diff -Nru ebtables-2.0.10.4/autogen.sh ebtables-2.0.10.4+snapshot20181205/autogen.sh --- ebtables-2.0.10.4/autogen.sh 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/autogen.sh 2018-12-05 11:27:50.000000000 +0000 @@ -0,0 +1,4 @@ +#!/bin/sh -e + +autoreconf -fi; +rm -Rf autom4te*.cache; diff -Nru ebtables-2.0.10.4/communication.c ebtables-2.0.10.4+snapshot20181205/communication.c --- ebtables-2.0.10.4/communication.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/communication.c 2018-12-05 11:27:50.000000000 +0000 @@ -282,7 +282,7 @@ } close_file: fclose(file); - return 0; + return ret; } /* Gets executed after ebt_deliver_table. Delivers the counters to the kernel diff -Nru ebtables-2.0.10.4/configure.ac ebtables-2.0.10.4+snapshot20181205/configure.ac --- ebtables-2.0.10.4/configure.ac 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/configure.ac 2018-12-05 11:27:50.000000000 +0000 @@ -0,0 +1,23 @@ +AC_INIT([ebtables], [2.0.10.4]) +AC_CONFIG_AUX_DIR([build-aux]) +AC_CONFIG_HEADERS([config.h]) +AC_CONFIG_MACRO_DIR([m4]) +AC_PROG_INSTALL +AM_INIT_AUTOMAKE([-Wall foreign subdir-objects tar-pax]) +AC_PROG_CC +AM_PROG_CC_C_O +AC_DISABLE_STATIC +m4_ifdef([AM_PROG_AR], [AM_PROG_AR]) +AM_PROG_LIBTOOL + +regular_CFLAGS="-Wall -Wunused" +regular_CPPFLAGS="" +case "$host" in + sparc64-*) + regular_CPPFLAGS="$regular_CPPFLAGS -DEBT_MIN_ALIGN=8 -DKERNEL_64_USERSPACE_32";; +esac + +AC_SUBST([regular_CFLAGS]) +AC_SUBST([regular_CPPFLAGS]) +AC_CONFIG_FILES([Makefile]) +AC_OUTPUT diff -Nru ebtables-2.0.10.4/debian/changelog ebtables-2.0.10.4+snapshot20181205/debian/changelog --- ebtables-2.0.10.4/debian/changelog 2016-03-15 14:46:05.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/changelog 2021-07-21 21:02:13.000000000 +0000 @@ -1,3 +1,121 @@ +ebtables (2.0.10.4+snapshot20181205-1ubuntu1~16.04.sav0) xenial; urgency=medium + + * Backport to Xenial + * debian/compat: Set compat level to 10 (Launchpad sbuild highest for Xenial) + + -- Rob Savoury Wed, 21 Jul 2021 14:02:13 -0700 + +ebtables (2.0.10.4+snapshot20181205-1ubuntu1) disco; urgency=medium + + * Merge with Debian unstable (LP: #1812847). Remaining changes: + - Never return failure during ebtables.init stop(), it can cause + errors during package upgrade + - Add version number check to prerm script, to only ignore + failed upgrade for older versions instead of all versions. + * Dropped changes: + - Link ebtables with --no-as-needed and adjust the link order to fix + crash when running ebtables. + [fixed upstream commit 131920089dc21db43e7dba7104c15889701230ea] + - Use real locking in ebtables + [fixed upstream commit 6a826591878db3fa9e2a94b87a3d5edd8e0fc442] + - Fix check of fcntl errno value, to allow lockfile contention to work. + [fixed upstream commit 6a826591878db3fa9e2a94b87a3d5edd8e0fc442] + + -- Karl Stenerud Thu, 24 Jan 2019 11:28:57 +0100 + +ebtables (2.0.10.4+snapshot20181205-1) unstable; urgency=medium + + * [6222d5e] New upstream version 2.0.10.4+snapshot20181205 + * [e8625b3] Adapt debian patches to the latest upstream version + * [02842b0] ebtables: introduce /sbin compatibility symlinks + * [1927aad] ebtables: introduce alternatives for /usr/sbin/ebtables + (Closes: #912046) + * [b649957] d/patches ebtables libraries in a specific directory + + -- Alberto Molina Coballes Tue, 01 Jan 2019 12:21:45 +0000 + +ebtables (2.0.10.4-5) unstable; urgency=medium + + * [3681e23] d/patches: Add dpkg-buildflags + * [2663aba] d/patches: Modify makefile allowing parallel build + (Closes: #897592) + * [e30fe91] manpages: Add ebtables-save.8 and ebtables-restore.8 + + -- Alberto Molina Coballes Wed, 09 May 2018 15:58:13 +0000 + +ebtables (2.0.10.4-4) unstable; urgency=medium + + [ Alberto Molina Coballes ] + * [bf201c6] d/control: Updating maintainers and adding uploaders + (Closes: #891769) + * [0f4ede2] d/control: Updating Standards-Version to 4.1.3 + * [3ce5061] d/control: Adding VCS-* headers + * [481b022] d/control: Updating homepage + * [16740e9] d/watch: Updating url + * [6d94fde] d/control: Updating debhelper to 11 + * [ea71db8] d/compat: Updating to 11 + * [a80dc56] d/copyright: Updating according to DEP-5 + + [ Arturo Borrero Gonzalez ] + * [1b1ac15] d/rules: use debhelper rather than cdbs + * [dd20bc3] d/patches: add compilation_warning.patch + + [ Alberto Molina Coballes ] + * [1aa6f5d] d/patches: set LIBDIR to /lib/ebtables + * [01096e7] d/control: delete dh-systemd (>= 1.5) as build-dependence + * [9232eca] d/patches: add -g to produce debugging information + + -- Alberto Molina Coballes Thu, 26 Apr 2018 09:12:22 +0000 + +ebtables (2.0.10.4-3.5ubuntu5) cosmic; urgency=medium + + * Add version number check to prerm script, to only ignore + failed upgrade for older versions instead of all versions. + + -- Dan Streetman Mon, 11 Jun 2018 15:56:23 -0400 + +ebtables (2.0.10.4-3.5ubuntu4) cosmic; urgency=medium + + * Never return failure during ebtables.init stop(), it can cause + errors during package upgrade (LP: #1774120) + + -- Dan Streetman Thu, 31 May 2018 08:46:43 -0400 + +ebtables (2.0.10.4-3.5ubuntu3) cosmic; urgency=medium + + * Fix check of fcntl errno value, to allow lockfile contention to work. + (LP: #1772456) + + -- Dan Streetman Mon, 21 May 2018 13:20:15 -0400 + +ebtables (2.0.10.4-3.5ubuntu2) artful; urgency=medium + + * Use real locking in ebtables (LP: #1645324) + - Prior use of locking by file exclusive access is inadequate + because if ebtables crashes or is killed it will leave a + stale lock file behind which then blocks new ebtables from + running. + + -- Dragan Stancevic Tue, 18 Apr 2017 17:32:38 -0500 + +ebtables (2.0.10.4-3.5ubuntu1) yakkety; urgency=medium + + * Merge with Debian unstable. Remaining changes: + - Link ebtables with --no-as-needed and adjust the link order to fix + crash when running ebtables. (LP: #899315) + + -- Martin Pitt Thu, 28 Jul 2016 14:38:18 +0200 + +ebtables (2.0.10.4-3.5) unstable; urgency=medium + + * Non-maintainer upload. + * Add native systemd unit file ebtables.service (Closes: #796602) + - this is basically just a wrapper around the init script. + * Add dh-systemd (>= 1.5) build dependency for the above. + - accompanying cdbs versioned dependency was already new enough. + + -- Andreas Henriksson Wed, 25 May 2016 20:34:14 +0200 + ebtables (2.0.10.4-3.4ubuntu1) xenial; urgency=medium * Merge with Debian unstable (LP: #1556300). Remaining changes: diff -Nru ebtables-2.0.10.4/debian/compat ebtables-2.0.10.4+snapshot20181205/debian/compat --- ebtables-2.0.10.4/debian/compat 2012-05-24 12:13:16.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/compat 2021-07-21 21:01:41.000000000 +0000 @@ -1 +1 @@ -9 +10 diff -Nru ebtables-2.0.10.4/debian/control ebtables-2.0.10.4+snapshot20181205/debian/control --- ebtables-2.0.10.4/debian/control 2016-03-15 14:46:05.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/control 2019-01-24 10:28:57.000000000 +0000 @@ -2,17 +2,19 @@ Section: net Priority: optional Maintainer: Ubuntu Developers -XSBC-Original-Maintainer: Jochen Friedrich -Uploaders: William Dauchy -Standards-Version: 3.9.6 -Build-Depends: debhelper (>= 9), cdbs (>= 0.4.127) -Homepage: http://ebtables.sourceforge.net +XSBC-Original-Maintainer: Debian Netfilter Packaging Team +Uploaders: Alberto Molina Coballes +Standards-Version: 4.1.3 +Build-Depends: debhelper (>= 11) +Homepage: https://netfilter.org/ +Vcs-Git: https://salsa.debian.org/pkg-netfilter-team/pkg-ebtables.git +Vcs-Browser: https://salsa.debian.org/pkg-netfilter-team/pkg-ebtables.git Package: ebtables Architecture: linux-any Depends: ${shlibs:Depends}, ${misc:Depends} Recommends: iptables, kmod Description: Ethernet bridge frame table administration - Ebtables is used to set up, maintain, and inspect the tables of - Ethernet frame rules in the Linux kernel. It is analogous to iptables, + Ebtables is used to set up, maintain, and inspect the tables of + Ethernet frame rules in the Linux kernel. It is analogous to iptables, but operates at the MAC layer rather than the IP layer. diff -Nru ebtables-2.0.10.4/debian/copyright ebtables-2.0.10.4+snapshot20181205/debian/copyright --- ebtables-2.0.10.4/debian/copyright 2010-05-06 16:49:21.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/copyright 2019-01-24 10:28:57.000000000 +0000 @@ -1,34 +1,37 @@ -This package was debianized by David Kimdon on -Fri, 17 Jan 2003 20:05:00 -0800. - -It is currently maintained by Jochen Friedrich -and Jan Christoph Nordholz . - -It was downloaded from http://ebtables.sourceforge.net - -Upstream Authors: - Bart De Schuymer - Nick Fedchik - Grzegorz Borowiak - -Copyright: - Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling - Copyright (C) 2001, 2002, 2004 Bart De Schuymer - -License: - This package is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 dated June, 1991. - - This package is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this package; if not, write to the Free Software - Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, - MA 02110-1301, USA. - -On Debian GNU/Linux systems, the complete text of the GNU General Public -License, version 2, can be found in `/usr/share/common-licenses/GPL-2'. +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ +Upstream-Name: ebtables +Source: http://ftp.netfilter.org/pub/ebtables/ + +Files: * +Copyright: 1999 Paul `Rusty' Russell + 1999 Michael J. Neuling + 2002 Nick Fedchik + 2003 Grzegorz Borowiak + 2001-2005 Bart De Schuymer +License: GPL-2 + +Files: debian/* +Copyright: 2003 David Kimdon + 2003-2010 Jochen Friedrich + 2007-2009 Jan Christoph Nordholz + 2012-2013 William Dauchy + 2016 Laurent Bigonville + 2018 Alberto Molina Coballes +License: GPL-2 + +License: GPL-2 + This package is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License version 2 as + published by the Free Software Foundation. + . + This package is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + . + You should have received a copy of the GNU General Public License + along with this package; if not, write to the Free Software + Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + . + On Debian systems, the complete text of the GNU General Public License version + 2 can be found in `/usr/share/common-licenses/GPL-2'. \ No newline at end of file diff -Nru ebtables-2.0.10.4/debian/ebtables.init ebtables-2.0.10.4+snapshot20181205/debian/ebtables.init --- ebtables-2.0.10.4/debian/ebtables.init 2013-03-15 14:40:53.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/ebtables.init 2019-01-24 10:28:57.000000000 +0000 @@ -49,7 +49,7 @@ /sbin/ebtables -t filter -L 2>&1 1>/dev/null | grep -q permission if [ $? -eq 0 ]; then log_failure_msg "Error: insufficient privileges to access the ebtables rulesets." - exit 1 + return fi for table in filter nat broute; do /sbin/ebtables -t $table -L &> /dev/null @@ -140,6 +140,9 @@ stop) [ "$EBTABLES_SAVE_ON_STOP" = "yes" ] && save clear + # Never return failure for stop; it's not helpful, and causes problems + # in some cases during pkg upgrade, e.g. LP: #1774120 + RETVAL=0 ;; restart|reload|force-reload) [ "$EBTABLES_SAVE_ON_RESTART" = "yes" ] && save diff -Nru ebtables-2.0.10.4/debian/ebtables.manpages ebtables-2.0.10.4+snapshot20181205/debian/ebtables.manpages --- ebtables-2.0.10.4/debian/ebtables.manpages 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/ebtables.manpages 2019-01-24 10:28:57.000000000 +0000 @@ -0,0 +1,2 @@ +debian/ebtables-save.8 +debian/ebtables-restore.8 \ No newline at end of file diff -Nru ebtables-2.0.10.4/debian/ebtables.postinst ebtables-2.0.10.4+snapshot20181205/debian/ebtables.postinst --- ebtables-2.0.10.4/debian/ebtables.postinst 2016-02-07 21:00:16.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/ebtables.postinst 2019-01-24 10:28:57.000000000 +0000 @@ -12,8 +12,15 @@ rmdir --ignore-fail-on-non-empty /var/lib/ebtables fi fi - ;; +# compat symlinks for /sbin -> /usr/sbin move, to be dropped in buster+1 + LIST="/sbin/ebtables /sbin/ebtables-save /sbin/ebtables-restore" + for i in $LIST ; do + if [ ! -e "$i" ] ; then + ln -sf /usr$i $i + fi + done + ;; abort-upgrade|abort-remove|abort-deconfigure) ;; @@ -23,6 +30,15 @@ ;; esac +# Providing alternatives with lower priority than those provided by iptables >= 1.8 + +if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ]; then + update-alternatives \ + --install /usr/sbin/ebtables ebtables /usr/sbin/ebtables-legacy 10 \ + --slave /usr/sbin/ebtables-restore ebtables-restore /usr/sbin/ebtables-legacy-restore \ + --slave /usr/sbin/ebtables-save ebtables-save /usr/sbin/ebtables-legacy-save +fi + # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. diff -Nru ebtables-2.0.10.4/debian/ebtables.prerm ebtables-2.0.10.4+snapshot20181205/debian/ebtables.prerm --- ebtables-2.0.10.4/debian/ebtables.prerm 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/ebtables.prerm 2019-01-24 10:28:57.000000000 +0000 @@ -0,0 +1,30 @@ +#!/bin/bash + +set -e + +if [ "$1" != "upgrade" ]; then + update-alternatives --remove ebtables /usr/sbin/ebtables-legacy +fi + +# compat symlinks are deleted, unless iptables is installed and its version is equal +# or higher to 1.8 + +if [ "$1" = "remove" ] ; then + iptables_version=$(dpkg-query -W -f='${Version;3}\n' iptables) + if [[ "$iptables_version" < 1.8 ]]; then + LIST="/sbin/ebtables /sbin/ebtables-save /sbin/ebtables-restore" + + for i in $LIST ; do + if [ -L "$i" ] ; then + rm $i + fi + done + fi +fi + +if [ "$1" = "failed-upgrade" ]; then + # Ignore failed prerm on old versions; see LP: #1774120 + dpkg --compare-versions "$2" lt "2.0.10.4-3.5ubuntu5" && exit 0 +fi + +#DEBHELPER# diff -Nru ebtables-2.0.10.4/debian/ebtables-restore.8 ebtables-2.0.10.4+snapshot20181205/debian/ebtables-restore.8 --- ebtables-2.0.10.4/debian/ebtables-restore.8 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/ebtables-restore.8 2019-01-24 10:28:57.000000000 +0000 @@ -0,0 +1,36 @@ +.TH EBTABLES-RESTORE 8 "May 09, 2018" "" "" +.\" +.\" Man page written by Alberto Molina Coballes +.\" It is based on the arptables-restore man page. +.\" +.\" This program is free software; you can redistribute it and/or modify +.\" it under the terms of the GNU General Public License as published by +.\" the Free Software Foundation; either version 2 of the License, or +.\" (at your option) any later version. +.\" +.\" This program is distributed in the hope that it will be useful, +.\" but WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +.\" GNU General Public License for more details. +.\" +.\" You should have received a copy of the GNU General Public License +.\" along with this program; if not, write to the Free Software +.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +.\" +.\" +.SH NAME +ebtables-restore \- Restore Ethernet bridge frame Tables +.SH SYNOPSIS +.BR "ebtables-restore " +.br +.SH DESCRIPTION +.PP +.B ebtables-restore +is used to restore Ethernet bridge frame Tables from data specified on +STDIN. Use I/O redirection provided by your shell to read from a file +.SH BUGS +None known as of ebtables-2.0.10-4 release +.SH AUTHOR +Bart De Schuymer +.SH SEE ALSO +.BR ebtables-save "(8), " ebtables "(8) " diff -Nru ebtables-2.0.10.4/debian/ebtables-save.8 ebtables-2.0.10.4+snapshot20181205/debian/ebtables-save.8 --- ebtables-2.0.10.4/debian/ebtables-save.8 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/ebtables-save.8 2019-01-24 10:28:57.000000000 +0000 @@ -0,0 +1,37 @@ +.TH ARPTABLES-SAVE 8 "May 09, 2018" "" "" +.\" +.\" Man page written by Alberto Molina Coballes +.\" It is based on the arptables-save man page. +.\" +.\" This program is free software; you can redistribute it and/or modify +.\" it under the terms of the GNU General Public License as published by +.\" the Free Software Foundation; either version 2 of the License, or +.\" (at your option) any later version. +.\" +.\" This program is distributed in the hope that it will be useful, +.\" but WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +.\" GNU General Public License for more details. +.\" +.\" You should have received a copy of the GNU General Public License +.\" along with this program; if not, write to the Free Software +.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +.\" +.\" +.SH NAME +ebtables-save \- Dump ebtables rules to stdout +.SH SYNOPSIS +.BR "ebtables-save " +.br +.SH DESCRIPTION +.PP +.B ebtables-save +is used to dump the contents of an Ethernet bridge frame Table in +easily parseable format to STDOUT. Use I/O-redirection provided by +your shell to write to a file. +.SH BUGS +None known as of ebtables-2.0.10-4 release +.SH AUTHOR +Bart De Schuymer +.SH SEE ALSO +.BR ebtables-restore "(8), " ebtables "(8) " diff -Nru ebtables-2.0.10.4/debian/ebtables.service ebtables-2.0.10.4+snapshot20181205/debian/ebtables.service --- ebtables-2.0.10.4/debian/ebtables.service 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/ebtables.service 2019-01-24 10:28:57.000000000 +0000 @@ -0,0 +1,19 @@ +[Unit] +Description=ebtables ruleset management +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +After=local-fs.target +# n.b. use below if we want to tear down rules before shutting down. +#Before=shutdown.target +#Conflicts=shutdown.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/etc/init.d/ebtables start +ExecStop=/etc/init.d/ebtables stop +ExecReload=/etc/init.d/ebtables reload + +[Install] +WantedBy=multi-user.target diff -Nru ebtables-2.0.10.4/debian/NEWS ebtables-2.0.10.4+snapshot20181205/debian/NEWS --- ebtables-2.0.10.4/debian/NEWS 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/NEWS 2019-01-24 10:28:57.000000000 +0000 @@ -0,0 +1,11 @@ +ebtables (2.0.10.4+snapshot20181205-1) unstable; urgency=medium + + All the ebtables binaries have been moved away from /sbin to + /usr/sbin. Some compatibility symlinks have been added for the + Buster release cycle, but please make sure your scripts aren't using + hardcoded binary paths. + + The plan is to drop the symlinks in Bullseye, the release after + Buster. + + -- Alberto Molina Coballes Sun, 27 Dec 2018 21:29:00 +0100 diff -Nru ebtables-2.0.10.4/debian/patches/configure.patch ebtables-2.0.10.4+snapshot20181205/debian/patches/configure.patch --- ebtables-2.0.10.4/debian/patches/configure.patch 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/patches/configure.patch 2019-01-24 10:28:57.000000000 +0000 @@ -0,0 +1,14 @@ +Description: configure.am patch +Ebtables libraries are allocated in a specific directory +From: Alberto Molina Coballes + +--- a/configure.ac ++++ b/configure.ac +@@ -10,6 +10,7 @@ + m4_ifdef([AM_PROG_AR], [AM_PROG_AR]) + AM_PROG_LIBTOOL + ++libdir="/usr/lib/ebtables" + regular_CFLAGS="-Wall -Wunused" + regular_CPPFLAGS="" + case "$host" in diff -Nru ebtables-2.0.10.4/debian/patches/debian_defaultconfig.patch ebtables-2.0.10.4+snapshot20181205/debian/patches/debian_defaultconfig.patch --- ebtables-2.0.10.4/debian/patches/debian_defaultconfig.patch 2012-06-04 20:36:11.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/patches/debian_defaultconfig.patch 2019-01-24 10:28:57.000000000 +0000 @@ -2,8 +2,8 @@ From: Jan Christoph Nordholz --- ---- a/ebtables-config -+++ b/ebtables-config +--- a/ebtables-config.in ++++ b/ebtables-config.in @@ -1,17 +1,3 @@ -# Save (and possibly restore) in text format. -# Value: yes|no, default: yes @@ -44,4 +44,5 @@ +# Value: , default: "~" +# Keep one backup level of saved rules. +# Set this variable to the empty string to disable backups. -+EBTABLES_BACKUP_SUFFIX="~" +++EBTABLES_BACKUP_SUFFIX="~" + diff -Nru ebtables-2.0.10.4/debian/patches/link_with_no-as-needed.patch ebtables-2.0.10.4+snapshot20181205/debian/patches/link_with_no-as-needed.patch --- ebtables-2.0.10.4/debian/patches/link_with_no-as-needed.patch 2016-03-15 14:46:05.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/patches/link_with_no-as-needed.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,15 +0,0 @@ -Bug-Ubuntu: https://bugs.launchpad.net/bugs/899315 - -Index: b/Makefile -=================================================================== ---- a/Makefile -+++ b/Makefile -@@ -90,7 +90,7 @@ - $(CC) -shared $(LDFLAGS) -Wl,-soname,libebtc.so -o libebtc.so -lc $(OBJECTS2) - - ebtables: $(OBJECTS) ebtables-standalone.o libebtc.so -- $(CC) $(CFLAGS) $(CFLAGS_SH_LIB) $(LDFLAGS) -o $@ ebtables-standalone.o -I$(KERNEL_INCLUDES) -L. -Lextensions -lebtc $(EXT_LIBSI) \ -+ $(CC) $(CFLAGS) $(CFLAGS_SH_LIB) $(LDFLAGS) -o $@ ebtables-standalone.o -I$(KERNEL_INCLUDES) -L. -Lextensions -Wl,--no-as-needed $(EXT_LIBSI) -lebtc \ - -Wl,-rpath,$(LIBDIR) - - ebtablesu: ebtablesu.c diff -Nru ebtables-2.0.10.4/debian/patches/lockdirfix.patch ebtables-2.0.10.4+snapshot20181205/debian/patches/lockdirfix.patch --- ebtables-2.0.10.4/debian/patches/lockdirfix.patch 2016-02-05 12:12:16.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/patches/lockdirfix.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,54 +0,0 @@ -Description: Move the lockfile from /var/lib/ebtables/lock to /run/ebtables.lock -Origin: http://pkgs.fedoraproject.org/cgit/rpms/ebtables.git/tree/ebtables-2.0.10-linkfix.patch -Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813760 - -diff -up ebtables-v2.0.10-4/ebtables.8.lockdirfix ebtables-v2.0.10-4/ebtables.8 ---- ebtables-v2.0.10-4/ebtables.8.lockdirfix 2016-01-18 11:13:21.707069702 -0500 -+++ ebtables-v2.0.10-4/ebtables.8 2016-01-18 11:13:40.554953365 -0500 -@@ -1103,7 +1103,7 @@ arp message and the hardware address len - .br - .SH FILES - .I /etc/ethertypes --.I /var/lib/ebtables/lock -+.I /run/ebtables.lock - .SH ENVIRONMENT VARIABLES - .I EBTABLES_ATOMIC_FILE - .SH MAILINGLISTS -diff -up ebtables-v2.0.10-4/INSTALL.lockdirfix ebtables-v2.0.10-4/INSTALL ---- ebtables-v2.0.10-4/INSTALL.lockdirfix 2016-01-18 11:15:31.458268826 -0500 -+++ ebtables-v2.0.10-4/INSTALL 2016-01-18 11:15:53.890130367 -0500 -@@ -31,7 +31,7 @@ WHAT GETS INSTALLED AND WHAT OPTIONS ARE - copied to /etc/rc.d/init.d (change with option INITDIR) - - The ebtables configuration file (ebtables-config) is copied to /etc/sysconfig - - ebtables can use a lock file to enable concurrent execution of the ebtables -- tool. The standard location of the lock file is /var/lib/ebtables/lock. -+ tool. The standard location of the lock file is /run/ebtables.lock. - Include LOCKFILE=<> if you want to use another file. - - That's all -diff -up ebtables-v2.0.10-4/libebtc.c.lockdirfix ebtables-v2.0.10-4/libebtc.c ---- ebtables-v2.0.10-4/libebtc.c.lockdirfix 2016-01-18 11:12:14.347485472 -0500 -+++ ebtables-v2.0.10-4/libebtc.c 2016-01-18 11:13:06.515163472 -0500 -@@ -134,8 +134,8 @@ void ebt_list_extensions() - } - - #ifndef LOCKFILE --#define LOCKDIR "/var/lib/ebtables" --#define LOCKFILE LOCKDIR"/lock" -+#define LOCKDIR "/run" -+#define LOCKFILE LOCKDIR"/ebtables.lock" - #endif - static int lockfd = -1, locked; - int use_lockfd; -diff -up ebtables-v2.0.10-4/Makefile.lockdirfix ebtables-v2.0.10-4/Makefile ---- ebtables-v2.0.10-4/Makefile.lockdirfix 2016-01-18 11:14:10.715767201 -0500 -+++ ebtables-v2.0.10-4/Makefile 2016-01-18 11:15:20.506336425 -0500 -@@ -5,7 +5,7 @@ PROGRELEASE:=4 - PROGVERSION_:=2.0.10 - PROGVERSION:=$(PROGVERSION_)-$(PROGRELEASE) - PROGDATE:=December\ 2011 --LOCKFILE?