why don't we use /etc/protocols ?

why don't we use /etc/protocols ?

[Pedro Lamarão]

[-- Attachment #1: Type: text/plain, Size: 473 bytes --]

Hello.

I've just subscribed to the list, so, uhm, hello.

I tried to look for some older discussion about this section of 
iptables-save.c, but I'm not that good at searching mailing list 
archives, so here it goes.

Browsing the code I stumbled at this FIXME in iptables-save.c and 
produced the following patch. Please review it and send me comments. 
I'll be over this code for some time, so, if there is more of this kind 
of FIXME, I'd gladly work on it.

--
  Pedro

[-- Attachment #2: patch.txt --]
[-- Type: text/plain, Size: 1276 bytes --]

Index: iptables-save.c
===================================================================
RCS file: /cvspublic/iptables/iptables-save.c,v
retrieving revision 1.27
diff -u -r1.27 iptables-save.c
--- iptables-save.c	21 Feb 2004 09:20:34 -0000	1.27
+++ iptables-save.c	18 Mar 2004 18:53:54 -0000
@@ -62,36 +62,18 @@
 	printf(" ");
 }
 
-/* These are hardcoded backups in iptables.c, so they are safe */
-struct pprot {
-	char *name;
-	u_int8_t num;
-};
-
-/* FIXME: why don't we use /etc/protocols ? */
-static const struct pprot chain_protos[] = {
-	{ "tcp", IPPROTO_TCP },
-	{ "udp", IPPROTO_UDP },
-	{ "icmp", IPPROTO_ICMP },
-	{ "esp", IPPROTO_ESP },
-	{ "ah", IPPROTO_AH },
-	{ "sctp", IPPROTO_SCTP },
-};
-
 static void print_proto(u_int16_t proto, int invert)
 {
 	if (proto) {
-		unsigned int i;
 		const char *invertstr = invert ? "! " : "";
 
-		for (i = 0; i < sizeof(chain_protos)/sizeof(struct pprot); i++)
-			if (chain_protos[i].num == proto) {
-				printf("-p %s%s ",
-				       invertstr, chain_protos[i].name);
-				return;
-			}
-
-		printf("-p %s%u ", invertstr, proto);
+		struct protoent* pent = getprotobynumber(proto)
+		if (proto) {
+			printf("-p %s%s ", invertstr, pent->p_name);
+		}
+		else {
+			printf("-p %s%u", invertstr, proto);
+		}
 	}
 }
 

Re: why don't we use /etc/protocols ?

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 1085 bytes --]

On Thu, Mar 18, 2004 at 03:54:39PM -0300, Pedro Lamarão wrote:
> Browsing the code I stumbled at this FIXME in iptables-save.c and 
> produced the following patch. Please review it and send me comments. 
> I'll be over this code for some time, so, if there is more of this kind 
> of FIXME, I'd gladly work on it.

Thanks for your patch.  I think the original idea of that array was to
have it working even if there is no /etc/protocols (small embedded
system, ..).

So in a 'perfect' world, we would keep our small table for
commonly-used protocol and only query /etc/protocols if we don't have a
match.

Please also update iptables.c to make it consistent with
iptables-save/restore.

>  Pedro
-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: why don't we use /etc/protocols ?

[Pedro Lamarão]

[-- Attachment #1: Type: text/plain, Size: 1122 bytes --]

Harald Welte wrote:

> Thanks for your patch.  I think the original idea of that array was to
> have it working even if there is no /etc/protocols (small embedded
> system, ..).
> 
> So in a 'perfect' world, we would keep our small table for
> commonly-used protocol and only query /etc/protocols if we don't have a
> match.
> 
> Please also update iptables.c to make it consistent with
> iptables-save/restore.

I'm sorry to have taken so long to respond.
I've been studying this stuff and preparing a version of iptables-save 
that outputs in a XML format (with the appropriate DTD). I'm not quite 
finished yet.

As per your request, I've modified the patch to keep the protocol table.
Peeking more I saw that ip6tables-save.c has code to use 
getprotobynumber, so I've sort of reproduced that exactly.
The patch got quite small.

And iptables.c uses getprotobynumber in proto-to-name -- if there's 
somewhere else that requires change, I've not found it by myself.

When I'm finished with my little project, I'll post the code (rather 
small) to the list for review.

--
  Pedro Lamarão

[-- Attachment #2: iptables-save.patch --]
[-- Type: text/x-patch, Size: 746 bytes --]

? .cdtproject
? .project
? iptables-save.patch
Index: iptables-save.c
===================================================================
RCS file: /cvspublic/iptables/iptables-save.c,v
retrieving revision 1.27
diff -u -r1.27 iptables-save.c
--- iptables-save.c	21 Feb 2004 09:20:34 -0000	1.27
+++ iptables-save.c	2 Apr 2004 00:53:10 -0000
@@ -84,6 +84,13 @@
 		unsigned int i;
 		const char *invertstr = invert ? "! " : "";
 
+                struct protoent *pent = getprotobynumber(proto);
+                if (pent) {
+			printf("-p %s%s ",
+			       invertstr, pent->p_name);
+	                return;
+		}
+
 		for (i = 0; i < sizeof(chain_protos)/sizeof(struct pprot); i++)
 			if (chain_protos[i].num == proto) {
 				printf("-p %s%s ",