[PATCH 1/3] iptables-compat: fix chain policy reset with iptables -L -n

[PATCH 1/3] iptables-compat: fix chain policy reset with iptables -L -n

[Pablo Neira Ayuso]

Initialize built-in tables/chains if they don't exists, otherwise
simply skip.

This avoids the chain policy reset to NF_ACCEPT by when you call
iptables -L -n.

Reported-by: Ana Rey <anarey@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 iptables/nft.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/iptables/nft.c b/iptables/nft.c
index ca199cd..b68b275 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -620,11 +620,17 @@ __nft_chain_builtin_init(struct nft_handle *h,
 			 int policy)
 {
 	int i, default_policy;
+	struct nft_chain_list *list = nft_chain_dump(h);
+	struct nft_chain *c;
 
-	/* Initialize all built-in chains. Exception, for e one received as
-	 * parameter, set the default policy as requested.
-	 */
+	/* Initialize built-in chains if they don't exist yet */
 	for (i=0; i<NF_IP_NUMHOOKS && table->chains[i].name != NULL; i++) {
+
+		c = nft_chain_list_find(list, table->name,
+					table->chains[i].name);
+		if (c != NULL)
+			continue;
+
 		if (chain && strcmp(table->chains[i].name, chain) == 0)
 			default_policy = policy;
 		else
@@ -633,6 +639,8 @@ __nft_chain_builtin_init(struct nft_handle *h,
 		nft_chain_builtin_add(h, table, &table->chains[i],
 					default_policy);
 	}
+
+	nft_chain_list_free(list);
 }
 
 int
-- 
1.7.10.4

[PATCH 2/3] iptables-compat: statify unused built-in table/chain functions

[Pablo Neira Ayuso]

The functions that allows you to create built-in table and chains are
required out of the scope of nft.c

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 iptables/nft.c |   14 +++++++-------
 iptables/nft.h |    5 -----
 2 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/iptables/nft.c b/iptables/nft.c
index b68b275..33afae4 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -518,7 +518,7 @@ static int nft_table_builtin_add(struct nft_handle *h,
 	return ret;
 }
 
-struct nft_chain *
+static struct nft_chain *
 nft_chain_builtin_alloc(struct builtin_table *table,
 			struct builtin_chain *chain, int policy)
 {
@@ -561,8 +561,9 @@ int nft_chain_add(struct nft_handle *h, struct nft_chain *c, uint16_t flags)
 	return mnl_talk(h, nlh, NULL, NULL);
 }
 
-void nft_chain_builtin_add(struct nft_handle *h, struct builtin_table *table,
-			   struct builtin_chain *chain, int policy)
+static void nft_chain_builtin_add(struct nft_handle *h,
+				  struct builtin_table *table,
+				  struct builtin_chain *chain, int policy)
 {
 	struct nft_chain *c;
 
@@ -598,7 +599,7 @@ nft_table_builtin_find(struct nft_handle *h, const char *table)
 }
 
 /* find if built-in chain already exists */
-struct builtin_chain *
+static struct builtin_chain *
 nft_chain_builtin_find(struct builtin_table *t, const char *chain)
 {
 	int i;
@@ -643,9 +644,8 @@ __nft_chain_builtin_init(struct nft_handle *h,
 	nft_chain_list_free(list);
 }
 
-int
-nft_chain_builtin_init(struct nft_handle *h, const char *table,
-		       const char *chain, int policy)
+static int nft_chain_builtin_init(struct nft_handle *h, const char *table,
+				  const char *chain, int policy)
 {
 	int ret = 0;
 	struct builtin_table *t;
diff --git a/iptables/nft.h b/iptables/nft.h
index 339d7bc..0db2ed6 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -54,7 +54,6 @@ void nft_fini(struct nft_handle *h);
 struct nft_table;
 struct nft_chain_list;
 