=/var/lib/ebtables/lock -+LOCKFILE?=/run/ebtables.lock - LOCKDIR:=$(shell echo $(LOCKFILE) | sed 's/\(.*\)\/.*/\1/')/ - - # default paths diff -Nru ebtables-2.0.10.4/debian/patches/makefile_adjustments.patch ebtables-2.0.10.4+snapshot20181205/debian/patches/makefile_adjustments.patch --- ebtables-2.0.10.4/debian/patches/makefile_adjustments.patch 2012-06-04 20:36:59.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/patches/makefile_adjustments.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,68 +0,0 @@ -Description: makefile_adjustments -Adjust the installation paths to Debian-compatible values, and drag -all install incovations to the install target because $(DESTDIR) -(i.e. debian/ebtables) isn't available before. -Also fix an FTBFS bug on HPPA by calling $(CC) instead of $(LD). -From: Jan Christoph Nordholz ---- - ---- a/Makefile -+++ b/Makefile -@@ -10,11 +10,11 @@ - - # default paths - LIBDIR:=/usr/lib --MANDIR:=/usr/local/man --BINDIR:=/usr/local/sbin -+MANDIR:=/usr/share/man -+BINDIR:=/sbin - ETCDIR:=/etc --INITDIR:=/etc/rc.d/init.d --SYSCONFIGDIR:=/etc/sysconfig -+INITDIR:=/etc/init.d -+SYSCONFIGDIR:=/etc/default - DESTDIR:= - - CFLAGS:=-Wall -Wunused -Werror -@@ -157,21 +157,14 @@ - scripts: ebtables-save ebtables.sysv ebtables-config - cat ebtables-save | sed 's/__EXEC_PATH__/$(tmp1)/g' > ebtables-save_ - mkdir -p $(DESTDIR)$(BINDIR) -- install -m 0755 -o root -g root ebtables-save_ $(DESTDIR)$(BINDIR)/ebtables-save - cat ebtables.sysv | sed 's/__EXEC_PATH__/$(tmp1)/g' | sed 's/__SYSCONFIG__/$(tmp2)/g' > ebtables.sysv_ - if [ "$(DESTDIR)" != "" ]; then mkdir -p $(DESTDIR)$(INITDIR); fi -- if test -d $(DESTDIR)$(INITDIR); then install -m 0755 -o root -g root ebtables.sysv_ $(DESTDIR)$(INITDIR)/ebtables; fi - cat ebtables-config | sed 's/__SYSCONFIG__/$(tmp2)/g' > ebtables-config_ - if [ "$(DESTDIR)" != "" ]; then mkdir -p $(DESTDIR)$(SYSCONFIGDIR); fi -- if test -d $(DESTDIR)$(SYSCONFIGDIR); then install -m 0600 -o root -g root ebtables-config_ $(DESTDIR)$(SYSCONFIGDIR)/ebtables-config; fi -- rm -f ebtables-save_ ebtables.sysv_ ebtables-config_ - - tmp4:=$(shell printf $(LOCKFILE) | sed 's/\//\\\//g') - $(MANDIR)/man8/ebtables.8: ebtables.8 -- mkdir -p $(DESTDIR)$(@D) - sed -e 's/$$(VERSION)/$(PROGVERSION)/' -e 's/$$(DATE)/$(PROGDATE)/' -e 's/$$(LOCKFILE)/$(tmp4)/' ebtables.8 > ebtables.8_ -- install -m 0644 -o root -g root ebtables.8_ $(DESTDIR)$@ -- rm -f ebtables.8_ - - $(DESTDIR)$(ETHERTYPESFILE): ethertypes - mkdir -p $(@D) -@@ -179,12 +172,16 @@ - - .PHONY: exec - exec: ebtables ebtables-restore -- mkdir -p $(DESTDIR)$(BINDIR) -- install -m 0755 -o root -g root $(PROGNAME) $(DESTDIR)$(BINDIR)/$(PROGNAME) -+ mkdir -p $(DESTDIR)$(LIBDIR) $(DESTDIR)$(INITDIR) $(DESTDIR)$(SYSCONFIGDIR) $(DESTDIR)$(MANDIR)/man8 -+ install -m 0755 -o root -g root $(PROGNAME) $(DESTDIR)$(BINDIR) - install -m 0755 -o root -g root ebtables-restore $(DESTDIR)$(BINDIR)/ebtables-restore -+ install -m 0755 -o root -g root ebtables-save_ $(DESTDIR)$(BINDIR)/ebtables-save -+ install -m 0755 -o root -g root ebtables.sysv_ $(DESTDIR)$(INITDIR)/ebtables -+ install -m 0600 -o root -g root ebtables-config_ $(DESTDIR)$(SYSCONFIGDIR)/ebtables-config -+ install -m 0644 -o root -g root ebtables.8_ $(DESTDIR)$(MANDIR)/man8/ebtables.8 - - .PHONY: install --install: $(MANDIR)/man8/ebtables.8 $(DESTDIR)$(ETHERTYPESFILE) exec scripts -+install: $(MANDIR)/man8/ebtables.8 $(DESTDIR)$(ETHERTYPESFILE) scripts exec - mkdir -p $(DESTDIR)$(LIBDIR) - install -m 0755 extensions/*.so $(DESTDIR)$(LIBDIR) - install -m 0755 *.so $(DESTDIR)$(LIBDIR) diff -Nru ebtables-2.0.10.4/debian/patches/makefile.patch ebtables-2.0.10.4+snapshot20181205/debian/patches/makefile.patch --- ebtables-2.0.10.4/debian/patches/makefile.patch 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/patches/makefile.patch 2019-01-24 10:28:57.000000000 +0000 @@ -0,0 +1,19 @@ +Description: Makefile.am patch +Adjust the installation paths to Debian-compatible values +From: Alberto Molina Coballes + +--- a/Makefile.am ++++ b/Makefile.am +@@ -7,9 +7,10 @@ + PROGDATE = December\ 2011 + LOCKDIR = /var/lib/ebtables + LOCKFILE = ${LOCKDIR}/lock +-INITDIR = /etc/rc.d/init.d ++INITDIR = /etc/init.d + initddir = ${INITDIR} +-sysconfigdir = ${sysconfdir}/sysconfig ++sysconfigdir = /etc/default ++sbindir = /usr/sbin + EBTD_CMDLINE_MAXLN = 2048 + EBTD_ARGC_MAX = 50 + PIPE_DIR = /tmp/${PACKAGE_NAME}-v${PROGVERSION} diff -Nru ebtables-2.0.10.4/debian/patches/manpage.patch ebtables-2.0.10.4+snapshot20181205/debian/patches/manpage.patch --- ebtables-2.0.10.4/debian/patches/manpage.patch 2012-06-04 20:43:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/patches/manpage.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,15 +0,0 @@ -Description: Drop the version number from the manpage header. -From: Jan Christoph Nordholz ---- - ---- a/ebtables.8 -+++ b/ebtables.8 -@@ -24,7 +24,7 @@ - .\" - .\" - .SH NAME --ebtables (v2.0.10-4) \- Ethernet bridge frame table administration -+ebtables \- Ethernet bridge frame table administration - .SH SYNOPSIS - .BR "ebtables " [ -t " table ] " - [ ACDI "] chain rule specification [match extensions] [watcher extensions] target" - .br diff -Nru ebtables-2.0.10.4/debian/patches/series ebtables-2.0.10.4+snapshot20181205/debian/patches/series --- ebtables-2.0.10.4/debian/patches/series 2016-03-15 14:46:05.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/patches/series 2019-01-24 10:28:57.000000000 +0000 @@ -1,6 +1,5 @@ +configure.patch +makefile.patch debian_defaultconfig.patch -makefile_adjustments.patch -manpage.patch compensate-for-missing-aligned-u64.patch -lockdirfix.patch -link_with_no-as-needed.patch + diff -Nru ebtables-2.0.10.4/debian/rules ebtables-2.0.10.4+snapshot20181205/debian/rules --- ebtables-2.0.10.4/debian/rules 2016-02-05 01:12:50.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/rules 2019-01-24 10:28:57.000000000 +0000 @@ -1,32 +1,5 @@ #!/usr/bin/make -f -export DPKG_EXPORT_BUILDFLAGS = 1 -export DEB_CFLAGS_MAINT_APPEND=-fstack-protector-all -include /usr/share/dpkg/buildflags.mk +%: + dh $@ -MAKE_PATH_REDIRECTIONS:=LIBDIR=/lib/ebtables \ - BINDIR=/sbin \ - DESTDIR=debian/ebtables - -include /usr/share/cdbs/1/rules/debhelper.mk - -DEB_DH_INSTALLINIT_ARGS:=-- start 20 S . stop 80 0 1 6 . - -build/ebtables:: - make CFLAGS="$(CPPFLAGS) $(CFLAGS)" CFLAGS_SH_LIB="-fPIC" LDFLAGS="$(LDFLAGS)" $(MAKE_PATH_REDIRECTIONS) - -clean:: - dh_testdir - rm -f build-stamp - make clean - rm -f ebtables.8_ ebtables.sysv_ ebtables-config_ ebtables-save_ - dh_clean - -install/ebtables:: build - dh_testdir - dh_testroot - dh_clean - dh_installdirs - make install $(MAKE_PATH_REDIRECTIONS) - mv debian/ebtables/etc/default/ebtables-config debian/ebtables/etc/default/ebtables - rm -f debian/ebtables/etc/init.d/ebtables diff -Nru ebtables-2.0.10.4/debian/watch ebtables-2.0.10.4+snapshot20181205/debian/watch --- ebtables-2.0.10.4/debian/watch 2010-05-06 16:49:21.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/debian/watch 2019-01-24 10:28:57.000000000 +0000 @@ -1,2 +1,3 @@ version=3 -opts="uversionmangle=s/-/./g" http://sf.net/ebtables/ebtables-v([[:digit:].-]*)\.tar\.gz +http://ftp.netfilter.org/pub/ebtables/ebtables-v(\S+).tar.gz + diff -Nru ebtables-2.0.10.4/ebtables.8 ebtables-2.0.10.4+snapshot20181205/ebtables.8 --- ebtables-2.0.10.4/ebtables.8 2011-12-15 20:02:48.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtables.8 1970-01-01 00:00:00.000000000 +0000 @@ -1,1114 +0,0 @@ -.TH EBTABLES 8 "December 2011" -.\" -.\" Man page written by Bart De Schuymer -.\" It is based on the iptables man page. -.\" -.\" The man page was edited, February 25th 2003, by -.\" Greg Morgan <" dr_kludge_at_users_sourceforge_net > -.\" -.\" Iptables page by Herve Eychenne March 2000. -.\" -.\" This program is free software; you can redistribute it and/or modify -.\" it under the terms of the GNU General Public License as published by -.\" the Free Software Foundation; either version 2 of the License, or -.\" (at your option) any later version. -.\" -.\" This program is distributed in the hope that it will be useful, -.\" but WITHOUT ANY WARRANTY; without even the implied warranty of -.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -.\" GNU General Public License for more details. -.\" -.\" You should have received a copy of the GNU General Public License -.\" along with this program; if not, write to the Free Software -.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -.\" -.\" -.SH NAME -ebtables (v2.0.10-4) \- Ethernet bridge frame table administration -.SH SYNOPSIS -.BR "ebtables " [ -t " table ] " - [ ACDI "] chain rule specification [match extensions] [watcher extensions] target" -.br -.BR "ebtables " [ -t " table ] " -P " chain " ACCEPT " | " DROP " | " RETURN -.br -.BR "ebtables " [ -t " table ] " -F " [chain]" -.br -.BR "ebtables " [ -t " table ] " -Z " [chain]" -.br -.BR "ebtables " [ -t " table ] " -L " [" -Z "] [chain] [ [" --Ln "] | [" --Lx "] ] [" --Lc "] [" --Lmac2 ] -.br -.BR "ebtables " [ -t " table ] " -N " chain [" "-P ACCEPT " | " DROP " | " RETURN" ] -.br -.BR "ebtables " [ -t " table ] " -X " [chain]" -.br -.BR "ebtables " [ -t " table ] " -E " old-chain-name new-chain-name" -.br -.BR "ebtables " [ -t " table ] " --init-table -.br -.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit -.br -.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init -.br -.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save -.br -.SH DESCRIPTION -.B ebtables -is an application program used to set up and maintain the -tables of rules (inside the Linux kernel) that inspect -Ethernet frames. -It is analogous to the -.B iptables -application, but less complicated, due to the fact that the Ethernet protocol -is much simpler than the IP protocol. -.SS CHAINS -There are three ebtables tables with built-in chains in the -Linux kernel. These tables are used to divide functionality into -different sets of rules. Each set of rules is called a chain. -Each chain is an ordered list of rules that can match Ethernet frames. If a -rule matches an Ethernet frame, then a processing specification tells -what to do with that matching frame. The processing specification is -called a 'target'. However, if the frame does not match the current -rule in the chain, then the next rule in the chain is examined and so forth. -The user can create new (user-defined) chains that can be used as the 'target' -of a rule. User-defined chains are very useful to get better performance -over the linear traversal of the rules and are also essential for structuring -the filtering rules into well-organized and maintainable sets of rules. -.SS TARGETS -A firewall rule specifies criteria for an Ethernet frame and a frame -processing specification called a target. When a frame matches a rule, -then the next action performed by the kernel is specified by the target. -The target can be one of these values: -.BR ACCEPT , -.BR DROP , -.BR CONTINUE , -.BR RETURN , -an 'extension' (see below) or a jump to a user-defined chain. -.PP -.B ACCEPT -means to let the frame through. -.B DROP -means the frame has to be dropped. In the -.BR BROUTING " chain however, the " ACCEPT " and " DROP " target have different" -meanings (see the info provided for the -.BR -t " option)." -.B CONTINUE -means the next rule has to be checked. This can be handy, f.e., to know how many -frames pass a certain point in the chain, to log those frames or to apply multiple -targets on a frame. -.B RETURN -means stop traversing this chain and resume at the next rule in the -previous (calling) chain. -For the extension targets please refer to the -.B "TARGET EXTENSIONS" -section of this man page. -.SS TABLES -As stated earlier, there are three ebtables tables in the Linux -kernel. The table names are -.BR filter ", " nat " and " broute . -Of these three tables, -the filter table is the default table that the command operates on. -If you are working with the filter table, then you can drop the '-t filter' -argument to the ebtables command. However, you will need to provide -the -t argument for the other two tables. Moreover, the -t argument must be the -first argument on the ebtables command line, if used. -.TP -.B "-t, --table" -.br -.B filter -is the default table and contains three built-in chains: -.B INPUT -(for frames destined for the bridge itself, on the level of the MAC destination address), -.B OUTPUT -(for locally-generated or (b)routed frames) and -.B FORWARD -(for frames being forwarded by the bridge). -.br -.br -.B nat -is mostly used to change the mac addresses and contains three built-in chains: -.B PREROUTING -(for altering frames as soon as they come in), -.B OUTPUT -(for altering locally generated or (b)routed frames before they are bridged) and -.B POSTROUTING -(for altering frames as they are about to go out). A small note on the naming -of chains PREROUTING and POSTROUTING: it would be more accurate to call them -PREFORWARDING and POSTFORWARDING, but for all those who come from the -iptables world to ebtables it is easier to have the same names. Note that you -can change the name -.BR "" ( -E ) -if you don't like the default. -.br -.br -.B broute -is used to make a brouter, it has one built-in chain: -.BR BROUTING . -The targets -.BR DROP " and " ACCEPT -have a special meaning in the broute table (these names are used instead of -more descriptive names to keep the implementation generic). -.B DROP -actually means the frame has to be routed, while -.B ACCEPT -means the frame has to be bridged. The -.B BROUTING -chain is traversed very early. However, it is only traversed by frames entering on -a bridge port that is in forwarding state. Normally those frames -would be bridged, but you can decide otherwise here. The -.B redirect -target is very handy here. -.SH EBTABLES COMMAND LINE ARGUMENTS -After the initial ebtables '-t table' command line argument, the remaining -arguments can be divided into several groups. These groups -are commands, miscellaneous commands, rule specifications, match extensions, -watcher extensions and target extensions. -.SS COMMANDS -The ebtables command arguments specify the actions to perform on the table -defined with the -t argument. If you do not use the -t argument to name -a table, the commands apply to the default filter table. -Only one command may be used on the command line at a time, except when -the commands -.BR -L " and " -Z -are combined, the commands -.BR -N " and " -P -are combined, or when -.B --atomic-file -is used. -.TP -.B "-A, --append" -Append a rule to the end of the selected chain. -.TP -.B "-D, --delete" -Delete the specified rule or rules from the selected chain. There are two ways to -use this command. The first is by specifying an interval of rule numbers -to delete (directly after -.BR -D ). -Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use -.B -L --Ln -to list the rules with their rule number). When \fIend_nr\fP is omitted, all rules starting -from \fIstart_nr\fP are deleted. Using negative numbers is allowed, for more -details about using negative numbers, see the -.B -I -command. The second usage is by -specifying the complete rule as it would have been specified when it was added. Only -the first encountered rule that is the same as this specified rule, in other -words the matching rule with the lowest (positive) rule number, is deleted. -.TP -.B "-C, --change-counters" -Change the counters of the specified rule or rules from the selected chain. There are two ways to -use this command. The first is by specifying an interval of rule numbers -to do the changes on (directly after -.BR -C ). -Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use -.B -L --Ln -to list the rules with their rule number). The details are the same as for the -.BR -D " command. The second usage is by" -specifying the complete rule as it would have been specified when it was added. Only -the counters of the first encountered rule that is the same as this specified rule, in other -words the matching rule with the lowest (positive) rule number, are changed. -In the first usage, the counters are specified directly after the interval specification, -in the second usage directly after -.BR -C . -First the packet counter is specified, then the byte counter. If the specified counters start -with a '+', the counter values are added to the respective current counter values. -If the specified counters start with a '-', the counter values are decreased from the respective -current counter values. No bounds checking is done. If the counters don't start with '+' or '-', -the current counters are changed to the specified counters. -.TP -.B "-I, --insert" -Insert the specified rule into the selected chain at the specified rule number. If the -rule number is not specified, the rule is added at the head of the chain. -If the current number of rules equals -.IR N , -then the specified number can be -between -.IR -N " and " N+1 . -For a positive number -.IR i , -it holds that -.IR i " and " i-N-1 -specify the same place in the chain where the rule should be inserted. The rule number -0 specifies the place past the last rule in the chain and using this number is therefore -equivalent to using the -.BR -A " command." -Rule numbers structly smaller than 0 can be useful when more than one rule needs to be inserted -in a chain. -.TP -.B "-P, --policy" -Set the policy for the chain to the given target. The policy can be -.BR ACCEPT ", " DROP " or " RETURN . -.TP -.B "-F, --flush" -Flush the selected chain. If no chain is selected, then every chain will be -flushed. Flushing a chain does not change the policy of the -chain, however. -.TP -.B "-Z, --zero" -Set the counters of the selected chain to zero. If no chain is selected, all the counters -are set to zero. The -.B "-Z" -command can be used in conjunction with the -.B "-L" -command. -When both the -.B "-Z" -and -.B "-L" -commands are used together in this way, the rule counters are printed on the screen -before they are set to zero. -.TP -.B "-L, --list" -List all rules in the selected chain. If no chain is selected, all chains -are listed. -.br -The following options change the output of the -.B "-L" -command. -.br -.B "--Ln" -.br -Places the rule number in front of every rule. This option is incompatible with the -.BR --Lx " option." -.br -.B "--Lc" -.br -Shows the counters at the end of each rule displayed by the -.B "-L" -command. Both a frame counter (pcnt) and a byte counter (bcnt) are displayed. -The frame counter shows how many frames have matched the specific rule, the byte -counter shows the sum of the frame sizes of these matching frames. Using this option -.BR "" "in combination with the " --Lx " option causes the counters to be written out" -.BR "" "in the '" -c " ' option format." -.br -.B "--Lx" -.br -Changes the output so that it produces a set of ebtables commands that construct -the contents of the chain, when specified. -If no chain is specified, ebtables commands to construct the contents of the -table are given, including commands for creating the user-defined chains (if any). -You can use this set of commands in an ebtables boot or reload -script. For example the output could be used at system startup. -The -.B "--Lx" -option is incompatible with the -.B "--Ln" -listing option. Using the -.BR --Lx " option together with the " --Lc " option will cause the counters to be written out" -.BR "" "in the '" -c " ' option format." -.br -.B "--Lmac2" -.br -Shows all MAC addresses with the same length, adding leading zeroes -if necessary. The default representation omits leading zeroes in the addresses. -.TP -.B "-N, --new-chain" -Create a new user-defined chain with the given name. The number of -user-defined chains is limited only by the number of possible chain names. -A user-defined chain name has a maximum -length of 31 characters. The standard policy of the user-defined chain is -ACCEPT. The policy of the new chain can be initialized to a different standard -target by using the -.B -P -command together with the -.B -N -command. In this case, the chain name does not have to be specified for the -.B -P -command. -.TP -.B "-X, --delete-chain" -Delete the specified user-defined chain. There must be no remaining references (jumps) -to the specified chain, otherwise ebtables will refuse to delete it. If no chain is -specified, all user-defined chains that aren't referenced will be removed. -.TP -.B "-E, --rename-chain" -Rename the specified chain to a new name. Besides renaming a user-defined -chain, you can rename a standard chain to a name that suits your -taste. For example, if you like PREFORWARDING more than PREROUTING, -then you can use the -E command to rename the PREROUTING chain. If you do -rename one of the standard ebtables chain names, please be sure to mention -this fact should you post a question on the ebtables mailing lists. -It would be wise to use the standard name in your post. Renaming a standard -ebtables chain in this fashion has no effect on the structure or functioning -of the ebtables kernel table. -.TP -.B "--init-table" -Replace the current table data by the initial table data. -.TP -.B "--atomic-init" -Copy the kernel's initial data of the table to the specified -file. This can be used as the first action, after which rules are added -to the file. The file can be specified using the -.B --atomic-file -command or through the -.IR EBTABLES_ATOMIC_FILE " environment variable." -.TP -.B "--atomic-save" -Copy the kernel's current data of the table to the specified -file. This can be used as the first action, after which rules are added -to the file. The file can be specified using the -.B --atomic-file -command or through the -.IR EBTABLES_ATOMIC_FILE " environment variable." -.TP -.B "--atomic-commit" -Replace the kernel table data with the data contained in the specified -file. This is a useful command that allows you to load all your rules of a -certain table into the kernel at once, saving the kernel a lot of precious -time and allowing atomic updates of the tables. The file which contains -the table data is constructed by using either the -.B "--atomic-init" -or the -.B "--atomic-save" -command to generate a starting file. After that, using the -.B "--atomic-file" -command when constructing rules or setting the -.IR EBTABLES_ATOMIC_FILE " environment variable" -allows you to extend the file and build the complete table before -committing it to the kernel. This command can be very useful in boot scripts -to populate the ebtables tables in a fast way. -.SS MISCELLANOUS COMMANDS -.TP -.B "-V, --version" -Show