iptables: restore NOTRACK functionality, target aliasing

Commit v1.4.16-1-g2aaa7ec is testing for real_name (not) being NULL
which was always false (true). real_name was never NULL, so cs->jumpto
would always be used, which rendered -j NOTRACK unusable, since the
chosen real name.revision is for example NOTRACK.1, which does not exist
at the kernel side.

	# ./iptables/xtables-multi main4 -t raw -A foo -j NOTRACK
	dbg: Using NOTRACK.1
	WARNING: The NOTRACK target is obsolete. Use CT instead.
	iptables: Protocol wrong type for socket.

To reasonably support the extra-special verdict names, make it so that
real_name remains NULL when an extension defined no alias, which we can
then use to determine whether the user entered an alias name (which
needs to be followed) or not.

[ I have mangled this patch to remove a comment unnecessarily large.
  BTW, this patch gets this very close to the initial target aliasing
  proposal --pablo ]

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
index faddb71b64996d4424485eb1688e7159b5466255..0e11a9e12b700474cecc4d7057bbaeeb62ce33b3 100644 (file)
--- a/iptables/ip6tables.c
+++ b/iptables/ip6tables.c
@@ -1286,15 +1286,15 @@ static void command_jump(struct iptables_command_state *cs)
 
        cs->target->t = xtables_calloc(1, size);
        cs->target->t->u.target_size = size;
-       if (cs->target->real_name != NULL)
+       if (cs->target->real_name == NULL) {
                strcpy(cs->target->t->u.user.name, cs->jumpto);
-       else
+       } else {
                strcpy(cs->target->t->u.user.name, cs->target->real_name);
-       cs->target->t->u.user.revision = cs->target->revision;
-       if (cs->target->real_name != cs->target->name)
                fprintf(stderr, "WARNING: The %s target is obsolete. "
                        "Use %s instead.\n",
                        cs->jumpto, cs->target->real_name);
+       }
+       cs->target->t->u.user.revision = cs->target->revision;
 
        xs_init_target(cs->target);
        if (cs->target->x6_options != NULL)
@@ -1322,11 +1322,14 @@ static void command_match(struct iptables_command_state *cs)
        size = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size;
        m->m = xtables_calloc(1, size);
        m->m->u.match_size = size;
-       strcpy(m->m->u.user.name, m->real_name);
-       m->m->u.user.revision = m->revision;
-       if (m->real_name != m->name)
+       if (m->real_name == NULL) {
+               strcpy(m->m->u.user.name, m->name);
+       } else {
+               strcpy(m->m->u.user.name, m->real_name);
                fprintf(stderr, "WARNING: The %s match is obsolete. "
                        "Use %s instead.\n", m->name, m->real_name);
+       }
+       m->m->u.user.revision = m->revision;
 
        xs_init_match(m);
        if (m == m->next)

diff --git a/iptables/iptables.c b/iptables/iptables.c
index 96cea64dd200a7fa36008bacf62249299018720a..f765cf9809087d8500c56ab98621407a98b8be25 100644 (file)
--- a/iptables/iptables.c
+++ b/iptables/iptables.c
@@ -1295,16 +1295,16 @@ static void command_jump(struct iptables_command_state *cs)
 
        cs->target->t = xtables_calloc(1, size);
        cs->target->t->u.target_size = size;
-       if (cs->target->real_name != NULL)
+       if (cs->target->real_name == NULL) {
                strcpy(cs->target->t->u.user.name, cs->jumpto);
-       else
-               strcpy(cs->target->t->u.user.name, cs->target->real_name);
-       cs->target->t->u.user.revision = cs->target->revision;
-       if (cs->target->real_name != cs->target->name)
+       } else {
                /* Alias support for userspace side */
+               strcpy(cs->target->t->u.user.name, cs->target->real_name);
                fprintf(stderr, "WARNING: The %s target is obsolete. "
                        "Use %s instead.\n",
                        cs->jumpto, cs->target->real_name);
+       }
+       cs->target->t->u.user.revision = cs->target->revision;
 
        xs_init_target(cs->target);
 
