From patchwork Thu Jan 26 12:24:00 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Phil Sutter X-Patchwork-Id: 1732233 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=nwl.cc header.i=@nwl.cc header.a=rsa-sha256 header.s=mail2022 header.b=W2Q8gIgi; dkim-atps=neutral Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4P2fz04c9Rz23gY for ; Thu, 26 Jan 2023 23:24:28 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236982AbjAZMY1 (ORCPT ); Thu, 26 Jan 2023 07:24:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45022 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237074AbjAZMY0 (ORCPT ); Thu, 26 Jan 2023 07:24:26 -0500 Received: from orbyte.nwl.cc (orbyte.nwl.cc [IPv6:2001:41d0:e:133a::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 763733BDB6 for ; Thu, 26 Jan 2023 04:24:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nwl.cc; s=mail2022; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=ZUWGtoCHSkEaEsL4KkicwL9U6j1VRa2xPBUnz26swZw=; b=W2Q8gIgi9U7g0V62KbIXfnlIiL lRL4AiafRqEoibb/IYfhcV074Q203dfMKL77UqtM4OntdfXGeG4eERNZ9k0pKibWh0VaU18zvSaTp kAcidQLs1n/WoC5MMK73+JC83cVXSsspt9AH/J+yg9dteVPupVRLuKsmhSvO0sR9OyvKDxdp/7Wb7 0yYEjy0hktZrCkJBKL70a3EnXC7BW5YXyVEHReqFKY8nMvxg0h4EUxtzWl/LPtjzTu5R4JC2YYWMx mDYg0Nn3gJbElQPYdJXzOqKvyifJUc6n10Cv8/MP0+00BWeImi0NJcD37R1wa9hpVLs6l6e/kVZh4 rwlDS/xQ==; Received: from localhost ([::1] helo=xic) by orbyte.nwl.cc with esmtp (Exim 4.94.2) (envelope-from ) id 1pL1Il-00057a-Q2 for netfilter-devel@vger.kernel.org; Thu, 26 Jan 2023 13:24:23 +0100 From: Phil Sutter To: netfilter-devel@vger.kernel.org Subject: [iptables PATCH 1/7] Proper fix for "unknown argument" error message Date: Thu, 26 Jan 2023 13:24:00 +0100 Message-Id: <20230126122406.23288-2-phil@nwl.cc> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20230126122406.23288-1-phil@nwl.cc> References: <20230126122406.23288-1-phil@nwl.cc> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org While commit 1b8210f848631 kind of fixed the corner-case of invalid short-options packed with others, it broke error reporting for long-options. Revert it and deploy a proper solution: When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long sets the variable 'optopt' to the invalid character's value. Use it for reporting instead of optind if set. To distinguish between invalid options and missing option arguments, ebtables-translate optstring needs adjustment. Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters") Signed-off-by: Phil Sutter --- .../testcases/iptables/0009-unknown-arg_0 | 31 +++++++++++++++++++ iptables/xshared.c | 9 ++++-- iptables/xtables-eb-translate.c | 8 ++--- iptables/xtables-eb.c | 17 ++++++---- 4 files changed, 50 insertions(+), 15 deletions(-) create mode 100755 iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 diff --git a/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 new file mode 100755 index 0000000000000..ac6e743966196 --- /dev/null +++ b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 @@ -0,0 +1,31 @@ +#!/bin/bash + +rc=0 + +check() { + local cmd="$1" + local msg="$2" + + $XT_MULTI $cmd 2>&1 | grep -q "$msg" || { + echo "cmd: $XT_MULTI $1" + echo "exp: $msg" + echo "res: $($XT_MULTI $cmd 2>&1)" + rc=1 + } +} + +cmds="iptables ip6tables" +[[ $XT_MULTI == *xtables-nft-multi ]] && { + cmds+=" ebtables" + cmds+=" iptables-translate" + cmds+=" ip6tables-translate" + cmds+=" ebtables-translate" +} + +for cmd in $cmds; do + check "${cmd} --foo" 'unknown option "--foo"' + check "${cmd} -A" 'option "-A" requires an argument' + check "${cmd} -aL" 'unknown option "-a"' +done + +exit $rc diff --git a/iptables/xshared.c b/iptables/xshared.c index f93529b11a319..ac51fac5ce9ed 100644 --- a/iptables/xshared.c +++ b/iptables/xshared.c @@ -192,9 +192,12 @@ static int command_default(struct iptables_command_state *cs, if (cs->c == ':') xtables_error(PARAMETER_PROBLEM, "option \"%s\" " "requires an argument", cs->argv[optind-1]); - if (cs->c == '?') - xtables_error(PARAMETER_PROBLEM, "unknown option " - "\"%s\"", cs->argv[optind-1]); + if (cs->c == '?') { + char optoptstr[3] = {'-', optopt, '\0'}; + + xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", + optopt ? optoptstr : cs->argv[optind - 1]); + } xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); } diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c