the version of the ebtables userspace program. -.TP -.BR "-h, --help " "[\fIlist of module names\fP]" -Give a brief description of the command syntax. Here you can also specify -names of extensions and ebtables will try to write help about those -extensions. E.g. -.IR "ebtables -h snat log ip arp" . -Specify -.I list_extensions -to list all extensions supported by the userspace -utility. -.TP -.BR "-j, --jump " "\fItarget\fP" -The target of the rule. This is one of the following values: -.BR ACCEPT , -.BR DROP , -.BR CONTINUE , -.BR RETURN , -a target extension (see -.BR "TARGET EXTENSIONS" ")" -or a user-defined chain name. -.TP -.B --atomic-file "\fIfile\fP" -Let the command operate on the specified -.IR file . -The data of the table to -operate on will be extracted from the file and the result of the operation -will be saved back into the file. If specified, this option should come -before the command specification. An alternative that should be preferred, -is setting the -.IR EBTABLES_ATOMIC_FILE " environment variable." -.TP -.B -M, --modprobe "\fIprogram\fP" -When talking to the kernel, use this -.I program -to try to automatically load missing kernel modules. -.TP -.B --concurrent -Use a file lock to support concurrent scripts updating the ebtables kernel tables. - -.SS -RULE SPECIFICATIONS -The following command line arguments make up a rule specification (as used -in the add and delete commands). A "!" option before the specification -inverts the test for that specification. Apart from these standard rule -specifications there are some other command line arguments of interest. -See both the -.BR "MATCH EXTENSIONS" -and the -.BR "WATCHER EXTENSIONS" -below. -.TP -.BR "-p, --protocol " "[!] \fIprotocol\fP" -The protocol that was responsible for creating the frame. This can be a -hexadecimal number, above -.IR 0x0600 , -a name (e.g. -.I ARP -) or -.BR LENGTH . -The protocol field of the Ethernet frame can be used to denote the -length of the header (802.2/802.3 networks). When the value of that field is -below or equals -.IR 0x0600 , -the value equals the size of the header and shouldn't be used as a -protocol number. Instead, all frames where the protocol field is used as -the length field are assumed to be of the same 'protocol'. The protocol -name used in ebtables for these frames is -.BR LENGTH . -.br -The file -.B /etc/ethertypes -can be used to show readable -characters instead of hexadecimal numbers for the protocols. For example, -.I 0x0800 -will be represented by -.IR IPV4 . -The use of this file is not case sensitive. -See that file for more information. The flag -.B --proto -is an alias for this option. -.TP -.BR "-i, --in-interface " "[!] \fIname\fP" -The interface (bridge port) via which a frame is received (this option is useful in the -.BR INPUT , -.BR FORWARD , -.BR PREROUTING " and " BROUTING -chains). If the interface name ends with '+', then -any interface name that begins with this name (disregarding '+') will match. -The flag -.B --in-if -is an alias for this option. -.TP -.BR "--logical-in " "[!] \fIname\fP" -The (logical) bridge interface via which a frame is received (this option is useful in the -.BR INPUT , -.BR FORWARD , -.BR PREROUTING " and " BROUTING -chains). -If the interface name ends with '+', then -any interface name that begins with this name (disregarding '+') will match. -.TP -.BR "-o, --out-interface " "[!] \fIname\fP" -The interface (bridge port) via which a frame is going to be sent (this option is useful in the -.BR OUTPUT , -.B FORWARD -and -.B POSTROUTING -chains). If the interface name ends with '+', then -any interface name that begins with this name (disregarding '+') will match. -The flag -.B --out-if -is an alias for this option. -.TP -.BR "--logical-out " "[!] \fIname\fP" -The (logical) bridge interface via which a frame is going to be sent (this option -is useful in the -.BR OUTPUT , -.B FORWARD -and -.B POSTROUTING -chains). -If the interface name ends with '+', then -any interface name that begins with this name (disregarding '+') will match. -.TP -.BR "-s, --source " "[!] \fIaddress\fP[/\fImask\fP]" -The source MAC address. Both mask and address are written as 6 hexadecimal -numbers separated by colons. Alternatively one can specify Unicast, -Multicast, Broadcast or BGA (Bridge Group Address): -.br -.IR "Unicast" "=00:00:00:00:00:00/01:00:00:00:00:00," -.IR "Multicast" "=01:00:00:00:00:00/01:00:00:00:00:00," -.IR "Broadcast" "=ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff or" -.IR "BGA" "=01:80:c2:00:00:00/ff:ff:ff:ff:ff:ff." -Note that a broadcast -address will also match the multicast specification. The flag -.B --src -is an alias for this option. -.TP -.BR "-d, --destination " "[!] \fIaddress\fP[/\fImask\fP]" -The destination MAC address. See -.B -s -(above) for more details on MAC addresses. The flag -.B --dst -is an alias for this option. -.TP -.BR "-c, --set-counter " "\fIpcnt bcnt\fP" -If used with -.BR -A " or " -I ", then the packet and byte counters of the new rule will be set to -.IR pcnt ", resp. " bcnt ". -If used with the -.BR -C " or " -D " commands, only rules with a packet and byte count equal to" -.IR pcnt ", resp. " bcnt " will match." - -.SS MATCH EXTENSIONS -Ebtables extensions are dynamically loaded into the userspace tool, -there is therefore no need to explicitly load them with a --m option like is done in iptables. -These extensions deal with functionality supported by kernel modules supplemental to -the core ebtables code. -.SS 802_3 -Specify 802.3 DSAP/SSAP fields or SNAP type. The protocol must be specified as -.IR "LENGTH " "(see the option " " -p " above). -.TP -.BR "--802_3-sap " "[!] \fIsap\fP" -DSAP and SSAP are two one byte 802.3 fields. The bytes are always -equal, so only one byte (hexadecimal) is needed as an argument. -.TP -.BR "--802_3-type " "[!] \fItype\fP" -If the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field must -be consulted to determine the payload protocol. This is a two byte -(hexadecimal) argument. Only 802.3 frames with DSAP/SSAP 0xaa are -checked for type. -.SS among -Match a MAC address or MAC/IP address pair versus a list of MAC addresses -and MAC/IP address pairs. -A list entry has the following format: -.IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple" -list entries are separated by a comma, specifying an IP address corresponding to -the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address -but different IP address (and vice versa) can be specified. If the MAC address doesn't -match any entry from the list, the frame doesn't match the rule (unless "!" was used). -.TP -.BR "--among-dst " "[!] \fIlist\fP" -Compare the MAC destination to the given list. If the Ethernet frame has type -.IR IPv4 " or " ARP , -then comparison with MAC/IP destination address pairs from the -list is possible. -.TP -.BR "--among-src " "[!] \fIlist\fP" -Compare the MAC source to the given list. If the Ethernet frame has type -.IR IPv4 " or " ARP , -then comparison with MAC/IP source address pairs from the list -is possible. -.TP -.BR "--among-dst-file " "[!] \fIfile\fP" -Same as -.BR --among-dst " but the list is read in from the specified file." -.TP -.BR "--among-src-file " "[!] \fIfile\fP" -Same as -.BR --among-src " but the list is read in from the specified file." -.SS arp -Specify (R)ARP fields. The protocol must be specified as -.IR ARP " or " RARP . -.TP -.BR "--arp-opcode " "[!] \fIopcode\fP" -The (R)ARP opcode (decimal or a string, for more details see -.BR "ebtables -h arp" ). -.TP -.BR "--arp-htype " "[!] \fIhardware type\fP" -The hardware type, this can be a decimal or the string -.I Ethernet -(which sets -.I type -to 1). Most (R)ARP packets have Eternet as hardware type. -.TP -.BR "--arp-ptype " "[!] \fIprotocol type\fP" -The protocol type for which the (r)arp is used (hexadecimal or the string -.IR IPv4 , -denoting 0x0800). -Most (R)ARP packets have protocol type IPv4. -.TP -.BR "--arp-ip-src " "[!] \fIaddress\fP[/\fImask\fP]" -The (R)ARP IP source address specification. -.TP -.BR "--arp-ip-dst " "[!] \fIaddress\fP[/\fImask\fP]" -The (R)ARP IP destination address specification. -.TP -.BR "--arp-mac-src " "[!] \fIaddress\fP[/\fImask\fP]" -The (R)ARP MAC source address specification. -.TP -.BR "--arp-mac-dst " "[!] \fIaddress\fP[/\fImask\fP]" -The (R)ARP MAC destination address specification. -.TP -.BR "" "[!]" " --arp-gratuitous" -Checks for ARP gratuitous packets: checks equality of IPv4 source -address and IPv4 destination address inside the ARP header. -.SS ip -Specify IPv4 fields. The protocol must be specified as -.IR IPv4 . -.TP -.BR "--ip-source " "[!] \fIaddress\fP[/\fImask\fP]" -The source IP address. -The flag -.B --ip-src -is an alias for this option. -.TP -.BR "--ip-destination " "[!] \fIaddress\fP[/\fImask\fP]" -The destination IP address. -The flag -.B --ip-dst -is an alias for this option. -.TP -.BR "--ip-tos " "[!] \fItos\fP" -The IP type of service, in hexadecimal numbers. -.BR IPv4 . -.TP -.BR "--ip-protocol " "[!] \fIprotocol\fP" -The IP protocol. -The flag -.B --ip-proto -is an alias for this option. -.TP -.BR "--ip-source-port " "[!] \fIport1\fP[:\fIport2\fP]" -The source port or port range for the IP protocols 6 (TCP), 17 -(UDP), 33 (DCCP) or 132 (SCTP). The -.B --ip-protocol -option must be specified as -.IR TCP ", " UDP ", " DCCP " or " SCTP . -If -.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." -The flag -.B --ip-sport -is an alias for this option. -.TP -.BR "--ip-destination-port " "[!] \fIport1\fP[:\fIport2\fP]" -The destination port or port range for ip protocols 6 (TCP), 17 -(UDP), 33 (DCCP) or 132 (SCTP). The -.B --ip-protocol -option must be specified as -.IR TCP ", " UDP ", " DCCP " or " SCTP . -If -.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." -The flag -.B --ip-dport -is an alias for this option. -.SS ip6 -Specify IPv6 fields. The protocol must be specified as -.IR IPv6 . -.TP -.BR "--ip6-source " "[!] \fIaddress\fP[/\fImask\fP]" -The source IPv6 address. -The flag -.B --ip6-src -is an alias for this option. -.TP -.BR "--ip6-destination " "[!] \fIaddress\fP[/\fImask\fP]" -The destination IPv6 address. -The flag -.B --ip6-dst -is an alias for this option. -.TP -.BR "--ip6-tclass " "[!] \fItclass\fP" -The IPv6 traffic class, in hexadecimal numbers. -.TP -.BR "--ip6-protocol " "[!] \fIprotocol\fP" -The IP protocol. -The flag -.B --ip6-proto -is an alias for this option. -.TP -.BR "--ip6-source-port " "[!] \fIport1\fP[:\fIport2\fP]" -The source port or port range for the IPv6 protocols 6 (TCP), 17 -(UDP), 33 (DCCP) or 132 (SCTP). The -.B --ip6-protocol -option must be specified as -.IR TCP ", " UDP ", " DCCP " or " SCTP . -If -.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." -The flag -.B --ip6-sport -is an alias for this option. -.TP -.BR "--ip6-destination-port " "[!] \fIport1\fP[:\fIport2\fP]" -The destination port or port range for IPv6 protocols 6 (TCP), 17 -(UDP), 33 (DCCP) or 132 (SCTP). The -.B --ip6-protocol -option must be specified as -.IR TCP ", " UDP ", " DCCP " or " SCTP . -If -.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." -The flag -.B --ip6-dport -is an alias for this option. -.TP -.BR "--ip6-icmp-type " "[!] {\fItype\fP[:\fItype\fP]/\fIcode\fP[:\fIcode\fP]|\fItypename\fP}" -Specify ipv6\-icmp type and code to match. -Ranges for both type and code are supported. Type and code are -separated by a slash. Valid numbers for type and range are 0 to 255. -To match a single type including all valid codes, symbolic names can -be used instead of numbers. The list of known type names is shown by the command -.nf - ebtables \-\-help ip6 -.fi -This option is only valid for \-\-ip6-prococol ipv6-icmp. -.SS limit -This module matches at a limited rate using a token bucket filter. -A rule using this extension will match until this limit is reached. -It can be used with the -.B --log -watcher to give limited logging, for example. Its use is the same -as the limit match of iptables. -.TP -.BR "--limit " "[\fIvalue\fP]" -Maximum average matching rate: specified as a number, with an optional -.IR /second ", " /minute ", " /hour ", or " /day " suffix; the default is " 3/hour . -.TP -.BR "--limit-burst " "[\fInumber\fP]" -Maximum initial number of packets to match: this number gets recharged by -one every time the limit specified above is not reached, up to this -number; the default is -.IR 5 . -.SS mark_m -.TP -.BR "--mark " "[!] [\fIvalue\fP][/\fImask\fP]" -Matches frames with the given unsigned mark value. If a -.IR value " and " mask " are specified, the logical AND of the mark value of the frame and" -the user-specified -.IR mask " is taken before comparing it with the" -user-specified mark -.IR value ". When only a mark " -.IR value " is specified, the packet" -only matches when the mark value of the frame equals the user-specified -mark -.IR value . -If only a -.IR mask " is specified, the logical" -AND of the mark value of the frame and the user-specified -.IR mask " is taken and the frame matches when the result of this logical AND is" -non-zero. Only specifying a -.IR mask " is useful to match multiple mark values." -.SS pkttype -.TP -.BR "--pkttype-type " "[!] \fItype\fP" -Matches on the Ethernet "class" of the frame, which is determined by the -generic networking code. Possible values: -.IR broadcast " (MAC destination is the broadcast address)," -.IR multicast " (MAC destination is a multicast address)," -.IR host " (MAC destination is the receiving network device), or " -.IR otherhost " (none of the above)." -.SS stp -Specify stp BPDU (bridge protocol data unit) fields. The destination -address -.BR "" ( -d ") must be specified as the bridge group address" -.IR "" ( BGA ). -For all options for which a range of values can be specified, it holds that -if the lower bound is omitted (but the colon is not), then the lowest possible lower bound -for that option is used, while if the upper bound is omitted (but the colon again is not), the -highest possible upper bound for that option is used. -.TP -.BR "--stp-type " "[!] \fItype\fP" -The BPDU type (0-255), recognized non-numerical types are -.IR config ", denoting a configuration BPDU (=0), and" -.IR tcn ", denothing a topology change notification BPDU (=128)." -.TP -.BR "--stp-flags " "[!] \fIflag\fP" -The BPDU flag (0-255), recognized non-numerical flags are -.IR topology-change ", denoting the topology change flag (=1), and" -.IR topology-change-ack ", denoting the topology change acknowledgement flag (=128)." -.TP -.BR "--stp-root-prio " "[!] [\fIprio\fP][:\fIprio\fP]" -The root priority (0-65535) range. -.TP -.BR "--stp-root-addr " "[!] [\fIaddress\fP][/\fImask\fP]" -The root mac address, see the option -.BR -s " for more details." -.TP -.BR "--stp-root-cost " "[!] [\fIcost\fP][:\fIcost\fP]" -The root path cost (0-4294967295) range. -.TP -.BR "--stp-sender-prio " "[!] [\fIprio\fP][:\fIprio\fP]" -The BPDU's sender priority (0-65535) range. -.TP -.BR "--stp-sender-addr " "[!] [\fIaddress\fP][/\fImask\fP]" -The BPDU's sender mac address, see the option -.BR -s " for more details." -.TP -.BR "--stp-port " "[!] [\fIport\fP][:\fIport\fP]" -The port identifier (0-65535) range. -.TP -.BR "--stp-msg-age " "[!] [\fIage\fP][:\fIage\fP]" -The message age timer (0-65535) range. -.TP -.BR "--stp-max-age " "[!] [\fIage\fP][:\fIage\fP]" -The max age timer (0-65535) range. -.TP -.BR "--stp-hello-time " "[!] [\fItime\fP][:\fItime\fP]" -The hello time timer (0-65535) range. -.TP -.BR "--stp-forward-delay " "[!] [\fIdelay\fP][:\fIdelay\fP]" -The forward delay timer (0-65535) range. -.SS vlan -Specify 802.1Q Tag Control Information fields. -The protocol must be specified as -.IR 802_1Q " (0x8100)." -.TP -.BR "--vlan-id " "[!] \fIid\fP" -The VLAN identifier field (VID). Decimal number from 0 to 4095. -.TP -.BR "--vlan-prio " "[!] \fIprio\fP" -The user priority field, a decimal number from 0 to 7. -The VID should be set to 0 ("null VID") or unspecified -(in the latter case the VID is deliberately set to 0). -.TP -.BR "--vlan-encap " "[!] \fItype\fP" -The encapsulated Ethernet frame type/length. -Specified as a hexadecimal -number from 0x0000 to 0xFFFF or as a symbolic name -from -.BR /etc/ethertypes . - -.SS WATCHER EXTENSIONS -Watchers only look at frames passing by, they don't modify them nor decide -to accept the frames or not. These watchers only -see the frame if the frame matches the rule, and they see it before the -target is executed. -.SS log -The log watcher writes descriptive data about a frame to the syslog. -.TP -.B "--log" -.br -Log with the default loggin options: log-level= -.IR info , -log-prefix="", no ip logging, no arp logging. -.TP -.B --log-level "\fIlevel\fP" -.br -Defines the logging level. For the possible values, see -.BR "ebtables -h log" . -The default level is -.IR info . -.TP -.BR --log-prefix " \fItext\fP" -.br -Defines the prefix -.I text -to be printed at the beginning of the line with the logging information. -.TP -.B --log-ip -.br -Will log the ip information when a frame made by the ip protocol matches -the rule. The default is no ip information logging. -.TP -.B --log-ip6 -.br -Will log the ipv6 information when a frame made by the ipv6 protocol matches -the rule. The default is no ipv6 information logging. -.TP -.B --log-arp -.br -Will log the (r)arp information when a frame made by the (r)arp protocols -matches the rule. The default is no (r)arp information logging. -.SS nflog -The nflog watcher passes the packet to the loaded logging backend -in order to log the packet. This is usually used in combination with -nfnetlink_log as logging backend, which will multicast the packet -through a -.IR netlink -socket to the specified multicast group. One or more userspace processes -may subscribe to the group to receive the packets. -.TP -.B "--nflog" -.br -Log with the default logging options -.TP -.B --nflog-group "\fInlgroup\fP" -.br -The netlink group (1 - 2^32-1) to which packets are (only applicable for -nfnetlink_log). The default value is 1. -.TP -.B --nflog-prefix "\fIprefix\fP" -.br -A prefix string to include in the log message, up to 30 characters -long, useful for distinguishing messages in the logs. -.TP -.B --nflog-range "\fIsize\fP" -.br -The number of bytes to be copied to userspace (only applicable for -nfnetlink_log). nfnetlink_log instances may specify their own -range, this option overrides it. -.TP -.B --nflog-threshold "\fIsize\fP" -.br -Number of packets to queue inside the kernel before sending them -to userspace (only applicable for nfnetlink_log). Higher values -result in less overhead per packet, but increase delay until the -packets reach userspace. The default value is 1. -.SS ulog -The ulog watcher passes the packet to a userspace -logging daemon using netlink multicast sockets. This differs -from the log watcher in the sense that the complete packet is -sent to userspace instead of a descriptive text and that -netlink multicast sockets are used instead of the syslog. -This watcher enables parsing of packets with userspace programs, the -physical bridge in and out ports are also included in the netlink messages. -The ulog watcher module accepts 2 parameters when the module is loaded -into the kernel (e.g. with modprobe): -.B nlbufsiz -specifies how big the buffer for each netlink multicast -group is. If you say -.IR nlbufsiz=8192 , -for example, up to eight kB of packets will -get accumulated in the kernel until they are sent to userspace. It is -not possible to allocate more than 128kB. Please also keep in mind that -this buffer size is allocated for each nlgroup you are using, so the -total kernel memory usage increases by that factor. The default is 4096. -.B flushtimeout -specifies after how many hundredths of a second the queue should be -flushed, even if it is not full yet. The default is 10 (one tenth of -a second). -.TP -.B "--ulog" -.br -Use the default settings: ulog-prefix="", ulog-nlgroup=1, -ulog-cprange=4096, ulog-qthreshold=1. -.TP -.B --ulog-prefix "\fItext\fP" -.br -Defines the prefix included with the packets sent to userspace. -.TP -.BR --ulog-nlgroup " \fIgroup\fP" -.br -Defines which netlink group number to use (a number from 1 to 32). -Make sure the netlink group numbers used for the iptables ULOG -target differ from those used for the ebtables ulog watcher. -The default group number is 1. -.TP -.BR --ulog-cprange " \fIrange\fP" -.br -Defines the maximum copy range to userspace, for packets matching the -rule. The default range is 0, which means the maximum copy range is -given by -.BR nlbufsiz . -A maximum copy range larger than -128*1024 is meaningless as the packets sent to userspace have an upper -size limit of 128*1024. -.TP -.BR --ulog-qthreshold " \fIthreshold\fP" -.br -Queue at most -.I threshold -number of packets before sending them to -userspace with a netlink socket. Note that packets can be sent to -userspace before the queue is full, this happens when the ulog -kernel timer goes off (the frequency of this timer depends on -.BR flushtimeout ). -.SS TARGET EXTENSIONS -.SS arpreply -The -.B arpreply -target can be used in the -.BR PREROUTING " chain of the " nat " table." -If this target sees an ARP request it will automatically reply -with an ARP reply. The used MAC address for the reply can be specified. -The protocol must be specified as -.IR ARP . -When the ARP message is not an ARP request or when the ARP request isn't -for an IP address on an Ethernet network, it is ignored by this target -.BR "" ( CONTINUE ). -When the ARP request is malformed, it is dropped -.BR "" ( DROP ). -.TP -.BR "--arpreply-mac " "\fIaddress\fP" -Specifies the MAC address to reply with: the Ethernet source MAC and the -ARP payload source MAC will be filled in with this address. -.TP -.BR "--arpreply-target " "\fItarget\fP" -Specifies the standard target. After sending the ARP reply, the rule still -has to give a standard target so ebtables knows what to do with the ARP request. -The default target -.BR "" "is " DROP . -.SS dnat -The -.B dnat -target can only be used in the -.BR BROUTING " chain of the " broute " table and the " -.BR PREROUTING " and " OUTPUT " chains of the " nat " table." -It specifies that the destination MAC address has to be changed. -.TP -.BR "--to-destination " "\fIaddress\fP" -.br -Change the destination MAC address to the specified -.IR address . -The flag -.B --to-dst -is an alias for this option. -.TP -.BR "--dnat-target " "\fItarget\fP" -.br -Specifies the standard target. After doing the dnat, the rule still has to -give a standard target so ebtables knows what to do with the dnated frame. -The default target is -.BR ACCEPT . -Making it -.BR CONTINUE " could let you use" -multiple target extensions on the same frame. Making it -.BR DROP " only makes" -sense in the -.BR BROUTING " chain but using the " redirect " target is