mbox series

[iptables,0/5] Fixes around ebtables' --proto match

Message ID 20220927221512.7400-1-phil@nwl.cc
Headers show
Series Fixes around ebtables' --proto match | expand

Message

Phil Sutter Sept. 27, 2022, 10:15 p.m. UTC 
During some code merge, I created an ugly situation where local OPT_*
defines in xtables-eb.c override OPT_* enum values from xshared.h with
same name but different value.

The above became problematic when I curtly added --verbose support to
ebtables-nft in order to support -vv debug output. The used OPT_VERBOSE
symbol stemmed from xshared.h and its value clashed with OPT_PROTOCOL.
In practice, this turned verbose mode on for rules with protocol match.

Fix all the above by merging the different OPT_* symbols in the first
three patches.

The second more relevant issue was ebtables' lack of support for '-p
LENGTH', foremost a mandatory prerequisite for 802_3 extension matches
validity. The last two patches resolve this.

Phil Sutter (5):
  ebtables: Drop unused OPT_* defines
  ebtables: Eliminate OPT_TABLE
  ebtables: Merge OPT_* flags with xshared ones
  nft-shared: Introduce __get_cmp_data()
  ebtables: Support '-p Length'

 extensions/generic.txlate |  6 +++++
 extensions/libebt_802_3.t |  6 +++--
 iptables/nft-bridge.c     | 46 ++++++++++++++++++++++++++++++---------
 iptables/nft-shared.c     | 17 +++++++++------
 iptables/nft-shared.h     |  1 +
 iptables/xshared.h        |  5 +++++
 iptables/xtables-eb.c     | 28 ++++++------------------
 7 files changed, 69 insertions(+), 40 deletions(-)

Comments

Florian Westphal Sept. 28, 2022, 11:42 a.m. UTC | #1 
Phil Sutter <phil@nwl.cc> wrote:
> During some code merge, I created an ugly situation where local OPT_*
> defines in xtables-eb.c override OPT_* enum values from xshared.h with
> same name but different value.
> 
> The above became problematic when I curtly added --verbose support to
> ebtables-nft in order to support -vv debug output. The used OPT_VERBOSE
> symbol stemmed from xshared.h and its value clashed with OPT_PROTOCOL.
> In practice, this turned verbose mode on for rules with protocol match.
> 
> Fix all the above by merging the different OPT_* symbols in the first
> three patches.
> 
> The second more relevant issue was ebtables' lack of support for '-p
> LENGTH', foremost a mandatory prerequisite for 802_3 extension matches
> validity. The last two patches resolve this.

Series:
Reviewed-by: Florian Westphal <fw@strlen.de>