-struct builtin_table *nft_table_builtin_find(struct nft_handle *h, const char *table);
 int nft_table_add(struct nft_handle *h, struct nft_table *t, uint16_t flags);
 int nft_for_each_table(struct nft_handle *h, int (*func)(struct nft_handle *h, const char *tablename, bool counters), bool counters);
 bool nft_table_find(struct nft_handle *h, const char *tablename);
@@ -65,10 +64,6 @@ int nft_table_purge_chains(struct nft_handle *h, const char *table, struct nft_c
  */
 struct nft_chain;
 
-struct nft_chain *nft_chain_builtin_alloc(struct builtin_table *table, struct builtin_chain *chain, int policy);
-void nft_chain_builtin_add(struct nft_handle *h, struct builtin_table *table, struct builtin_chain *chain, int policy);
-struct builtin_chain *nft_chain_builtin_find(struct builtin_table *t, const char *chain);
-int nft_chain_builtin_init(struct nft_handle *h, const char *table, const char *chain, int policy);
 int nft_chain_add(struct nft_handle *h, struct nft_chain *c, uint16_t flags);
 int nft_chain_set(struct nft_handle *h, const char *table, const char *chain, const char *policy, const struct xt_counters *counters);
 struct nft_chain_list *nft_chain_dump(struct nft_handle *h);
-- 
1.7.10.4

[PATCH 3/3] iptables-compat: assume chain policy NF_ACCEPT when creating built-in chains

[Pablo Neira Ayuso]

Newly created (emulated) xt built-in chain have to use NF_ACCEPT. Remove
extra unused chain parameter and rename nft_chain_builtin_init to
nft_xt_builtin_init too.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 iptables/nft.c |   39 +++++++++++++++------------------------
 1 file changed, 15 insertions(+), 24 deletions(-)

diff --git a/iptables/nft.c b/iptables/nft.c
index 33afae4..ac72bfa 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -563,11 +563,11 @@ int nft_chain_add(struct nft_handle *h, struct nft_chain *c, uint16_t flags)
 
 static void nft_chain_builtin_add(struct nft_handle *h,
 				  struct builtin_table *table,
-				  struct builtin_chain *chain, int policy)
+				  struct builtin_chain *chain)
 {
 	struct nft_chain *c;
 
-	c = nft_chain_builtin_alloc(table, chain, policy);
+	c = nft_chain_builtin_alloc(table, chain, NF_ACCEPT);
 	if (c == NULL)
 		return;
 
@@ -578,8 +578,8 @@ static void nft_chain_builtin_add(struct nft_handle *h,
 }
 
 /* find if built-in table already exists */
-struct builtin_table *
-nft_table_builtin_find(struct nft_handle *h, const char *table)
+static struct builtin_table *nft_table_builtin_find(struct nft_handle *h,
+						    const char *table)
 {
 	int i;
 	bool found = false;
@@ -615,12 +615,10 @@ nft_chain_builtin_find(struct builtin_table *t, const char *chain)
 	return found ? &t->chains[i] : NULL;
 }
 
-static void
-__nft_chain_builtin_init(struct nft_handle *h,
-			 struct builtin_table *table, const char *chain,
-			 int policy)
+static void nft_chain_builtin_init(struct nft_handle *h,
+				   struct builtin_table *table)
 {
-	int i, default_policy;
+	int i;
 	struct nft_chain_list *list = nft_chain_dump(h);
 	struct nft_chain *c;
 
@@ -632,20 +630,13 @@ __nft_chain_builtin_init(struct nft_handle *h,
 		if (c != NULL)
 			continue;
 
-		if (chain && strcmp(table->chains[i].name, chain) == 0)
-			default_policy = policy;
-		else
-			default_policy = NF_ACCEPT;
-
-		nft_chain_builtin_add(h, table, &table->chains[i],
-					default_policy);
+		nft_chain_builtin_add(h, table, &table->chains[i]);
 	}
 
 	nft_chain_list_free(list);
 }
 
-static int nft_chain_builtin_init(struct nft_handle *h, const char *table,
-				  const char *chain, int policy)
+static int nft_xt_builtin_init(struct nft_handle *h, const char *table)
 {
 	int ret = 0;
 	struct builtin_table *t;
@@ -660,7 +651,7 @@ static int nft_chain_builtin_init(struct nft_handle *h, const char *table,
 		if (errno == EEXIST)
 			goto out;
 	}
-	__nft_chain_builtin_init(h, t, chain, policy);
+	nft_chain_builtin_init(h, t);
 out:
 	return ret;
 }
@@ -1003,7 +994,7 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
 
