N': /* Make a user defined chain */ case 'E': /* Rename chain */ case 'X': /* Delete chain */ - /* We allow -N chainname -P policy */ if (command == 'N' && c == 'P') { - command = c; - optind--; /* No table specified */ - goto handle_P; + xtables_error(PARAMETER_PROBLEM, + "The default policy in user-defined" + " chains is RETURN (mandatory)"); } if (OPT_COMMANDS) xtables_error(PARAMETER_PROBLEM, @@ -663,7 +662,6 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table) optind++; } } else if (c == 'P') { -handle_P: if (optind >= argc) xtables_error(PARAMETER_PROBLEM, "No policy specified"); @@ -1146,9 +1144,16 @@ check_extension: */ cs.fw.ethproto = htons(cs.fw.ethproto); if (command == 'P') { - if (selected_chain < NF_BR_NUMHOOKS && strcmp(policy, "RETURN")==0) + if (selected_chain < 0) { xtables_error(PARAMETER_PROBLEM, - "Policy RETURN only allowed for user defined chains"); + "Default policy in user-defined chains " + "is mandatory RETURN"); + } + if (strcmp(policy, "RETURN") == 0) { + xtables_error(PARAMETER_PROBLEM, + "Policy RETURN only allowed for user " + "defined chains"); + } ret = nft_chain_set(h, *table, chain, policy, NULL); if (ret < 0) xtables_error(PARAMETER_PROBLEM, "Wrong policy");