nft: consolidate nft_rule_new to support ARP
This patch removes nft_arp_rule_new, which almost a copy and paste
of the original nft_rule_new. This patch generalizes the
infrastructure to support ARP.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
index 0e6d9f9..10c7b63 100644
--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
@@ -1,10 +1,13 @@
/*
+ * (C) 2013 by Pablo Neira Ayuso <pablo@netfilter.org>
* (C) 2013 by Giuseppe Longo <giuseppelng@gmail.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
*/
#include <stdio.h>
@@ -14,6 +17,7 @@
#include <net/if_arp.h>
#include <xtables.h>
+#include <libiptc/libxtc.h>
#include <net/if_arp.h>
#include <netinet/if_ether.h>
@@ -161,6 +165,9 @@
{
struct arpt_entry *fw = data;
uint8_t flags = arpt_to_ipt_flags(fw->arp.invflags);
+ struct xt_entry_target *t;
+ char *targname;
+ int ret;
if (fw->arp.iniface[0] != '\0')
add_iniface(r, fw->arp.iniface, flags);
@@ -207,7 +214,28 @@
add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
&fw->arp.tgt.s_addr, 4, flags);
- return 0;
+ /* Counters need to me added before the target, otherwise they are
+ * increased for each rule because of the way nf_tables works.
+ */
+ if (add_counters(r, fw->counters.pcnt, fw->counters.bcnt) < 0)
+ return -1;
+
+ t = nft_arp_get_target(fw);
+ targname = t->u.user.name;
+
+ /* Standard target? */
+ if (strcmp(targname, XTC_LABEL_ACCEPT) == 0)
+ ret = add_verdict(r, NF_ACCEPT);
+ else if (strcmp(targname, XTC_LABEL_DROP) == 0)
+ ret = add_verdict(r, NF_DROP);
+ else if (strcmp(targname, XTC_LABEL_RETURN) == 0)
+ ret = add_verdict(r, NFT_RETURN);
+ else if (xtables_find_target(targname, XTF_TRY_LOAD) != NULL)
+ ret = add_target(r, t);
+ else
+ ret = add_jumpto(r, targname, NFT_JUMP);
+
+ return ret;
}
static uint16_t ipt_to_arpt_flags(uint8_t invflags)
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 2142a2e..3be801d 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -22,11 +22,13 @@
#include <linux/netfilter/nf_tables.h>
+#include "nft.h"
#include "nft-shared.h"
static int nft_ipv4_add(struct nft_rule *r, void *data)
{
struct iptables_command_state *cs = data;
+ struct xtables_rule_match *matchp;
uint32_t op;
if (cs->fw.ip.iniface[0] != '\0')
@@ -63,7 +65,18 @@
add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags);
- return cs->fw.ip.flags;
+ for (matchp = cs->matches; matchp; matchp = matchp->next) {
+ if (add_match(r, matchp->match->m) < 0)
+ break;
+ }
+
+ /* Counters need to me added before the target, otherwise they are
+ * increased for each rule because of the way nf_tables works.
+ */
+ if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
+ return -1;
+
+ return add_action(r, cs, cs->fw.ip.flags);
}
static bool nft_ipv4_is_same(const void *data_a,
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index dbb148a..e3784a8 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -20,11 +20,13 @@
#include <xtables.h>
+#include "nft.h"
#include "nft-shared.h"
static int nft_ipv6_add(struct nft_rule *r, void *data)
{
struct iptables_command_state *cs = data;
+ struct xtables_rule_match *matchp;
if (cs->fw6.ipv6.iniface[0] != '\0')
add_iniface(r, cs->fw6.ipv6.iniface, cs->fw6.ipv6.invflags);
@@ -46,7 +48,18 @@
add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags);
- return cs->fw6.ipv6.flags;
+ for (matchp = cs->matches; matchp; matchp = matchp->next) {
+ if (add_match(r, matchp->match->m) < 0)
+ break;
+ }
+
+ /* Counters need to me added before the target, otherwise they are
+ * increased for each rule because of the way nf_tables works.
+ */
+ if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
+ return -1;
+
+ return add_action(r, cs, cs->fw6.ipv6.flags);
}
static bool nft_ipv6_is_same(const void *data_a,
diff --git a/iptables/nft.c b/iptables/nft.c
index d08a513..c3784c0 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -589,7 +589,7 @@
return 0;
}
-static int add_match(struct nft_rule *r, struct xt_entry_match *m)
+int add_match(struct nft_rule *r, struct xt_entry_match *m)
{
struct nft_rule_expr *expr;
int ret;
@@ -671,6 +671,32 @@
return 0;
}
+int add_action(struct nft_rule *r, struct iptables_command_state *cs,
+ int ip_flags)
+{
+ int ret = 0;
+
+ /* If no target at all, add nothing (default to continue) */
+ if (cs->target != NULL) {
+ /* Standard target? */
+ if (strcmp(cs->jumpto, XTC_LABEL_ACCEPT) == 0)
+ ret = add_verdict(r, NF_ACCEPT);
+ else if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0)
+ ret = add_verdict(r, NF_DROP);
+ else if (strcmp(cs->jumpto, XTC_LABEL_RETURN) == 0)
+ ret = add_verdict(r, NFT_RETURN);
+ else
+ ret = add_target(r, cs->target->t);
+ } else if (strlen(cs->jumpto) > 0) {
+ /* Not standard, then it's a go / jump to chain */
+ if (ip_flags & IPT_F_GOTO)
+ ret = add_jumpto(r, cs->jumpto, NFT_GOTO);
+ else
+ ret = add_jumpto(r, cs->jumpto, NFT_JUMP);
+ }
+ return ret;
+}
+
static void nft_rule_print_debug(struct nft_rule *r, struct nlmsghdr *nlh)
{
#ifdef NLDEBUG
@@ -707,11 +733,9 @@
static struct nft_rule *
nft_rule_new(struct nft_handle *h, const char *chain, const char *table,
- struct iptables_command_state *cs)
+ void *data)
{
struct nft_rule *r;
- int ret = 0, ip_flags = 0;
- struct xtables_rule_match *matchp;
r = nft_rule_alloc();
if (r == NULL)
@@ -721,39 +745,7 @@
nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, (char *)table);
nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, (char *)chain);
- ip_flags = h->ops->add(r, cs);
-
- for (matchp = cs->matches; matchp; matchp = matchp->next) {
- if (add_match(r, matchp->match->m) < 0)
- goto err;
- }
-
- /* Counters need to me added before the target, otherwise they are
- * increased for each rule because of the way nf_tables works.
