From a6504e3aec5cfa910f96c51319c93cd2761df9e4 Mon Sep 17 00:00:00 2001

From: Phil Sutter <phil@nwl.cc>

Date: Tue, 27 Sep 2022 23:19:34 +0200

Subject: [PATCH] ebtables: Support '-p Length'

To match on Ethernet frames using the etherproto field as length value,

ebtables accepts the special protocol name "LENGTH". Implement this in

ebtables-nft using a native match for 'ether type < 0x0600'.

Since extension 802_3 matches are valid only with such Ethernet frames,

add a local add_match() wrapper which complains if the extension is used

without '-p Length' parameter. Legacy ebtables does this within the

extension's final_check callback, but it's not possible here due for lack of

fw->bitmask field access.

While being at it, add xlate support, adjust tests and make ebtables-nft

print the case-insensitive argument with capital 'L' like legacy

ebtables does.

Signed-off-by: Phil Sutter <phil@nwl.cc>

(cherry picked from commit aa0b8b03f7c7e741ccd96360bd64d90ea8c3c3aa)

Conflicts:

	iptables/nft-bridge.c

- Adjusted to missing commit 7e38890c6b4fb

  ("nft: prepare for dynamic register allocation")

- Context change due to missing commit 0c0cd4340ed88

  ("nft: Don't pass command state opaque to family ops callbacks")

---

 extensions/generic.txlate                     |  6 +++

 extensions/libebt_802_3.t                     |  6 ++-

 iptables/nft-bridge.c                         | 47 +++++++++++++++----

 .../ebtables/0002-ebtables-save-restore_0     | 12 ++---

 4 files changed, 53 insertions(+), 18 deletions(-)

diff --git a/extensions/generic.txlate b/extensions/generic.txlate

index 9ae9a5b54c1b9..6779d6f86dec8 100644

--- a/extensions/generic.txlate

+++ b/extensions/generic.txlate

@@ -67,6 +67,12 @@ nft add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oi

 ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00

 nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter

+ebtables-translate -I INPUT -p Length

+nft insert rule bridge filter INPUT ether type < 0x0600 counter

+

+ebtables-translate -I INPUT -p ! Length

+nft insert rule bridge filter INPUT ether type >= 0x0600 counter

+

 # asterisk is not special in iptables and it is even a valid interface name

 iptables-translate -A FORWARD -i '*' -o 'eth*foo'

 nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter

diff --git a/extensions/libebt_802_3.t b/extensions/libebt_802_3.t

index ddfb2f0a72baf..a138f35d2c756 100644

--- a/extensions/libebt_802_3.t

+++ b/extensions/libebt_802_3.t

@@ -1,3 +1,5 @@

 :INPUT,FORWARD,OUTPUT

---802_3-sap ! 0x0a -j CONTINUE;=;OK

---802_3-type 0x000a -j RETURN;=;OK

+--802_3-sap ! 0x0a -j CONTINUE;=;FAIL

+--802_3-type 0x000a -j RETURN;=;FAIL

+-p Length --802_3-sap ! 0x0a -j CONTINUE;=;OK

+-p Length --802_3-type 0x000a -j RETURN;=;OK

diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c

index 3fd03fb8de4ff..176304e9f2f23 100644

--- a/iptables/nft-bridge.c

+++ b/iptables/nft-bridge.c

@@ -129,6 +129,18 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs)

 	return add_action(r, cs, false);

 }

+static int

+nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw,

+		     struct nftnl_rule *r, struct xt_entry_match *m)

+{

+	if (!strcmp(m->u.user.name, "802_3") &&

+	    !(fw->bitmask & EBT_802_3))

+		xtables_error(PARAMETER_PROBLEM,

+			      "For 802.3 DSAP/SSAP filtering the protocol must be LENGTH");

+

+	return add_match(h, r, m);

+}

+

 static int nft_bridge_add(struct nft_handle *h,

 			  struct nftnl_rule *r, void *data)

 {

@@ -172,17 +184,25 @@ static int nft_bridge_add(struct nft_handle *h,

 	}

 	if ((fw->bitmask & EBT_NOPROTO) == 0) {

+		uint16_t ethproto = fw->ethproto;

+

 		op = nft_invflags2cmp(fw->invflags, EBT_IPROTO);

 		add_payload(r, offsetof(struct ethhdr, h_proto), 2,

 			    NFT_PAYLOAD_LL_HEADER);

-		add_cmp_u16(r, fw->ethproto, op);

+

+		if (fw->bitmask & EBT_802_3) {

+			op = (op == NFT_CMP_EQ ? NFT_CMP_LT : NFT_CMP_GTE);

+			ethproto = htons(0x0600);

+		}

+

+		add_cmp_u16(r, ethproto, op);

 	}

 	add_compat(r, fw->ethproto, fw->invflags & EBT_IPROTO);

 	for (iter = cs->match_list; iter; iter = iter->next) {

 		if (iter->ismatch) {

-			if (add_match(h, r, iter->u.match->m))

+			if (nft_bridge_add_match(h, fw, r, iter->u.match->m))

 				break;

 		} else {

 			if (add_target(r, iter->u.watcher->t))

@@ -239,6 +259,7 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,

 	struct ebt_entry *fw = &cs->eb;

 	unsigned char addr[ETH_ALEN];

 	unsigned short int ethproto;

+	uint8_t op;

 	bool inv;

 	int i;

@@ -275,8 +296,14 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,

 		fw->bitmask |= EBT_ISOURCE;

 		break;

 	case offsetof(struct ethhdr, h_proto):

