ebtables: Support '-p Length'

To match on Ethernet frames using the etherproto field as length value,
ebtables accepts the special protocol name "LENGTH". Implement this in
ebtables-nft using a native match for 'ether type < 0x0600'.

Since extension 802_3 matches are valid only with such Ethernet frames,
add a local add_match() wrapper which complains if the extension is used
without '-p Length' parameter. Legacy ebtables does this within the
extension's final_check callback, but it's not possible here due for lack of
fw->bitmask field access.

While being at it, add xlate support, adjust tests and make ebtables-nft
print the case-insensitive argument with capital 'L' like legacy
ebtables does.

Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/extensions/generic.txlate b/extensions/generic.txlate
index 9ae9a5b54c1b98af078e56e3b29841ceacc2a3aa..6779d6f86dec8f1e1143107290655ea0573bbf55 100644 (file)
--- a/extensions/generic.txlate
+++ b/extensions/generic.txlate
@@ -67,6 +67,12 @@ nft add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oi
 ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00
 nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter
 
+ebtables-translate -I INPUT -p Length
+nft insert rule bridge filter INPUT ether type < 0x0600 counter
+
+ebtables-translate -I INPUT -p ! Length
+nft insert rule bridge filter INPUT ether type >= 0x0600 counter
+
 # asterisk is not special in iptables and it is even a valid interface name
 iptables-translate -A FORWARD -i '*' -o 'eth*foo'
 nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter

diff --git a/extensions/libebt_802_3.t b/extensions/libebt_802_3.t
index ddfb2f0a72baf46ca9f35c9042059cc6a32b9858..a138f35d2c756e73c343949f4b7659424c2444c2 100644 (file)
--- a/extensions/libebt_802_3.t
+++ b/extensions/libebt_802_3.t
@@ -1,3 +1,5 @@
 :INPUT,FORWARD,OUTPUT
---802_3-sap ! 0x0a -j CONTINUE;=;OK
---802_3-type 0x000a -j RETURN;=;OK
+--802_3-sap ! 0x0a -j CONTINUE;=;FAIL
+--802_3-type 0x000a -j RETURN;=;FAIL
+-p Length --802_3-sap ! 0x0a -j CONTINUE;=;OK
+-p Length --802_3-type 0x000a -j RETURN;=;OK

diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
index 1121e8644a4e1a73c8b37d7e014741945eda4b38..659c5b58ba633e7056f4d6387fc33541dd3b66be 100644 (file)
--- a/iptables/nft-bridge.c
+++ b/iptables/nft-bridge.c
@@ -100,6 +100,18 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs)
        return add_action(r, cs, false);
 }
 
+static int
+nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw,
+                    struct nftnl_rule *r, struct xt_entry_match *m)
+{
+       if (!strcmp(m->u.user.name, "802_3") &&
+           !(fw->bitmask & EBT_802_3))
+               xtables_error(PARAMETER_PROBLEM,
+                             "For 802.3 DSAP/SSAP filtering the protocol must be LENGTH");
+
+       return add_match(h, r, m);
+}
+
 static int nft_bridge_add(struct nft_handle *h,
                          struct nftnl_rule *r,
                          struct iptables_command_state *cs)
@@ -143,19 +155,26 @@ static int nft_bridge_add(struct nft_handle *h,
        }
 
        if ((fw->bitmask & EBT_NOPROTO) == 0) {
+               uint16_t ethproto = fw->ethproto;
                uint8_t reg;
 
                op = nft_invflags2cmp(fw->invflags, EBT_IPROTO);
                add_payload(h, r, offsetof(struct ethhdr, h_proto), 2,
                            NFT_PAYLOAD_LL_HEADER, &reg);
-               add_cmp_u16(r, fw->ethproto, op, reg);
+
+               if (fw->bitmask & EBT_802_3) {
+                       op = (op == NFT_CMP_EQ ? NFT_CMP_LT : NFT_CMP_GTE);
+                       ethproto = htons(0x0600);
+               }
+
+               add_cmp_u16(r, ethproto, op, reg);
        }
 
        add_compat(r, fw->ethproto, fw->invflags & EBT_IPROTO);
 
        for (iter = cs->match_list; iter; iter = iter->next) {
                if (iter->ismatch) {
-                       if (add_match(h, r, iter->u.match->m))
+                       if (nft_bridge_add_match(h, fw, r, iter->u.match->m))
                                break;
                } else {
                        if (add_target(r, iter->u.watcher->t))
@@ -214,6 +233,7 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,
        struct ebt_entry *fw = &cs->eb;
        unsigned char addr[ETH_ALEN];
        unsigned short int ethproto;
+       uint8_t op;
        bool inv;
        int i;
 
@@ -246,8 +266,14 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,
                fw->bitmask |= EBT_ISOURCE;
                break;
        case offsetof(struct ethhdr, h_proto):
-               get_cmp_data(e, &ethproto, sizeof(ethproto), &inv);
-               fw->ethproto = ethproto;
+               __get_cmp_data(e, &ethproto, sizeof(ethproto), &op);
+               if (ethproto == htons(0x0600)) {
+                       fw->bitmask |= EBT_802_3;
+                       inv = (op == NFT_CMP_GTE);
+               } else {
+                       fw->ethproto = ethproto;
+                       inv = (op == NFT_CMP_NEQ);
+               }
                if (inv)
                        fw->invflags |= EBT_IPROTO;
                fw->bitmask &= ~EBT_NOPROTO;
@@ -613,7 +639,7 @@ static void print_protocol(uint16_t ethproto, bool invert, unsigned int bitmask)
                printf("! ");
 
        if (bitmask & EBT_802_3) {
-               printf("length ");
+               printf("Length ");
                return;
        }
 
