[PATCH 0/3] xtables-events segfault

[PATCH 0/3] xtables-events segfault

[Giuseppe Longo]

Hi,
this patchset fixes the segfault obtained if you try
to add a rule for arp family.

I added a new function into nft-shared that will be
used to print matches and target for ip/ip6/family
and reworked a bit the code.

The function nft_arp_save_firewall isn't implemented yet,
I'll send another patch later.

Currently is not possible to print ebtables rules,
when xtables-eb is ready, I'll do it.

BR,

Giuseppe Longo (3):
  nft-shared: adds save_matches_and_target
  nft-arp: adds nft_arp_save_firewall
  xtables-events: prints arp rules

 iptables/nft-arp.c        |  9 +++++++++
 iptables/nft-ipv4.c       |  7 +++++--
 iptables/nft-ipv6.c       |  7 +++++--
 iptables/nft-shared.c     | 35 +++++++++++++++++++++++++++++++++++
 iptables/nft-shared.h     |  6 +++++-
 iptables/nft.c            | 33 ++-------------------------------
 iptables/nft.h            |  2 +-
 iptables/xtables-events.c | 20 +++++++++++++-------
 8 files changed, 75 insertions(+), 44 deletions(-)

-- 
1.8.1.5

[PATCH 1/3] nft-shared: adds save_matches_and_target

[Giuseppe Longo]

This patch permits to save matches and target for ip/ip6/eb family,
required for xtables-events.

Also, generalizes nft_rule_print_save to be reused for all protocol families.

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
---
 iptables/nft-ipv4.c   |  7 +++++--
 iptables/nft-ipv6.c   |  7 +++++--
 iptables/nft-shared.c | 35 +++++++++++++++++++++++++++++++++++
 iptables/nft-shared.h |  6 +++++-
 iptables/nft.c        | 33 ++-------------------------------
 iptables/nft.h        |  2 +-
 6 files changed, 53 insertions(+), 37 deletions(-)

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 1afe8b6..e18a649 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -309,9 +309,11 @@ static void save_ipv4_addr(char letter, const struct in_addr *addr,
 	       mask_to_str(mask));
 }
 
-static uint8_t nft_ipv4_save_firewall(const struct iptables_command_state *cs,
+static void nft_ipv4_save_firewall(const void *data,
 				      unsigned int format)
 {
+	const struct iptables_command_state *cs = data;
+
 	save_firewall_details(cs, cs->fw.ip.invflags, cs->fw.ip.proto,
 			      cs->fw.ip.iniface, cs->fw.ip.iniface_mask,
 			      cs->fw.ip.outiface, cs->fw.ip.outiface_mask,
@@ -328,7 +330,8 @@ static uint8_t nft_ipv4_save_firewall(const struct iptables_command_state *cs,
 	save_ipv4_addr('d', &cs->fw.ip.dst, cs->fw.ip.dmsk.s_addr,
 		       cs->fw.ip.invflags & IPT_INV_DSTIP);
 
-	return cs->fw.ip.flags;
+	save_matches_and_target(cs->matches, cs->target, cs->jumpto,
+				cs->fw.ip.flags, &cs);
 }
 
 static void nft_ipv4_proto_parse(struct iptables_command_state *cs,
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index f30cec6..4beb411 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -218,9 +218,11 @@ static void save_ipv6_addr(char letter, const struct in6_addr *addr,
 	printf("%s-%c %s ", invert ? "! " : "", letter, addr_str);
 }
 
-static uint8_t nft_ipv6_save_firewall(const struct iptables_command_state *cs,
+static void nft_ipv6_save_firewall(const void *data,
 				      unsigned int format)
 {
+	const struct iptables_command_state *cs = data;
+
 	save_firewall_details(cs, cs->fw6.ipv6.invflags, cs->fw6.ipv6.proto,
 			      cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask,
 			      cs->fw6.ipv6.outiface, cs->fw6.ipv6.outiface_mask,
@@ -231,7 +233,8 @@ static uint8_t nft_ipv6_save_firewall(const struct iptables_command_state *cs,
 	save_ipv6_addr('d', &cs->fw6.ipv6.dst,
 		       cs->fw6.ipv6.invflags & IPT_INV_DSTIP);
 