-		get_cmp_data(e, &ethproto, sizeof(ethproto), &inv;;

-		fw->ethproto = ethproto;

+		__get_cmp_data(e, &ethproto, sizeof(ethproto), &op);

+		if (ethproto == htons(0x0600)) {

+			fw->bitmask |= EBT_802_3;

+			inv = (op == NFT_CMP_GTE);

+		} else {

+			fw->ethproto = ethproto;

+			inv = (op == NFT_CMP_NEQ);

+		}

 		if (inv)

 			fw->invflags |= EBT_IPROTO;

 		fw->bitmask &= ~EBT_NOPROTO;

@@ -611,7 +638,7 @@ static void print_protocol(uint16_t ethproto, bool invert, unsigned int bitmask)

 		printf("! ");

 	if (bitmask & EBT_802_3) {

-		printf("length ");

+		printf("Length ");

 		return;

 	}

@@ -626,7 +653,7 @@ static void nft_bridge_save_rule(const void *data, unsigned int format)

 {

 	const struct iptables_command_state *cs = data;

-	if (cs->eb.ethproto)

+	if (!(cs->eb.bitmask & EBT_NOPROTO))

 		print_protocol(cs->eb.ethproto, cs->eb.invflags & EBT_IPROTO,

 			       cs->eb.bitmask);

 	if (cs->eb.bitmask & EBT_ISOURCE)

@@ -892,7 +919,10 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl)

 	xlate_ifname(xl, "meta obrname", cs->eb.logical_out,

 		     cs->eb.invflags & EBT_ILOGICALOUT);

-	if ((cs->eb.bitmask & EBT_NOPROTO) == 0) {

+	if (cs->eb.bitmask & EBT_802_3) {

+		xt_xlate_add(xl, "ether type %s 0x0600 ",

+			     cs->eb.invflags & EBT_IPROTO ? ">=" : "<");

+	} else if ((cs->eb.bitmask & EBT_NOPROTO) == 0) {

 		const char *implicit = NULL;

 		switch (ntohs(cs->eb.ethproto)) {

@@ -915,9 +945,6 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl)

 				     ntohs(cs->eb.ethproto));

 	}

-	if (cs->eb.bitmask & EBT_802_3)

-		return 0;

-

 	if (cs->eb.bitmask & EBT_ISOURCE)

 		nft_bridge_xlate_mac(xl, "saddr", cs->eb.invflags & EBT_ISOURCE,

 				     cs->eb.sourcemac, cs->eb.sourcemsk);

diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0

index b84f63a7c3672..a4fc31548e323 100755

--- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0

+++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0

@@ -13,8 +13,8 @@ $XT_MULTI ebtables -A INPUT -p IPv4 -i lo -j ACCEPT

 $XT_MULTI ebtables -P FORWARD DROP

 $XT_MULTI ebtables -A OUTPUT -s ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff -j DROP

 $XT_MULTI ebtables -N foo

-$XT_MULTI ebtables -A foo --802_3-sap 0x23 -j ACCEPT

-$XT_MULTI ebtables -A foo --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT

+$XT_MULTI ebtables -A foo -p length --802_3-sap 0x23 -j ACCEPT

+$XT_MULTI ebtables -A foo -p length --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT

 #$XT_MULTI ebtables -A foo --among-dst fe:ed:ba:be:00:01,fe:ed:ba:be:00:02,fe:ed:ba:be:00:03 -j ACCEPT

 $XT_MULTI ebtables -A foo -p ARP --arp-gratuitous -j ACCEPT

 $XT_MULTI ebtables -A foo -p ARP --arp-opcode Request -j ACCEPT

@@ -44,7 +44,7 @@ $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT

 $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT

 #$XT_MULTI ebtables -A foo --vlan-id 42 -j ACCEPT

-$XT_MULTI ebtables -A foo --802_3-sap 0x23 --limit 100 -j ACCEPT

+$XT_MULTI ebtables -A foo -p length --802_3-sap 0x23 --limit 100 -j ACCEPT

 $XT_MULTI ebtables -A foo --pkttype-type multicast --log

 $XT_MULTI ebtables -A foo --pkttype-type multicast --limit 100 -j ACCEPT

@@ -75,8 +75,8 @@ DUMP='*filter

 -A INPUT -p IPv4 -i lo -j ACCEPT

 -A FORWARD -j foo

 -A OUTPUT -s Broadcast -j DROP

--A foo --802_3-sap 0x23 -j ACCEPT

--A foo --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT

+-A foo -p Length --802_3-sap 0x23 -j ACCEPT

+-A foo -p Length --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT

 -A foo -p ARP --arp-gratuitous -j ACCEPT

 -A foo -p ARP --arp-op Request -j ACCEPT

 -A foo -p ARP --arp-ip-src 10.0.0.1 -j ACCEPT

@@ -96,7 +96,7 @@ DUMP='*filter

 -A foo --nflog-group 1 -j CONTINUE

 -A foo --pkttype-type multicast -j ACCEPT

 -A foo --stp-type config -j ACCEPT

--A foo --802_3-sap 0x23 --limit 100/sec --limit-burst 5 -j ACCEPT

+-A foo -p Length --802_3-sap 0x23 --limit 100/sec --limit-burst 5 -j ACCEPT

 -A foo --pkttype-type multicast --log-level notice --log-prefix "" -j CONTINUE

 -A foo --pkttype-type multicast --limit 100/sec --limit-burst 5 -j ACCEPT

 *nat

-- 

2.38.0