You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
200 lines
6.5 KiB
200 lines
6.5 KiB
2 years ago
|
From c65bd8b3c23f0fe5f824274467740a2d350dcb9c Mon Sep 17 00:00:00 2001
|
||
|
|
From: Phil Sutter <phil@nwl.cc>
|
||
|
|
Date: Tue, 1 Mar 2022 18:59:31 +0100
|
||
|
|
Subject: [PATCH] nft: Simplify immediate parsing
|
||
|
|
|
||
|
|
Implementations of parse_immediate callback are mostly trivial, the only
|
||
|
|
relevant part is access to family-specific parts of struct
|
||
|
|
iptables_command_state when setting goto flag for iptables and
|
||
|
|
ip6tables. Refactor them into simple set_goto_flag callbacks.
|
||
|
|
|
||
|
|
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||
|
|
Acked-by: Florian Westphal <fw@strlen.de>
|
||
|
|
(cherry picked from commit b5f2faea325a315bfb932ebc634f3298d4824cae)
|
||
|
|
---
|
||
|
|
iptables/nft-arp.c | 9 ---------
|
||
|
|
iptables/nft-bridge.c | 9 ---------
|
||
|
|
iptables/nft-ipv4.c | 12 +++---------
|
||
|
|
iptables/nft-ipv6.c | 12 +++---------
|
||
|
|
iptables/nft-shared.c | 17 +++++++----------
|
||
|
|
iptables/nft-shared.h | 2 +-
|
||
|
|
6 files changed, 14 insertions(+), 47 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
|
||
|
|
index 7c61c31a13c40..0c37a762cd418 100644
|
||
|
|
--- a/iptables/nft-arp.c
|
||
|
|
+++ b/iptables/nft-arp.c
|
||
|
|
@@ -182,14 +182,6 @@ static void nft_arp_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
|
||
|
|
fw->arp.invflags |= flags;
|
||
|
|
}
|
||
|
|
|
||
|
|
-static void nft_arp_parse_immediate(const char *jumpto, bool nft_goto,
|
||
|
|
- void *data)
|
||
|
|
-{
|
||
|
|
- struct iptables_command_state *cs = data;
|
||
|
|
-
|
||
|
|
- cs->jumpto = jumpto;
|
||
|
|
-}
|
||
|
|
-
|
||
|
|
static void parse_mask_ipv4(struct nft_xt_ctx *ctx, struct in_addr *mask)
|
||
|
|
{
|
||
|
|
mask->s_addr = ctx->bitwise.mask[0];
|
||
|
|
@@ -575,7 +567,6 @@ struct nft_family_ops nft_family_ops_arp = {
|
||
|
|
.print_payload = NULL,
|
||
|
|
.parse_meta = nft_arp_parse_meta,
|
||
|
|
.parse_payload = nft_arp_parse_payload,
|
||
|
|
- .parse_immediate = nft_arp_parse_immediate,
|
||
|
|
.print_header = nft_arp_print_header,
|
||
|
|
.print_rule = nft_arp_print_rule,
|
||
|
|
.save_rule = nft_arp_save_rule,
|
||
|
|
diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
|
||
|
|
index 2aa15e2d1e69d..e00a19e843d93 100644
|
||
|
|
--- a/iptables/nft-bridge.c
|
||
|
|
+++ b/iptables/nft-bridge.c
|
||
|
|
@@ -284,14 +284,6 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
-static void nft_bridge_parse_immediate(const char *jumpto, bool nft_goto,
|
||
|
|
- void *data)
|
||
|
|
-{
|
||
|
|
- struct iptables_command_state *cs = data;
|
||
|
|
-
|
||
|
|
- cs->jumpto = jumpto;
|
||
|
|
-}
|
||
|
|
-
|
||
|
|
/* return 0 if saddr, 1 if daddr, -1 on error */
|
||
|
|
static int
|
||
|
|
lookup_check_ether_payload(uint32_t base, uint32_t offset, uint32_t len)
|
||
|
|
@@ -948,7 +940,6 @@ struct nft_family_ops nft_family_ops_bridge = {
|
||
|
|
.print_payload = NULL,
|
||
|
|
.parse_meta = nft_bridge_parse_meta,
|
||
|
|
.parse_payload = nft_bridge_parse_payload,
|
||
|
|
- .parse_immediate = nft_bridge_parse_immediate,
|
||
|
|
.parse_lookup = nft_bridge_parse_lookup,
|
||
|
|
.parse_match = nft_bridge_parse_match,
|
||
|
|
.parse_target = nft_bridge_parse_target,
|
||
|
|
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
|
||
|
|
index d8c48ce8817b6..c826ac153139f 100644
|
||
|
|
--- a/iptables/nft-ipv4.c
|
||
|
|
+++ b/iptables/nft-ipv4.c
|
||
|
|
@@ -241,15 +241,9 @@ static void nft_ipv4_parse_payload(struct nft_xt_ctx *ctx,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
-static void nft_ipv4_parse_immediate(const char *jumpto, bool nft_goto,
|
||
|
|
- void *data)
|
||
|
|
+static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs)
|
||
|
|
{
|
||
|
|
- struct iptables_command_state *cs = data;
|
||
|
|
-
|
||
|
|
- cs->jumpto = jumpto;
|
||
|
|
-
|
||
|
|
- if (nft_goto)
|
||
|
|
- cs->fw.ip.flags |= IPT_F_GOTO;
|
||
|
|
+ cs->fw.ip.flags |= IPT_F_GOTO;
|
||
|
|
}
|
||
|
|
|
||
|
|