-	return cs->fw6.ipv6.flags;
+	save_matches_and_target(cs->matches, cs->target, cs->jumpto,
+				cs->fw6.ipv6.flags, &cs);
 }
 
 /* These are invalid numbers as upper layer protocol */
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 233011c..29bfab7 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -621,6 +621,41 @@ void save_firewall_details(const struct iptables_command_state *cs,
 	}
 }
 
+void save_matches_and_target(struct xtables_rule_match *m,
+			     struct xtables_target *target,
+			     const char *jumpto,
+			     uint8_t flags, void *fw)
+{
+	struct xtables_rule_match *matchp;
+
+	for (matchp = m; matchp; matchp = matchp->next) {
+		if (matchp->match->alias) {
+			printf("-m %s",
+			       matchp->match->alias(matchp->match->m));
+		} else
+			printf("-m %s", matchp->match->name);
+
+		if (matchp->match->save != NULL) {
+			/* cs->fw union makes the trick */
+			matchp->match->save(&fw, matchp->match->m);
+		}
+		printf(" ");
+	}
+
+	if (target != NULL) {
+		if (target->alias) {
+			printf("-j %s", target->alias(target->t));
+		} else
+			printf("-j %s", jumpto);
+
+		if (target->save != NULL)
+			target->save(fw, target->t);
+	} else if (strlen(jumpto) > 0)
+		printf("-%c %s", flags & IPT_F_GOTO ? 'g' : 'j', jumpto);
+
+	printf("\n");
+}
+
 void print_matches_and_target(struct iptables_command_state *cs,
 			      unsigned int format)
 {
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
index 9df17bc..676cdca 100644
--- a/iptables/nft-shared.h
+++ b/iptables/nft-shared.h
@@ -49,7 +49,7 @@ struct nft_family_ops {
 	void (*parse_immediate)(const char *jumpto, bool nft_goto, void *data);
 	void (*print_firewall)(struct nft_rule *r, unsigned int num,
 			       unsigned int format);
-	uint8_t (*save_firewall)(const struct iptables_command_state *cs,
+	void (*save_firewall)(const void *data,
 				 unsigned int format);
 	void (*proto_parse)(struct iptables_command_state *cs,
 			    struct xtables_args *args);
@@ -118,6 +118,10 @@ void save_firewall_details(const struct iptables_command_state *cs,
 			   const char *outiface,
 			   unsigned const char *outiface_mask,
 			   unsigned int format);
+void save_matches_and_target(struct xtables_rule_match *m,
+			     struct xtables_target *target,
+			     const char *jumpto,
+			     uint8_t flags, void *fw);
 
 struct nft_family_ops *nft_family_ops_lookup(int family);
 
diff --git a/iptables/nft.c b/iptables/nft.c
index 8c8c026..cde2493 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1038,15 +1038,13 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
 }
 
 void
-nft_rule_print_save(const struct iptables_command_state *cs,
+nft_rule_print_save(const void *data,
 		    struct nft_rule *r, enum nft_rule_print type,
 		    unsigned int format)
 {
 	const char *chain = nft_rule_attr_get_str(r, NFT_RULE_ATTR_CHAIN);
 	int family = nft_rule_attr_get_u8(r, NFT_RULE_ATTR_FAMILY);
-	struct xtables_rule_match *matchp;
 	struct nft_family_ops *ops;
-	int ip_flags = 0;
 
 	/* print chain name */
 	switch(type) {
@@ -1059,35 +1057,8 @@ nft_rule_print_save(const struct iptables_command_state *cs,
 	}
 
 	ops = nft_family_ops_lookup(family);
-	ip_flags = ops->save_firewall(cs, format);
-
-	for (matchp = cs->matches; matchp; matchp = matchp->next) {
-		if (matchp->match->alias) {
-			printf("-m %s",
-			       matchp->match->alias(matchp->match->m));
-		} else
-			printf("-m %s", matchp->match->name);
-
-		if (matchp->match->save != NULL) {
-			/* cs->fw union makes the trick */
-			matchp->match->save(&cs->fw, matchp->match->m);
-		}
-		printf(" ");
-	}
-
-	if (cs->target != NULL) {
-		if (cs->target->alias) {
-			printf("-j %s", cs->target->alias(cs->target->t));
-		} else
-			printf("-j %s", cs->jumpto);
+	ops->save_firewall(data, format);
 