index 13b6b864a5f24..0c35272051752 100644 --- a/iptables/xtables-eb-translate.c +++ b/iptables/xtables-eb-translate.c @@ -201,7 +201,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char printf("nft "); /* Getopt saves the day */ while ((c = getopt_long(argc, argv, - "-A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { + "-:A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { cs.c = c; switch (c) { case 'A': /* Add a rule */ @@ -491,11 +491,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char continue; default: ebt_check_inverse2(optarg, argc, argv); - - if (ebt_command_default(&cs)) - xtables_error(PARAMETER_PROBLEM, - "Unknown argument: '%s'", - argv[optind - 1]); + ebt_command_default(&cs); if (command != 'A' && command != 'I' && command != 'D') diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c index 7214a767ffe96..412b5cccdc46a 100644 --- a/iptables/xtables-eb.c +++ b/iptables/xtables-eb.c @@ -640,7 +640,16 @@ int ebt_command_default(struct iptables_command_state *cs) return 0; } } - return 1; + if (cs->c == ':') + xtables_error(PARAMETER_PROBLEM, "option \"%s\" " + "requires an argument", cs->argv[optind - 1]); + if (cs->c == '?') { + char optoptstr[3] = {'-', optopt, '\0'}; + + xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", + optopt ? optoptstr : cs->argv[optind - 1]); + } + xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); } int nft_init_eb(struct nft_handle *h, const char *pname) @@ -1084,11 +1093,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, continue; default: ebt_check_inverse2(optarg, argc, argv); - - if (ebt_command_default(&cs)) - xtables_error(PARAMETER_PROBLEM, - "Unknown argument: '%s'", - argv[optind]); + ebt_command_default(&cs); if (command != 'A' && command != 'I' && command != 'D' && command != 'C' && command != 14) From patchwork Thu Jan 26 12:24:01 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Phil Sutter X-Patchwork-Id: 1732235 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=nwl.cc header.i=@nwl.cc header.a=rsa-sha256 header.s=mail2022 header.b=irlFaLlw; dkim-atps=neutral Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4P2fzJ6JgKz23gY for ; Thu, 26 Jan 2023 23:24:44 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237102AbjAZMYn (ORCPT ); Thu, 26 Jan 2023 07:24:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45526 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236891AbjAZMYm (ORCPT ); Thu, 26 Jan 2023 07:24:42 -0500 Received: from orbyte.nwl.cc (orbyte.nwl.cc [IPv6:2001:41d0:e:133a::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5DA266C55C for ; Thu, 26 Jan 2023 04:24:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nwl.cc; s=mail2022; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=VaYJxv0FBCAkqQxuuXJb6JuRa5imGFZdqTBGmabBtSw=; b=irlFaLlw4HguHhy0tdaMxyQSZV Smtz7L8ACpGIgcse7rnJJ5Ug3jaVmG6tQ82cNnQCtmCp6wzs0WgFSIpg9Lu3fzpg4iqpiQ483nAx2 HWdJXYI9zg3fbe+Qs6nb1fveyBMJiQVRG1jB0A6dbm/4sM4q+xdrHxNu5JOjB5Q9uk9L5MpIYZaFb 87wcw6o4KBKK6s+xGGmKGRUHBpzpsnhvz88OHdya3FFP2QVjKYsAo+OUJjmingnYY1G5KjE84e0FH kJ/YCwn4oqHuetPIK5Dfa/BnUn+pdDDdB6s70alRjRbQ7CPDPNQNrBN9gtVIVSCbyZaaTlWGQQdOW e50F6bsQ==; Received: from localhost ([::1] helo=xic) by orbyte.nwl.cc with esmtp (Exim 4.94.2) (envelope-from ) id 1pL1Iw-000589-Ec for netfilter-devel@vger.kernel.org; Thu, 26 Jan 2023 13:24:34 +0100 From: Phil Sutter To: netfilter-devel@vger.kernel.org Subject: [iptables PATCH 2/7] ebtables: Refuse unselected targets' options Date: Thu, 26 Jan 2023 13:24:01 +0100 Message-Id: <20230126122406.23288-3-phil@nwl.cc> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20230126122406.23288-1-phil@nwl.cc> References: <20230126122406.23288-1-phil@nwl.cc> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Unlike legacy, ebtables-nft would allow e.g.: | -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be While the result is correct, it may mislead users into believing multiple targets are possible per rule. Better follow legacy's behaviour and reject target options unless they have been "enabled" by a previous '-j' option. To achieve this, one needs to distinguish targets from watchers also attached to 'xtables_targets' and otherwise behaving like regular matches. Introduce XTABLES_EXT_WATCHER to mark the two. The above works already, but error messages are misleading when using the now unsupported syntax since target options have been merged already. Solve this by not pre-loading the targets at all, code will just fall back to loading ad '-j' parsing time as iptables does. Note how this also fixes for 'counter' statement being in wrong position of ebtables-translate output. Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") Signed-off-by: Phil Sutter --- extensions/libebt_dnat.txlate | 12 ++++---- extensions/libebt_log.c | 1 + extensions/libebt_mark.txlate | 16 +++++----- extensions/libebt_nflog.c | 1 + extensions/libebt_snat.txlate | 8 ++--- include/xtables.h | 1 + .../ebtables/0002-ebtables-save-restore_0 | 4 +-- iptables/xtables-eb.c | 29 +++++++------------ 8 files changed, 33 insertions(+), 39 deletions(-) diff --git a/extensions/libebt_dnat.txlate b/extensions/libebt_dnat.txlate index 9f305c76c954f..531a22aa3e14f 100644 --- a/extensions/libebt_dnat.txlate +++ b/extensions/libebt_dnat.txlate @@ -1,8 +1,8 @@ -ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff -nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' +ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff +nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' -ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT -nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' +ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT +nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' -ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE -nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff continue counter' +ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE +nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff continue' diff --git a/extensions/libebt_log.c b/extensions/libebt_log.c index 045062196d20d..9f8d158956802 100644 --- a/extensions/libebt_log.c +++ b/extensions/libebt_log.c @@ -197,6 +197,7 @@ static int brlog_xlate(struct xt_xlate *xl, static struct xtables_target brlog_target = { .name = "log", .revision = 0, + .ext_flags = XTABLES_EXT_WATCHER, .version = XTABLES_VERSION, .family = NFPROTO_BRIDGE, .size = XT_ALIGN(sizeof(struct ebt_log_info)), diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate index d006e8ac94008..4ace1a1f5cfde 100644 --- a/extensions/libebt_mark.txlate +++ b/extensions/libebt_mark.txlate @@ -1,11 +1,11 @@ -ebtables-translate -A INPUT --mark-set 42 -nft 'add rule bridge filter INPUT meta mark set 0x2a accept counter' +ebtables-translate -A INPUT -j mark --mark-set 42 +nft 'add rule bridge filter INPUT counter meta mark set 0x2a accept' -ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN -nft 'add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter' +ebtables-translate -A INPUT -j mark --mark-or 42 --mark-target RETURN +nft 'add rule bridge filter INPUT counter meta mark set meta mark or 0x2a return' -ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT -nft 'add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter' +ebtables-translate -A INPUT -j mark --mark-and 42 --mark-target ACCEPT +nft 'add rule bridge filter INPUT counter meta mark set meta mark and 0x2a accept' -ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP -nft 'add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter' +ebtables-translate -A INPUT -j mark --mark-xor 42 --mark-target DROP +nft 'add rule bridge filter INPUT counter meta mark set meta mark xor 0x2a drop' diff --git a/extensions/libebt_nflog.c b/extensions/libebt_nflog.c index 115e15da45845..762d6d5d8bbe2 100644 --- a/extensions/libebt_nflog.c +++ b/extensions/libebt_nflog.c @@ -146,6 +146,7 @@ static int brnflog_xlate(struct xt_xlate *xl, static struct xtables_target brnflog_watcher = { .name = "nflog", .revision = 0, + .ext_flags = XTABLES_EXT_WATCHER, .version = XTABLES_VERSION, .family = NFPROTO_BRIDGE, .size = XT_ALIGN(sizeof(struct ebt_nflog_info)), diff --git a/extensions/libebt_snat.txlate b/extensions/libebt_snat.txlate index 857a6052aed1a..37343d3a14754 100644 --- a/extensions/libebt_snat.txlate +++ b/extensions/libebt_snat.txlate @@ -1,5 +1,5 @@ -ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ --to-source de:ad:00:be:ee:ff -nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 ether saddr set de:ad:0:be:ee:ff accept counter' +ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ -j snat --to-source de:ad:00:be:ee:ff +nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 counter ether saddr set de:ad:0:be:ee:ff accept' -ebtables-translate -t nat -A POSTROUTING -o someport --to-src de:ad:00:be:ee:ff --snat-target CONTINUE -nft 'add rule bridge nat POSTROUTING oifname "someport" ether saddr set de:ad:0:be:ee:ff continue counter' +ebtables-translate -t nat -A POSTROUTING -o someport -j snat --to-src de:ad:00:be:ee:ff --snat-target CONTINUE +nft 'add rule bridge nat POSTROUTING oifname "someport" counter ether saddr set de:ad:0:be:ee:ff continue' diff --git a/include/xtables.h b/include/xtables.h index 4ffc8ec5a17e9..087a1d600f9ae 100644 --- a/include/xtables.h +++ b/include/xtables.h @@ -203,6 +203,7 @@ struct xtables_lmap { enum xtables_ext_flags { XTABLES_EXT_ALIAS = 1 << 0, + XTABLES_EXT_WATCHER = 1 << 1, }; struct xt_xlate; diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 index 1091a4e80bebe..b4f9728bb9b6f 100755 --- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 +++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 @@ -38,7 +38,7 @@ $XT_MULTI ebtables -A foo -p IPv6 --ip6-proto tcp -j ACCEPT $XT_MULTI ebtables -A foo --limit 100 --limit-burst 42 -j ACCEPT $XT_MULTI ebtables -A foo --log -$XT_MULTI ebtables -A foo --mark-set 0x23 --mark-target ACCEPT +$XT_MULTI ebtables -A foo -j mark --mark-set 0x23 --mark-target ACCEPT $XT_MULTI ebtables -A foo --nflog $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT @@ -53,7 +53,7 @@ $XT_MULTI ebtables -A FORWARD -j foo $XT_MULTI ebtables -N bar $XT_MULTI ebtables -P bar RETURN -$XT_MULTI ebtables -t nat -A PREROUTING --redirect-target ACCEPT +$XT_MULTI ebtables -t nat -A PREROUTING -j redirect --redirect-target ACCEPT #$XT_MULTI ebtables -t nat -A PREROUTING --to-src fe:ed:ba:be:00:01 $XT_MULTI ebtables -t nat -A OUTPUT -j ACCEPT diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c index 412b5cccdc46a..3a73e79725489 100644 --- a/iptables/xtables-eb.c +++ b/iptables/xtables-eb.c @@ -468,14 +468,14 @@ static void ebt_load_match(const char *name) xtables_error(OTHER_PROBLEM, "Can't alloc memory"); } -static void __ebt_load_watcher(const char *name, const char *typename) +static void ebt_load_watcher(const char *name) { struct xtables_target *watcher; size_t size; watcher = xtables_find_target(name, XTF_TRY_LOAD); if (!watcher) { - fprintf(stderr, "Unable to load %s %s\n", name, typename); + fprintf(stderr, "Unable to load %s watcher\n", name); return; } @@ -496,16 +496,6 @@ static void __ebt_load_watcher(const char *name, const char *typename) xtables_error(OTHER_PROBLEM, "Can't alloc memory"); } -static void ebt_load_watcher(const char *name) -{ - return __ebt_load_watcher(name, "watcher"); -} - -static void ebt_load_target(const char *name) -{ - return __ebt_load_watcher(name, "target"); -} - void ebt_load_match_extensions(void) { opts = ebt_original_options; @@ -522,13 +512,6 @@ void ebt_load_match_extensions(void) ebt_load_watcher("log"); ebt_load_watcher("nflog"); - - ebt_load_target("mark"); - ebt_load_target("dnat"); - ebt_load_target("snat"); - ebt_load_target("arpreply"); - ebt_load_target("redirect"); - ebt_load_target("standard"); } void ebt_add_match(struct xtables_match *m, @@ -633,6 +616,9 @@ int ebt_command_default(struct iptables_command_state *cs) /* Is it a watcher option? */ for (t = xtables_targets; t; t = t->next) { + if (!(t->ext_flags & XTABLES_EXT_WATCHER)) + continue; + if (t->parse && t->parse(cs->c - t->option_offset, cs->argv, ebt_invert, &t->tflags, NULL, &t->t)) { @@ -726,6 +712,11 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, optind = 0; opterr = false; + for (t = xtables_targets; t; t = t->next) { + t->tflags = 0; + t->used = 0; + } + /* Getopt saves the day */ while ((c = getopt_long(argc, argv, EBT_OPTSTRING, opts, NULL)) != -1) { From patchwork Thu Jan 26 12:24:02 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Phil Sutter X-Patchwork-Id: 1732237 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=nwl.cc header.i=@nwl.cc header.a=rsa-sha256 header.s=mail2022 header.b=bkrjCztl; dkim-atps=neutral Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4P2fzg3m19z23gY for ; Thu, 26 Jan 2023 23:25:03 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236355AbjAZMZC (ORCPT ); Thu, 26 Jan 2023 07:25:02 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46080 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236426AbjAZMZB (ORCPT ); Thu, 26 Jan 2023 07:25:01 -0500 Received: from orbyte.nwl.cc (orbyte.nwl.cc [IPv6:2001:41d0:e:133a::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9710062274 for ; Thu, 26 Jan 2023 04:24:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nwl.cc; s=mail2022; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=sHzEBmUIUQZmgPEMkgYbrWn1Kprh1idG7BB+g0oag08=; b=bkrjCztle4qwpVSeKcz6vNQ84G D11ePNdw6vPw6zGC/Ir7u7OTP2px76GZHfs/X0KQiBfb3VCptxelwoFd825LxUWSGTHfuHQDqd3om AjLDUT9tBGlqOKTZ4M4fWFtAMOLMMhozrZ78BKq/lU4mf5BCsHj9JQQJpjjEb4gFCY6yPjaN5+KSj LKGXjxjzSywEZJIDmUjOjCvRl//lQZEucGHpKVBVrh7M9i2w7f9wNnjWq8WbHMk21xhTxa7j3OkoW jBkjn/xvi/WQTqOgUvhZP8e4f/GCAAuvn0B3xjBZWzja6BtWwYcvU5/icIZ58I+newGMGG6cnPq2o IBKSR+hw==; Received: from localhost ([::1] helo=xic) by orbyte.nwl.cc with esmtp (Exim 4.94.2) (envelope-from ) id 1pL1J7-00058W-0Q for netfilter-devel@vger.kernel.org; Thu, 26 Jan 2023 13:24:45 +0100 From: Phil Sutter To: netfilter-devel@vger.kernel.org Subject: [iptables PATCH 3/7] ebtables-translate: Drop exec_style Date: Thu, 26 Jan 2023 13:24:02 +0100 Message-Id: <20230126122406.23288-4-phil@nwl.cc> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20230126122406.23288-1-phil@nwl.cc> References: <20230126122406.23288-1-phil@nwl.cc> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Apply the changes from commit 816bd1fdecb63 ("ebtables-nft: remove exec_style") to ebtables-translate, too. Signed-off-by: Phil Sutter --- iptables/xtables-eb-translate.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c index 0c35272051752..4db10ae6706a1 100644 --- a/iptables/xtables-eb-translate.c +++ b/iptables/xtables-eb-translate.c @@ -24,9 +24,6 @@ /* * From include/ebtables_u.h */ -#define EXEC_STYLE_PRG 0 -#define EXEC_STYLE_DAEMON 1 - #define ebt_check_option2(flags, mask) EBT_CHECK_OPTION(flags, mask) extern int ebt_invert; @@ -172,7 +169,6 @@ static int nft_rule_eb_xlate_add(struct nft_handle *h, const struct xt_cmd_parse return ret; } -/* We use exec_style instead of #ifdef's because ebtables.so is a shared object. */ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char **table) { char *buffer; @@ -187,7 +183,6 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char }; char command = 'h'; const char *chain = NULL; - int exec_style = EXEC_STYLE_PRG; int selected_chain = -1; struct xtables_rule_match *xtrm_i; struct ebt_match *match; @@ -292,9 +287,6 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char if (OPT_COMMANDS) xtables_error(PARAMETER_PROBLEM, "Multiple commands are not allowed"); - if (exec_style == EXEC_STYLE_DAEMON) - xtables_error(PARAMETER_PROBLEM, - "%s %s", prog_name, prog_vers); printf("%s %s\n", prog_name, prog_vers); exit(0); case 'h': From patchwork Thu Jan 26 12:24:03 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Phil Sutter X-Patchwork-Id: 1732232 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=nwl.cc header.i=@nwl.cc header.a=rsa-sha256 header.s=mail2022 header.b=hcDb3dHb; dkim-atps=neutral Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4P2fyv0FhNz23gY for ; Thu, 26 Jan 2023 23:24:23 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236667AbjAZMYV (ORCPT ); Thu, 26 Jan 2023 07:24:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44966 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229470AbjAZMYV (ORCPT ); Thu, 26 Jan 2023 07:24:21 -0500 Received: from orbyte.nwl.cc (orbyte.nwl.cc [IPv6:2001:41d0:e:133a::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 14E1D3BDB6 for ; Thu, 26 Jan 2023 04:24:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nwl.cc; s=mail2022; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=ZSYVVM4VrPa1QBR9pgc0HqCsSJIWszYJi+fjqKchSr4=; b=hcDb3dHbTbRV+yCoA+Ht7VWkiG LTZHRuX2dTG/j8qjX3BGoJpcbcWC7ZajgufHXkX7UkIQx9ZAk6hnwi8XSHkZJM7R/rDOBQR+DWpDv 3joMgfYcCRzYxkvZdXNzs4lUdmRcjw2NmdxFvZtvOaOVchh5+tEUwzHExlnoB+Z4jQaVLun9aPz7z /tfxvaxKBUQxaCP6xSsaT3mfzViR/FWFC2kFh/J+w5Ocv0Vv+vnwj8IatAv0iVUJ7Mc1LhZbzNtkH 9YQkyCPnVdIZe8IeTB4PwV3HakXHlS3ahKHPlFbn9DZg86aKKJuu/AMJPCTjmkBSL8Lb2Cv6Eqhpi +ZhHmWKA==; Received: from localhost ([::1] helo=xic) by orbyte.nwl.cc with esmtp (Exim 4.94.2) (envelope-from ) id 1pL1Ig-00056z-DG for netfilter-devel@vger.kernel.org; Thu, 26 Jan 2023 13:24:18 +0100 From: Phil Sutter To: netfilter-devel@vger.kernel.org Subject: [iptables PATCH 4/7] ebtables-translate: Use OPT_* from xshared.h Date: Thu, 26 Jan 2023 13:24:03 +0100 Message-Id: <20230126122406.23288-5-phil@nwl.cc> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20230126122406.23288-1-phil@nwl.cc> References: <20230126122406.23288-1-phil@nwl.cc> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Same as commit db420e268735e ("ebtables: Merge OPT_* flags with xshared ones") but also introduce 'table_set' as a replacement for OPT_TABLE. Signed-off-by: Phil Sutter --- iptables/xtables-eb-translate.c | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c index 4db10ae6706a1..49ae6f64a9741 100644 --- a/iptables/xtables-eb-translate.c +++ b/iptables/xtables-eb-translate.c @@ -68,19 +68,6 @@ static int parse_rule_number(const char *rule) /* Checks whether a command has already been specified */ #define OPT_COMMANDS (flags & OPT_COMMAND || flags & OPT_ZERO) -#define OPT_COMMAND 0x01 -#define OPT_TABLE 0x02 -#define OPT_IN 0x04 -#define OPT_OUT 0x08 -#define OPT_JUMP 0x10 -#define OPT_PROTOCOL 0x20 -#define OPT_SOURCE 0x40 -#define OPT_DEST 0x80 -#define OPT_ZERO 0x100 -#define OPT_LOGICALIN 0x200 -#define OPT_LOGICALOUT 0x400 -#define OPT_COUNT 0x1000 /* This value is also defined in libebtc.c */ - /* Default command line options. Do not mess around with the already * assigned numbers unless you know what you are doing */ extern struct option ebt_original_options[]; @@ -189,6 +176,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char struct xt_cmd_parse p = { .table = *table, }; + bool table_set = false; /* prevent getopt to spoil our error reporting */ opterr = false; @@ -299,13 +287,16 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char if (OPT_COMMANDS) xtables_error(PARAMETER_PROBLEM, "Please put the -t option first"); - ebt_check_option2(&flags, OPT_TABLE); + if (table_set) + xtables_error(PARAMETER_PROBLEM, + "Multiple use of same option not allowed"); if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1) xtables_error(PARAMETER_PROBLEM, "Table name length cannot exceed %d characters", EBT_TABLE_MAXNAMELEN - 1); *table = optarg; p.table = optarg; + table_set = true; break; case 'i': /* Input interface */ case 2 : /* Logical input interface */ @@ -323,7 +314,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char xtables_error(PARAMETER_PROBLEM, "Command and option do not match"); if (c == 'i') { - ebt_check_option2(&flags, OPT_IN); + ebt_check_option2(&flags, OPT_VIANAMEIN); if (selected_chain > 2 && selected_chain < NF_BR_BROUTING) xtables_error(PARAMETER_PROBLEM, "Use -i only in INPUT, FORWARD, PREROUTING and BROUTING chains"); @@ -343,7 +334,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char ebtables_parse_interface(optarg, cs.eb.logical_in); break; } else if (c == 'o') { - ebt_check_option2(&flags, OPT_OUT); + ebt_check_option2(&flags, OPT_VIANAMEOUT); if (selected_chain < 2 || selected_chain == NF_BR_BROUTING) xtables_error(PARAMETER_PROBLEM, "Use -o only in OUTPUT, FORWARD and POSTROUTING chains"); @@ -378,7 +369,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char cs.eb.bitmask |= EBT_SOURCEMAC; break; } else if (c == 'd') { - ebt_check_option2(&flags, OPT_DEST); + ebt_check_option2(&flags, OPT_DESTINATION); if (ebt_check_inverse2(optarg, argc, argv)) cs.eb.invflags |= EBT_IDEST; @@ -389,7 +380,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char cs.eb.bitmask |= EBT_DESTMAC; break; } else if (c == 'c') { - ebt_check_option2(&flags, OPT_COUNT); + ebt_check_option2(&flags, OPT_COUNTERS); if (ebt_check_inverse2(optarg, argc, argv)) xtables_error(PARAMETER_PROBLEM, "Unexpected '!' after -c"); From patchwork Thu Jan 26 12:24:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Phil Sutter X-Patchwork-Id: 1732238 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=nwl.cc header.i=@nwl.cc header.a=rsa-sha256 header.s=mail2022 header.b=nk3QEc42; dkim-atps=neutral Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4P2fzp1G1Pz23gY for ; Thu, 26 Jan 2023 23:25:10 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236972AbjAZMZH (ORCPT ); Thu, 26 Jan 2023 07:25:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46152 