 	/* If built-in chains don't exist for this table, create them */
 	if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
-		nft_chain_builtin_init(h, table, chain, NF_ACCEPT);
+		nft_xt_builtin_init(h, table);
 
 	nft_fn = nft_rule_append;
 
@@ -1309,7 +1300,7 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
 
 	/* If built-in chains don't exist for this table, create them */
 	if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
-		nft_chain_builtin_init(h, table, NULL, NF_ACCEPT);
+		nft_xt_builtin_init(h, table);
 
 	c = nft_chain_alloc();
 	if (c == NULL)
@@ -1466,7 +1457,7 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
 
 	/* If built-in chains don't exist for this table, create them */
 	if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
-		nft_chain_builtin_init(h, table, NULL, NF_ACCEPT);
+		nft_xt_builtin_init(h, table);
 
 	/* Find the old chain to be renamed */
 	c = nft_chain_find(h, table, chain);
@@ -1793,7 +1784,7 @@ int nft_rule_insert(struct nft_handle *h, const char *chain,
 
 	/* If built-in chains don't exist for this table, create them */
 	if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
-		nft_chain_builtin_init(h, table, chain, NF_ACCEPT);
+		nft_xt_builtin_init(h, table);
 
 	nft_fn = nft_rule_insert;
 
@@ -1947,7 +1938,7 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
 
 	/* If built-in chains don't exist for this table, create them */
 	if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0)
-		nft_chain_builtin_init(h, table, NULL, NF_ACCEPT);
+		nft_xt_builtin_init(h, table);
 
 	ops = nft_family_ops_lookup(h->family);
 
-- 
1.7.10.4

Re: [PATCH 1/3] iptables-compat: fix chain policy reset with iptables -L -n

[Ana Rey]

2014-10-23 13:18 GMT+02:00 Pablo Neira Ayuso <pablo@netfilter.org>:
> Initialize built-in tables/chains if they don't exists, otherwise
> simply skip.
>
> This avoids the chain policy reset to NF_ACCEPT by when you call
> iptables -L -n.
>
> Reported-by: Ana Rey <anarey@gmail.com>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Tested-by: Ana Rey <anarey@gmail.com>


> ---
>  iptables/nft.c |   14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/iptables/nft.c b/iptables/nft.c
> index ca199cd..b68b275 100644
> --- a/iptables/nft.c
> +++ b/iptables/nft.c
> @@ -620,11 +620,17 @@ __nft_chain_builtin_init(struct nft_handle *h,
>                          int policy)
>  {
>         int i, default_policy;
> +       struct nft_chain_list *list = nft_chain_dump(h);
> +       struct nft_chain *c;
>
> -       /* Initialize all built-in chains. Exception, for e one received as
> -        * parameter, set the default policy as requested.
> -        */
> +       /* Initialize built-in chains if they don't exist yet */
>         for (i=0; i<NF_IP_NUMHOOKS && table->chains[i].name != NULL; i++) {
> +
> +               c = nft_chain_list_find(list, table->name,
> +                                       table->chains[i].name);
> +               if (c != NULL)
> +                       continue;
> +
>                 if (chain && strcmp(table->chains[i].name, chain) == 0)
>                         default_policy = policy;
>                 else
> @@ -633,6 +639,8 @@ __nft_chain_builtin_init(struct nft_handle *h,
>                 nft_chain_builtin_add(h, table, &table->chains[i],
>                                         default_policy);
>         }
> +
> +       nft_chain_list_free(list);
>  }
>
>  int
> --
> 1.7.10.4
>



-- 
Ana Rey (@anaRB)
http://about.me/anarey