nft: consolidate nft_rule_new to support ARP

This patch removes nft_arp_rule_new, which almost a copy and paste
of the original nft_rule_new. This patch generalizes the
infrastructure to support ARP.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
index 0e6d9f98bac46337ddf73d7fedf01d47f3691ceb..10c7b63ee0ccd32341d7944ddadb6413d4ec5446 100644 (file)
--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
@@ -1,10 +1,13 @@
 /*
+ * (C) 2013 by Pablo Neira Ayuso <pablo@netfilter.org>
  * (C) 2013 by Giuseppe Longo <giuseppelng@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
  */
 
 #include <stdio.h>
@@ -14,6 +17,7 @@
 #include <net/if_arp.h>
 
 #include <xtables.h>
+#include <libiptc/libxtc.h>
 #include <net/if_arp.h>
 #include <netinet/if_ether.h>
 
@@ -161,6 +165,9 @@ static int nft_arp_add(struct nft_rule *r, void *data)
 {
        struct arpt_entry *fw = data;
        uint8_t flags = arpt_to_ipt_flags(fw->arp.invflags);
+       struct xt_entry_target *t;
+       char *targname;
+       int ret;
 
        if (fw->arp.iniface[0] != '\0')
                add_iniface(r, fw->arp.iniface, flags);
@@ -207,7 +214,28 @@ static int nft_arp_add(struct nft_rule *r, void *data)
                add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
                         &fw->arp.tgt.s_addr, 4, flags);
 
-       return 0;
+       /* Counters need to me added before the target, otherwise they are
+        * increased for each rule because of the way nf_tables works.
+        */
+       if (add_counters(r, fw->counters.pcnt, fw->counters.bcnt) < 0)
+               return -1;
+
+       t = nft_arp_get_target(fw);
+       targname = t->u.user.name;
+
+       /* Standard target? */
+       if (strcmp(targname, XTC_LABEL_ACCEPT) == 0)
+               ret = add_verdict(r, NF_ACCEPT);
+       else if (strcmp(targname, XTC_LABEL_DROP) == 0)
+               ret = add_verdict(r, NF_DROP);
+       else if (strcmp(targname, XTC_LABEL_RETURN) == 0)
+               ret = add_verdict(r, NFT_RETURN);
+       else if (xtables_find_target(targname, XTF_TRY_LOAD) != NULL)
+               ret = add_target(r, t);
+       else
+               ret = add_jumpto(r, targname, NFT_JUMP);
+
+       return ret;
 }
 
 static uint16_t ipt_to_arpt_flags(uint8_t invflags)

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 2142a2e6dc5dc1bc08b3b439d1d08d6f59df6f80..3be801d396ff926b0642b511caff8ebd74624a38 100644 (file)
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -22,11 +22,13 @@
 
 #include <linux/netfilter/nf_tables.h>
 
+#include "nft.h"
 #include "nft-shared.h"
 
 static int nft_ipv4_add(struct nft_rule *r, void *data)
 {
        struct iptables_command_state *cs = data;
+       struct xtables_rule_match *matchp;
        uint32_t op;
 
        if (cs->fw.ip.iniface[0] != '\0')
@@ -63,7 +65,18 @@ static int nft_ipv4_add(struct nft_rule *r, void *data)
 
        add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags);
 
-       return cs->fw.ip.flags;
+       for (matchp = cs->matches; matchp; matchp = matchp->next) {
+               if (add_match(r, matchp->match->m) < 0)
+                       break;
+       }
+
+       /* Counters need to me added before the target, otherwise they are
+        * increased for each rule because of the way nf_tables works.
+        */
+       if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
+               return -1;
+
+       return add_action(r, cs, cs->fw.ip.flags);
 }
 
 static bool nft_ipv4_is_same(const void *data_a,

diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index dbb148ab9eab50ea16b127a76943217d72e94a50..e3784a8b1306456dcc00318a2883727c60d0afc6 100644 (file)
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -20,11 +20,13 @@
 