more logical there. " RETURN " is also allowed. Note that using " RETURN -in a base chain is not allowed (for obvious reasons). -.SS mark -.BR "" "The " mark " target can be used in every chain of every table. It is possible" -to use the marking of a frame/packet in both ebtables and iptables, -if the bridge-nf code is compiled into the kernel. Both put the marking at the -same place. This allows for a form of communication between ebtables and iptables. -.TP -.BR "--mark-set " "\fIvalue\fP" -.br -Mark the frame with the specified non-negative -.IR value . -.TP -.BR "--mark-or " "\fIvalue\fP" -.br -Or the frame with the specified non-negative -.IR value . -.TP -.BR "--mark-and " "\fIvalue\fP" -.br -And the frame with the specified non-negative -.IR value . -.TP -.BR "--mark-xor " "\fIvalue\fP" -.br -Xor the frame with the specified non-negative -.IR value . -.TP -.BR "--mark-target " "\fItarget\fP" -.br -Specifies the standard target. After marking the frame, the rule -still has to give a standard target so ebtables knows what to do. -The default target is -.BR ACCEPT ". Making it " CONTINUE " can let you do other" -things with the frame in subsequent rules of the chain. -.SS redirect -The -.B redirect -target will change the MAC target address to that of the bridge device the -frame arrived on. This target can only be used in the -.BR BROUTING " chain of the " broute " table and the " -.BR PREROUTING " chain of the " nat " table." -In the -.BR BROUTING " chain, the MAC address of the bridge port is used as destination address," -.BR "" "in the " PREROUTING " chain, the MAC address of the bridge is used." -.TP -.BR "--redirect-target " "\fItarget\fP" -.br -Specifies the standard target. After doing the MAC redirect, the rule -still has to give a standard target so ebtables knows what to do. -The default target is -.BR ACCEPT ". Making it " CONTINUE " could let you use" -multiple target extensions on the same frame. Making it -.BR DROP " in the " BROUTING " chain will let the frames be routed. " RETURN " is also allowed. Note" -.BR "" "that using " RETURN " in a base chain is not allowed." -.SS snat -The -.B snat -target can only be used in the -.BR POSTROUTING " chain of the " nat " table." -It specifies that the source MAC address has to be changed. -.TP -.BR "--to-source " "\fIaddress\fP" -.br -Changes the source MAC address to the specified -.IR address ". The flag" -.B --to-src -is an alias for this option. -.TP -.BR "--snat-target " "\fItarget\fP" -.br -Specifies the standard target. After doing the snat, the rule still has -to give a standard target so ebtables knows what to do. -.BR "" "The default target is " ACCEPT ". Making it " CONTINUE " could let you use" -.BR "" "multiple target extensions on the same frame. Making it " DROP " doesn't" -.BR "" "make sense, but you could do that too. " RETURN " is also allowed. Note" -.BR "" "that using " RETURN " in a base chain is not allowed." -.br -.TP -.BR "--snat-arp " -.br -Also change the hardware source address inside the arp header if the packet is an -arp message and the hardware address length in the arp header is 6 bytes. -.br -.SH FILES -.I /etc/ethertypes -.I /var/lib/ebtables/lock -.SH ENVIRONMENT VARIABLES -.I EBTABLES_ATOMIC_FILE -.SH MAILINGLISTS -.BR "" "See " http://netfilter.org/mailinglists.html -.SH SEE ALSO -.BR iptables "(8), " brctl "(8), " ifconfig "(8), " route (8) -.PP -.BR "" "See " http://ebtables.sf.net diff -Nru ebtables-2.0.10.4/ebtables.c ebtables-2.0.10.4+snapshot20181205/ebtables.c --- ebtables-2.0.10.4/ebtables.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtables.c 2018-12-05 11:27:50.000000000 +0000 @@ -528,12 +528,6 @@ ebt_iterate_targets(merge_target); } -/* signal handler, installed when the option --concurrent is specified. */ -static void sighandler(int signum) -{ - exit(-1); -} - /* We use exec_style instead of #ifdef's because ebtables.so is a shared object. */ int do_command(int argc, char *argv[], int exec_style, struct ebt_u_replace *replace_) @@ -1047,8 +1041,6 @@ strcpy(replace->filename, optarg); break; case 13 : /* concurrent */ - signal(SIGINT, sighandler); - signal(SIGTERM, sighandler); use_lockfd = 1; break; case 1 : diff -Nru ebtables-2.0.10.4/ebtables-config ebtables-2.0.10.4+snapshot20181205/ebtables-config --- ebtables-2.0.10.4/ebtables-config 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtables-config 1970-01-01 00:00:00.000000000 +0000 @@ -1,37 +0,0 @@ -# Save (and possibly restore) in text format. -# Value: yes|no, default: yes -# Save the firewall rules in text format to __SYSCONFIG__/ebtables -# If EBTABLES_BINARY_FORMAT="no" then restoring the firewall rules -# is done using this text format. -EBTABLES_TEXT_FORMAT="yes" - -# Save (and restore) in binary format. -# Value: yes|no, default: yes -# Save (and restore) the firewall rules in binary format to (and from) -# __SYSCONFIG__/ebtables.. Enabling this option will make -# firewall initialisation a lot faster. -EBTABLES_BINARY_FORMAT="yes" - -# Unload modules on restart and stop -# Value: yes|no, default: yes -# This option has to be 'yes' to get to a sane state for a firewall -# restart or stop. Only set to 'no' if there are problems unloading netfilter -# modules. -EBTABLES_MODULES_UNLOAD="yes" - -# Save current firewall rules on stop. -# Value: yes|no, default: no -# Saves all firewall rules if firewall gets stopped -# (e.g. on system shutdown). -EBTABLES_SAVE_ON_STOP="no" - -# Save current firewall rules on restart. -# Value: yes|no, default: no -# Saves all firewall rules if firewall gets restarted. -EBTABLES_SAVE_ON_RESTART="no" - -# Save (and restore) rule counters. -# Value: yes|no, default: no -# Save rule counters when saving a kernel table to a file. If the -# rule counters were saved, they will be restored when restoring the table. -EBTABLES_SAVE_COUNTER="no" diff -Nru ebtables-2.0.10.4/ebtables-config.in ebtables-2.0.10.4+snapshot20181205/ebtables-config.in --- ebtables-2.0.10.4/ebtables-config.in 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtables-config.in 2018-12-05 11:27:50.000000000 +0000 @@ -0,0 +1,37 @@ +# Save (and possibly restore) in text format. +# Value: yes|no, default: yes +# Save the firewall rules in text format to __SYSCONFIG__/ebtables +# If EBTABLES_BINARY_FORMAT="no" then restoring the firewall rules +# is done using this text format. +EBTABLES_TEXT_FORMAT="yes" + +# Save (and restore) in binary format. +# Value: yes|no, default: yes +# Save (and restore) the firewall rules in binary format to (and from) +# __SYSCONFIG__/ebtables.. Enabling this option will make +# firewall initialisation a lot faster. +EBTABLES_BINARY_FORMAT="yes" + +# Unload modules on restart and stop +# Value: yes|no, default: yes +# This option has to be 'yes' to get to a sane state for a firewall +# restart or stop. Only set to 'no' if there are problems unloading netfilter +# modules. +EBTABLES_MODULES_UNLOAD="yes" + +# Save current firewall rules on stop. +# Value: yes|no, default: no +# Saves all firewall rules if firewall gets stopped +# (e.g. on system shutdown). +EBTABLES_SAVE_ON_STOP="no" + +# Save current firewall rules on restart. +# Value: yes|no, default: no +# Saves all firewall rules if firewall gets restarted. +EBTABLES_SAVE_ON_RESTART="no" + +# Save (and restore) rule counters. +# Value: yes|no, default: no +# Save rule counters when saving a kernel table to a file. If the +# rule counters were saved, they will be restored when restoring the table. +EBTABLES_SAVE_COUNTER="no" diff -Nru ebtables-2.0.10.4/ebtablesd.c ebtables-2.0.10.4+snapshot20181205/ebtablesd.c --- ebtables-2.0.10.4/ebtablesd.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtablesd.c 2018-12-05 11:27:50.000000000 +0000 @@ -52,7 +52,7 @@ char *argv[EBTD_ARGC_MAX], *args[4], name[] = "mkdir", mkdir_option[] = "-p", mkdir_dir[] = EBTD_PIPE_DIR, cmdline[EBTD_CMDLINE_MAXLN]; - int readfd, base = 0, offset = 0, n = 0, ret = 0, quotemode = 0; + int readfd, base = 0, offset = 0, n = 0, quotemode = 0; /* Make sure the pipe directory exists */ args[0] = name; @@ -74,19 +74,16 @@ if (mkfifo(EBTD_PIPE, 0600) < 0 && errno != EEXIST) { printf("Error creating FIFO " EBTD_PIPE "\n"); - ret = -1; goto do_exit; } if ((readfd = open(EBTD_PIPE, O_RDONLY | O_NONBLOCK, 0)) == -1) { perror("open"); - ret = -1; goto do_exit; } if (signal(SIGPIPE, sigpipe_handler) == SIG_ERR) { perror("signal"); - ret = -1; goto do_exit; } diff -Nru ebtables-2.0.10.4/ebtables-legacy.8.in ebtables-2.0.10.4+snapshot20181205/ebtables-legacy.8.in --- ebtables-2.0.10.4/ebtables-legacy.8.in 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtables-legacy.8.in 2018-12-05 11:27:50.000000000 +0000 @@ -0,0 +1,1146 @@ +.TH EBTABLES 8 "@PACKAGE_DATE@" +.\" +.\" Man page written by Bart De Schuymer +.\" It is based on the iptables man page. +.\" +.\" The man page was edited, February 25th 2003, by +.\" Greg Morgan <" dr_kludge_at_users_sourceforge_net > +.\" +.\" Iptables page by Herve Eychenne March 2000. +.\" +.\" This program is free software; you can redistribute it and/or modify +.\" it under the terms of the GNU General Public License as published by +.\" the Free Software Foundation; either version 2 of the License, or +.\" (at your option) any later version. +.\" +.\" This program is distributed in the hope that it will be useful, +.\" but WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +.\" GNU General Public License for more details. +.\" +.\" You should have received a copy of the GNU General Public License +.\" along with this program; if not, write to the Free Software +.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +.\" +.\" +.SH NAME +ebtables-legacy (@PACKAGE_VERSION@) \- Ethernet bridge frame table administration (legacy) +.SH SYNOPSIS +.BR "ebtables " [ -t " table ] " - [ ACDI "] chain rule specification [match extensions] [watcher extensions] target" +.br +.BR "ebtables " [ -t " table ] " -P " chain " ACCEPT " | " DROP " | " RETURN +.br +.BR "ebtables " [ -t " table ] " -F " [chain]" +.br +.BR "ebtables " [ -t " table ] " -Z " [chain]" +.br +.BR "ebtables " [ -t " table ] " -L " [" -Z "] [chain] [ [" --Ln "] | [" --Lx "] ] [" --Lc "] [" --Lmac2 ] +.br +.BR "ebtables " [ -t " table ] " -N " chain [" "-P ACCEPT " | " DROP " | " RETURN" ] +.br +.BR "ebtables " [ -t " table ] " -X " [chain]" +.br +.BR "ebtables " [ -t " table ] " -E " old-chain-name new-chain-name" +.br +.BR "ebtables " [ -t " table ] " --init-table +.br +.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit +.br +.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init +.br +.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save +.br + +.SH LEGACY +This tool uses the old xtables/setsockopt framework, and is a legacy version +of ebtables. That means that a new, more modern tool exists with the same +functionality using the nf_tables framework and you are encouraged to migrate now. +The new binaries (known as ebtables-nft and formerly known as ebtables-compat) +uses the same syntax and semantics than this legacy one. + +You can still use this legacy tool. You should probably get some specific +information from your Linux distribution or vendor. +More docs are available at https://wiki.nftables.org + +.SH DESCRIPTION +.B ebtables +is an application program used to set up and maintain the +tables of rules (inside the Linux kernel) that inspect +Ethernet frames. +It is analogous to the +.B iptables +application, but less complicated, due to the fact that the Ethernet protocol +is much simpler than the IP protocol. +.SS CHAINS +There are three ebtables tables with built-in chains in the +Linux kernel. These tables are used to divide functionality into +different sets of rules. Each set of rules is called a chain. +Each chain is an ordered list of rules that can match Ethernet frames. If a +rule matches an Ethernet frame, then a processing specification tells +what to do with that matching frame. The processing specification is +called a 'target'. However, if the frame does not match the current +rule in the chain, then the next rule in the chain is examined and so forth. +The user can create new (user-defined) chains that can be used as the 'target' +of a rule. User-defined chains are very useful to get better performance +over the linear traversal of the rules and are also essential for structuring +the filtering rules into well-organized and maintainable sets of rules. +.SS TARGETS +A firewall rule specifies criteria for an Ethernet frame and a frame +processing specification called a target. When a frame matches a rule, +then the next action performed by the kernel is specified by the target. +The target can be one of these values: +.BR ACCEPT , +.BR DROP , +.BR CONTINUE , +.BR RETURN , +an 'extension' (see below) or a jump to a user-defined chain. +.PP +.B ACCEPT +means to let the frame through. +.B DROP +means the frame has to be dropped. In the +.BR BROUTING " chain however, the " ACCEPT " and " DROP " target have different" +meanings (see the info provided for the +.BR -t " option)." +.B CONTINUE +means the next rule has to be checked. This can be handy, f.e., to know how many +frames pass a certain point in the chain, to log those frames or to apply multiple +targets on a frame. +.B RETURN +means stop traversing this chain and resume at the next rule in the +previous (calling) chain. +For the extension targets please refer to the +.B "TARGET EXTENSIONS" +section of this man page. +.SS TABLES +As stated earlier, there are three ebtables tables in the Linux +kernel. The table names are +.BR filter ", " nat " and " broute . +Of these three tables, +the filter table is the default table that the command operates on. +If you are working with the filter table, then you can drop the '-t filter' +argument to the ebtables command. However, you will need to provide +the -t argument for the other two tables. Moreover, the -t argument must be the +first argument on the ebtables command line, if used. +.TP +.B "-t, --table" +.br +.B filter +is the default table and contains three built-in chains: +.B INPUT +(for frames destined for the bridge itself, on the level of the MAC destination address), +.B OUTPUT +(for locally-generated or (b)routed frames) and +.B FORWARD +(for frames being forwarded by the bridge). +.br +.br +.B nat +is mostly used to change the mac addresses and contains three built-in chains: +.B PREROUTING +(for altering frames as soon as they come in), +.B OUTPUT +(for altering locally generated or (b)routed frames before they are bridged) and +.B POSTROUTING +(for altering frames as they are about to go out). A small note on the naming +of chains PREROUTING and POSTROUTING: it would be more accurate to call them +PREFORWARDING and POSTFORWARDING, but for all those who come from the +iptables world to ebtables it is easier to have the same names. Note that you +can change the name +.BR "" ( -E ) +if you don't like the default. +.br +.br +.B broute +is used to make a brouter, it has one built-in chain: +.BR BROUTING . +The targets +.BR DROP " and " ACCEPT +have a special meaning in the broute table (these names are used instead of +more descriptive names to keep the implementation generic). +.B DROP +actually means the frame has to be routed, while +.B ACCEPT +means the frame has to be bridged. The +.B BROUTING +chain is traversed very early. However, it is only traversed by frames entering on +a bridge port that is in forwarding state. Normally those frames +would be bridged, but you can decide otherwise here. The +.B redirect +target is very handy here. +.SH EBTABLES COMMAND LINE ARGUMENTS +After the initial ebtables '-t table' command line argument, the remaining +arguments can be divided into several groups. These groups +are commands, miscellaneous commands, rule specifications, match extensions, +watcher extensions and target extensions. +.SS COMMANDS +The ebtables command arguments specify the actions to perform on the table +defined with the -t argument. If you do not use the -t argument to name +a table, the commands apply to the default filter table. +Only one command may be used on the command line at a time, except when +the commands +.BR -L " and " -Z +are combined, the commands +.BR -N " and " -P +are combined, or when +.B --atomic-file +is used. +.TP +.B "-A, --append" +Append a rule to the end of the selected chain. +.TP +.B "-D, --delete" +Delete the specified rule or rules from the selected chain. There are two ways to +use this command. The first is by specifying an interval of rule numbers +to delete (directly after +.BR -D ). +Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use +.B -L --Ln +to list the rules with their rule number). When \fIend_nr\fP is omitted, all rules starting +from \fIstart_nr\fP are deleted. Using negative numbers is allowed, for more +details about using negative numbers, see the +.B -I +command. The second usage is by +specifying the complete rule as it would have been specified when it was added. Only +the first encountered rule that is the same as this specified rule, in other +words the matching rule with the lowest (positive) rule number, is deleted. +.TP +.B "-C, --change-counters" +Change the counters of the specified rule or rules from the selected chain. There are two ways to +use this command. The first is by specifying an interval of rule numbers +to do the changes on (directly after +.BR -C ). +Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use +.B -L --Ln +to list the rules with their rule number). The details are the same as for the +.BR -D " command. The second usage is by" +specifying the complete rule as it would have been specified when it was added. Only +the counters of the first encountered rule that is the same as this specified rule, in other +words the matching rule with the lowest (positive) rule number, are changed. +In the first usage, the counters are specified directly after the interval specification, +in the second usage directly after +.BR -C . +First the packet counter is specified, then the byte counter. If the specified counters start +with a '+', the counter values are added to the respective current counter values. +If the specified counters start with a '-', the counter values are decreased from the respective +current counter values. No bounds checking is done. If the counters don't start with '+' or '-', +the current counters are changed to the specified counters. +.TP +.B "-I, --insert" +Insert the specified rule into the selected chain at the specified rule number. If the +rule number is not specified, the rule is added at the head of the chain. +If the current number of rules equals +.IR N , +then the specified number can be +between +.IR -N " and " N+1 . +For a positive number +.IR i , +it holds that +.IR i " and " i-N-1 +specify the same place in the chain where the rule should be inserted. The rule number +0 specifies the place past the last rule in the chain and using this number is therefore +equivalent to using the +.BR -A " command." +Rule numbers structly smaller than 0 can be useful when more than one rule needs to be inserted +in a chain. +.TP +.B "-P, --policy" +Set the policy for the chain to the given target. The policy can be +.BR ACCEPT ", " DROP " or " RETURN . +.TP +.B "-F, --flush" +Flush the selected chain. If no chain is selected, then every chain will be +flushed. Flushing a chain does not change the policy of the +chain, however. +.TP +.B "-Z, --zero" +Set the counters of the selected chain to zero. If no chain is selected, all the counters +are set to zero. The +.B "-Z" +command can be used in conjunction with the +.B "-L" +command. +When both the +.B "-Z" +and +.B "-L" +commands are used together in this way, the rule counters are printed on the screen +before they are set to zero. +.TP +.B "-L, --list" +List all rules in the selected chain. If no chain is selected, all chains +are listed. +.br +The following options change the output of the +.B "-L" +command. +.br +.B "--Ln" +.br +Places the rule number in front of every rule. This option is incompatible with the +.BR --Lx " option." +.br +.B "--Lc" +.br +Shows the counters at the end of each rule displayed by the +.B "-L" +command. Both a frame counter (pcnt) and a byte counter (bcnt) are displayed. +The frame counter shows how many frames have matched the specific rule, the byte +counter shows the sum of the frame sizes of these matching frames. Using this option +.BR "" "in combination with the " --Lx " option causes the counters to be written out" +.BR "" "in the '" -c " ' option format." +.br +.B "--Lx" +.br +Changes the output so that it produces a set of ebtables commands that construct +the contents of the chain, when specified. +If no chain is specified, ebtables commands to construct the contents of the +table are given, including commands for creating the user-defined chains (if any). +You can use this set of commands in an ebtables boot or reload +script. For example the output could be used at system startup. +The +.B "--Lx" +option is incompatible with the +.B "--Ln" +listing option. Using the +.BR --Lx " option together with the " --Lc " option will cause the counters to be written out" +.BR "" "in the '" -c " ' option format." +.br +.B "--Lmac2" +.br +Shows all MAC addresses with the same length, adding leading zeroes +if necessary. The default representation omits leading zeroes in the addresses. +.TP +.B "-N, --new-chain" +Create a new user-defined chain with the given name. The number of +user-defined chains is limited only by the number of possible chain names. +A user-defined chain name has a maximum +length of 31 characters. The standard policy of the user-defined chain is +ACCEPT. The policy of the new chain can be initialized to a different standard +target by using the +.B -P +command together with the +.B -N +command. In this case, the chain name does not have to be specified for the +.B -P +command. +.TP +.B "-X, --delete-chain" +Delete the specified user-defined chain. There must be no remaining references (jumps) +to the specified chain, otherwise ebtables will refuse to delete it. If no chain is +specified, all user-defined chains that aren't referenced will be removed. +.TP +.B "-E, --rename-chain" +Rename the specified chain to a new name. Besides renaming a user-defined +chain, you can rename a standard chain to a name that suits your +taste. For example, if you like PREFORWARDING more than PREROUTING, +then you can use the -E command to rename the PREROUTING chain. If you do +rename one of the standard ebtables chain names, please be sure to mention +this fact should you post a question on the ebtables mailing lists. +It would be wise to use the standard name in your post. Renaming a standard +ebtables chain in this fashion has no effect on the structure or functioning +of the ebtables kernel table. +.TP +.B "--init-table" +Replace the