[PATCH 0/2] xtables-eb for the compatibility layer

[Giuseppe Longo <giuseppelng@gmail.com>]

Hi,
this patchset implements ebtables for the nftables compatibility layer.
I would explain some points:

- The code is not built with the gcc version 4.7.3 (Gentoo 4.7.3-r1 p1.3, pie-0.5.5):
xtables_multi-nft-bridge.o:/home/giuseppe/git/iptables-nftables/iptables/nft-bridge.c:53: first defined here
xtables_multi-nft-bridge.o: In function `nft_rule_to_xtables_ebt_entry':
/home/giuseppe/git/iptables-nftables/iptables/nft-bridge.c:226: multiple definition of `nft_rule_to_xtables_ebt_entry'
xtables_multi-nft-bridge.o:/home/giuseppe/git/iptables-nftables/iptables/nft-bridge.c:226: first defined here
xtables_multi-nft-bridge.o:(.data+0x0): multiple definition of `nft_family_ops_bridge'
xtables_multi-nft-bridge.o:(.data+0x0): first defined here
collect2: error: ld returned 1 exit status

but, with the gcc version 4.8.2 (Debian 4.8.2-1) (on my vm) it works fine.
I didn't figure out the reason, honestly.

- I didn't figure out how to replace some parts of codes, for istance:
  from xtables-eb.c, line 928:
  t = (struct ebt_u_target *)new_entry->t;
  if ((t->parse(c - t->option_offset, argv, argc, new_entry, &t->flags, &t->t))) {
	  if (ebt_errormsg[0] != '\0')
		  return -1;
	  goto check_extension;
  }

  /* Is it a match_option? */
  for (m = ebt_matches; m; m = m->next)
	  if (m->parse(c - m->option_offset, argv, argc, new_entry, &m->flags, &m->m))
		  break;

  if (m != NULL) {
	  if (ebt_errormsg[0] != '\0')
		  return -1;
	  if (m->used == 0) {
		  ebt_add_match(new_entry, m);
		  m->used = 1;
	  }
	  goto check_extension;
  }
  
Looking at extensions, I noticed that any xtables_match/xtables_target have parse functions. Maybe I'm wrong.
Even the code from line 992 is not very clear, about final checks. I don't know if I can remove this part of code.

Thanks

Giuseppe Longo (2):
  xtables: bootstrap xtables-eb for nftables
  Operations for bridge family

 include/linux/netfilter_bridge.h            |   33 +
 include/linux/netfilter_bridge/ebtables.h   |  276 +++++++
 include/linux/netfilter_bridge/ethernetdb.h |   58 ++
 iptables/Makefile.am                        |    8 +-
 iptables/getethertype.c                     |  161 ++++
 iptables/nft-bridge.c                       |  384 +++++++++
 iptables/nft-shared.c                       |    3 +
 iptables/nft.c                              |   28 +
 iptables/nft.h                              |   12 +
 iptables/xtables-eb-standalone.c            |   87 +++
 iptables/xtables-eb.c                       | 1122 +++++++++++++++++++++++++++
 iptables/xtables-ebtables.h                 |   39 +
 iptables/xtables-multi.c                    |    1 +
 iptables/xtables-multi.h                    |    1 +
 14 files changed, 2210 insertions(+), 3 deletions(-)
 create mode 100644 include/linux/netfilter_bridge.h
 create mode 100644 include/linux/netfilter_bridge/ebtables.h
 create mode 100644 include/linux/netfilter_bridge/ethernetdb.h
 create mode 100644 iptables/getethertype.c
 create mode 100644 iptables/nft-bridge.c
 create mode 100644 iptables/xtables-eb-standalone.c
 create mode 100644 iptables/xtables-eb.c
 create mode 100644 iptables/xtables-ebtables.h

-- 
1.8.1.5