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236757AbjAZMZH (ORCPT ); Thu, 26 Jan 2023 07:25:07 -0500 Received: from orbyte.nwl.cc (orbyte.nwl.cc [IPv6:2001:41d0:e:133a::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D65AE6C542 for ; Thu, 26 Jan 2023 04:24:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nwl.cc; s=mail2022; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=OyeQ6I/v9LzXDFWJ1yO5gv1GPVTdP8D6N4Er5iDmaY4=; b=nk3QEc42qQxpm6hdIFjZHES8Ow x3yAR7hj1A6EQK+oyOaBhmacrWVsaEy+VvTLihRnfYyHVBKry5raXL/Rh+Yo3qKwP4zvjVlyRc3IO xBoJjXkmt3VIhs/C2vwP1p0xjECBW6AdgbXB+GqZkMx5TGRqML3dfxhnMhduPSJ63Ykj12shaYZCw i2mjYo3r751neyNnRohLSktdGUSXcbceGAp/pbifNzBdJi8J53EQIZ9c91LP+blAZJIbt1ls6//Or J/b0rpCjw/uNgypqwPugBbldpQqrI1dUJ3qK/AhlcBWMAGTcqR+CH3dDNvG4ez55UFIn/36blq9/3 bNSzefGw==; Received: from localhost ([::1] helo=xic) by orbyte.nwl.cc with esmtp (Exim 4.94.2) (envelope-from ) id 1pL1JC-00058n-AC for netfilter-devel@vger.kernel.org; Thu, 26 Jan 2023 13:24:50 +0100 From: Phil Sutter To: netfilter-devel@vger.kernel.org Subject: [iptables PATCH 5/7] ebtables-translate: Ignore '-j CONTINUE' Date: Thu, 26 Jan 2023 13:24:04 +0100 Message-Id: <20230126122406.23288-6-phil@nwl.cc> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20230126122406.23288-1-phil@nwl.cc> References: <20230126122406.23288-1-phil@nwl.cc> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org It is default behaviour. Does not hurt here, but reducing diff to xtables-eb.c can't hurt. Signed-off-by: Phil Sutter --- iptables/xtables-eb-translate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c index 49ae6f64a9741..99347c0c3ee46 100644 --- a/iptables/xtables-eb-translate.c +++ b/iptables/xtables-eb-translate.c @@ -355,7 +355,9 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char break; } else if (c == 'j') { ebt_check_option2(&flags, OPT_JUMP); - command_jump(&cs, optarg); + if (strcmp(optarg, "CONTINUE") != 0) { + command_jump(&cs, optarg); + } break; } else if (c == 's') { ebt_check_option2(&flags, OPT_SOURCE); From patchwork Thu Jan 26 12:24:05 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Phil Sutter X-Patchwork-Id: 1732236 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=nwl.cc header.i=@nwl.cc header.a=rsa-sha256 header.s=mail2022 header.b=AvA1FzOu; dkim-atps=neutral Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4P2fzc2VgQz23gY for ; Thu, 26 Jan 2023 23:25:00 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236676AbjAZMY6 (ORCPT ); Thu, 26 Jan 2023 07:24:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45882 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237074AbjAZMYv (ORCPT ); Thu, 26 Jan 2023 07:24:51 -0500 Received: from orbyte.nwl.cc (orbyte.nwl.cc [IPv6:2001:41d0:e:133a::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6C3516A31A for ; Thu, 26 Jan 2023 04:24:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nwl.cc; s=mail2022; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=VaDkkm2VKTnn3yomvJxquK9kPTOSNtaeu2NmyI2jmE0=; b=AvA1FzOuV4RKqFunAPFTbXwoX/ NjJN3fpVhDwWEw4XbvE8U+RMzsKrxwHENWVt/BfaPALaqL5NbDC6mZRsotj1+2BR2wbNh1TqzqJ7t Qhu04aXuCqjA3FOnmPby3R0IEaRVcbmet+7fneVmARGROsi1BFeEx0gSMjouaIDHw85rm7Jn1Mpfd Fh/6sRnygQZrtgdidPI8Z8tyV8wz2Nu+w2C2jz2jObNEYVldrZSkGMkKea8etLI9TLC0xKx42lY/y NHCzCAgHZ7Y284sNLifRdyAkq80uT1+FZp7X285hgTUdPWuHSX2tOxTO2nQsv9Vju/7oZgu2QqZcS HLtXKEow==; Received: from localhost ([::1] helo=xic) by orbyte.nwl.cc with esmtp (Exim 4.94.2) (envelope-from ) id 1pL1J1-00058S-Ny for netfilter-devel@vger.kernel.org; Thu, 26 Jan 2023 13:24:39 +0100 From: Phil Sutter To: netfilter-devel@vger.kernel.org Subject: [iptables PATCH 6/7] ebtables-translate: Print flush command after parsing is finished Date: Thu, 26 Jan 2023 13:24:05 +0100 Message-Id: <20230126122406.23288-7-phil@nwl.cc> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20230126122406.23288-1-phil@nwl.cc> References: <20230126122406.23288-1-phil@nwl.cc> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Otherwise, bad calls like 'ebtables-translate -F -F' produce wrong output instead of an error message. Signed-off-by: Phil Sutter --- iptables/xtables-eb-translate.