|
 |
05e71a |
From 31b9f879b04314da07d79dd653465c4dc030f819 Mon Sep 17 00:00:00 2001
|
|
|
05e71a |
From: =?UTF-8?q?Alin=20N=C4=83stac?= <alin.nastac@gmail.com>
|
|
|
05e71a |
Date: Thu, 22 Oct 2015 16:41:03 +0200
|
|
|
05e71a |
Subject: [PATCH] ebtables: Allow RETURN target rules in user defined chains
|
|
|
05e71a |
|
|
|
05e71a |
During loop checking ebtables marks entries with '1 << NF_BR_NUMHOOKS' if
|
|
|
05e71a |
they're called from a base chain rather than a user defined chain.
|
|
|
05e71a |
|
|
|
05e71a |
This can be used by ebtables targets that can encode a special return
|
|
|
05e71a |
value to bail out if e.g. RETURN is used from a base chain.
|
|
|
05e71a |
|
|
|
05e71a |
Unfortunately, this is broken, since the '1 << NF_BR_NUMHOOKS' is also
|
|
|
05e71a |
copied to called user-defined-chains (i.e., a user defined chain can no
|
|
|
05e71a |
longer be distinguished from a base chain):
|
|
|
05e71a |
|
|
|
05e71a |
root@OpenWrt:~# ebtables -N foo
|
|
|
05e71a |
root@OpenWrt:~# ebtables -A OUTPUT -j foo
|
|
|
05e71a |
root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN
|
|
|
05e71a |
--mark-target RETURN not allowed on base chain.
|
|
|
05e71a |
|
|
|
05e71a |
This works if -A OUTPUT -j foo is omitted, but will still appear
|
|
|
05e71a |
if we try to call foo from OUTPUT afterwards.
|
|
|
05e71a |
|
|
|
05e71a |
After this patch we still reject
|
|
|
05e71a |
'-A OUTPUT -j mark .. --mark-target RETURN'.
|
|
|
05e71a |
|
|
|
05e71a |
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
05e71a |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
05e71a |
---
|
|
|
05e71a |
libebtc.c | 2 +-
|
|
|
05e71a |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
05e71a |
|
|
|
05e71a |
diff --git a/libebtc.c b/libebtc.c
|
|
|
05e71a |
index 17ba8f243dd45..74830ecf2e91b 100644
|
|
|
05e71a |
--- a/libebtc.c
|
|
|
05e71a |
+++ b/libebtc.c
|
|
|
05e71a |
@@ -1102,7 +1102,7 @@ void ebt_check_for_loops(struct ebt_u_replace *replace)
|
|
|
05e71a |
/* check if we've dealt with this chain already */
|
|
|
05e71a |
if (entries2->hook_mask & (1<
|
|
|
05e71a |
goto letscontinue;
|
|
|
05e71a |
- entries2->hook_mask |= entries->hook_mask;
|
|
|
05e71a |
+ entries2->hook_mask |= entries->hook_mask & ~(1 << NF_BR_NUMHOOKS);
|
|
|
05e71a |
/* Jump to the chain, make sure we know how to get back */
|
|
|
05e71a |
stack[sp].chain_nr = chain_nr;
|
|
|
05e71a |
stack[sp].n = j;
|
|
|
05e71a |
--
|
|
|
05e71a |
2.21.0
|
|
|
05e71a |
|