From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Cc: netfilter-devel@vger.kernel.org, giuseppelng@gmail.com
Subject: Re: [ebtables-compat-experimental5 PATCH] iptables: xtables-eb: adjust policy in user-defined chains
Date: Tue, 18 Nov 2014 19:43:43 +0100 [thread overview]
Message-ID: <20141118184343.GA5179@salvia> (raw)
In-Reply-To: <20141117123622.11349.43033.stgit@nfdev.cica.es>
On Mon, Nov 17, 2014 at 01:36:23PM +0100, Arturo Borrero Gonzalez wrote:
> The ebtables-compat tool doesn't support default policy in custom chains.
> RETURN is the default policy in this case, and is mandatory (this is the
> behaviour of nf_tables).
>
> While at it, fix the error message when trying to change the default policy to
> RETURN in builtin chains to match the original ebtables message.
>
> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
> ---
> iptables/nft-bridge.c | 7 ++++++-
> iptables/xtables-eb.c | 19 ++++++++++++-------
> 2 files changed, 18 insertions(+), 8 deletions(-)
>
> diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
> index b5aec00..dc26bfd 100644
> --- a/iptables/nft-bridge.c
> +++ b/iptables/nft-bridge.c
> @@ -356,7 +356,12 @@ static void nft_bridge_print_header(unsigned int format, const char *chain,
> const struct xt_counters *counters,
> bool basechain, uint32_t refs)
> {
> - printf("Bridge chain: %s, entries: %u, policy: %s\n", chain, refs, pol);
> + if (basechain)
> + printf("Bridge chain: %s, entries: %u, policy: %s\n",
> + chain, refs, pol);
> + else
> + printf("Bridge chain: %s, entries: %u, policy: RETURN\n",
> + chain, refs);
> }
I'd suggest:
printf("Bridge chain: %s, entries: %u, policy: %s\n",
chain, refs, basechain ? pol : "RETURN");
> static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num,
> diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
> index 917bca2..bf9f264 100644
> --- a/iptables/xtables-eb.c
> +++ b/iptables/xtables-eb.c
> @@ -615,11 +615,10 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table)
> case 'N': /* Make a user defined chain */
> case 'E': /* Rename chain */
> case 'X': /* Delete chain */
> - /* We allow -N chainname -P policy */
Better extend this comment:
/* We allow -N chainname -P policy */
/* XXX: Not in ebtables-compat */
> if (command == 'N' && c == 'P') {
> - command = c;
> - optind--; /* No table specified */
> - goto handle_P;
> + xtables_error(PARAMETER_PROBLEM,
> + "The default policy in user-defined"
> + " chains is RETURN (mandatory)");
> }
I'd really prefer to avoid changes in the ebtables parser. Could you
perform this checking from later on, when validating the
configuration.
if (strcmp(chain, "INPUT") != 0 &&
strcmp(chain, "FORWARD") != 0 &&
... &&
strcmp(policy, "RETURN") != 0)
xtables_error("...);
> if (OPT_COMMANDS)
> xtables_error(PARAMETER_PROBLEM,
> @@ -663,7 +662,6 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table)
> optind++;
> }
> } else if (c == 'P') {
> -handle_P:
> if (optind >= argc)
> xtables_error(PARAMETER_PROBLEM,
> "No policy specified");
> @@ -1146,9 +1144,16 @@ check_extension: */
> cs.fw.ethproto = htons(cs.fw.ethproto);
>
> if (command == 'P') {
> - if (selected_chain < NF_BR_NUMHOOKS && strcmp(policy, "RETURN")==0)
> + if (selected_chain < 0) {
> xtables_error(PARAMETER_PROBLEM,
> - "Policy RETURN only allowed for user defined chains");
> + "Default policy in user-defined chains "
> + "is mandatory RETURN");
> + }
> + if (strcmp(policy, "RETURN") == 0) {
> + xtables_error(PARAMETER_PROBLEM,
> + "Policy RETURN only allowed for user "
> + "defined chains");
> + }
Not sure why you need this change.
next prev parent reply other threads:[~2014-11-18 18:41 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-11-17 12:36 [ebtables-compat-experimental5 PATCH] iptables: xtables-eb: adjust policy in user-defined chains Arturo Borrero Gonzalez
2014-11-18 18:43 ` Pablo Neira Ayuso [this message]
2014-11-19 12:23 ` Arturo Borrero Gonzalez
2014-11-19 12:36 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20141118184343.GA5179@salvia \
--to=pablo@netfilter.org \
--cc=arturo.borrero.glez@gmail.com \
--cc=giuseppelng@gmail.com \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.