 #include <xtables.h>
 
+#include "nft.h"
 #include "nft-shared.h"
 
 static int nft_ipv6_add(struct nft_rule *r, void *data)
 {
        struct iptables_command_state *cs = data;
+       struct xtables_rule_match *matchp;
 
        if (cs->fw6.ipv6.iniface[0] != '\0')
                add_iniface(r, cs->fw6.ipv6.iniface, cs->fw6.ipv6.invflags);
@@ -46,7 +48,18 @@ static int nft_ipv6_add(struct nft_rule *r, void *data)
 
        add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags);
 
-       return cs->fw6.ipv6.flags;
+       for (matchp = cs->matches; matchp; matchp = matchp->next) {
+               if (add_match(r, matchp->match->m) < 0)
+                       break;
+       }
+
+       /* Counters need to me added before the target, otherwise they are
+        * increased for each rule because of the way nf_tables works.
+        */
+       if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
+               return -1;
+
+       return add_action(r, cs, cs->fw6.ipv6.flags);
 }
 
 static bool nft_ipv6_is_same(const void *data_a,

diff --git a/iptables/nft.c b/iptables/nft.c
index d08a513b5a99cbc1b90c4859622b8691f8ddc343..c3784c0727f7c6dabf59e01c91cac1b9c8e8b988 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -589,7 +589,7 @@ static int __add_match(struct nft_rule_expr *e, struct xt_entry_match *m)
        return 0;
 }
 
-static int add_match(struct nft_rule *r, struct xt_entry_match *m)
+int add_match(struct nft_rule *r, struct xt_entry_match *m)
 {
        struct nft_rule_expr *expr;
        int ret;
@@ -671,6 +671,32 @@ int add_verdict(struct nft_rule *r, int verdict)
        return 0;
 }
 
+int add_action(struct nft_rule *r, struct iptables_command_state *cs,
+             int ip_flags)
+{
+       int ret = 0;
+
+       /* If no target at all, add nothing (default to continue) */
+       if (cs->target != NULL) {
+              /* Standard target? */
+              if (strcmp(cs->jumpto, XTC_LABEL_ACCEPT) == 0)
+                      ret = add_verdict(r, NF_ACCEPT);
+              else if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0)
+                      ret = add_verdict(r, NF_DROP);
+              else if (strcmp(cs->jumpto, XTC_LABEL_RETURN) == 0)
+                      ret = add_verdict(r, NFT_RETURN);
+              else
+                      ret = add_target(r, cs->target->t);
+       } else if (strlen(cs->jumpto) > 0) {
+              /* Not standard, then it's a go / jump to chain */
+              if (ip_flags & IPT_F_GOTO)
+                      ret = add_jumpto(r, cs->jumpto, NFT_GOTO);
+              else
+                      ret = add_jumpto(r, cs->jumpto, NFT_JUMP);
+       }
+       return ret;
+}
+
 static void nft_rule_print_debug(struct nft_rule *r, struct nlmsghdr *nlh)
 {
 #ifdef NLDEBUG
@@ -707,11 +733,9 @@ void add_compat(struct nft_rule *r, uint32_t proto, bool inv)
 
 static struct nft_rule *
 nft_rule_new(struct nft_handle *h, const char *chain, const char *table,
-            struct iptables_command_state *cs)
+            void *data)
 {
        struct nft_rule *r;
-       int ret = 0, ip_flags = 0;
-       struct xtables_rule_match *matchp;
 
        r = nft_rule_alloc();
        if (r == NULL)
@@ -721,39 +745,7 @@ nft_rule_new(struct nft_handle *h, const char *chain, const char *table,
        nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, (char *)table);
        nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, (char *)chain);
 
-       ip_flags = h->ops->add(r, cs);
-
-       for (matchp = cs->matches; matchp; matchp = matchp->next) {
-               if (add_match(r, matchp->match->m) < 0)
-                       goto err;
-       }
-
-       /* Counters need to me added before the target, otherwise they are
-        * increased for each rule because of the way nf_tables works.
-        */
-       if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
-               goto err;
-
-       /* If no target at all, add nothing (default to continue) */
-       if (cs->target != NULL) {
-               /* Standard target? */
-               if (strcmp(cs->jumpto, XTC_LABEL_ACCEPT) == 0)
-                       ret = add_verdict(r, NF_ACCEPT);
-               else if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0)
-                       ret = add_verdict(r, NF_DROP);
-               else if (strcmp(cs->jumpto, XTC_LABEL_RETURN) == 0)
-                       ret = add_verdict(r, NFT_RETURN);
-               else
-                       ret = add_target(r, cs->target->t);
-       } else if (strlen(cs->jumpto) > 0) {
-               /* Not standard, then it's a go / jump to chain */
-               if (ip_flags & IPT_F_GOTO)
-                       ret = add_jumpto(r, cs->jumpto, NFT_GOTO);
-               else
-                       ret = add_jumpto(r, cs->jumpto, NFT_JUMP);
-       }
-
-       if (ret < 0)
+       if (h->ops->add(r, data) < 0)
                goto err;
 
