[IPTABLES 0/2] iptables-compat fixes

[IPTABLES 0/2] iptables-compat fixes

[Thomas Woerner]

Here are the first patches from my tests with iptables-compat and firewalld:

The first patch is enabling to insert a rule into rule_count+1 position. 
# iptables-compat -t filter -S INPUT
-P INPUT ACCEPT
[0:0] -A INPUT -s 1.2.3.4/32 -j DROP
# iptables-compat -t filter -I INPUT 2 -s 1.2.3.5 -j DROP 
# iptables-compat -t filter -S INPUT
-P INPUT ACCEPT
[0:0] -A INPUT -s 1.2.3.4/32 -j DROP
[0:0] -A INPUT -s 1.2.3.5/32 -j DROP
This is possible with iptables, but not possible with iptables-compat.
Maybe it would be good to add nft_rule_list_count or similar and use it here.

The second patch fixes the rule number handling in nft_rule_find and 
__nft_rule_list. The rule number is only valid in the selected table and chain 
and therefore may not be increased for other tables or chains. With this patch 
the correct rule will be removed with -D <name> i and listed with -S <name> i.

Thomas Woerner (2):
  iptables-compat: Allow to insert into rule_count+1 position
  iptables-compat: Increase rule number only for the selected table and
    chain

 iptables/nft.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

-- 
2.4.3

[IPTABLES 1/2] iptables-compat: Allow to insert into rule_count+1 position

[Thomas Woerner]

iptables allows to insert a rule into the next non existing rule number but
iptables-compat does not allow to do this

Signed-off-by: Thomas Woerner <twoerner@redhat.com>
---
:100644 100644 7cd56ef... 323f124... M	iptables/nft.c
 iptables/nft.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/iptables/nft.c b/iptables/nft.c
index 7cd56ef..323f124 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1854,6 +1854,16 @@ int nft_rule_insert(struct nft_handle *h, const char *chain,
 
 		r = nft_rule_find(h, list, chain, table, data, rulenum);
 		if (r == NULL) {
+			/* special case: iptables allows to insert into
+			   rule_count+1 position */
+			r = nft_rule_find(h, list, chain, table, data,
+					  rulenum-1);
+			if (r != NULL) {
+				nft_rule_list_destroy(list);
+				return nft_rule_append(h, chain, table, data,
+						       0, verbose);
+			}
+
 			errno = ENOENT;
 			goto err;
 		}
-- 
2.4.3

[IPTABLES 2/2] iptables-compat: Increase rule number only for the selected table and chain

[Thomas Woerner]

This patch fixes the rule number handling in nft_rule_find and __nft_rule_list. The rule number is only valid in the selected table and chain and therefore may
not be increased for other tables or chains.

Signed-off-by: Thomas Woerner <twoerner@redhat.com>
---
:100644 100644 323f124... 139cf5a... M	iptables/nft.c
 iptables/nft.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/iptables/nft.c b/iptables/nft.c
index 323f124..139cf5a 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1746,17 +1746,17 @@ nft_rule_find(struct nft_handle *h, struct nft_rule_list *list,
 
 		if (rulenum >= 0) {
 			/* Delete by rule number case */
-			if (rule_ctr != rulenum)
-				goto next;
-			found = true;
-			break;
+			if (rule_ctr == rulenum) {
+			    found = true;
+			    break;
+			}
 		} else {
 			found = h->ops->rule_find(h->ops, r, data);
 			if (found)
 				break;
 		}
-next:
 		rule_ctr++;
+next:
 		r = nft_rule_list_iter_next(iter);
 	}
 
@@ -1965,12 +1965,12 @@ __nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
 		const char *rule_chain =
 			nft_rule_attr_get_str(r, NFT_RULE_ATTR_CHAIN);
 
-		rule_ctr++;
-
 		if (strcmp(table, rule_table) != 0 ||
 		    strcmp(chain, rule_chain) != 0)
 			goto next;
 
+		rule_ctr++;
+
 		if (rulenum > 0 && rule_ctr != rulenum) {
 			/* List by rule number case */
 			goto next;
-- 
2.4.3

Re: [IPTABLES 0/2] iptables-compat fixes

[Pablo Neira Ayuso]

On Tue, Jul 21, 2015 at 03:45:40PM +0200, Thomas Woerner wrote:
> Here are the first patches from my tests with iptables-compat and firewalld:
> 
> The first patch is enabling to insert a rule into rule_count+1 position. 
> # iptables-compat -t filter -S INPUT
> -P INPUT ACCEPT
> [0:0] -A INPUT -s 1.2.3.4/32 -j DROP
> # iptables-compat -t filter -I INPUT 2 -s 1.2.3.5 -j DROP 
> # iptables-compat -t filter -S INPUT
> -P INPUT ACCEPT
> [0:0] -A INPUT -s 1.2.3.4/32 -j DROP
> [0:0] -A INPUT -s 1.2.3.5/32 -j DROP
> This is possible with iptables, but not possible with iptables-compat.
> Maybe it would be good to add nft_rule_list_count or similar and use it here.
> 
> The second patch fixes the rule number handling in nft_rule_find and 
> __nft_rule_list. The rule number is only valid in the selected table and chain 
> and therefore may not be increased for other tables or chains. With this patch 
> the correct rule will be removed with -D <name> i and listed with -S <name> i.

Series applied, thanks Thomas!