static void print_fragment(unsigned int flags, unsigned int invflags,
|
||
|
|
@@ -473,7 +467,7 @@ struct nft_family_ops nft_family_ops_ipv4 = {
|
||
|
|
.is_same = nft_ipv4_is_same,
|
||
|
|
.parse_meta = nft_ipv4_parse_meta,
|
||
|
|
.parse_payload = nft_ipv4_parse_payload,
|
||
|
|
- .parse_immediate = nft_ipv4_parse_immediate,
|
||
|
|
+ .set_goto_flag = nft_ipv4_set_goto_flag,
|
||
|
|
.print_header = print_header,
|
||
|
|
.print_rule = nft_ipv4_print_rule,
|
||
|
|
.save_rule = nft_ipv4_save_rule,
|
||
|
|
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
|
||
|
|
index a5481b3f77ac5..127bc96379968 100644
|
||
|
|
--- a/iptables/nft-ipv6.c
|
||
|
|
+++ b/iptables/nft-ipv6.c
|
||
|
|
@@ -180,15 +180,9 @@ static void nft_ipv6_parse_payload(struct nft_xt_ctx *ctx,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
-static void nft_ipv6_parse_immediate(const char *jumpto, bool nft_goto,
|
||
|
|
- void *data)
|
||
|
|
+static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs)
|
||
|
|
{
|
||
|
|
- struct iptables_command_state *cs = data;
|
||
|
|
-
|
||
|
|
- cs->jumpto = jumpto;
|
||
|
|
-
|
||
|
|
- if (nft_goto)
|
||
|
|
- cs->fw6.ipv6.flags |= IP6T_F_GOTO;
|
||
|
|
+ cs->fw6.ipv6.flags |= IP6T_F_GOTO;
|
||
|
|
}
|
||
|
|
|
||
|
|
static void nft_ipv6_print_rule(struct nft_handle *h, struct nftnl_rule *r,
|
||
|
|
@@ -415,7 +409,7 @@ struct nft_family_ops nft_family_ops_ipv6 = {
|
||
|
|
.is_same = nft_ipv6_is_same,
|
||
|
|
.parse_meta = nft_ipv6_parse_meta,
|
||
|
|
.parse_payload = nft_ipv6_parse_payload,
|
||
|
|
- .parse_immediate = nft_ipv6_parse_immediate,
|
||
|
|
+ .set_goto_flag = nft_ipv6_set_goto_flag,
|
||
|
|
.print_header = print_header,
|
||
|
|
.print_rule = nft_ipv6_print_rule,
|
||
|
|
.save_rule = nft_ipv6_save_rule,
|
||
|
|
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
||
|
|
index 7f757d38ecaec..172cf2054a33c 100644
|
||
|
|
--- a/iptables/nft-shared.c
|
||
|
|
+++ b/iptables/nft-shared.c
|
||
|
|
@@ -510,9 +510,7 @@ static void nft_parse_counter(struct nftnl_expr *e, struct xt_counters *counters
|
||
|
|
static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
|
||
|
|
{
|
||
|
|
const char *chain = nftnl_expr_get_str(e, NFTNL_EXPR_IMM_CHAIN);
|
||
|
|
- const char *jumpto = NULL;
|
||
|
|
- bool nft_goto = false;
|
||
|
|
- void *data = ctx->cs;
|
||
|
|
+ struct iptables_command_state *cs = ctx->cs;
|
||
|
|
int verdict;
|
||
|
|
|
||
|
|
if (nftnl_expr_is_set(e, NFTNL_EXPR_IMM_DATA)) {
|
||
|
|
@@ -535,23 +533,22 @@ static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
|
||
|
|
/* Standard target? */
|
||
|
|
switch(verdict) {
|
||
|
|
case NF_ACCEPT:
|
||
|
|
- jumpto = "ACCEPT";
|
||
|
|
+ cs->jumpto = "ACCEPT";
|
||
|
|
break;
|
||
|
|
case NF_DROP:
|
||
|
|
- jumpto = "DROP";
|
||
|
|
+ cs->jumpto = "DROP";
|
||
|
|
break;
|
||
|
|
case NFT_RETURN:
|
||
|
|
- jumpto = "RETURN";
|
||
|
|
+ cs->jumpto = "RETURN";
|
||
|
|
break;;
|
||
|
|
case NFT_GOTO:
|
||
|
|
- nft_goto = true;
|
||
|
|
+ if (ctx->h->ops->set_goto_flag)
|
||
|
|
+ ctx->h->ops->set_goto_flag(cs);
|
||
|
|
/* fall through */
|
||
|
|
case NFT_JUMP:
|
||
|
|
- jumpto = chain;
|
||
|
|
+ cs->jumpto = chain;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
-
|
||
|
|
- ctx->h->ops->parse_immediate(jumpto, nft_goto, data);
|
||
|
|
}
|
||
|
|
|
||
|
|
static void nft_parse_limit(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
|
||
|
|
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
|
||
|
|
index 520a296fb530c..29f7056714235 100644
|
||
|
|
--- a/iptables/nft-shared.h
|
||
|
|
+++ b/iptables/nft-shared.h
|
||
|
|
@@ -89,7 +89,7 @@ struct nft_family_ops {
|
||
|
|
void *data);
|
||
|
|
void (*parse_lookup)(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
|
||
|
|
void *data);
|
||
|
|
- void (*parse_immediate)(const char *jumpto, bool nft_goto, void *data);
|
||
|
|
+ void (*set_goto_flag)(struct iptables_command_state *cs);
|
||
|
|
|
||
|
|
void (*print_table_header)(const char *tablename);
|
||
|
|
void (*print_header)(unsigned int format, const char *chain,
|
||
|
|
--
|
||
|
|
2.34.1
|
||
|
|
|