        return r;
@@ -2393,56 +2385,6 @@ err:
  * to ARP. These functions should go away with some refactoring of the
  * existing infrastructure.
  */
-static struct nft_rule *
-nft_arp_rule_new(struct nft_handle *h, const char *chain, const char *table,
-            struct arpt_entry *fw)
-{
-       struct xt_entry_target *t;
-       char *targname;
-       struct nft_rule *r;
-       int ret = 0;
-
-       t = nft_arp_get_target(fw);
-       targname = t->u.user.name;
-
-       r = nft_rule_alloc();
-       if (r == NULL)
-               return NULL;
-
-       nft_rule_attr_set_u32(r, NFT_RULE_ATTR_FAMILY, h->family);
-       nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, (char *)table);
-       nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, (char *)chain);
-
-       h->ops->add(r, fw);
-
-       /* Counters need to me added before the target, otherwise they are
-        * increased for each rule because of the way nf_tables works.
-        */
-       if (add_counters(r, fw->counters.pcnt, fw->counters.bcnt) < 0)
-               goto err;
-
-       /* Standard target? */
-       if (strcmp(targname, XTC_LABEL_ACCEPT) == 0)
-               ret = add_verdict(r, NF_ACCEPT);
-       else if (strcmp(targname, XTC_LABEL_DROP) == 0)
-               ret = add_verdict(r, NF_DROP);
-       else if (strcmp(targname, XTC_LABEL_RETURN) == 0)
-               ret = add_verdict(r, NFT_RETURN);
-       else if (xtables_find_target(targname, XTF_TRY_LOAD) != NULL)
-               ret = add_target(r, t);
-       else
-               ret = add_jumpto(r, targname, NFT_JUMP);
-
-       if (ret < 0)
-               goto err;
-
-       return r;
-err:
-       nft_rule_free(r);
-       return NULL;
-
-}
-
 static void
 nft_arp_rule_print_debug(struct nft_rule *r, struct nlmsghdr *nlh) {
 #ifdef NLDEBUG
@@ -2464,7 +2406,7 @@ nft_arp_rule_add(struct nft_handle *h, const char *chain,
        struct nft_rule *r;
        int ret = 1;
 
-       r = nft_arp_rule_new(h, chain, table, fw);
+       r = nft_rule_new(h, chain, table, fw);
        if (r == NULL) {
                ret = 0;
                goto err;
@@ -2507,7 +2449,7 @@ int nft_arp_rule_append(struct nft_handle *h, const char *chain,
 
        nft_fn = nft_arp_rule_append;
 
-       r = nft_arp_rule_new(h, chain, table, fw);
+       r = nft_rule_new(h, chain, table, fw);
        if (r == NULL) {
                ret = 0;
                goto err;

diff --git a/iptables/nft.h b/iptables/nft.h
index 09d3e0c57538cf77429e69cc3d62c5fb3378a793..8ddde48d4ef003c1eb1805eb9d2288cf16edf13b 100644 (file)
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -100,8 +100,10 @@ void nft_rule_list_destroy(struct nft_rule_list *list);
  */
 int add_counters(struct nft_rule *r, uint64_t packets, uint64_t bytes);
 int add_verdict(struct nft_rule *r, int verdict);
+int add_match(struct nft_rule *r, struct xt_entry_match *m);
 int add_target(struct nft_rule *r, struct xt_entry_target *t);
 int add_jumpto(struct nft_rule *r, const char *name, int verdict);
+int add_action(struct nft_rule *r, struct iptables_command_state *cs, int ip_flags);
 
 enum nft_rule_print {
        NFT_RULE_APPEND,