[iptables PATCH] ebtables: Fix corner-case noflush restore bug

[iptables PATCH] ebtables: Fix corner-case noflush restore bug

[Phil Sutter]

Report came from firwalld, but this is actually rather hard to trigger.
Since a regular chain line prevents it, typical dump/restore use-cases
are unaffected.

Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation")
Cc: Eric Garver <eric@garver.life>
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 .../testcases/ebtables/0009-broute-bug_0      | 25 +++++++++++++++++++
 iptables/xtables-eb.c                         |  2 ++
 2 files changed, 27 insertions(+)
 create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0

diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0
new file mode 100755
index 0000000000000..0def0ac58e7be
--- /dev/null
+++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0
@@ -0,0 +1,25 @@
+#!/bin/sh
+#
+# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring:
+# - with --noflush
+# - a second table after the broute one
+# - A policy command but no chain line for BROUTING chain
+
+set -e
+
+case "$XT_MULTI" in
+*xtables-nft-multi)
+	;;
+*)
+	echo "skip $XT_MULTI"
+	exit 0
+	;;
+esac
+
+$XT_MULTI ebtables-restore --noflush <<EOF
+*broute
+-P BROUTING ACCEPT
+*nat
+-P PREROUTING ACCEPT
+COMMIT
+EOF
diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
index 08eec79d80400..a8ad57c735cc5 100644
--- a/iptables/xtables-eb.c
+++ b/iptables/xtables-eb.c
@@ -169,6 +169,8 @@ int ebt_get_current_chain(const char *chain)
 		return NF_BR_LOCAL_OUT;
 	else if (strcmp(chain, "POSTROUTING") == 0)
 		return NF_BR_POST_ROUTING;
+	else if (strcmp(chain, "BROUTING") == 0)
+		return NF_BR_BROUTING;
 
 	/* placeholder for user defined chain */
 	return NF_BR_NUMHOOKS;
-- 
2.41.0

Re: [iptables PATCH] ebtables: Fix corner-case noflush restore bug

[Phil Sutter]

On Tue, Nov 07, 2023 at 07:25:00PM +0100, Phil Sutter wrote:
> Report came from firwalld, but this is actually rather hard to trigger.
> Since a regular chain line prevents it, typical dump/restore use-cases
> are unaffected.
> 
> Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation")
> Cc: Eric Garver <eric@garver.life>
> Signed-off-by: Phil Sutter <phil@nwl.cc>

Patch applied.