Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 1 | From e6b367c0c2668341c47242d099f4d2048ae575ef Mon Sep 17 00:00:00 2001 |
| 2 | From: =?UTF-8?q?Alin=20N=C4=83stac?= <alin.nastac@gmail.com> |
| 3 | Date: Thu, 22 Oct 2015 16:41:03 +0200 |
| 4 | Subject: [PATCH 09/10] ebtables: Allow RETURN target rules in user defined |
| 5 | chains |
| 6 | |
| 7 | During loop checking ebtables marks entries with '1 << NF_BR_NUMHOOKS' if |
| 8 | they're called from a base chain rather than a user defined chain. |
| 9 | |
| 10 | This can be used by ebtables targets that can encode a special return |
| 11 | value to bail out if e.g. RETURN is used from a base chain. |
| 12 | |
| 13 | Unfortunately, this is broken, since the '1 << NF_BR_NUMHOOKS' is also |
| 14 | copied to called user-defined-chains (i.e., a user defined chain can no |
| 15 | longer be distinguished from a base chain): |
| 16 | |
| 17 | root@OpenWrt:~# ebtables -N foo |
| 18 | root@OpenWrt:~# ebtables -A OUTPUT -j foo |
| 19 | root@OpenWrt:~# ebtables -A foo -j mark --mark-or 3 --mark-target RETURN |
| 20 | --mark-target RETURN not allowed on base chain. |
| 21 | |
| 22 | This works if -A OUTPUT -j foo is omitted, but will still appear |
| 23 | if we try to call foo from OUTPUT afterwards. |
| 24 | |
| 25 | After this patch we still reject |
| 26 | '-A OUTPUT -j mark .. --mark-target RETURN'. |
| 27 | |
| 28 | Signed-off-by: Florian Westphal <fw@strlen.de> |
| 29 | --- |
| 30 | libebtc.c | 2 +- |
| 31 | 1 file changed, 1 insertion(+), 1 deletion(-) |
| 32 | |
| 33 | diff --git a/libebtc.c b/libebtc.c |
| 34 | index 17ba8f2..74830ec 100644 |
| 35 | --- a/libebtc.c |
| 36 | +++ b/libebtc.c |
| 37 | @@ -1102,7 +1102,7 @@ void ebt_check_for_loops(struct ebt_u_replace *replace) |
| 38 | /* check if we've dealt with this chain already */ |
| 39 | if (entries2->hook_mask & (1<<i)) |
| 40 | goto letscontinue; |
| 41 | - entries2->hook_mask |= entries->hook_mask; |
| 42 | + entries2->hook_mask |= entries->hook_mask & ~(1 << NF_BR_NUMHOOKS); |
| 43 | /* Jump to the chain, make sure we know how to get back */ |
| 44 | stack[sp].chain_nr = chain_nr; |
| 45 | stack[sp].n = j; |
| 46 | -- |
| 47 | 2.12.1 |
| 48 | |