current table data by the initial table data. +.TP +.B "--atomic-init" +Copy the kernel's initial data of the table to the specified +file. This can be used as the first action, after which rules are added +to the file. The file can be specified using the +.B --atomic-file +command or through the +.IR EBTABLES_ATOMIC_FILE " environment variable." +.TP +.B "--atomic-save" +Copy the kernel's current data of the table to the specified +file. This can be used as the first action, after which rules are added +to the file. The file can be specified using the +.B --atomic-file +command or through the +.IR EBTABLES_ATOMIC_FILE " environment variable." +.TP +.B "--atomic-commit" +Replace the kernel table data with the data contained in the specified +file. This is a useful command that allows you to load all your rules of a +certain table into the kernel at once, saving the kernel a lot of precious +time and allowing atomic updates of the tables. The file which contains +the table data is constructed by using either the +.B "--atomic-init" +or the +.B "--atomic-save" +command to generate a starting file. After that, using the +.B "--atomic-file" +command when constructing rules or setting the +.IR EBTABLES_ATOMIC_FILE " environment variable" +allows you to extend the file and build the complete table before +committing it to the kernel. This command can be very useful in boot scripts +to populate the ebtables tables in a fast way. +.SS MISCELLANOUS COMMANDS +.TP +.B "-V, --version" +Show the version of the ebtables userspace program. +.TP +.BR "-h, --help " "[\fIlist of module names\fP]" +Give a brief description of the command syntax. Here you can also specify +names of extensions and ebtables will try to write help about those +extensions. E.g. +.IR "ebtables -h snat log ip arp" . +Specify +.I list_extensions +to list all extensions supported by the userspace +utility. +.TP +.BR "-j, --jump " "\fItarget\fP" +The target of the rule. This is one of the following values: +.BR ACCEPT , +.BR DROP , +.BR CONTINUE , +.BR RETURN , +a target extension (see +.BR "TARGET EXTENSIONS" ")" +or a user-defined chain name. +.TP +.B --atomic-file "\fIfile\fP" +Let the command operate on the specified +.IR file . +The data of the table to +operate on will be extracted from the file and the result of the operation +will be saved back into the file. If specified, this option should come +before the command specification. An alternative that should be preferred, +is setting the +.IR EBTABLES_ATOMIC_FILE " environment variable." +.TP +.B -M, --modprobe "\fIprogram\fP" +When talking to the kernel, use this +.I program +to try to automatically load missing kernel modules. +.TP +.B --concurrent +Use a file lock to support concurrent scripts updating the ebtables kernel tables. + +.SS +RULE SPECIFICATIONS +The following command line arguments make up a rule specification (as used +in the add and delete commands). A "!" option before the specification +inverts the test for that specification. Apart from these standard rule +specifications there are some other command line arguments of interest. +See both the +.BR "MATCH EXTENSIONS" +and the +.BR "WATCHER EXTENSIONS" +below. +.TP +.BR "-p, --protocol " "[!] \fIprotocol\fP" +The protocol that was responsible for creating the frame. This can be a +hexadecimal number, above +.IR 0x0600 , +a name (e.g. +.I ARP +) or +.BR LENGTH . +The protocol field of the Ethernet frame can be used to denote the +length of the header (802.2/802.3 networks). When the value of that field is +below or equals +.IR 0x0600 , +the value equals the size of the header and shouldn't be used as a +protocol number. Instead, all frames where the protocol field is used as +the length field are assumed to be of the same 'protocol'. The protocol +name used in ebtables for these frames is +.BR LENGTH . +.br +The file +.B /etc/ethertypes +can be used to show readable +characters instead of hexadecimal numbers for the protocols. For example, +.I 0x0800 +will be represented by +.IR IPV4 . +The use of this file is not case sensitive. +See that file for more information. The flag +.B --proto +is an alias for this option. +.TP +.BR "-i, --in-interface " "[!] \fIname\fP" +The interface (bridge port) via which a frame is received (this option is useful in the +.BR INPUT , +.BR FORWARD , +.BR PREROUTING " and " BROUTING +chains). If the interface name ends with '+', then +any interface name that begins with this name (disregarding '+') will match. +The flag +.B --in-if +is an alias for this option. +.TP +.BR "--logical-in " "[!] \fIname\fP" +The (logical) bridge interface via which a frame is received (this option is useful in the +.BR INPUT , +.BR FORWARD , +.BR PREROUTING " and " BROUTING +chains). +If the interface name ends with '+', then +any interface name that begins with this name (disregarding '+') will match. +.TP +.BR "-o, --out-interface " "[!] \fIname\fP" +The interface (bridge port) via which a frame is going to be sent (this option is useful in the +.BR OUTPUT , +.B FORWARD +and +.B POSTROUTING +chains). If the interface name ends with '+', then +any interface name that begins with this name (disregarding '+') will match. +The flag +.B --out-if +is an alias for this option. +.TP +.BR "--logical-out " "[!] \fIname\fP" +The (logical) bridge interface via which a frame is going to be sent (this option +is useful in the +.BR OUTPUT , +.B FORWARD +and +.B POSTROUTING +chains). +If the interface name ends with '+', then +any interface name that begins with this name (disregarding '+') will match. +.TP +.BR "-s, --source " "[!] \fIaddress\fP[/\fImask\fP]" +The source MAC address. Both mask and address are written as 6 hexadecimal +numbers separated by colons. Alternatively one can specify Unicast, +Multicast, Broadcast or BGA (Bridge Group Address): +.br +.IR "Unicast" "=00:00:00:00:00:00/01:00:00:00:00:00," +.IR "Multicast" "=01:00:00:00:00:00/01:00:00:00:00:00," +.IR "Broadcast" "=ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff or" +.IR "BGA" "=01:80:c2:00:00:00/ff:ff:ff:ff:ff:ff." +Note that a broadcast +address will also match the multicast specification. The flag +.B --src +is an alias for this option. +.TP +.BR "-d, --destination " "[!] \fIaddress\fP[/\fImask\fP]" +The destination MAC address. See +.B -s +(above) for more details on MAC addresses. The flag +.B --dst +is an alias for this option. +.TP +.BR "-c, --set-counter " "\fIpcnt bcnt\fP" +If used with +.BR -A " or " -I ", then the packet and byte counters of the new rule will be set to +.IR pcnt ", resp. " bcnt ". +If used with the +.BR -C " or " -D " commands, only rules with a packet and byte count equal to" +.IR pcnt ", resp. " bcnt " will match." + +.SS MATCH EXTENSIONS +Ebtables extensions are dynamically loaded into the userspace tool, +there is therefore no need to explicitly load them with a +-m option like is done in iptables. +These extensions deal with functionality supported by kernel modules supplemental to +the core ebtables code. +.SS 802_3 +Specify 802.3 DSAP/SSAP fields or SNAP type. The protocol must be specified as +.IR "LENGTH " "(see the option " " -p " above). +.TP +.BR "--802_3-sap " "[!] \fIsap\fP" +DSAP and SSAP are two one byte 802.3 fields. The bytes are always +equal, so only one byte (hexadecimal) is needed as an argument. +.TP +.BR "--802_3-type " "[!] \fItype\fP" +If the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field must +be consulted to determine the payload protocol. This is a two byte +(hexadecimal) argument. Only 802.3 frames with DSAP/SSAP 0xaa are +checked for type. +.SS among +Match a MAC address or MAC/IP address pair versus a list of MAC addresses +and MAC/IP address pairs. +A list entry has the following format: +.IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple" +list entries are separated by a comma, specifying an IP address corresponding to +the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address +but different IP address (and vice versa) can be specified. If the MAC address doesn't +match any entry from the list, the frame doesn't match the rule (unless "!" was used). +.TP +.BR "--among-dst " "[!] \fIlist\fP" +Compare the MAC destination to the given list. If the Ethernet frame has type +.IR IPv4 " or " ARP , +then comparison with MAC/IP destination address pairs from the +list is possible. +.TP +.BR "--among-src " "[!] \fIlist\fP" +Compare the MAC source to the given list. If the Ethernet frame has type +.IR IPv4 " or " ARP , +then comparison with MAC/IP source address pairs from the list +is possible. +.TP +.BR "--among-dst-file " "[!] \fIfile\fP" +Same as +.BR --among-dst " but the list is read in from the specified file." +.TP +.BR "--among-src-file " "[!] \fIfile\fP" +Same as +.BR --among-src " but the list is read in from the specified file." +.SS arp +Specify (R)ARP fields. The protocol must be specified as +.IR ARP " or " RARP . +.TP +.BR "--arp-opcode " "[!] \fIopcode\fP" +The (R)ARP opcode (decimal or a string, for more details see +.BR "ebtables -h arp" ). +.TP +.BR "--arp-htype " "[!] \fIhardware type\fP" +The hardware type, this can be a decimal or the string +.I Ethernet +(which sets +.I type +to 1). Most (R)ARP packets have Eternet as hardware type. +.TP +.BR "--arp-ptype " "[!] \fIprotocol type\fP" +The protocol type for which the (r)arp is used (hexadecimal or the string +.IR IPv4 , +denoting 0x0800). +Most (R)ARP packets have protocol type IPv4. +.TP +.BR "--arp-ip-src " "[!] \fIaddress\fP[/\fImask\fP]" +The (R)ARP IP source address specification. +.TP +.BR "--arp-ip-dst " "[!] \fIaddress\fP[/\fImask\fP]" +The (R)ARP IP destination address specification. +.TP +.BR "--arp-mac-src " "[!] \fIaddress\fP[/\fImask\fP]" +The (R)ARP MAC source address specification. +.TP +.BR "--arp-mac-dst " "[!] \fIaddress\fP[/\fImask\fP]" +The (R)ARP MAC destination address specification. +.TP +.BR "" "[!]" " --arp-gratuitous" +Checks for ARP gratuitous packets: checks equality of IPv4 source +address and IPv4 destination address inside the ARP header. +.SS ip +Specify IPv4 fields. The protocol must be specified as +.IR IPv4 . +.TP +.BR "--ip-source " "[!] \fIaddress\fP[/\fImask\fP]" +The source IP address. +The flag +.B --ip-src +is an alias for this option. +.TP +.BR "--ip-destination " "[!] \fIaddress\fP[/\fImask\fP]" +The destination IP address. +The flag +.B --ip-dst +is an alias for this option. +.TP +.BR "--ip-tos " "[!] \fItos\fP" +The IP type of service, in hexadecimal numbers. +.BR IPv4 . +.TP +.BR "--ip-protocol " "[!] \fIprotocol\fP" +The IP protocol. +The flag +.B --ip-proto +is an alias for this option. +.TP +.BR "--ip-source-port " "[!] \fIport1\fP[:\fIport2\fP]" +The source port or port range for the IP protocols 6 (TCP), 17 +(UDP), 33 (DCCP) or 132 (SCTP). The +.B --ip-protocol +option must be specified as +.IR TCP ", " UDP ", " DCCP " or " SCTP . +If +.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." +The flag +.B --ip-sport +is an alias for this option. +.TP +.BR "--ip-destination-port " "[!] \fIport1\fP[:\fIport2\fP]" +The destination port or port range for ip protocols 6 (TCP), 17 +(UDP), 33 (DCCP) or 132 (SCTP). The +.B --ip-protocol +option must be specified as +.IR TCP ", " UDP ", " DCCP " or " SCTP . +If +.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." +The flag +.B --ip-dport +is an alias for this option. +.SS ip6 +Specify IPv6 fields. The protocol must be specified as +.IR IPv6 . +.TP +.BR "--ip6-source " "[!] \fIaddress\fP[/\fImask\fP]" +The source IPv6 address. +The flag +.B --ip6-src +is an alias for this option. +.TP +.BR "--ip6-destination " "[!] \fIaddress\fP[/\fImask\fP]" +The destination IPv6 address. +The flag +.B --ip6-dst +is an alias for this option. +.TP +.BR "--ip6-tclass " "[!] \fItclass\fP" +The IPv6 traffic class, in hexadecimal numbers. +.TP +.BR "--ip6-protocol " "[!] \fIprotocol\fP" +The IP protocol. +The flag +.B --ip6-proto +is an alias for this option. +.TP +.BR "--ip6-source-port " "[!] \fIport1\fP[:\fIport2\fP]" +The source port or port range for the IPv6 protocols 6 (TCP), 17 +(UDP), 33 (DCCP) or 132 (SCTP). The +.B --ip6-protocol +option must be specified as +.IR TCP ", " UDP ", " DCCP " or " SCTP . +If +.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." +The flag +.B --ip6-sport +is an alias for this option. +.TP +.BR "--ip6-destination-port " "[!] \fIport1\fP[:\fIport2\fP]" +The destination port or port range for IPv6 protocols 6 (TCP), 17 +(UDP), 33 (DCCP) or 132 (SCTP). The +.B --ip6-protocol +option must be specified as +.IR TCP ", " UDP ", " DCCP " or " SCTP . +If +.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." +The flag +.B --ip6-dport +is an alias for this option. +.TP +.BR "--ip6-icmp-type " "[!] {\fItype\fP[:\fItype\fP]/\fIcode\fP[:\fIcode\fP]|\fItypename\fP}" +Specify ipv6\-icmp type and code to match. +Ranges for both type and code are supported. Type and code are +separated by a slash. Valid numbers for type and range are 0 to 255. +To match a single type including all valid codes, symbolic names can +be used instead of numbers. The list of known type names is shown by the command +.nf + ebtables \-\-help ip6 +.fi +This option is only valid for \-\-ip6-prococol ipv6-icmp. +.SS limit +This module matches at a limited rate using a token bucket filter. +A rule using this extension will match until this limit is reached. +It can be used with the +.B --log +watcher to give limited logging, for example. Its use is the same +as the limit match of iptables. +.TP +.BR "--limit " "[\fIvalue\fP]" +Maximum average matching rate: specified as a number, with an optional +.IR /second ", " /minute ", " /hour ", or " /day " suffix; the default is " 3/hour . +.TP +.BR "--limit-burst " "[\fInumber\fP]" +Maximum initial number of packets to match: this number gets recharged by +one every time the limit specified above is not reached, up to this +number; the default is +.IR 5 . +.SS mark_m +.TP +.BR "--mark " "[!] [\fIvalue\fP][/\fImask\fP]" +Matches frames with the given unsigned mark value. If a +.IR value " and " mask " are specified, the logical AND of the mark value of the frame and" +the user-specified +.IR mask " is taken before comparing it with the" +user-specified mark +.IR value ". When only a mark " +.IR value " is specified, the packet" +only matches when the mark value of the frame equals the user-specified +mark +.IR value . +If only a +.IR mask " is specified, the logical" +AND of the mark value of the frame and the user-specified +.IR mask " is taken and the frame matches when the result of this logical AND is" +non-zero. Only specifying a +.IR mask " is useful to match multiple mark values." +.SS pkttype +.TP +.BR "--pkttype-type " "[!] \fItype\fP" +Matches on the Ethernet "class" of the frame, which is determined by the +generic networking code. Possible values: +.IR broadcast " (MAC destination is the broadcast address)," +.IR multicast " (MAC destination is a multicast address)," +.IR host " (MAC destination is the receiving network device), or " +.IR otherhost " (none of the above)." +.SS stp +Specify stp BPDU (bridge protocol data unit) fields. The destination +address +.BR "" ( -d ") must be specified as the bridge group address" +.IR "" ( BGA ). +For all options for which a range of values can be specified, it holds that +if the lower bound is omitted (but the colon is not), then the lowest possible lower bound +for that option is used, while if the upper bound is omitted (but the colon again is not), the +highest possible upper bound for that option is used. +.TP +.BR "--stp-type " "[!] \fItype\fP" +The BPDU type (0-255), recognized non-numerical types are +.IR config ", denoting a configuration BPDU (=0), and" +.IR tcn ", denothing a topology change notification BPDU (=128)." +.TP +.BR "--stp-flags " "[!] \fIflag\fP" +The BPDU flag (0-255), recognized non-numerical flags are +.IR topology-change ", denoting the topology change flag (=1), and" +.IR topology-change-ack ", denoting the topology change acknowledgement flag (=128)." +.TP +.BR "--stp-root-prio " "[!] [\fIprio\fP][:\fIprio\fP]" +The root priority (0-65535) range. +.TP +.BR "--stp-root-addr " "[!] [\fIaddress\fP][/\fImask\fP]" +The root mac address, see the option +.BR -s " for more details." +.TP +.BR "--stp-root-cost " "[!] [\fIcost\fP][:\fIcost\fP]" +The root path cost (0-4294967295) range. +.TP +.BR "--stp-sender-prio " "[!] [\fIprio\fP][:\fIprio\fP]" +The BPDU's sender priority (0-65535) range. +.TP +.BR "--stp-sender-addr " "[!] [\fIaddress\fP][/\fImask\fP]" +The BPDU's sender mac address, see the option +.BR -s " for more details." +.TP +.BR "--stp-port " "[!] [\fIport\fP][:\fIport\fP]" +The port identifier (0-65535) range. +.TP +.BR "--stp-msg-age " "[!] [\fIage\fP][:\fIage\fP]" +The message age timer (0-65535) range. +.TP +.BR "--stp-max-age " "[!] [\fIage\fP][:\fIage\fP]" +The max age timer (0-65535) range. +.TP +.BR "--stp-hello-time " "[!] [\fItime\fP][:\fItime\fP]" +The hello time timer (0-65535) range. +.TP +.BR "--stp-forward-delay " "[!] [\fIdelay\fP][:\fIdelay\fP]" +The forward delay timer (0-65535) range. +.SS string +This module matches on a given string using some pattern matching strategy. +.TP +.BR "--string-algo " "\fIalgorithm\fP" +The pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris) +.TP +.BR "--string-from " "\fIoffset\fP" +The lowest offset from which a match can start. (default: 0) +.TP +.BR "--string-to " "\fIoffset\fP" +The highest offset from which a match can start. (default: size of frame) +.TP +.BR "--string " "[!] \fIpattern\fP" +Matches the given pattern. +.TP +.BR "--string-hex " "[!] \fIpattern\fP" +Matches the given pattern in hex notation, e.g. '|0D 0A|', '|0D0A|', 'www|09|netfilter|03|org|00|' +.TP +.BR "--string-icase" +Ignore case when searching. +.SS vlan +Specify 802.1Q Tag Control Information fields. +The protocol must be specified as +.IR 802_1Q " (0x8100)." +.TP +.BR "--vlan-id " "[!] \fIid\fP" +The VLAN identifier field (VID). Decimal number from 0 to 4095. +.TP +.BR "--vlan-prio " "[!] \fIprio\fP" +The user priority field, a decimal number from 0 to 7. +The VID should be set to 0 ("null VID") or unspecified +(in the latter case the VID is deliberately set to 0). +.TP +.BR "--vlan-encap " "[!] \fItype\fP" +The encapsulated Ethernet frame type/length. +Specified as a hexadecimal +number from 0x0000 to 0xFFFF or as a symbolic name +from +.BR /etc/ethertypes . + +.SS WATCHER EXTENSIONS +Watchers only look at frames passing by, they don't modify them nor decide +to accept the frames or not. These watchers only +see the frame if the frame matches the rule, and they see it before the +target is executed. +.SS log +The log watcher writes descriptive data about a frame to the syslog. +.TP +.B "--log" +.br +Log with the default loggin options: log-level= +.IR info , +log-prefix="", no ip logging, no arp logging. +.TP +.B --log-level "\fIlevel\fP" +.br +Defines the logging level. For the possible values, see +.BR "ebtables -h log" . +The default level is +.IR info . +.TP +.BR --log-prefix " \fItext\fP" +.br +Defines the prefix +.I text +to be printed at the beginning of the line with the logging information. +.TP +.B --log-ip +.br +Will log the ip information when a frame made by the ip protocol matches +the rule. The default is no ip information logging. +.TP +.B --log-ip6 +.br +Will log the ipv6 information when a frame made by the ipv6 protocol matches +the rule. The default is no ipv6 information logging. +.TP +.B --log-arp +.br +Will log the (r)arp information when a frame made by the (r)arp protocols +matches the rule. The default is no (r)arp information logging. +.SS nflog +The nflog watcher passes the packet to the loaded logging backend +in order to log the packet. This is usually used in combination with +nfnetlink_log as logging backend, which will multicast the packet +through a +.IR netlink +socket to the specified multicast group. One or more userspace processes +may subscribe to the group to receive the packets. +.TP +.B "--nflog" +.br +Log with the default logging options +.TP +.B --nflog-group "\fInlgroup\fP" +.br +The netlink group (1 - 2^32-1) to which packets are (only applicable for +nfnetlink_log). The default value is 1. +.TP +.B --nflog-prefix "\fIprefix\fP" +.br +A prefix string to include in the log message, up to 30 characters +long, useful for distinguishing messages in the logs. +.TP +.B --nflog-range "\fIsize\fP" +.br +The number of bytes to be copied to userspace (only applicable for +nfnetlink_log). nfnetlink_log instances may specify their own +range, this option overrides it. +.TP +.B --nflog-threshold "\fIsize\fP" +.br +Number of packets to queue inside the kernel before sending them +to userspace (only applicable for nfnetlink_log). Higher values +result in less overhead per packet, but increase delay until the +packets reach userspace. The default value is 1. +.SS ulog +The ulog watcher passes the packet to a userspace +logging daemon using netlink multicast sockets. This differs +from the log watcher in the sense that the complete packet is +sent to userspace instead of a descriptive text and that +netlink multicast sockets are used instead of the syslog. +This watcher enables parsing of packets with userspace programs, the +physical bridge in and out ports are also included in the netlink messages. +The ulog watcher module accepts 2 parameters when the module is loaded +into the kernel (e.g. with modprobe): +.B nlbufsiz +specifies how big the buffer for each netlink multicast +group is. If you say +.IR nlbufsiz=8192 , +for example, up to eight kB of packets will +get accumulated in the kernel until they are sent to userspace. It is +not possible to allocate more than 128kB. Please also keep in mind that +this buffer size is allocated for each nlgroup you are using, so the +total kernel memory usage increases by that factor. The default is 4096. +.B flushtimeout +specifies after how many hundredths of a second the queue should be +flushed, even if it is not full yet. The default is 10 (one tenth of +a second). +.TP +.B "--ulog" +.br +Use the default settings: ulog-prefix="", ulog-nlgroup=1, +ulog-cprange=4096, ulog-qthreshold=1. +.TP +.B --ulog-prefix "\fItext\fP" +.br +Defines the prefix included with the packets sent to userspace. +.TP +.BR --ulog-nlgroup " \fIgroup\fP" +.br +Defines which netlink group number to use (a number from 1 to 32). +Make sure the netlink group numbers used for the iptables ULOG +target differ from those used for the ebtables ulog watcher. +The default group number is 1. +.TP +.BR --ulog-cprange " \fIrange\fP" +.br +Defines the maximum copy range to userspace, for packets matching the +rule. The default range is 0, which means the maximum copy range is +given by +.BR nlbufsiz . +A maximum copy range larger than +128*1024 is meaningless as the packets sent to userspace have an upper +size limit of 128*1024. +.TP +.BR --ulog-qthreshold " \fIthreshold\fP" +.br +Queue at most +.I threshold +number of packets before sending them to +userspace with a netlink socket. Note that packets can be sent to +userspace before the queue is full, this happens when the ulog +kernel timer goes off (the frequency of this timer depends on +.BR flushtimeout ). +.SS TARGET EXTENSIONS +.SS arpreply +The +.B arpreply +target can be used in the +.BR PREROUTING " chain of the " nat " table." +If this target sees an ARP request it will automatically reply +with an ARP reply. The used MAC address for the reply can be specified. +The protocol must be specified as +.IR ARP . +When the ARP message is not an ARP request or when the ARP request isn't +for an IP address on an Ethernet network, it is ignored by this target +.BR "" ( CONTINUE ). +When the ARP request is malformed, it is dropped +.BR "" ( DROP ). +.TP +.BR "--arpreply-mac " "\fIaddress\fP" +Specifies the MAC address to reply with: the Ethernet source MAC and the +ARP payload source MAC will be filled in with this address. +.TP +.BR "--arpreply-target " "\fItarget\fP" +Specifies the standard target. After sending the ARP reply, the rule still +has to give a standard target so ebtables knows what to do with the ARP request. +The default target +.BR "" "is " DROP . +.SS dnat +The +.B dnat +target can only be used in the +.BR BROUTING " chain of the " broute " table and the " +.BR PREROUTING " and " OUTPUT " chains of the " nat " table." +It specifies that the destination MAC address has to be changed. +.TP +.BR "--to-destination " "\fIaddress\fP" +.br +Change the destination MAC address to the specified +.IR address . +The flag +.B --to-dst +is an alias for this option. +.TP +.BR "--dnat-target " "\fItarget\fP" +.br +Specifies the standard target. After doing the dnat, the rule still has to +give a standard target so ebtables knows what to do with the dnated frame. +The default target is +.BR ACCEPT . +Making it +.BR CONTINUE " could let you use" +multiple target extensions on the same frame. Making it +.BR DROP " only makes" +sense in the +.BR BROUTING " chain but using the " redirect " target is more logical there. " RETURN " is also allowed. Note that using " RETURN +in a base chain is not allowed (for obvious reasons). +.SS mark +.BR "" "The " mark " target can be used in every chain of every table. It is possible" +to use the marking of a frame/packet in both ebtables and iptables, +if the bridge-nf code is compiled into the kernel. Both put the marking at the +same place. This allows for a form of communication between ebtables and iptables. +.TP +.BR "--mark-set " "\fIvalue\fP" +.br +Mark the frame with the specified non-negative +.IR value . +.TP +.BR "--mark-or " "\fIvalue\fP" +.br +Or the frame with the specified non-negative +.IR value . +.TP +.BR "--mark-and " "\fIvalue\fP" +.br +And the frame with the specified non-negative +.IR value . +.TP +.BR "--mark-xor " "\fIvalue\fP" +.br +Xor the frame with the specified non-negative +.IR value . +.TP +.BR "--mark-target " "\fItarget\fP" +.br +Specifies the standard target. After marking the frame, the rule +still has to give a standard target so ebtables knows what to do. +The default target is +.BR ACCEPT ". Making it " CONTINUE " can let you do other" +things with the frame in subsequent rules of the chain. +.SS redirect +The +.B redirect +target will change the MAC target address to that of the bridge device the +frame arrived on. This target can only be used in the +.BR BROUTING " chain of the " broute " table and the " +.BR PREROUTING " chain of the " nat " table." +In the +.BR BROUTING " chain, the MAC address of the bridge port is used as destination address," +.BR "" "in the " PREROUTING " chain, the MAC address of the bridge is used." +.TP +.BR "--redirect-target " "\fItarget\fP" +.br +Specifies the standard target. After doing the MAC redirect, the rule +still has to give a standard target so ebtables knows what to do. +The default target is +.BR ACCEPT ". Making it " CONTINUE " could let you use" +multiple target extensions on the same frame. Making it +.BR DROP " in the " BROUTING " chain will let the frames be routed. " RETURN " is also allowed. Note" +.BR "" "that using " RETURN " in a base chain is not allowed." +.SS snat +The +.B snat +target can only be used in the +.BR POSTROUTING " chain of the " nat " table." +It specifies that the source MAC address has to be changed. +.TP +.BR "--to-source " "\fIaddress\fP" +.br +Changes the source MAC address to the specified +.IR address ". The flag" +.B --to-src +is an alias for this option. +.TP +.BR "--snat-target " "\fItarget\fP" +.br +Specifies the standard target. After doing the snat, the rule still has +to give a standard target so ebtables knows what to do. +.BR "" "The default target is " ACCEPT ". Making it " CONTINUE " could let you use" +.BR "" "multiple target extensions on the same frame. Making it " DROP " doesn't" +.BR "" "make sense, but you could do that too. " RETURN " is also allowed. Note" +.BR "" "that using " RETURN " in a base chain is not allowed." +.br +.TP +.BR "--snat-arp " +.br +Also change the hardware source address inside the arp header if the packet is an +arp message and the hardware address length in the arp header is 6 bytes. +.br +.SH FILES +.I /etc/ethertypes +.I @LOCKFILE@ +.SH ENVIRONMENT VARIABLES +.I EBTABLES_ATOMIC_FILE +.SH MAILINGLISTS +.BR "" "See " http://netfilter.org/mailinglists.html +.SH SEE ALSO +.BR iptables "(8), " brctl "(8), " ifconfig "(8), " route (8) +.PP +.BR "" "See " http://ebtables.sf.net diff -Nru ebtables-2.0.10.4/ebtables-restore.c ebtables-2.0.10.4+snapshot20181205/ebtables-restore.c --- ebtables-2.0.10.4/ebtables-restore.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtables-restore.c 2018-12-05 11:27:50.000000000 +0000 @@ -22,13 +22,25 @@ #include #include #include +#include #include "include/ebtables_u.h" +static const struct option options[] = { + {.name = "noflush", .has_arg = 0, .val = 'n'}, + { 0 } +}; + static struct ebt_u_replace replace[3]; void ebt_early_init_once(); #define OPT_KERNELDATA 0x800 /* Also defined in ebtables.c */ +static void print_usage() +{ + fprintf(stderr, "Usage: ebtables-restore [ --noflush ]\n"); + exit(1); +} + static void copy_table_names() { strcpy(replace[0].name, "filter"); @@ -41,11 +53,20 @@ int main(int argc_, char *argv_[]) { char *argv[EBTD_ARGC_MAX], cmdline[EBTD_CMDLINE_MAXLN]; - int i, offset, quotemode = 0, argc, table_nr = -1, line = 0, whitespace; + int i, offset, quotemode = 0, argc, table_nr = -1, line = 0, whitespace, c, flush = 1; char ebtables_str[] = "ebtables"; - if (argc_ != 1) - ebtrest_print_error("options are not supported"); + while ((c = getopt_long(argc_, argv_, "n", options, NULL)) != -1) { + switch(c) { + case 'n': + flush = 0; + break; + default: + print_usage(); + break; + } + } + ebt_silent = 0; copy_table_names(); ebt_early_init_once(); @@ -68,7 +89,7 @@ ebtrest_print_error("table '%s' was not recognized", cmdline+1); table_nr = i; replace[table_nr].command = 11; - ebt_get_kernel_table(&replace[table_nr], 1); + ebt_get_kernel_table(&replace[table_nr], flush); replace[table_nr].command = 0; replace[table_nr].flags = OPT_KERNELDATA; /* Prevent do_command from initialising replace */ continue; diff -Nru ebtables-2.0.10.4/ebtables-save ebtables-2.0.10.4+snapshot20181205/ebtables-save --- ebtables-2.0.10.4/ebtables-save 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtables-save 1970-01-01 00:00:00.000000000 +0000 @@ -1,61 +0,0 @@ -#!/usr/bin/perl -w -# -# -# A script that generates text output of the ebtables rules. -# Similar to iptables-save. -# -# It can be used to store active configuration to /etc/sysconfig/ebtables - -use strict; -my $table; -my $ebtables = "__EXEC_PATH__/ebtables"; -my $cnt = ""; -my $version = "1.0"; -my $table_name; - -# ======================================================== -# Process filter table -# ======================================================== -sub process_table { - my $chain = ""; - my $rules = ""; - my $chains = ""; - my $line = ""; - - foreach $line (split("\n",$_[0])) { - if ($line =~ m/Bridge table: (.*)/) { - print "*$1\n"; - next; - } - if ($line =~ m/Bridge chain: (.*?), entries:.* policy: (.*)/) { - $chains = $chains . ":$1 $2\n"; - $chain = $1; - next; - } - if ($line =~ m/^$/) { - next; - } - if ($cnt eq "--Lc") { - $line =~ s/, pcnt = (.*) -- bcnt = (.*)/-c $1 $2/; - } else { - $line =~ s/ $//; - } - $rules = $rules . "-A $chain $line\n"; - } - - print $chains; - print $rules; - print "\n"; -} -# ======================================================== - -unless (-x $ebtables) { exit -1 }; -print "# Generated by ebtables-save v$version on " . `date`; -if (defined($ENV{'EBTABLES_SAVE_COUNTER'}) && $ENV{'EBTABLES_SAVE_COUNTER'} eq "yes") { - $cnt = "--Lc"; -} -foreach $table_name (split("\n", `grep -E '^ebtable_' /proc/modules | cut -f1 -d' ' | sed s/ebtable_//`)) { - $table =`$ebtables -t $table_name -L $cnt`; - unless ($? == 0) { print $table; exit -1 }; - &process_table($table); -} diff -Nru ebtables-2.0.10.4/ebtables-save.in ebtables-2.0.10.4+snapshot20181205/ebtables-save.in --- ebtables-2.0.10.4/ebtables-save.in 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtables-save.in 2018-12-05 11:27:50.000000000 +0000 @@ -0,0 +1,61 @@ +#!/usr/bin/perl -w +# +# +# A script that generates text output of the ebtables rules. +# Similar to iptables-save. +# +# It can be used to store active configuration to /etc/sysconfig/ebtables + +use strict; +my $table; +my $ebtables = "@sbindir@/ebtables"; +my $cnt = ""; +my $version = "1.0"; +my $table_name; + +# ======================================================== +# Process filter table +# ======================================================== +sub process_table { + my $chain = ""; + my $rules = ""; + my $chains = ""; + my $line = ""; + + foreach $line (split("\n",$_[0])) { + if ($line =~ m/Bridge table: (.*)/) { + print "*$1\n"; + next; + } + if ($line =~ m/Bridge chain: (.*?), entries:.* policy: (.*)/) { + $chains = $chains . ":$1 $2\n"; + $chain = $1; + next; + } + if ($line =~ m/^$/) { + next; + } + if ($cnt eq "--Lc") { + $line =~ s/, pcnt = (.*) -- bcnt = (.*)/-c $1 $2/; + } else { + $line =~ s/ $//; + } + $rules = $rules . "-A $chain $line\n"; + } + + print $chains; + print $rules; + print "\n"; +} +# ======================================================== + +unless (-x $ebtables) { exit -1 }; +print "# Generated by ebtables-save v$version (legacy) on " . `date`; +if (defined($ENV{'EBTABLES_SAVE_COUNTER'}) && $ENV{'EBTABLES_SAVE_COUNTER'} eq "yes") { + $cnt = "--Lc"; +} +foreach $table_name (split("\n", `grep -E '^ebtable_' /proc/modules | cut -f1 -d' ' | sed s/ebtable_//`)) { + $table =`$ebtables -t $table_name -L $cnt`; + unless ($? == 0) { print $table; exit -1 }; + &process_table($table); +} diff -Nru ebtables-2.0.10.4/ebtables.spec ebtables-2.0.10.4+snapshot20181205/ebtables.spec --- ebtables-2.0.10.4/ebtables.spec 2011-12-15 20:02:48.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtables.spec 2018-12-05 11:27:50.000000000 +0000 @@ -5,8 +5,8 @@ Summary: Ethernet Bridge frame table administration tool Name: ebtables -Version: 2.0.10 -Release: 4 +Version: $(VERSION) +Release: $(RELEASE) License: GPL Group: System Environment/Base URL: http://ebtables.sourceforge.net/ diff -Nru ebtables-2.0.10.4/ebtables.sysv ebtables-2.0.10.4+snapshot20181205/ebtables.sysv --- ebtables-2.0.10.4/ebtables.sysv 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtables.sysv 1970-01-01 00:00:00.000000000 +0000 @@ -1,145 +0,0 @@ -#!/bin/bash -# -# init script for the Ethernet Bridge filter tables -# -# Written by Dag Wieers -# Modified by Rok Papez -# Bart De Schuymer -# -# chkconfig: - 15 85 -# description: Ethernet Bridge filtering tables -# -# config: __SYSCONFIG__/ebtables (text) -# __SYSCONFIG__/ebtables. (binary) - -source /etc/init.d/functions -source /etc/sysconfig/network - -# Check that networking is up. -[ ${NETWORKING} = "no" ] && exit 0 - -[ -x __EXEC_PATH__/ebtables ] || exit 1 -[ -x __EXEC_PATH__/ebtables-save ] || exit 1 -[ -x __EXEC_PATH__/ebtables-restore ] || exit 1 - -RETVAL=0 -prog="ebtables" -desc="Ethernet bridge filtering" -umask 0077 - -#default configuration -EBTABLES_TEXT_FORMAT="yes" -EBTABLES_BINARY_FORMAT="yes" -EBTABLES_MODULES_UNLOAD="yes" -EBTABLES_SAVE_ON_STOP="no" -EBTABLES_SAVE_ON_RESTART="no" -EBTABLES_SAVE_COUNTER="no" - -config=__SYSCONFIG__/$prog-config -[ -f "$config" ] && . "$config" - -start() { - echo -n $"Starting $desc ($prog): " - if [ "$EBTABLES_BINARY_FORMAT" = "yes" ]; then - for table in $(ls __SYSCONFIG__/ebtables.* 2>/dev/null | sed -e 's/.*ebtables\.//' -e '/save/d' ); do - __EXEC_PATH__/ebtables -t $table --atomic-file __SYSCONFIG__/ebtables.$table --atomic-commit || RETVAL=1 - done - else - __EXEC_PATH__/ebtables-restore < /etc/sysconfig/ebtables || RETVAL=1 - fi - - if [ $RETVAL -eq 0 ]; then - success "$prog startup" - rm -f /var/lock/subsys/$prog - else - failure "$prog startup" - fi - echo -} - -stop() { - echo -n $"Stopping $desc ($prog): " - for table in $(grep '^ebtable_' /proc/modules | sed -e 's/ebtable_\([^ ]*\).*/\1/'); do - __EXEC_PATH__/ebtables -t $table --init-table || RETVAL=1 - done - - if [ "$EBTABLES_MODULES_UNLOAD" = "yes" ]; then - for mod in $(grep -E '^(ebt|ebtable)_' /proc/modules | cut -f1 -d' ') ebtables; do - rmmod $mod 2> /dev/null - done - fi - - if [ $RETVAL -eq 0 ]; then - success "$prog shutdown" - rm -f /var/lock/subsys/$prog - else - failure "$prog shutdown" - fi - echo -} - -restart() { - stop - start -} - -save() { - echo -n $"Saving $desc ($prog): " - if [ "$EBTABLES_TEXT_FORMAT" = "yes" ]; then - if [ -e __SYSCONFIG__/ebtables ]; then - chmod 0600 __SYSCONFIG__/ebtables - mv -f __SYSCONFIG__/ebtables __SYSCONFIG__/ebtables.save - fi - __EXEC_PATH__/ebtables-save > __SYSCONFIG__/ebtables || RETVAL=1 - fi - if [ "$EBTABLES_BINARY_FORMAT" = "yes" ]; then - rm -f __SYSCONFIG__/ebtables.*.save - for oldtable in $(ls __SYSCONFIG__/ebtables.* 2>/dev/null | grep -vF 'ebtables.save'); do - chmod 0600 $oldtable - mv -f $oldtable $oldtable.save - done - for table in $(grep '^ebtable_' /proc/modules | sed -e 's/ebtable_\([^ ]*\).*/\1/'); do - __EXEC_PATH__/ebtables -t $table --atomic-file __SYSCONFIG__/ebtables.$table --atomic-save || RETVAL=1 - if [ "$EBTABLES_SAVE_COUNTER" = "no" ]; then - __EXEC_PATH__/ebtables -t $table --atomic-file __SYSCONFIG__/ebtables.$table -Z || RETVAL=1 - fi - done - fi - - if [ $RETVAL -eq 0 ]; then - success "$prog saved" - else - failure "$prog saved" - fi - echo -} - -case "$1" in - start) - start - ;; - stop) - [ "$EBTABLES_SAVE_ON_STOP" = "yes" ] && save - stop - ;; - restart|reload) - [ "$EBTABLES_SAVE_ON_RESTART" = "yes" ] && save - restart - ;; - condrestart) - [ -e /var/lock/subsys/$prog ] && restart - RETVAL=$? - ;; - save) - save - ;; - status) - __EXEC_PATH__/ebtables-save - RETVAL=$? - ;; - *) - echo $"Usage $0 {start|stop|restart|condrestart|save|status}" - RETVAL=1 -esac - -exit $RETVAL diff -Nru ebtables-2.0.10.4/ebtables.sysv.in ebtables-2.0.10.4+snapshot20181205/ebtables.sysv.in --- ebtables-2.0.10.4/ebtables.sysv.in 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ebtables.sysv.in 2018-12-05 11:27:50.000000000 +0000 @@ -0,0 +1,145 @@ +#!/bin/bash +# +# init script for the Ethernet Bridge filter tables +# +# Written by Dag Wieers +# Modified by Rok Papez +# Bart De Schuymer +# +# chkconfig: - 15 85 +# description: Ethernet Bridge filtering tables +# +# config: @sysconfigdir@/ebtables (text) +# @sysconfigdir@/ebtables.
(binary) + +source /etc/init.d/functions +source /etc/sysconfig/network + +# Check that networking is up. +[ ${NETWORKING} = "no" ] && exit 0 + +[ -x @sbindir@/ebtables ] || exit 1 +[ -x @sbindir@/ebtables-save ] || exit 1 +[ -x @sbindir@/ebtables-restore ] || exit 1 + +RETVAL=0 +prog="ebtables" +desc="Ethernet bridge filtering" +umask 0077 + +#default configuration +EBTABLES_TEXT_FORMAT="yes" +EBTABLES_BINARY_FORMAT="yes" +EBTABLES_MODULES_UNLOAD="yes" +EBTABLES_SAVE_ON_STOP="no" +EBTABLES_SAVE_ON_RESTART="no" +EBTABLES_SAVE_COUNTER="no" + +config=@sysconfigdir@/$prog-config +[ -f "$config" ] && . "$config" + +start() { + echo -n $"Starting $desc ($prog): " + if [ "$EBTABLES_BINARY_FORMAT" = "yes" ]; then + for table in $(ls @sysconfigdir@/ebtables.* 2>/dev/null | sed -e 's/.*ebtables\.//' -e '/save/d' ); do + @sbindir@/ebtables -t $table --atomic-file @sysconfigdir@/ebtables.$table --atomic-commit || RETVAL=1 + done + else + @sbindir@/ebtables-restore < /etc/sysconfig/ebtables || RETVAL=1 + fi + + if [ $RETVAL -eq 0 ]; then + success "$prog startup" + rm -f /var/lock/subsys/$prog + else + failure "$prog startup" + fi + echo +} + +stop() { + echo -n $"Stopping $desc ($prog): " + for table in $(grep '^ebtable_' /proc/modules | sed -e 's/ebtable_\([^ ]*\).*/\1/'); do + @sbindir@/ebtables -t $table --init-table || RETVAL=1 + done + + if [ "$EBTABLES_MODULES_UNLOAD" = "yes" ]; then + for mod in $(grep -E '^(ebt|ebtable)_' /proc/modules | cut -f1 -d' ') ebtables; do + rmmod $mod 2> /dev/null + done + fi + + if [ $RETVAL -eq 0 ]; then + success "$prog shutdown" + rm -f /var/lock/subsys/$prog + else + failure "$prog shutdown" + fi + echo +} + +restart() { + stop + start +} + +save() { + echo -n $"Saving $desc ($prog): " + if [ "$EBTABLES_TEXT_FORMAT" = "yes" ]; then + if [ -e @sysconfigdir@/ebtables ]; then + chmod 0600 @sysconfigdir@/ebtables + mv -f @sysconfigdir@/ebtables @sysconfigdir@/ebtables.save + fi + @sbindir@/ebtables-save > @sysconfigdir@/ebtables || RETVAL=1 + fi + if [ "$EBTABLES_BINARY_FORMAT" = "yes" ]; then + rm -f @sysconfigdir@/ebtables.*.save + for oldtable in $(ls @sysconfigdir@/ebtables.* 2>/dev/null | grep -vF 'ebtables.save'); do + chmod 0600 $oldtable + mv -f $oldtable $oldtable.save + done + for table in $(grep '^ebtable_' /proc/modules | sed -e 's/ebtable_\([^ ]*\).*/\1/'); do + @sbindir@/ebtables -t $table --atomic-file @sysconfigdir@/ebtables.$table --atomic-save || RETVAL=1 + if [ "$EBTABLES_SAVE_COUNTER" = "no" ]; then + @sbindir@/ebtables -t $table --atomic-file @sysconfigdir@/ebtables.$table -Z || RETVAL=1 + fi + done + fi + + if [ $RETVAL -eq 0 ]; then + success "$prog saved" + else + failure "$prog saved" + fi + echo +} + +case "$1" in + start) + start + ;; + stop) + [ "$EBTABLES_SAVE_ON_STOP" = "yes" ] && save + stop + ;; + restart|reload) + [ "$EBTABLES_SAVE_ON_RESTART" = "yes" ] && save + restart + ;; + condrestart) + [ -e /var/lock/subsys/$prog ] && restart + RETVAL=$? + ;; + save) + save + ;; + status) + @sbindir@/ebtables-save + RETVAL=$? + ;; + *) + echo $"Usage $0 {start|stop|restart|condrestart|save|status}" + RETVAL=1 +esac + +exit $RETVAL diff -Nru ebtables-2.0.10.4/ethertypes ebtables-2.0.10.4+snapshot20181205/ethertypes --- ebtables-2.0.10.4/ethertypes 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/ethertypes 2018-12-05 11:27:50.000000000 +0000 @@ -5,6 +5,7 @@ # # This list could be found on: # http://www.iana.org/assignments/ethernet-numbers +# http://www.iana.org/assignments/ieee-802-numbers # # ... #Comment # @@ -21,15 +22,16 @@ DIAG 6005 # DEC Diagnostics CUST 6006 # DEC Customer use SCA 6007 # DEC Systems Comms Arch -TEB 6558 # Trans Ether Bridging [RFC1701] -RAW_FR 6559 # Raw Frame Relay [RFC1701] +TEB 6558 # Trans Ether Bridging [RFC1701] +RAW_FR 6559 # Raw Frame Relay [RFC1701] +RARP 8035 # Reverse ARP [RFC903] AARP 80F3 # Appletalk AARP -ATALK 809B # Appletalk +ATALK 809B # Appletalk 802_1Q 8100 8021q 1q 802.1q dot1q # 802.1Q Virtual LAN tagged frame IPX 8137 # Novell IPX NetBEUI 8191 # NetBEUI IPv6 86DD ip6 # IP version 6 -PPP 880B # PPP +PPP 880B # PPP ATMMPOA 884C # MultiProtocol over ATM PPP_DISC 8863 # PPPoE discovery messages PPP_SES 8864 # PPPoE session messages diff -Nru ebtables-2.0.10.4/extensions/ebt_802_3.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_802_3.c --- ebtables-2.0.10.4/extensions/ebt_802_3.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_802_3.c 2018-12-05 11:27:50.000000000 +0000 @@ -17,7 +17,7 @@ #define _802_3_SAP '1' #define _802_3_TYPE '2' -static struct option opts[] = +static const struct option opts[] = { { "802_3-sap" , required_argument, 0, _802_3_SAP }, { "802_3-type" , required_argument, 0, _802_3_TYPE }, @@ -141,7 +141,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_match(&_802_3_match); } diff -Nru ebtables-2.0.10.4/extensions/ebtable_broute.c ebtables-2.0.10.4+snapshot20181205/extensions/ebtable_broute.c --- ebtables-2.0.10.4/extensions/ebtable_broute.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebtable_broute.c 2018-12-05 11:27:50.000000000 +0000 @@ -23,7 +23,7 @@ .help = print_help, }; -void _init(void) +static void _INIT(void) { ebt_register_table(&table); } diff -Nru ebtables-2.0.10.4/extensions/ebtable_filter.c ebtables-2.0.10.4+snapshot20181205/extensions/ebtable_filter.c --- ebtables-2.0.10.4/extensions/ebtable_filter.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebtable_filter.c 2018-12-05 11:27:50.000000000 +0000 @@ -29,7 +29,7 @@ .help = print_help, }; -void _init(void) +static void _INIT(void) { ebt_register_table(&table); } diff -Nru ebtables-2.0.10.4/extensions/ebtable_nat.c ebtables-2.0.10.4+snapshot20181205/extensions/ebtable_nat.c --- ebtables-2.0.10.4/extensions/ebtable_nat.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebtable_nat.c 2018-12-05 11:27:50.000000000 +0000 @@ -30,7 +30,7 @@ .help = print_help, }; -void _init(void) +static void _INIT(void) { ebt_register_table(&table); } diff -Nru ebtables-2.0.10.4/extensions/ebt_among.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_among.c --- ebtables-2.0.10.4/extensions/ebt_among.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_among.c 2018-12-05 11:27:50.000000000 +0000 @@ -26,7 +26,7 @@ #define AMONG_DST_F '3' #define AMONG_SRC_F '4' -static struct option opts[] = { +static const struct option opts[] = { {"among-dst", required_argument, 0, AMONG_DST}, {"among-src", required_argument, 0, AMONG_SRC}, {"among-dst-file", required_argument, 0, AMONG_DST_F}, @@ -436,14 +436,14 @@ if (info->wh_dst_ofs) { printf("--among-dst "); - if (info->bitmask && EBT_AMONG_DST_NEG) { + if (info->bitmask & EBT_AMONG_DST_NEG) { printf("! "); } wormhash_printout(ebt_among_wh_dst(info)); } if (info->wh_src_ofs) { printf("--among-src "); - if (info->bitmask && EBT_AMONG_SRC_NEG) { + if (info->bitmask & EBT_AMONG_SRC_NEG) { printf("! "); } wormhash_printout(ebt_among_wh_src(info)); @@ -491,7 +491,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_match(&among_match); } diff -Nru ebtables-2.0.10.4/extensions/ebt_arp.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_arp.c --- ebtables-2.0.10.4/extensions/ebt_arp.