- */
- if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
- goto err;
-
- /* If no target at all, add nothing (default to continue) */
- if (cs->target != NULL) {
- /* Standard target? */
- if (strcmp(cs->jumpto, XTC_LABEL_ACCEPT) == 0)
- ret = add_verdict(r, NF_ACCEPT);
- else if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0)
- ret = add_verdict(r, NF_DROP);
- else if (strcmp(cs->jumpto, XTC_LABEL_RETURN) == 0)
- ret = add_verdict(r, NFT_RETURN);
- else
- ret = add_target(r, cs->target->t);
- } else if (strlen(cs->jumpto) > 0) {
- /* Not standard, then it's a go / jump to chain */
- if (ip_flags & IPT_F_GOTO)
- ret = add_jumpto(r, cs->jumpto, NFT_GOTO);
- else
- ret = add_jumpto(r, cs->jumpto, NFT_JUMP);
- }
-
- if (ret < 0)
+ if (h->ops->add(r, data) < 0)
goto err;
return r;
@@ -2393,56 +2385,6 @@
* to ARP. These functions should go away with some refactoring of the
* existing infrastructure.
*/
-static struct nft_rule *
-nft_arp_rule_new(struct nft_handle *h, const char *chain, const char *table,
- struct arpt_entry *fw)
-{
- struct xt_entry_target *t;
- char *targname;
- struct nft_rule *r;
- int ret = 0;
-
- t = nft_arp_get_target(fw);
- targname = t->u.user.name;
-
- r = nft_rule_alloc();
- if (r == NULL)
- return NULL;
-
- nft_rule_attr_set_u32(r, NFT_RULE_ATTR_FAMILY, h->family);
- nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, (char *)table);
- nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, (char *)chain);
-
- h->ops->add(r, fw);
-
- /* Counters need to me added before the target, otherwise they are
- * increased for each rule because of the way nf_tables works.
- */
- if (add_counters(r, fw->counters.pcnt, fw->counters.bcnt) < 0)
- goto err;
-
- /* Standard target? */
- if (strcmp(targname, XTC_LABEL_ACCEPT) == 0)
- ret = add_verdict(r, NF_ACCEPT);
- else if (strcmp(targname, XTC_LABEL_DROP) == 0)
- ret = add_verdict(r, NF_DROP);
- else if (strcmp(targname, XTC_LABEL_RETURN) == 0)
- ret = add_verdict(r, NFT_RETURN);
- else if (xtables_find_target(targname, XTF_TRY_LOAD) != NULL)
- ret = add_target(r, t);
- else
- ret = add_jumpto(r, targname, NFT_JUMP);
-
- if (ret < 0)
- goto err;
-
- return r;
-err:
- nft_rule_free(r);
- return NULL;
-
-}
-
static void
nft_arp_rule_print_debug(struct nft_rule *r, struct nlmsghdr *nlh) {
#ifdef NLDEBUG
@@ -2464,7 +2406,7 @@
struct nft_rule *r;
int ret = 1;
- r = nft_arp_rule_new(h, chain, table, fw);
+ r = nft_rule_new(h, chain, table, fw);
if (r == NULL) {
ret = 0;
goto err;
@@ -2507,7 +2449,7 @@
nft_fn = nft_arp_rule_append;
- r = nft_arp_rule_new(h, chain, table, fw);
+ r = nft_rule_new(h, chain, table, fw);
if (r == NULL) {
ret = 0;
goto err;
diff --git a/iptables/nft.h b/iptables/nft.h
index 09d3e0c..8ddde48 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -100,8 +100,10 @@
*/
int add_counters(struct nft_rule *r, uint64_t packets, uint64_t bytes);
int add_verdict(struct nft_rule *r, int verdict);
+int add_match(struct nft_rule *r, struct xt_entry_match *m);
int add_target(struct nft_rule *r, struct xt_entry_target *t);
int add_jumpto(struct nft_rule *r, const char *name, int verdict);
+int add_action(struct nft_rule *r, struct iptables_command_state *cs, int ip_flags);
enum nft_rule_print {
NFT_RULE_APPEND,