@@ -627,7 +653,7 @@ static void print_protocol(uint16_t ethproto, bool invert, unsigned int bitmask)
 static void __nft_bridge_save_rule(const struct iptables_command_state *cs,
                                   unsigned int format)
 {
-       if (cs->eb.ethproto)
+       if (!(cs->eb.bitmask & EBT_NOPROTO))
                print_protocol(cs->eb.ethproto, cs->eb.invflags & EBT_IPROTO,
                               cs->eb.bitmask);
        if (cs->eb.bitmask & EBT_ISOURCE)
@@ -866,7 +892,10 @@ static int nft_bridge_xlate(const struct iptables_command_state *cs,
        xlate_ifname(xl, "meta obrname", cs->eb.logical_out,
                     cs->eb.invflags & EBT_ILOGICALOUT);
 
-       if ((cs->eb.bitmask & EBT_NOPROTO) == 0) {
+       if (cs->eb.bitmask & EBT_802_3) {
+               xt_xlate_add(xl, "ether type %s 0x0600 ",
+                            cs->eb.invflags & EBT_IPROTO ? ">=" : "<");
+       } else if ((cs->eb.bitmask & EBT_NOPROTO) == 0) {
                const char *implicit = NULL;
 
                switch (ntohs(cs->eb.ethproto)) {
@@ -889,9 +918,6 @@ static int nft_bridge_xlate(const struct iptables_command_state *cs,
                                     ntohs(cs->eb.ethproto));
        }
 
-       if (cs->eb.bitmask & EBT_802_3)
-               return 0;
-
        if (cs->eb.bitmask & EBT_ISOURCE)
                nft_bridge_xlate_mac(xl, "saddr", cs->eb.invflags & EBT_ISOURCE,
                                     cs->eb.sourcemac, cs->eb.sourcemsk);

diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
index ccdef19cfb21516a8366ff820cffcf1a0bf603c1..0537f5677c5d5327f11d08cd411671e9a0f5c62a 100755 (executable)
--- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
+++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
@@ -13,8 +13,8 @@ $XT_MULTI ebtables -A INPUT -p IPv4 -i lo -j ACCEPT
 $XT_MULTI ebtables -P FORWARD DROP
 $XT_MULTI ebtables -A OUTPUT -s ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff -j DROP
 $XT_MULTI ebtables -N foo
-$XT_MULTI ebtables -A foo --802_3-sap 0x23 -j ACCEPT
-$XT_MULTI ebtables -A foo --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT
+$XT_MULTI ebtables -A foo -p length --802_3-sap 0x23 -j ACCEPT
+$XT_MULTI ebtables -A foo -p length --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT
 #$XT_MULTI ebtables -A foo --among-dst fe:ed:ba:be:00:01,fe:ed:ba:be:00:02,fe:ed:ba:be:00:03 -j ACCEPT
 $XT_MULTI ebtables -A foo -p ARP --arp-gratuitous -j ACCEPT
 $XT_MULTI ebtables -A foo -p ARP --arp-opcode Request -j ACCEPT
@@ -44,7 +44,7 @@ $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT
 $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT
 #$XT_MULTI ebtables -A foo --vlan-id 42 -j ACCEPT
 
-$XT_MULTI ebtables -A foo --802_3-sap 0x23 --limit 100 -j ACCEPT
+$XT_MULTI ebtables -A foo -p length --802_3-sap 0x23 --limit 100 -j ACCEPT
 $XT_MULTI ebtables -A foo --pkttype-type multicast --log
 $XT_MULTI ebtables -A foo --pkttype-type multicast --limit 100 -j ACCEPT
 
@@ -75,8 +75,8 @@ DUMP='*filter
 -A INPUT -p IPv4 -i lo -j ACCEPT
 -A FORWARD -j foo
 -A OUTPUT -s Broadcast -j DROP
--A foo --802_3-sap 0x23 -j ACCEPT
--A foo --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT
+-A foo -p Length --802_3-sap 0x23 -j ACCEPT
+-A foo -p Length --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT
 -A foo -p ARP --arp-gratuitous -j ACCEPT
 -A foo -p ARP --arp-op Request -j ACCEPT
 -A foo -p ARP --arp-ip-src 10.0.0.1 -j ACCEPT
@@ -96,7 +96,7 @@ DUMP='*filter
 -A foo --nflog-group 1 -j CONTINUE
 -A foo --pkttype-type multicast -j ACCEPT
 -A foo --stp-type config -j ACCEPT
--A foo --802_3-sap 0x23 --limit 100/sec --limit-burst 5 -j ACCEPT
+-A foo -p Length --802_3-sap 0x23 --limit 100/sec --limit-burst 5 -j ACCEPT
 -A foo --pkttype-type multicast --log-level notice --log-prefix "" -j CONTINUE
 -A foo --pkttype-type multicast --limit 100/sec --limit-burst 5 -j ACCEPT
 *nat