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_arp.c 2018-12-05 11:27:50.000000000 +0000 @@ -24,7 +24,7 @@ #define ARP_MAC_S '6' #define ARP_MAC_D '7' #define ARP_GRAT '8' -static struct option opts[] = +static const struct option opts[] = { { "arp-opcode" , required_argument, 0, ARP_OPCODE }, { "arp-op" , required_argument, 0, ARP_OPCODE }, @@ -362,7 +362,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_match(&arp_match); } diff -Nru ebtables-2.0.10.4/extensions/ebt_arpreply.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_arpreply.c --- ebtables-2.0.10.4/extensions/ebt_arpreply.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_arpreply.c 2018-12-05 11:27:50.000000000 +0000 @@ -19,7 +19,7 @@ #define REPLY_MAC '1' #define REPLY_TARGET '2' -static struct option opts[] = +static const struct option opts[] = { { "arpreply-mac" , required_argument, 0, REPLY_MAC }, { "arpreply-target" , required_argument, 0, REPLY_TARGET }, @@ -133,7 +133,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_target(&arpreply_target); } diff -Nru ebtables-2.0.10.4/extensions/ebt_inat.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_inat.c --- ebtables-2.0.10.4/extensions/ebt_inat.c 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_inat.c 2018-12-05 11:27:50.000000000 +0000 @@ -0,0 +1,386 @@ +/* ebt_inat + * + * Authors: + * Grzegorz Borowiak + * + * August, 2003 + */ + +#include +#include +#include +#include +#include +#include +#include "../include/ebtables_u.h" +#include + +static int s_sub_supplied, d_sub_supplied; + +#define NAT_S '1' +#define NAT_D '1' +#define NAT_S_SUB '2' +#define NAT_D_SUB '2' +#define NAT_S_TARGET '3' +#define NAT_D_TARGET '3' +static const struct option opts_s[] = +{ + { "isnat-list" , required_argument, 0, NAT_S }, + { "isnat-sub" , required_argument, 0, NAT_S_SUB }, + { "isnat-default-target" , required_argument, 0, NAT_S_TARGET }, + { 0 } +}; + +static const struct option opts_d[] = +{ + { "idnat-list" , required_argument, 0, NAT_D }, + { "idnat-sub" , required_argument, 0, NAT_D_SUB }, + { "idnat-default-target" , required_argument, 0, NAT_D_TARGET }, + { 0 } +}; + +static void print_help_common(const char *cas) +{ + printf( +"isnat options:\n" +" --i%1.1snat-list : indexed list of MAC addresses\n" +" --i%1.1snat-sub : /24 subnet to which the rule apply\n" +" --i%1.1snat-default-target target : ACCEPT, DROP, RETURN or CONTINUE\n" +"Indexed list of addresses is as follows:\n" +"\tlist := chunk\n" +"\tlist := list chunk\n" +"\tchunk := pair ','\n" +"\tpair := index '=' action\n" +"\taction := mac_addr\n" +"\taction := mac_addr '+'\n" +"\taction := '_'\n" +"where\n" +"\tindex -- an integer [0..255]\n" +"\tmac_addr -- a MAC address in format xx:xx:xx:xx:xx:xx\n" +"If '_' at some index is specified, packets with last %s IP address byte\n" +"equal to index are DROPped. If there is a MAC address, they are %1.1snatted\n" +"to this and the target is CONTINUE. If this MAC is followed by '+', the\n" +"target is ACCEPT.\n" +"For example,\n" +"--idnat-list 2=20:21:22:23:24:25,4=_,7=30:31:32:33:34:35,\n" +"is valid.\n" +"The subnet MUST be specified. Only packets with 3 first bytes of their\n" +"%s address are considered. --i%1.1snat-sub parameter must begin with\n" +"3 integers separated by dots. Only they are considered, the rest is ignored.\n" +"No matter if you write '192.168.42.', '192.168.42.0', '192.168.42.12',\n" +"'192.168.42.0/24', '192.168.42.0/23' or '192.168.42.i%1.1snat_sucks!!!',\n" +"The numbers 192, 168 and 42 are taken and it behaves like a /24 IP subnet.\n" +"--i%1.1snat-default-target affects only the packet not matching the subnet.\n", + cas, cas, cas, cas, cas, cas, cas, cas, + cas, cas, cas, cas, cas, cas, cas, cas + ); +} + +static void print_help_s() +{ + print_help_common("src"); +} + +static void print_help_d() +{ + print_help_common("dest"); +} + +static void init_s(struct ebt_entry_target *target) +{ + struct ebt_inat_info *natinfo = (struct ebt_inat_info *)target->data; + + s_sub_supplied = 0; + memset(natinfo, 0, sizeof(struct ebt_inat_info)); + natinfo->target = EBT_CONTINUE; + return; +} + +static void init_d(struct ebt_entry_target *target) +{ + struct ebt_inat_info *natinfo = (struct ebt_inat_info *)target->data; + + d_sub_supplied = 0; + memset(natinfo, 0, sizeof(struct ebt_inat_info)); + natinfo->target = EBT_CONTINUE; + return; +} + +static void parse_list(const char *arg, struct ebt_inat_info *info) +{ + int i; + char c; + int count = 0; + int now_index = 1; + int index; + char buf[4]; + unsigned char mac[6]; + int ibuf = 0; + int imac = 0; + int target; + memset(buf, 0, 4); + i = 0; + while (1) { + c = arg[i]; + if (now_index) { + if (isdigit(c)) { + buf[ibuf++] = c; + if (ibuf > 3) { + print_error("Index too long at position %d", i); + } + goto next; + } + if (c == '=') { + if (ibuf == 0) { + print_error("Integer index expected before '=' at position %d", i); + } + buf[ibuf] = 0; + ibuf = 0; + index = atoi(buf); + if (index < 0 || 255 < index) { + print_error("Index out of range [0..255], namely %d", index); + } + now_index = 0; + memset(mac, 0, 6); + imac = 0; + target = EBT_CONTINUE; + goto next; + } + if (c == '\0') { + goto next; + } + print_error("Unexpected '%c' where integer or '=' expected", c); + } + else { + if (isxdigit(c)) { + buf[ibuf++] = c; + if (ibuf > 2) { + print_error("MAC address chunk too long at position %d", i); + } + goto next; + } + if (c == ':' || c == ',' || c == '\0') { + buf[ibuf] = 0; + ibuf = 0; + mac[imac++] = strtol(buf, 0, 16); + if (c == ',' || c == '\0') { + info->a[index].enabled = 1; + info->a[index].target = target; + memcpy(info->a[index].mac, mac, 6); + now_index = 1; + count++; + goto next; + } + if (c == ':' && imac >= 6) { + print_error("Too many MAC address chunks at position %d", i); + } + goto next; + } + if (c == '_') { + target = EBT_DROP; + goto next; + } + if (c == '+') { + target = EBT_ACCEPT; + goto next; + } + print_error("Unexpected '%c' where hex digit, '_', '+', ',' or end of string expected", c); + } + next: + if (!c) break; + i++; + } + if (count == 0) { + print_error("List empty"); + } +} + +static uint32_t parse_ip(const char *s) +{ + int a0, a1, a2; + char ip[4]; + sscanf(s, "%d.%d.%d", &a0, &a1, &a2); + ip[0] = a0; + ip[1] = a1; + ip[2] = a2; + ip[3] = 0; + return *(uint32_t*)ip; +} + +#define OPT_ISNAT 0x01 +#define OPT_ISNAT_SUB 0x02 +#define OPT_ISNAT_TARGET 0x04 +static int parse_s(int c, char **argv, int argc, + const struct ebt_u_entry *entry, unsigned int *flags, + struct ebt_entry_target **target) +{ + struct ebt_inat_info *natinfo = (struct ebt_inat_info *)(*target)->data; + + switch (c) { + case NAT_S: + check_option(flags, OPT_ISNAT); + parse_list(optarg, natinfo); + break; + case NAT_S_TARGET: + check_option(flags, OPT_ISNAT_TARGET); + if (FILL_TARGET(optarg, natinfo->target)) + print_error("Illegal --isnat-default-target target"); + break; + case NAT_S_SUB: + natinfo->ip_subnet = parse_ip(optarg); + s_sub_supplied = 1; + break; + default: + return 0; + } + return 1; +} + +#define OPT_IDNAT 0x01 +#define OPT_IDNAT_SUB 0x02 +#define OPT_IDNAT_TARGET 0x04 +static int parse_d(int c, char **argv, int argc, + const struct ebt_u_entry *entry, unsigned int *flags, + struct ebt_entry_target **target) +{ + struct ebt_inat_info *natinfo = (struct ebt_inat_info *)(*target)->data; + + switch (c) { + case NAT_D: + check_option(flags, OPT_IDNAT); + parse_list(optarg, natinfo); + break; + case NAT_D_TARGET: + check_option(flags, OPT_IDNAT_TARGET); + if (FILL_TARGET(optarg, natinfo->target)) + print_error("Illegal --idnat-default-target target"); + break; + case NAT_D_SUB: + natinfo->ip_subnet = parse_ip(optarg); + d_sub_supplied = 1; + break; + default: + return 0; + } + return 1; +} + +static void final_check_s(const struct ebt_u_entry *entry, + const struct ebt_entry_target *target, const char *name, + unsigned int hookmask, unsigned int time) +{ + struct ebt_inat_info *natinfo = (struct ebt_inat_info *)target->data; + + if (BASE_CHAIN && natinfo->target == EBT_RETURN) + print_error("--isnat-default-target RETURN not allowed on base chain"); + CLEAR_BASE_CHAIN_BIT; + if ((hookmask & ~(1 << NF_BR_POST_ROUTING)) || strcmp(name, "nat")) + print_error("Wrong chain for isnat"); + if (time == 0 && s_sub_supplied == 0) + print_error("No isnat subnet supplied"); +} + +static void final_check_d(const struct ebt_u_entry *entry, + const struct ebt_entry_target *target, const char *name, + unsigned int hookmask, unsigned int time) +{ + struct ebt_inat_info *natinfo = (struct ebt_inat_info *)target->data; + + if (BASE_CHAIN && natinfo->target == EBT_RETURN) + print_error("--idnat-default-target RETURN not allowed on base chain"); + CLEAR_BASE_CHAIN_BIT; + if (((hookmask & ~((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT))) + || strcmp(name, "nat")) && + ((hookmask & ~(1 << NF_BR_BROUTING)) || strcmp(name, "broute"))) + print_error("Wrong chain for idnat"); + if (time == 0 && d_sub_supplied == 0) + print_error("No idnat subnet supplied"); +} + +static void print_list(const struct ebt_inat_info *info) +{ + int i; + for (i = 0; i < 256; i++) { + if (info->a[i].enabled) { + printf("%d=", i); + if (info->a[i].target == EBT_DROP) { + printf("_"); + } + else { + if (info->a[i].target == EBT_ACCEPT) { + printf("+"); + } + print_mac(info->a[i].mac); + } + printf(","); + } + } +} + +static void print_s(const struct ebt_u_entry *entry, + const struct ebt_entry_target *target) +{ + struct ebt_inat_info *info = (struct ebt_inat_info *)target->data; + + unsigned char sub[4]; + *(uint32_t*)sub = info->ip_subnet; + printf("--isnat-sub %u.%u.%u.0/24", sub[0], sub[1], sub[2]); + printf(" --isnat-list "); + print_list(info); + printf(" --isnat-default-target %s", TARGET_NAME(info->target)); +} + +static void print_d(const struct ebt_u_entry *entry, + const struct ebt_entry_target *target) +{ + struct ebt_inat_info *info = (struct ebt_inat_info *)target->data; + + unsigned char sub[4]; + *(uint32_t*)sub = info->ip_subnet; + printf("--idnat-sub %u.%u.%u.0/24", sub[0], sub[1], sub[2]); + printf(" --idnat-list "); + print_list(info); + printf(" --idnat-default-target %s", TARGET_NAME(info->target)); +} + +static int compare(const struct ebt_entry_target *t1, + const struct ebt_entry_target *t2) +{ + struct ebt_inat_info *natinfo1 = (struct ebt_inat_info *)t1->data; + struct ebt_inat_info *natinfo2 = (struct ebt_inat_info *)t2->data; + + + return !memcmp(natinfo1, natinfo2, sizeof(struct ebt_inat_info)); +} + +static struct ebt_u_target isnat_target = +{ + .name = EBT_ISNAT_TARGET, + .size = sizeof(struct ebt_inat_info), + .help = print_help_s, + .init = init_s, + .parse = parse_s, + .final_check = final_check_s, + .print = print_s, + .compare = compare, + .extra_ops = opts_s, +}; + +static struct ebt_u_target idnat_target = +{ + .name = EBT_IDNAT_TARGET, + .size = sizeof(struct ebt_inat_info), + .help = print_help_d, + .init = init_d, + .parse = parse_d, + .final_check = final_check_d, + .print = print_d, + .compare = compare, + .extra_ops = opts_d, +}; + +static void _INIT(void) +{ + register_target(&isnat_target); + register_target(&idnat_target); +} diff -Nru ebtables-2.0.10.4/extensions/ebt_ip6.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_ip6.c --- ebtables-2.0.10.4/extensions/ebt_ip6.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_ip6.c 2018-12-05 11:27:50.000000000 +0000 @@ -11,9 +11,6 @@ * */ -#include -#include -#include #include #include #include @@ -51,13 +48,7 @@ }; -struct icmpv6_names { - const char *name; - u_int8_t type; - u_int8_t code_min, code_max; -}; - -static const struct icmpv6_names icmpv6_codes[] = { +static const struct ebt_icmp_names icmpv6_codes[] = { { "destination-unreachable", 1, 0, 0xFF }, { "no-route", 1, 0, 0 }, { "communication-prohibited", 1, 1, 1 }, @@ -141,97 +132,6 @@ free(buffer); } -static char* -parse_num(const char *str, long min, long max, long *num) -{ - char *end; - - errno = 0; - *num = strtol(str, &end, 10); - if (errno && (*num == LONG_MIN || *num == LONG_MAX)) { - ebt_print_error("Invalid number %s: %s", str, strerror(errno)); - return NULL; - } - if (min <= max) { - if (*num > max || *num < min) { - ebt_print_error("Value %ld out of range (%ld, %ld)", *num, min, max); - return NULL; - } - } - if (*num == 0 && str == end) - return NULL; - return end; -} - -static char * -parse_range(const char *str, long min, long max, long num[]) -{ - char *next; - - next = parse_num(str, min, max, num); - if (next == NULL) - return NULL; - if (next && *next == ':') - next = parse_num(next+1, min, max, &num[1]); - else - num[1] = num[0]; - return next; -} - -static int -parse_icmpv6(const char *icmpv6type, uint8_t type[], uint8_t code[]) -{ - static const unsigned int limit = ARRAY_SIZE(icmpv6_codes); - unsigned int match = limit; - unsigned int i; - long number[2]; - - for (i = 0; i < limit; i++) { - if (strncasecmp(icmpv6_codes[i].name, icmpv6type, strlen(icmpv6type))) - continue; - if (match != limit) - ebt_print_error("Ambiguous ICMPv6 type `%s':" - " `%s' or `%s'?", - icmpv6type, icmpv6_codes[match].name, - icmpv6_codes[i].name); - match = i; - } - - if (match < limit) { - type[0] = type[1] = icmpv6_codes[match].type; - code[0] = icmpv6_codes[match].code_min; - code[1] = icmpv6_codes[match].code_max; - } else { - char *next = parse_range(icmpv6type, 0, 255, number); - if (!next) { - ebt_print_error("Unknown ICMPv6 type `%s'", - icmpv6type); - return -1; - } - type[0] = (uint8_t) number[0]; - type[1] = (uint8_t) number[1]; - switch (*next) { - case 0: - code[0] = 0; - code[1] = 255; - return 0; - case '/': - next = parse_range(next+1, 0, 255, number); - code[0] = (uint8_t) number[0]; - code[1] = (uint8_t) number[1]; - if (next == NULL) - return -1; - if (next && *next == 0) - return 0; - /* fallthrough */ - default: - ebt_print_error("unknown character %c", *next); - return -1; - } - } - return 0; -} - static void print_port_range(uint16_t *ports) { if (ports[0] == ports[1]) @@ -240,58 +140,6 @@ printf("%d:%d ", ports[0], ports[1]); } -static void print_icmp_code(uint8_t *code) -{ - if (code[0] == code[1]) - printf("/%"PRIu8 " ", code[0]); - else - printf("/%"PRIu8":%"PRIu8 " ", code[0], code[1]); -} - -static void print_icmp_type(uint8_t *type, uint8_t *code) -{ - unsigned int i; - - if (type[0] != type[1]) { - printf("%"PRIu8 ":%" PRIu8, type[0], type[1]); - print_icmp_code(code); - return; - } - - for (i = 0; i < ARRAY_SIZE(icmpv6_codes); i++) { - if (icmpv6_codes[i].type != type[0]) - continue; - - if (icmpv6_codes[i].code_min == code[0] && - icmpv6_codes[i].code_max == code[1]) { - printf("%s ", icmpv6_codes[i].name); - return; - } - } - printf("%"PRIu8, type[0]); - print_icmp_code(code); -} - -static void print_icmpv6types(void) -{ - unsigned int i; - printf("Valid ICMPv6 Types:"); - - for (i=0; i < ARRAY_SIZE(icmpv6_codes); i++) { - if (i && icmpv6_codes[i].type == icmpv6_codes[i-1].type) { - if (icmpv6_codes[i].code_min == icmpv6_codes[i-1].code_min - && (icmpv6_codes[i].code_max - == icmpv6_codes[i-1].code_max)) - printf(" (%s)", icmpv6_codes[i].name); - else - printf("\n %s", icmpv6_codes[i].name); - } - else - printf("\n%s", icmpv6_codes[i].name); - } - printf("\n"); -} - static void print_help() { printf( @@ -303,7 +151,9 @@ "--ip6-sport [!] port[:port] : tcp/udp source port or port range\n" "--ip6-dport [!] port[:port] : tcp/udp destination port or port range\n" "--ip6-icmp-type [!] type[[:type]/code[:code]] : ipv6-icmp type/code or type/code range\n"); -print_icmpv6types(); + + printf("\nValid ICMPv6 Types:\n"); + ebt_print_icmp_types(icmpv6_codes, ARRAY_SIZE(icmpv6_codes)); } static void init(struct ebt_entry_match *match) @@ -312,6 +162,10 @@ ipinfo->invflags = 0; ipinfo->bitmask = 0; + memset(ipinfo->saddr.s6_addr, 0, sizeof(ipinfo->saddr.s6_addr)); + memset(ipinfo->smsk.s6_addr, 0, sizeof(ipinfo->smsk.s6_addr)); + memset(ipinfo->daddr.s6_addr, 0, sizeof(ipinfo->daddr.s6_addr)); + memset(ipinfo->dmsk.s6_addr, 0, sizeof(ipinfo->dmsk.s6_addr)); } #define OPT_SOURCE 0x01 @@ -370,7 +224,9 @@ ipinfo->bitmask |= EBT_IP6_ICMP6; if (ebt_check_inverse2(optarg)) ipinfo->invflags |= EBT_IP6_ICMP6; - if (parse_icmpv6(optarg, ipinfo->icmpv6_type, ipinfo->icmpv6_code)) + if (ebt_parse_icmp(icmpv6_codes, ARRAY_SIZE(icmpv6_codes), + optarg, ipinfo->icmpv6_type, + ipinfo->icmpv6_code)) return 0; break; @@ -445,14 +301,14 @@ if (ipinfo->invflags & EBT_IP6_SOURCE) printf("! "); printf("%s", ebt_ip6_to_numeric(&ipinfo->saddr)); - printf("/%s ", ebt_ip6_to_numeric(&ipinfo->smsk)); + printf("%s ", ebt_ip6_mask_to_string(&ipinfo->smsk)); } if (ipinfo->bitmask & EBT_IP6_DEST) { printf("--ip6-dst "); if (ipinfo->invflags & EBT_IP6_DEST) printf("! "); printf("%s", ebt_ip6_to_numeric(&ipinfo->daddr)); - printf("/%s ", ebt_ip6_to_numeric(&ipinfo->dmsk)); + printf("%s ", ebt_ip6_mask_to_string(&ipinfo->dmsk)); } if (ipinfo->bitmask & EBT_IP6_TCLASS) { printf("--ip6-tclass "); @@ -489,7 +345,8 @@ printf("--ip6-icmp-type "); if (ipinfo->invflags & EBT_IP6_ICMP6) printf("! "); - print_icmp_type(ipinfo->icmpv6_type, ipinfo->icmpv6_code); + ebt_print_icmp_type(icmpv6_codes, ARRAY_SIZE(icmpv6_codes), + ipinfo->icmpv6_type, ipinfo->icmpv6_code); } } @@ -556,7 +413,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_match(&ip6_match); } diff -Nru ebtables-2.0.10.4/extensions/ebt_ip.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_ip.c --- ebtables-2.0.10.4/extensions/ebt_ip.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_ip.c 2018-12-05 11:27:50.000000000 +0000 @@ -24,8 +24,10 @@ #define IP_PROTO '4' #define IP_SPORT '5' #define IP_DPORT '6' +#define IP_ICMP '7' +#define IP_IGMP '8' -static struct option opts[] = +static const struct option opts[] = { { "ip-source" , required_argument, 0, IP_SOURCE }, { "ip-src" , required_argument, 0, IP_SOURCE }, @@ -38,9 +40,73 @@ { "ip-sport" , required_argument, 0, IP_SPORT }, { "ip-destination-port" , required_argument, 0, IP_DPORT }, { "ip-dport" , required_argument, 0, IP_DPORT }, + { "ip-icmp-type" , required_argument, 0, IP_ICMP }, + { "ip-igmp-type" , required_argument, 0, IP_IGMP }, { 0 } }; +static const struct ebt_icmp_names icmp_codes[] = { + { "echo-reply", 0, 0, 0xFF }, + /* Alias */ { "pong", 0, 0, 0xFF }, + + { "destination-unreachable", 3, 0, 0xFF }, + { "network-unreachable", 3, 0, 0 }, + { "host-unreachable", 3, 1, 1 }, + { "protocol-unreachable", 3, 2, 2 }, + { "port-unreachable", 3, 3, 3 }, + { "fragmentation-needed", 3, 4, 4 }, + { "source-route-failed", 3, 5, 5 }, + { "network-unknown", 3, 6, 6 }, + { "host-unknown", 3, 7, 7 }, + { "network-prohibited", 3, 9, 9 }, + { "host-prohibited", 3, 10, 10 }, + { "TOS-network-unreachable", 3, 11, 11 }, + { "TOS-host-unreachable", 3, 12, 12 }, + { "communication-prohibited", 3, 13, 13 }, + { "host-precedence-violation", 3, 14, 14 }, + { "precedence-cutoff", 3, 15, 15 }, + + { "source-quench", 4, 0, 0xFF }, + + { "redirect", 5, 0, 0xFF }, + { "network-redirect", 5, 0, 0 }, + { "host-redirect", 5, 1, 1 }, + { "TOS-network-redirect", 5, 2, 2 }, + { "TOS-host-redirect", 5, 3, 3 }, + + { "echo-request", 8, 0, 0xFF }, + /* Alias */ { "ping", 8, 0, 0xFF }, + + { "router-advertisement", 9, 0, 0xFF }, + + { "router-solicitation", 10, 0, 0xFF }, + + { "time-exceeded", 11, 0, 0xFF }, + /* Alias */ { "ttl-exceeded", 11, 0, 0xFF }, + { "ttl-zero-during-transit", 11, 0, 0 }, + { "ttl-zero-during-reassembly", 11, 1, 1 }, + + { "parameter-problem", 12, 0, 0xFF }, + { "ip-header-bad", 12, 0, 0 }, + { "required-option-missing", 12, 1, 1 }, + + { "timestamp-request", 13, 0, 0xFF }, + + { "timestamp-reply", 14, 0, 0xFF }, + + { "address-mask-request", 17, 0, 0xFF }, + + { "address-mask-reply", 18, 0, 0xFF } +}; + +static const struct ebt_icmp_names igmp_types[] = { + { "membership-query", 0x11 }, + { "membership-report-v1", 0x12 }, + { "membership-report-v2", 0x16 }, + { "leave-group", 0x17 }, + { "membership-report-v3", 0x22 }, +}; + /* put the mask into 4 bytes */ /* transform a protocol and service name into a port number */ static uint16_t parse_port(const char *protocol, const char *name) @@ -105,7 +171,14 @@ "--ip-tos [!] tos : ip tos specification\n" "--ip-proto [!] protocol : ip protocol specification\n" "--ip-sport [!] port[:port] : tcp/udp source port or port range\n" -"--ip-dport [!] port[:port] : tcp/udp destination port or port range\n"); +"--ip-dport [!] port[:port] : tcp/udp destination port or port range\n" +"--ip-icmp-type [!] type[[:type]/code[:code]] : icmp type/code or type/code range\n" +"--ip-igmp-type [!] type[:type] : igmp type or type range\n"); + + printf("\nValid ICMP Types:\n"); + ebt_print_icmp_types(icmp_codes, ARRAY_SIZE(icmp_codes)); + printf("\nValid IGMP Types:\n"); + ebt_print_icmp_types(igmp_types, ARRAY_SIZE(igmp_types)); } static void init(struct ebt_entry_match *match) @@ -122,6 +195,8 @@ #define OPT_PROTO 0x08 #define OPT_SPORT 0x10 #define OPT_DPORT 0x20 +#define OPT_ICMP 0x40 +#define OPT_IGMP 0x80 static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry, unsigned int *flags, struct ebt_entry_match **match) { @@ -170,6 +245,26 @@ parse_port_range(NULL, optarg, ipinfo->dport); break; + case IP_ICMP: + ebt_check_option2(flags, OPT_ICMP); + ipinfo->bitmask |= EBT_IP_ICMP; + if (ebt_check_inverse2(optarg)) + ipinfo->invflags |= EBT_IP_ICMP; + if (ebt_parse_icmp(icmp_codes, ARRAY_SIZE(icmp_codes), optarg, + ipinfo->icmp_type, ipinfo->icmp_code)) + return 0; + break; + + case IP_IGMP: + ebt_check_option2(flags, OPT_IGMP); + ipinfo->bitmask |= EBT_IP_IGMP; + if (ebt_check_inverse2(optarg)) + ipinfo->invflags |= EBT_IP_IGMP; + if (ebt_parse_icmp(igmp_types, ARRAY_SIZE(igmp_types), optarg, + ipinfo->igmp_type, NULL)) + return 0; + break; + case IP_myTOS: ebt_check_option2(flags, OPT_TOS); if (ebt_check_inverse2(optarg)) @@ -219,10 +314,23 @@ (ipinfo->protocol!=IPPROTO_TCP && ipinfo->protocol!=IPPROTO_UDP && ipinfo->protocol!=IPPROTO_SCTP && - ipinfo->protocol!=IPPROTO_DCCP))) + ipinfo->protocol!=IPPROTO_DCCP))) { ebt_print_error("For port filtering the IP protocol must be " "either 6 (tcp), 17 (udp), 33 (dccp) or " "132 (sctp)"); + } else if ((ipinfo->bitmask & EBT_IP_ICMP) && + (!(ipinfo->bitmask & EBT_IP_PROTO) || + ipinfo->invflags & EBT_IP_PROTO || + ipinfo->protocol != IPPROTO_ICMP)) { + ebt_print_error("For ICMP filtering the IP protocol must be " + "1 (icmp)"); + } else if ((ipinfo->bitmask & EBT_IP_IGMP) && + (!