-		if (cs->target->save != NULL)
-			cs->target->save(&cs->fw, cs->target->t);
-	} else if (strlen(cs->jumpto) > 0)
-		printf("-%c %s", ip_flags & IPT_F_GOTO ? 'g' : 'j',
-								cs->jumpto);
-
-	printf("\n");
 }
 
 static int nft_chain_list_cb(const struct nlmsghdr *nlh, void *data)
diff --git a/iptables/nft.h b/iptables/nft.h
index 68f674e..fc380d9 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -115,7 +115,7 @@ enum nft_rule_print {
 	NFT_RULE_DEL,
 };
 
-void nft_rule_print_save(const struct iptables_command_state *cs,
+void nft_rule_print_save(const void *data,
 			 struct nft_rule *r, enum nft_rule_print type,
 			 unsigned int format);
 
-- 
1.8.1.5

[PATCH 2/3] nft-arp: adds nft_arp_save_firewall

[Giuseppe Longo]

Adds nft_arp_save_firewall to arp family.
(Avoids the segfault in xtables-events)

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
---
 iptables/nft-arp.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
index 1710136..bbb168d 100644
--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
@@ -570,6 +570,14 @@ after_devdst:
 		fputc('\n', stdout);
 }
 
+static void nft_arp_save_firewall(const void *data,
+				   unsigned int format)
+{
+	const struct arpt_entry *fw = data;
+
+	return;
+}
+
 static bool nft_arp_is_same(const void *data_a,
 			    const void *data_b)
 {
@@ -643,6 +651,7 @@ struct nft_family_ops nft_family_ops_arp = {
 	.parse_payload		= nft_arp_parse_payload,
 	.parse_immediate	= nft_arp_parse_immediate,
 	.print_firewall		= nft_arp_print_firewall,
+	.save_firewall		= nft_arp_save_firewall,
 	.post_parse		= NULL,
 	.rule_find		= nft_arp_rule_find,
 	.parse_target		= nft_arp_parse_target,
-- 
1.8.1.5

[PATCH 3/3] xtables-events: prints arp rules

[Giuseppe Longo]

This patch permits to print arp rules,
avoiding the segfault that you got currently.

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
---
 iptables/xtables-events.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/iptables/xtables-events.c b/iptables/xtables-events.c
index 408e091..7ce1d4f 100644
--- a/iptables/xtables-events.c
+++ b/iptables/xtables-events.c
@@ -59,7 +59,11 @@ static bool counters;
 static int rule_cb(const struct nlmsghdr *nlh, int type)
 {
 	struct iptables_command_state cs = {};
+	struct arpt_entry fw_arp = {};
+	struct xtables_ebt_entry fw_eb = {};
 	struct nft_rule *r;
+	void *fw = NULL;
+	uint8_t family;
 
 	r = nft_rule_alloc();
 	if (r == NULL) {
@@ -72,21 +76,23 @@ static int rule_cb(const struct nlmsghdr *nlh, int type)
 		goto err_free;
 	}
 
-	nft_rule_to_iptables_command_state(r, &cs);
-
-	switch(nft_rule_attr_get_u8(r, NFT_RULE_ATTR_FAMILY)) {
+	family = nft_rule_attr_get_u8(r, NFT_RULE_ATTR_FAMILY);
+	switch(family) {
 	case AF_INET:
-		printf("-4 ");
-		break;
 	case AF_INET6:
-		printf("-6 ");
+		printf("-%c ", family == AF_INET ? '4' : '6');
+		nft_rule_to_iptables_command_state(r, &cs);
+		fw = &cs;
 		break;
+	case NFPROTO_ARP:
+		nft_rule_to_arpt_entry(r, &fw_arp);
+		fw = &fw_arp;
 	default:
 		break;
 	}
 
