[iptables PATCH] libxtables: extensions find based also on family

[iptables PATCH] libxtables: extensions find based also on family

[Arturo Borrero Gonzalez]

When using libxtables with an external program (nft) which switches family
contexts (using xtables_set_nfproto()), the extensions finding proccess
needs to be smarter and also know about the family.

We want to avoid this situation:

 1) user first sets context to IPv6
 2) xtables_find_target() finds & load ip6t_REJECT and uses it
 3) context switch to IPv4
 4) user then tries to use ipt_REJECT
 5) xtables_find_target() will find ip6t_REJECT instead (same target name)
 6) using ip6t_REJECT as ipt_REJECT can cause a lot of troubles

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
 libxtables/xtables.c |   22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/libxtables/xtables.c b/libxtables/xtables.c
index 9df12ce..c56d7dd 100644
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -603,6 +603,17 @@ static void *load_extension(const char *search_path, const char *af_prefix,
 }
 #endif
 
+static bool extension_cmp(const char *name1, const char *name2,
+			  uint32_t family)
+{
+	if ((strcmp(name1, name2) == 0) &&
+	    ((family == afinfo->family) ||
+	     (family == NFPROTO_UNSPEC)))
+		return true;
+
+	return false;
+}
+
 struct xtables_match *
 xtables_find_match(const char *name, enum xtables_tryload tryload,
 		   struct xtables_rule_match **matches)
@@ -625,7 +636,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
 
 	/* Trigger delayed initialization */
 	for (dptr = &xtables_pending_matches; *dptr; ) {
-		if (strcmp(name, (*dptr)->name) == 0) {
+		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
 			ptr = *dptr;
 			*dptr = (*dptr)->next;
 			ptr->next = NULL;
@@ -636,7 +647,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
 	}
 
 	for (ptr = xtables_matches; ptr; ptr = ptr->next) {
-		if (strcmp(name, ptr->name) == 0) {
+		if (extension_cmp(name, ptr->name, ptr->family)) {
 			struct xtables_match *clone;
 
 			/* First match of this type: */
@@ -686,7 +697,8 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
 		newentry = xtables_malloc(sizeof(struct xtables_rule_match));
 
 		for (i = matches; *i; i = &(*i)->next) {
-			if (strcmp(name, (*i)->match->name) == 0)
+			if (extension_cmp(name, (*i)->match->name,
+					  (*i)->match->family))
 				(*i)->completed = true;
 		}
 		newentry->match = ptr;
@@ -714,7 +726,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
 
 	/* Trigger delayed initialization */
 	for (dptr = &xtables_pending_targets; *dptr; ) {
-		if (strcmp(name, (*dptr)->name) == 0) {
+		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
 			ptr = *dptr;
 			*dptr = (*dptr)->next;
 			ptr->next = NULL;
@@ -725,7 +737,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
 	}
 
 	for (ptr = xtables_targets; ptr; ptr = ptr->next) {
-		if (strcmp(name, ptr->name) == 0)
+		if (extension_cmp(name, ptr->name, ptr->family))
 			break;
 	}
 

Re: [iptables PATCH] libxtables: extensions find based also on family

[Pablo Neira Ayuso]

On Wed, Apr 08, 2015 at 07:42:19PM +0200, Arturo Borrero Gonzalez wrote:
> When using libxtables with an external program (nft) which switches family
> contexts (using xtables_set_nfproto()), the extensions finding proccess
> needs to be smarter and also know about the family.
> 
> We want to avoid this situation:
> 
>  1) user first sets context to IPv6
>  2) xtables_find_target() finds & load ip6t_REJECT and uses it
>  3) context switch to IPv4
>  4) user then tries to use ipt_REJECT
>  5) xtables_find_target() will find ip6t_REJECT instead (same target name)
>  6) using ip6t_REJECT as ipt_REJECT can cause a lot of troubles

Applied with minor changes:

http://git.netfilter.org/iptables/commit/?id=06d14d702e481f29d5fdc33afab4347e6efb678d

Thanks.