[PATCH] ebtables: Allow RETURN target rules in user defined chains

[PATCH] ebtables: Allow RETURN target rules in user defined chains

[Alin Nastac]

ebtables has a bug that prevents creation of rules with RETURN target, any attempt will result in an
    RETURN not allowed on base chain
error even if the chain where you want to create the rule is a user defined chain.

Reproduction scenario:
    root@OpenWrt:~# ebtables -N foo
    root@OpenWrt:~# ebtables -A OUTPUT -j foo
    root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN
    --mark-target RETURN not allowed on base chain.

My email client will probably replace tabs in the patch below, but it is a one-liner patch after all, easy to spot the actual 
change.

diff --git a/libebtc.c b/libebtc.c
--- a/libebtc.c
+++ b/libebtc.c
@@ -1102,7 +1102,7 @@ void ebt_check_for_loops(struct ebt_u_replace *replace)
                         /* check if we've dealt with this chain already */
                         if (entries2->hook_mask & (1<<i))
                                 goto letscontinue;
-                       entries2->hook_mask |= entries->hook_mask;
+                       entries2->hook_mask |= entries->hook_mask & ~(1 << NF_BR_NUMHOOKS);
                         /* Jump to the chain, make sure we know how to get back */
                         stack[sp].chain_nr = chain_nr;
                         stack[sp].n = j;

Re: [PATCH] ebtables: Allow RETURN target rules in user defined chains

[Florian Westphal]

Alin Nastac <alin.nastac@gmail.com> wrote:
> ebtables has a bug that prevents creation of rules with RETURN target, any attempt will result in an
>    RETURN not allowed on base chain
> error even if the chain where you want to create the rule is a user defined chain.
> 
> Reproduction scenario:
>    root@OpenWrt:~# ebtables -N foo
>    root@OpenWrt:~# ebtables -A OUTPUT -j foo
>    root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN
>    --mark-target RETURN not allowed on base chain.
> 
> My email client will probably replace tabs in the patch below, but

Yes, I applied this manually (with minor edits to commit message).

Thanks.

Re: [PATCH] ebtables: Allow RETURN target rules in user defined chains

[Pablo Neira Ayuso]

On Wed, Oct 28, 2015 at 02:01:55AM +0100, Florian Westphal wrote:
> Alin Nastac <alin.nastac@gmail.com> wrote:
> > ebtables has a bug that prevents creation of rules with RETURN target, any attempt will result in an
> >    RETURN not allowed on base chain
> > error even if the chain where you want to create the rule is a user defined chain.
> > 
> > Reproduction scenario:
> >    root@OpenWrt:~# ebtables -N foo
> >    root@OpenWrt:~# ebtables -A OUTPUT -j foo
> >    root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN
> >    --mark-target RETURN not allowed on base chain.
> > 
> > My email client will probably replace tabs in the patch below, but
> 
> Yes, I applied this manually (with minor edits to commit message).

Thanks, I wonder since then this has been broken BTW.

Re: [PATCH] ebtables: Allow RETURN target rules in user defined chains

[Pablo Neira Ayuso]

On Wed, Oct 28, 2015 at 03:46:00AM +0100, Pablo Neira Ayuso wrote:
> On Wed, Oct 28, 2015 at 02:01:55AM +0100, Florian Westphal wrote:
> > Alin Nastac <alin.nastac@gmail.com> wrote:
> > > ebtables has a bug that prevents creation of rules with RETURN target, any attempt will result in an
> > >    RETURN not allowed on base chain
> > > error even if the chain where you want to create the rule is a user defined chain.
> > > 
> > > Reproduction scenario:
> > >    root@OpenWrt:~# ebtables -N foo
> > >    root@OpenWrt:~# ebtables -A OUTPUT -j foo
> > >    root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN
> > >    --mark-target RETURN not allowed on base chain.
> > > 
> > > My email client will probably replace tabs in the patch below, but
> > 
> > Yes, I applied this manually (with minor edits to commit message).
> 
> Thanks, I wonder since then this has been broken BTW.

s/then/when/

Re: [PATCH] ebtables: Allow RETURN target rules in user defined chains

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Oct 28, 2015 at 03:46:00AM +0100, Pablo Neira Ayuso wrote:
> > On Wed, Oct 28, 2015 at 02:01:55AM +0100, Florian Westphal wrote:
> > > Alin Nastac <alin.nastac@gmail.com> wrote:
> > > > ebtables has a bug that prevents creation of rules with RETURN target, any attempt will result in an
> > > >    RETURN not allowed on base chain
> > > > error even if the chain where you want to create the rule is a user defined chain.
> > > > 
> > > > Reproduction scenario:
> > > >    root@OpenWrt:~# ebtables -N foo
> > > >    root@OpenWrt:~# ebtables -A OUTPUT -j foo
> > > >    root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN
> > > >    --mark-target RETURN not allowed on base chain.
> > > > 
> > > > My email client will probably replace tabs in the patch below, but
> > > 
> > > Yes, I applied this manually (with minor edits to commit message).
> > 
> > Thanks, I wonder since then this has been broken BTW.
> 
> s/then/when/

Seems it never worked.

I hacked 'allow checking for --xxxx--target RETURN rules on base chains'
commit from 2002 to build and it rejects RETURN unconditionally.