 
-	nft_rule_print_save(&cs, r,
+	nft_rule_print_save(fw, r,
 			    type == NFT_MSG_NEWRULE ? NFT_RULE_APPEND :
 						      NFT_RULE_DEL,
 			    counters ? 0 : FMT_NOCOUNTS);
-- 
1.8.1.5

Re: [PATCH 2/3] nft-arp: adds nft_arp_save_firewall

[Pablo Neira Ayuso]

Hi Giuseppe,

On Thu, Feb 06, 2014 at 02:31:10PM +0100, Giuseppe Longo wrote:
> Adds nft_arp_save_firewall to arp family.
> (Avoids the segfault in xtables-events)
> 
> Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
> ---
>  iptables/nft-arp.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
> index 1710136..bbb168d 100644
> --- a/iptables/nft-arp.c
> +++ b/iptables/nft-arp.c
> @@ -570,6 +570,14 @@ after_devdst:
>  		fputc('\n', stdout);
>  }
>  
> +static void nft_arp_save_firewall(const void *data,
> +				   unsigned int format)
> +{
> +	const struct arpt_entry *fw = data;
> +
> +	return;
> +}

Please, rework patch 1/3 to make save_firewall option, ie. something
like:

        ...
        if (ops->save_firewall)
                ops->save_firewall(data, format);

Thus, you don't need this dummy function which is almost noop.

Re: [PATCH 3/3] xtables-events: prints arp rules

[Pablo Neira Ayuso]

On Thu, Feb 06, 2014 at 02:31:11PM +0100, Giuseppe Longo wrote:
> This patch permits to print arp rules,
> avoiding the segfault that you got currently.
> 
> Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
> ---
>  iptables/xtables-events.c | 20 +++++++++++++-------
>  1 file changed, 13 insertions(+), 7 deletions(-)
> 
> diff --git a/iptables/xtables-events.c b/iptables/xtables-events.c
> index 408e091..7ce1d4f 100644
> --- a/iptables/xtables-events.c
> +++ b/iptables/xtables-events.c
> @@ -59,7 +59,11 @@ static bool counters;
>  static int rule_cb(const struct nlmsghdr *nlh, int type)
>  {
>  	struct iptables_command_state cs = {};
> +	struct arpt_entry fw_arp = {};
> +	struct xtables_ebt_entry fw_eb = {};

There is no ebt compat yet, please, remove this line above.

>  	struct nft_rule *r;
> +	void *fw = NULL;
> +	uint8_t family;
>  
>  	r = nft_rule_alloc();
>  	if (r == NULL) {
> @@ -72,21 +76,23 @@ static int rule_cb(const struct nlmsghdr *nlh, int type)
>  		goto err_free;
>  	}
>  
> -	nft_rule_to_iptables_command_state(r, &cs);
> -
> -	switch(nft_rule_attr_get_u8(r, NFT_RULE_ATTR_FAMILY)) {
> +	family = nft_rule_attr_get_u8(r, NFT_RULE_ATTR_FAMILY);
> +	switch(family) {
>  	case AF_INET:
> -		printf("-4 ");
> -		break;
>  	case AF_INET6:
> -		printf("-6 ");
> +		printf("-%c ", family == AF_INET ? '4' : '6');
> +		nft_rule_to_iptables_command_state(r, &cs);
> +		fw = &cs;
>  		break;
> +	case NFPROTO_ARP:
> +		nft_rule_to_arpt_entry(r, &fw_arp);
> +		fw = &fw_arp;
>  	default:
>  		break;
>  	}
>  
>  
> -	nft_rule_print_save(&cs, r,
> +	nft_rule_print_save(fw, r,
>  			    type == NFT_MSG_NEWRULE ? NFT_RULE_APPEND :
>  						      NFT_RULE_DEL,
>  			    counters ? 0 : FMT_NOCOUNTS);
> -- 
> 1.8.1.5
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html