@@ -1333,11 +1333,14 @@ static void command_match(struct iptables_command_state *cs)
        size = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size;
        m->m = xtables_calloc(1, size);
        m->m->u.match_size = size;
-       strcpy(m->m->u.user.name, m->real_name);
-       m->m->u.user.revision = m->revision;
-       if (m->real_name != m->name)
+       if (m->real_name == NULL) {
+               strcpy(m->m->u.user.name, m->name);
+       } else {
+               strcpy(m->m->u.user.name, m->real_name);
                fprintf(stderr, "WARNING: The %s match is obsolete. "
                        "Use %s instead.\n", m->name, m->real_name);
+       }
+       m->m->u.user.revision = m->revision;
 
        xs_init_match(m);
        if (m == m->next)

diff --git a/libxtables/xtables.c b/libxtables/xtables.c
index 82c3643b0f989593c4925ca10be20d47bec6812c..4c912860e03f4fe37d492303295726d9710da9de 100644 (file)
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -848,8 +848,6 @@ void xtables_register_match(struct xtables_match *me)
                exit(1);
        }
 
-       if (me->real_name == NULL)
-               me->real_name = me->name;
        if (me->x6_options != NULL)
                xtables_option_metavalidate(me->name, me->x6_options);
        if (me->extra_opts != NULL)
@@ -905,9 +903,9 @@ xtables_mt_prefer(bool a_alias, unsigned int a_rev, unsigned int a_fam,
 static int xtables_match_prefer(const struct xtables_match *a,
                                const struct xtables_match *b)
 {
-       return xtables_mt_prefer(a->name != a->real_name,
+       return xtables_mt_prefer(a->real_name != NULL,
                                 a->revision, a->family,
-                                b->name != b->real_name,
+                                b->real_name != NULL,
                                 b->revision, b->family);
 }
 
@@ -919,15 +917,16 @@ static int xtables_target_prefer(const struct xtables_target *a,
         * xtables_register_*; the direct pointer comparison here is therefore
         * legitimate to detect an alias.
         */
-       return xtables_mt_prefer(a->name != a->real_name,
+       return xtables_mt_prefer(a->real_name != NULL,
                                 a->revision, a->family,
-                                b->name != b->real_name,
+                                b->real_name != NULL,
                                 b->revision, b->family);
 }
 
 static void xtables_fully_register_pending_match(struct xtables_match *me)
 {
        struct xtables_match **i, *old;
+       const char *rn;
        int compare;
 
        old = xtables_find_match(me->name, XTF_DURING_LOAD, NULL);
@@ -941,12 +940,14 @@ static void xtables_fully_register_pending_match(struct xtables_match *me)
                }
 
                /* Now we have two (or more) options, check compatibility. */
+               rn = (old->real_name != NULL) ? old->real_name : old->name;
                if (compare > 0 &&
-                   compatible_match_revision(old->real_name, old->revision))
+                   compatible_match_revision(rn, old->revision))
                        return;
 
                /* See if new match can be used. */
-               if (!compatible_match_revision(me->real_name, me->revision))
+               rn = (me->real_name != NULL) ? me->real_name : me->name;
+               if (!compatible_match_revision(rn, me->revision))
                        return;
 
                /* Delete old one. */
@@ -1005,8 +1006,6 @@ void xtables_register_target(struct xtables_target *me)
                exit(1);
        }
 
-       if (me->real_name == NULL)
-               me->real_name = me->name;
        if (me->x6_options != NULL)
                xtables_option_metavalidate(me->name, me->x6_options);
        if (me->extra_opts != NULL)
@@ -1024,6 +1023,7 @@ void xtables_register_target(struct xtables_target *me)
 static void xtables_fully_register_pending_target(struct xtables_target *me)
 {
        struct xtables_target *old;
+       const char *rn;
        int compare;
 
        old = xtables_find_target(me->name, XTF_DURING_LOAD);
@@ -1039,12 +1039,14 @@ static void xtables_fully_register_pending_target(struct xtables_target *me)
                }
 
                /* Now we have two (or more) options, check compatibility. */
+               rn = (old->real_name != NULL) ? old->real_name : old->name;
                if (compare > 0 &&
-                   compatible_target_revision(old->real_name, old->revision))
+                   compatible_target_revision(rn, old->revision))
                        return;
 
                /* See if new target can be used. */
-               if (!compatible_target_revision(me->real_name, me->revision))
+               rn = (me->real_name != NULL) ? me->real_name : me->name;
+               if (!compatible_target_revision(rn, me->revision))
                        return;
 
                /* Delete old one. */