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c index 99347c0c3ee46..da7e5e3dda1f3 100644 --- a/iptables/xtables-eb-translate.c +++ b/iptables/xtables-eb-translate.c @@ -247,13 +247,6 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char ret = 1; break; case 'F': /* Flush */ - if (p.chain) { - printf("flush chain bridge %s %s\n", p.table, p.chain); - } else { - printf("flush table bridge %s\n", p.table); - } - ret = 1; - break; case 'Z': /* Zero counters */ if (c == 'Z') { if ((flags & OPT_ZERO) || (flags & OPT_COMMAND && command != 'L')) @@ -506,6 +499,13 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char if (command == 'P') { return 0; + } else if (command == 'F') { + if (p.chain) { + printf("flush chain bridge %s %s\n", p.table, p.chain); + } else { + printf("flush table bridge %s\n", p.table); + } + ret = 1; } else if (command == 'A') { ret = nft_rule_eb_xlate_add(h, &p, &cs, true); if (!ret) From patchwork Thu Jan 26 12:24:06 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Phil Sutter X-Patchwork-Id: 1732231 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=nwl.cc header.i=@nwl.cc header.a=rsa-sha256 header.s=mail2022 header.b=SQn9eGPd; dkim-atps=neutral Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4P2fyq6l5nz23gY for ; Thu, 26 Jan 2023 23:24:19 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236668AbjAZMYR (ORCPT ); Thu, 26 Jan 2023 07:24:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44944 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229470AbjAZMYQ (ORCPT ); Thu, 26 Jan 2023 07:24:16 -0500 Received: from orbyte.nwl.cc (orbyte.nwl.cc [IPv6:2001:41d0:e:133a::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4F9C01BAEB for ; Thu, 26 Jan 2023 04:24:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nwl.cc; s=mail2022; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=/FFCW9GhpZrLEmSXj82OYUi/+evxb/w1ECd0BdOrhng=; b=SQn9eGPdyF16FewtUqxduEV8FN nvPzJf1X7hqbv7Ne3qPAL4TxMls8/A/X4qykp02hOm0PkrAwRC6MZdfv6S+rKxAhPZw6joLdkdlP0 7zLM3iRXm2LCEupaNxRE0QZ7IiDe2cnAAYa052kso1+G/e/YFxPyI67ArgHaOJW6jz4ifHY1gMlCy vBi7DgWDzCWdLW0zfCWugLoE1jCLLl0Ifk5wyXL9YvPWP/47lrL23u6NpjMiwo/AyGEmPdcY03JXz kekvtAoke1n40I9ADSLwcLqs1FG6mL0SBb1zo62+tePt+VgECbvLERE4AIjBC5lDUN/p6mRA84vMy pjxpVh9Q==; Received: from localhost ([::1] helo=xic) by orbyte.nwl.cc with esmtp (Exim 4.94.2) (envelope-from ) id 1pL1Ia-00056p-VN for netfilter-devel@vger.kernel.org; Thu, 26 Jan 2023 13:24:13 +0100 From: Phil Sutter To: netfilter-devel@vger.kernel.org Subject: [iptables PATCH 7/7] tests: xlate: Support testing multiple individual files Date: Thu, 26 Jan 2023 13:24:06 +0100 Message-Id: <20230126122406.23288-8-phil@nwl.cc> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20230126122406.23288-1-phil@nwl.cc> References: <20230126122406.23288-1-phil@nwl.cc> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Simple use-case: run xlate-test for ebtables-nft: | % ./xlate-test.py extensions/libebt_*.txlate The script interpreted all parameters as a single file. Signed-off-by: Phil Sutter --- xlate-test.py | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/xlate-test.py b/xlate-test.py index 4cb1401b71677..1b544600aa242 100755 --- a/xlate-test.py +++ b/xlate-test.py @@ -241,17 +241,22 @@ xtables_nft_multi = 'xtables-nft-multi' + '/iptables/' + xtables_nft_multi files = tests = passed = failed = errors = 0 - if args.test: - if not args.test.endswith(".txlate"): - args.test += ".txlate" + for test in args.test: + if not test.endswith(".txlate"): + test += ".txlate" try: - with open(args.test, "r") as payload: - files = 1 - tests, passed, failed, errors = run_test(args.test, payload) + with open(test, "r") as payload: + t, p, f, e = run_test(test, payload) + files += 1 + tests += t + passed += p + failed += f + errors += e except IOError: print(red("Error: ") + "test file does not exist", file=sys.stderr) return 99 - else: + + if files == 0: files, tests, passed, failed, errors = load_test_files() if files > 1: @@ -272,6 +277,6 @@ parser.add_argument('-n', '--nft', type=str, default='nft', help='Replay using given nft binary (default: \'%(default)s\')') parser.add_argument('--no-netns', action='store_true', help='Do not run testsuite in own network namespace') -parser.add_argument("test", nargs="?", help="run only the specified test file") +parser.add_argument("test", nargs="*", help="run only the specified test file(s)") args = parser.parse_args() sys.exit(main())