(ipinfo->bitmask & EBT_IP_PROTO) || + ipinfo->invflags & EBT_IP_PROTO || + ipinfo->protocol != IPPROTO_IGMP)) { + ebt_print_error("For IGMP filtering the IP protocol must be " + "2 (igmp)"); + } } static void print(const struct ebt_u_entry *entry, @@ -280,6 +388,20 @@ printf("! "); print_port_range(ipinfo->dport); } + if (ipinfo->bitmask & EBT_IP_ICMP) { + printf("--ip-icmp-type "); + if (ipinfo->invflags & EBT_IP_ICMP) + printf("! "); + ebt_print_icmp_type(icmp_codes, ARRAY_SIZE(icmp_codes), + ipinfo->icmp_type, ipinfo->icmp_code); + } + if (ipinfo->bitmask & EBT_IP_IGMP) { + printf("--ip-igmp-type "); + if (ipinfo->invflags & EBT_IP_IGMP) + printf("! "); + ebt_print_icmp_type(igmp_types, ARRAY_SIZE(igmp_types), + ipinfo->igmp_type, NULL); + } } static int compare(const struct ebt_entry_match *m1, @@ -322,6 +444,18 @@ ipinfo1->dport[1] != ipinfo2->dport[1]) return 0; } + if (ipinfo1->bitmask & EBT_IP_ICMP) { + if (ipinfo1->icmp_type[0] != ipinfo2->icmp_type[0] || + ipinfo1->icmp_type[1] != ipinfo2->icmp_type[1] || + ipinfo1->icmp_code[0] != ipinfo2->icmp_code[0] || + ipinfo1->icmp_code[1] != ipinfo2->icmp_code[1]) + return 0; + } + if (ipinfo1->bitmask & EBT_IP_IGMP) { + if (ipinfo1->igmp_type[0] != ipinfo2->igmp_type[0] || + ipinfo1->igmp_type[1] != ipinfo2->igmp_type[1]) + return 0; + } return 1; } @@ -338,7 +472,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_match(&ip_match); } diff -Nru ebtables-2.0.10.4/extensions/ebt_limit.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_limit.c --- ebtables-2.0.10.4/extensions/ebt_limit.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_limit.c 2018-12-05 11:27:50.000000000 +0000 @@ -41,7 +41,7 @@ #define ARG_LIMIT '1' #define ARG_LIMIT_BURST '2' -static struct option opts[] = +static const struct option opts[] = { { "limit", required_argument, 0, ARG_LIMIT }, { "limit-burst", required_argument, 0, ARG_LIMIT_BURST }, @@ -59,11 +59,11 @@ " default %u\n", EBT_LIMIT_BURST); } -static int parse_rate(const char *rate, u_int32_t *val) +static int parse_rate(const char *rate, uint32_t *val) { const char *delim; - u_int32_t r; - u_int32_t mult = 1; /* Seconds by default. */ + uint32_t r; + uint32_t mult = 1; /* Seconds by default. */ delim = strchr(rate, '/'); if (delim) { @@ -151,7 +151,7 @@ struct rates { const char *name; - u_int32_t mult; + uint32_t mult; }; static struct rates g_rates[] = @@ -162,7 +162,7 @@ { "sec", EBT_LIMIT_SCALE } }; -static void print_rate(u_int32_t period) +static void print_rate(uint32_t period) { unsigned int i; @@ -212,7 +212,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_match(&limit_match); } diff -Nru ebtables-2.0.10.4/extensions/ebt_log.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_log.c --- ebtables-2.0.10.4/extensions/ebt_log.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_log.c 2018-12-05 11:27:50.000000000 +0000 @@ -61,7 +61,7 @@ #define LOG_IP '4' #define LOG_LOG '5' #define LOG_IP6 '6' -static struct option opts[] = +static const struct option opts[] = { { "log-prefix", required_argument, 0, LOG_PREFIX }, { "log-level" , required_argument, 0, LOG_LEVEL }, @@ -217,7 +217,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_watcher(&log_watcher); } diff -Nru ebtables-2.0.10.4/extensions/ebt_mark.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_mark.c --- ebtables-2.0.10.4/extensions/ebt_mark.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_mark.c 2018-12-05 11:27:50.000000000 +0000 @@ -20,7 +20,7 @@ #define MARK_ORMARK '3' #define MARK_ANDMARK '4' #define MARK_XORMARK '5' -static struct option opts[] = +static const struct option opts[] = { { "mark-target" , required_argument, 0, MARK_TARGET }, /* an oldtime messup, we should have always used the scheme @@ -172,7 +172,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_target(&mark_target); } diff -Nru ebtables-2.0.10.4/extensions/ebt_mark_m.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_mark_m.c --- ebtables-2.0.10.4/extensions/ebt_mark_m.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_mark_m.c 2018-12-05 11:27:50.000000000 +0000 @@ -15,7 +15,7 @@ #define MARK '1' -static struct option opts[] = +static const struct option opts[] = { { "mark", required_argument, 0, MARK }, { 0 } @@ -121,7 +121,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_match(&mark_match); } diff -Nru ebtables-2.0.10.4/extensions/ebt_nat.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_nat.c --- ebtables-2.0.10.4/extensions/ebt_nat.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_nat.c 2018-12-05 11:27:50.000000000 +0000 @@ -21,7 +21,7 @@ #define NAT_S_TARGET '2' #define NAT_D_TARGET '2' #define NAT_S_ARP '3' -static struct option opts_s[] = +static const struct option opts_s[] = { { "to-source" , required_argument, 0, NAT_S }, { "to-src" , required_argument, 0, NAT_S }, @@ -30,7 +30,7 @@ { 0 } }; -static struct option opts_d[] = +static const struct option opts_d[] = { { "to-destination", required_argument, 0, NAT_D }, { "to-dst" , required_argument, 0, NAT_D }, @@ -231,7 +231,7 @@ .extra_ops = opts_d, }; -void _init(void) +static void _INIT(void) { ebt_register_target(&snat_target); ebt_register_target(&dnat_target); diff -Nru ebtables-2.0.10.4/extensions/ebt_nflog.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_nflog.c --- ebtables-2.0.10.4/extensions/ebt_nflog.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_nflog.c 2018-12-05 11:27:50.000000000 +0000 @@ -25,7 +25,7 @@ NFLOG_NFLOG = 0x16, }; -static struct option nflog_opts[] = { +static const struct option nflog_opts[] = { {"nflog-group", required_argument, NULL, NFLOG_GROUP}, {"nflog-prefix", required_argument, NULL, NFLOG_PREFIX}, {"nflog-range", required_argument, NULL, NFLOG_RANGE}, @@ -166,7 +166,7 @@ .extra_ops = nflog_opts, }; -void _init(void) +static void _INIT(void) { ebt_register_watcher(&nflog_watcher); } diff -Nru ebtables-2.0.10.4/extensions/ebt_pkttype.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_pkttype.c --- ebtables-2.0.10.4/extensions/ebt_pkttype.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_pkttype.c 2018-12-05 11:27:50.000000000 +0000 @@ -27,7 +27,7 @@ "\0" }; -static struct option opts[] = +static const struct option opts[] = { { "pkttype-type" , required_argument, 0, '1' }, { 0 } @@ -125,7 +125,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_match(&pkttype_match); } diff -Nru ebtables-2.0.10.4/extensions/ebt_redirect.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_redirect.c --- ebtables-2.0.10.4/extensions/ebt_redirect.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_redirect.c 2018-12-05 11:27:50.000000000 +0000 @@ -14,7 +14,7 @@ #include #define REDIRECT_TARGET '1' -static struct option opts[] = +static const struct option opts[] = { { "redirect-target", required_argument, 0, REDIRECT_TARGET }, { 0 } @@ -108,7 +108,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_target(&redirect_target); } diff -Nru ebtables-2.0.10.4/extensions/ebt_standard.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_standard.c --- ebtables-2.0.10.4/extensions/ebt_standard.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_standard.c 2018-12-05 11:27:50.000000000 +0000 @@ -11,7 +11,7 @@ #include #include "../include/ebtables_u.h" -static struct option opts[] = +static const struct option opts[] = { {0} }; @@ -84,7 +84,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_target(&standard); } diff -Nru ebtables-2.0.10.4/extensions/ebt_stp.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_stp.c --- ebtables-2.0.10.4/extensions/ebt_stp.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_stp.c 2018-12-05 11:27:50.000000000 +0000 @@ -27,7 +27,7 @@ #define STP_FWDD 'l' #define STP_NUMOPS 12 -static struct option opts[] = +static const struct option opts[] = { { "stp-type" , required_argument, 0, STP_TYPE}, { "stp-flags" , required_argument, 0, STP_FLAGS}, @@ -337,7 +337,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_match(&stp_match); } diff -Nru ebtables-2.0.10.4/extensions/ebt_string.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_string.c --- ebtables-2.0.10.4/extensions/ebt_string.c 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_string.c 2018-12-05 11:27:50.000000000 +0000 @@ -0,0 +1,318 @@ +/* ebt_string + * + * Author: + * Bernie Harris + * + * February, 2018 + * + * Based on: + * libxt_string.c, Copyright (C) 2000 Emmanuel Roger + */ + +#include +#include +#include +#include +#include +#include +#include +#include "../include/ebtables_u.h" +#include +#include + +#define STRING_FROM '1' +#define STRING_TO '2' +#define STRING_ALGO '3' +#define STRING_ICASE '4' +#define STRING '5' +#define STRING_HEX '6' +#define OPT_STRING_FROM (1 << 0) +#define OPT_STRING_TO (1 << 1) +#define OPT_STRING_ALGO (1 << 2) +#define OPT_STRING_ICASE (1 << 3) +#define OPT_STRING (1 << 4) +#define OPT_STRING_HEX (1 << 5) + +static const struct option opts[] = +{ + { "string-from" , required_argument, 0, STRING_FROM }, + { "string-to" , required_argument, 0, STRING_TO }, + { "string-algo" , required_argument, 0, STRING_ALGO }, + { "string-icase" , no_argument, 0, STRING_ICASE }, + { "string" , required_argument, 0, STRING }, + { "string-hex" , required_argument, 0, STRING_HEX }, + { 0 } +}; + +static void print_help() +{ + printf( +"string options:\n" +"--string-from offset : Offset to start searching from (default: 0)\n" +"--string-to offset : Offset to stop searching (default: packet size)\n" +"--string-algo algorithm : Algorithm (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)\n" +"--string-icase : Ignore case when searching\n" +"--string [!] string : Match a string in a packet\n" +"--string-hex [!] string : Match a hex string in a packet, e.g. |0D 0A|, |0D0A|, netfilter|03|org\n"); +} + +static void init(struct ebt_entry_match *match) +{ + struct xt_string_info *info = (struct xt_string_info *)match->data; + + info->to_offset = UINT16_MAX; +} + +static void parse_string(const char *s, struct xt_string_info *info) +{ + /* xt_string does not need \0 at the end of the pattern */ + if (strlen(s) <= XT_STRING_MAX_PATTERN_SIZE) { + strncpy(info->pattern, s, XT_STRING_MAX_PATTERN_SIZE); + info->patlen = strnlen(s, XT_STRING_MAX_PATTERN_SIZE); + return; + } + ebt_print_error3("STRING too long \"%s\"", s); +} + +static void parse_hex_string(const char *s, struct xt_string_info *info) +{ + int i=0, slen, sindex=0, schar; + short hex_f = 0, literal_f = 0; + char hextmp[3]; + + slen = strlen(s); + + if (slen == 0) { + ebt_print_error3("STRING must contain at least one char"); + } + + while (i < slen) { + if (s[i] == '\\' && !hex_f) { + literal_f = 1; + } else if (s[i] == '\\') { + ebt_print_error3("Cannot include literals in hex data"); + } else if (s[i] == '|') { + if (hex_f) + hex_f = 0; + else { + hex_f = 1; + /* get past any initial whitespace just after the '|' */ + while (s[i+1] == ' ') + i++; + } + if (i+1 >= slen) + break; + else + i++; /* advance to the next character */ + } + + if (literal_f) { + if (i+1 >= slen) { + ebt_print_error3("Bad literal placement at end of string"); + } + info->pattern[sindex] = s[i+1]; + i += 2; /* skip over literal char */ + literal_f = 0; + } else if (hex_f) { + if (i+1 >= slen) { + ebt_print_error3("Odd number of hex digits"); + } + if (i+2 >= slen) { + /* must end with a "|" */ + ebt_print_error3("Invalid hex block"); + } + if (! isxdigit(s[i])) /* check for valid hex char */ + ebt_print_error3("Invalid hex char '%c'", s[i]); + if (! isxdigit(s[i+1])) /* check for valid hex char */ + ebt_print_error3("Invalid hex char '%c'", s[i+1]); + hextmp[0] = s[i]; + hextmp[1] = s[i+1]; + hextmp[2] = '\0'; + if (! sscanf(hextmp, "%x", &schar)) + ebt_print_error3("Invalid hex char `%c'", s[i]); + info->pattern[sindex] = (char) schar; + if (s[i+2] == ' ') + i += 3; /* spaces included in the hex block */ + else + i += 2; + } else { /* the char is not part of hex data, so just copy */ + info->pattern[sindex] = s[i]; + i++; + } + if (sindex > XT_STRING_MAX_PATTERN_SIZE) + ebt_print_error3("STRING too long \"%s\"", s); + sindex++; + } + info->patlen = sindex; +} + +static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry, + unsigned int *flags, struct ebt_entry_match **match) +{ + struct xt_string_info *info = (struct xt_string_info *)(*match)->data; + + switch (c) { + case STRING_FROM: + ebt_check_option2(flags, OPT_STRING_FROM); + if (ebt_check_inverse2(optarg)) + ebt_print_error2("Unexpected `!' after --string-from"); + info->from_offset = (__u16)strtoul(optarg, NULL, 10); + break; + case STRING_TO: + ebt_check_option2(flags, OPT_STRING_TO); + if (ebt_check_inverse2(optarg)) + ebt_print_error2("Unexpected `!' after --string-to"); + info->to_offset = (__u16)strtoul(optarg, NULL, 10); + break; + case STRING_ALGO: + ebt_check_option2(flags, OPT_STRING_ALGO); + if (ebt_check_inverse2(optarg)) + ebt_print_error2("Unexpected `!' after --string-algo"); + if (snprintf(info->algo, sizeof(info->algo), "%s", optarg) >= + sizeof(info->algo)) + ebt_print_error2("\"%s\" is truncated", info->algo); + break; + case STRING_ICASE: + ebt_check_option2(flags, OPT_STRING_ICASE); + if (ebt_check_inverse2(optarg)) + ebt_print_error2("Unexpected `!' after --string-icase"); + info->u.v1.flags |= XT_STRING_FLAG_IGNORECASE; + break; + case STRING: + ebt_check_option2(flags, OPT_STRING); + parse_string(optarg, info); + if (ebt_check_inverse2(optarg)) { + info->u.v1.flags |= XT_STRING_FLAG_INVERT; + } + break; + case STRING_HEX: + ebt_check_option2(flags, OPT_STRING_HEX); + parse_hex_string(optarg, info); + if (ebt_check_inverse2(optarg)) { + info->u.v1.flags |= XT_STRING_FLAG_INVERT; + } + break; + default: + return 0; + } + return 1; +} + +static void final_check(const struct ebt_u_entry *entry, + const struct ebt_entry_match *match, const char *name, + unsigned int hookmask, unsigned int time) +{ + struct xt_string_info *info = (struct xt_string_info *)match->data; + + if (info->to_offset < info->from_offset) { + ebt_print_error3("'to' offset should not be less than 'from' " + "offset"); + } +} + +/* Test to see if the string contains non-printable chars or quotes */ +static unsigned short int is_hex_string(const char *str, + const unsigned short int len) +{ + unsigned int i; + for (i=0; i < len; i++) { + if (! isprint(str[i])) { + /* string contains at least one non-printable char */ + return 1; + } + } + /* use hex output if the last char is a "\" */ + if (str[len-1] == '\\') + return 1; + return 0; +} + +/* Print string with "|" chars included as one would pass to --string-hex */ +static void print_hex_string(const char *str, const unsigned short int len) +{ + unsigned int i; + /* start hex block */ + printf("\"|"); + for (i=0; i < len; i++) + printf("%02x", (unsigned char)str[i]); + /* close hex block */ + printf("|\" "); +} + +static void print_string(const char *str, const unsigned short int len) +{ + unsigned int i; + printf("\""); + for (i=0; i < len; i++) { + if (str[i] == '\"' || str[i] == '\\') + putchar('\\'); + printf("%c", (unsigned char) str[i]); + } + printf("\" "); /* closing quote */ +} + +static void print(const struct ebt_u_entry *entry, + const struct ebt_entry_match *match) +{ + const struct xt_string_info *info = + (const struct xt_string_info *) match->data; + int invert = info->u.v1.flags & XT_STRING_FLAG_INVERT; + + if (is_hex_string(info->pattern, info->patlen)) { + printf("--string-hex %s", invert ? "! " : ""); + print_hex_string(info->pattern, info->patlen); + } else { + printf("--string %s", invert ? "! " : ""); + print_string(info->pattern, info->patlen); + } + printf("--string-algo %s ", info->algo); + if (info->from_offset != 0) + printf("--string-from %u ", info->from_offset); + if (info->to_offset != 0) + printf("--string-to %u ", info->to_offset); + if (info->u.v1.flags & XT_STRING_FLAG_IGNORECASE) + printf("--string-icase "); +} + +static int compare(const struct ebt_entry_match *m1, + const struct ebt_entry_match *m2) +{ + const struct xt_string_info *info1 = + (const struct xt_string_info *) m1->data; + const struct xt_string_info *info2 = + (const struct xt_string_info *) m2->data; + + if (info1->from_offset != info2->from_offset) + return 0; + if (info1->to_offset != info2->to_offset) + return 0; + if (info1->u.v1.flags != info2->u.v1.flags) + return 0; + if (info1->patlen != info2->patlen) + return 0; + if (strncmp (info1->algo, info2->algo, XT_STRING_MAX_ALGO_NAME_SIZE) != 0) + return 0; + if (strncmp (info1->pattern, info2->pattern, info1->patlen) != 0) + return 0; + + return 1; +} + +static struct ebt_u_match string_match = +{ + .name = "string", + .revision = 1, + .size = sizeof(struct xt_string_info), + .help = print_help, + .init = init, + .parse = parse, + .final_check = final_check, + .print = print, + .compare = compare, + .extra_ops = opts, +}; + +static void _INIT(void) +{ + ebt_register_match(&string_match); +} diff -Nru ebtables-2.0.10.4/extensions/ebt_ulog.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_ulog.c --- ebtables-2.0.10.4/extensions/ebt_ulog.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_ulog.c 2018-12-05 11:27:50.000000000 +0000 @@ -24,7 +24,7 @@ #define ULOG_CPRANGE '3' #define ULOG_QTHRESHOLD '4' #define ULOG_ULOG '5' -static struct option opts[] = +static const struct option opts[] = { { "ulog-prefix" , required_argument, 0, ULOG_PREFIX }, { "ulog-nlgroup" , required_argument, 0, ULOG_NLGROUP }, @@ -180,7 +180,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_watcher(&ulog_watcher); } diff -Nru ebtables-2.0.10.4/extensions/ebt_vlan.c ebtables-2.0.10.4+snapshot20181205/extensions/ebt_vlan.c --- ebtables-2.0.10.4/extensions/ebt_vlan.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/ebt_vlan.c 2018-12-05 11:27:50.000000000 +0000 @@ -25,7 +25,7 @@ #define VLAN_PRIO '2' #define VLAN_ENCAP '3' -static struct option opts[] = { +static const struct option opts[] = { {"vlan-id" , required_argument, NULL, VLAN_ID}, {"vlan-prio" , required_argument, NULL, VLAN_PRIO}, {"vlan-encap", required_argument, NULL, VLAN_ENCAP}, @@ -181,7 +181,7 @@ .extra_ops = opts, }; -void _init(void) +static void _INIT(void) { ebt_register_match(&vlan_match); } diff -Nru ebtables-2.0.10.4/extensions/Makefile ebtables-2.0.10.4+snapshot20181205/extensions/Makefile --- ebtables-2.0.10.4/extensions/Makefile 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/extensions/Makefile 2018-12-05 11:27:50.000000000 +0000 @@ -1,7 +1,7 @@ #! /usr/bin/make EXT_FUNC+=802_3 nat arp arpreply ip ip6 standard log redirect vlan mark_m mark \ - pkttype stp among limit ulog nflog + pkttype stp among limit ulog nflog string EXT_TABLES+=filter nat broute EXT_OBJS+=$(foreach T,$(EXT_FUNC), extensions/ebt_$(T).o) EXT_OBJS+=$(foreach T,$(EXT_TABLES), extensions/ebtable_$(T).o) @@ -11,13 +11,13 @@ EXT_LIBSI+=$(foreach T,$(EXT_TABLES), -lebtable_$(T)) extensions/ebt_%.so: extensions/ebt_%.o - $(CC) $(LDFLAGS) -shared -o $@ -lc $< -nostartfiles + $(CC) $(LDFLAGS) -shared -o $@ -lc $< extensions/libebt_%.so: extensions/ebt_%.so mv $< $@ extensions/ebtable_%.so: extensions/ebtable_%.o - $(CC) $(LDFLAGS) -shared -o $@ -lc $< -nostartfiles + $(CC) $(LDFLAGS) -shared -o $@ -lc $< extensions/libebtable_%.so: extensions/ebtable_%.so mv $< $@ diff -Nru ebtables-2.0.10.4/.gitignore ebtables-2.0.10.4+snapshot20181205/.gitignore --- ebtables-2.0.10.4/.gitignore 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/.gitignore 2018-12-05 11:27:50.000000000 +0000 @@ -0,0 +1,28 @@ +*.a +*.la +*.lo +*.so +*.o +.deps/ +.dirstamp +.libs/ +Makefile +Makefile.in + +/aclocal.m4 +/autom4te.cache/ +/build-aux/ +/config.* +/configure +/libtool +/stamp-h1 + +/ebtables +/ebtables-config +/ebtables-restore +/ebtables-save +/ebtables.8 +/ebtables.sysv +/ebtablesd +/ebtablesu +/static diff -Nru ebtables-2.0.10.4/include/ebtables.h ebtables-2.0.10.4+snapshot20181205/include/ebtables.h --- ebtables-2.0.10.4/include/ebtables.h 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/include/ebtables.h 1970-01-01 00:00:00.000000000 +0000 @@ -1,276 +0,0 @@ -/* - * ebtables - * - * Authors: - * Bart De Schuymer - * - * ebtables.c,v 2.0, April, 2002 - * - * This code is stongly inspired on the iptables code which is - * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling - */ - -/* Local copy of the kernel file, needed for Sparc64 support */ -#ifndef __LINUX_BRIDGE_EFF_H -#define __LINUX_BRIDGE_EFF_H -#include -#include -#include - -#define EBT_TABLE_MAXNAMELEN 32 -#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN -#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN - -/* verdicts >0 are "branches" */ -#define EBT_ACCEPT -1 -#define EBT_DROP -2 -#define EBT_CONTINUE -3 -#define EBT_RETURN -4 -#define NUM_STANDARD_TARGETS 4 -/* ebtables target modules store the verdict inside an int. We can - * reclaim a part of this int for backwards compatible extensions. - * The 4 lsb are more than enough to store the verdict. */ -#define EBT_VERDICT_BITS 0x0000000F - -struct ebt_counter -{ - uint64_t pcnt; - uint64_t bcnt; -}; - -struct ebt_replace -{ - char name[EBT_TABLE_MAXNAMELEN]; - unsigned int valid_hooks; - /* nr of rules in the table */ - unsigned int nentries; - /* total size of the entries */ - unsigned int entries_size; - /* start of the chains */ -#ifdef KERNEL_64_USERSPACE_32 - uint64_t hook_entry[NF_BR_NUMHOOKS]; -#else - struct ebt_entries *hook_entry[NF_BR_NUMHOOKS]; -#endif - /* nr of counters userspace expects back */ - unsigned int num_counters; - /* where the kernel will put the old counters */ -#ifdef KERNEL_64_USERSPACE_32 - uint64_t counters; - uint64_t entries; -#else - struct ebt_counter *counters; - char *entries; -#endif -}; - -struct ebt_entries { - /* this field is always set to zero - * See EBT_ENTRY_OR_ENTRIES. - * Must be same size as ebt_entry.bitmask */ - unsigned int distinguisher; - /* the chain name */ - char name[EBT_CHAIN_MAXNAMELEN]; - /* counter offset for this chain */ - unsigned int counter_offset; - /* one standard (accept, drop, return) per hook */ - int policy; - /* nr. of entries */ - unsigned int nentries; - /* entry list */ - char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace)))); -}; - -/* used for the bitmask of struct ebt_entry */ - -/* This is a hack to make a difference between an ebt_entry struct and an - * ebt_entries struct when traversing the entries from start to end. - * Using this simplifies the code alot, while still being able to use - * ebt_entries. - * Contrary, iptables doesn't use something like ebt_entries and therefore uses - * different techniques for naming the policy and such. So, iptables doesn't - * need a hack like this. - */ -#define EBT_ENTRY_OR_ENTRIES 0x01 -/* these are the normal masks */ -#define EBT_NOPROTO 0x02 -#define EBT_802_3 0x04 -#define EBT_SOURCEMAC 0x08 -#define EBT_DESTMAC 0x10 -#define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \ - | EBT_ENTRY_OR_ENTRIES) - -#define EBT_IPROTO 0x01 -#define EBT_IIN 0x02 -#define EBT_IOUT 0x04 -#define EBT_ISOURCE 0x8 -#define EBT_IDEST 0x10 -#define EBT_ILOGICALIN 0x20 -#define EBT_ILOGICALOUT 0x40 -#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \ - | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST) - -struct ebt_entry_match -{ - union { - char name[EBT_FUNCTION_MAXNAMELEN]; - struct ebt_match *match; - } u; - /* size of data */ - unsigned int match_size; -#ifdef KERNEL_64_USERSPACE_32 - unsigned int pad; -#endif - unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace)))); -}; - -struct ebt_entry_watcher -{ - union { - char name[EBT_FUNCTION_MAXNAMELEN]; - struct ebt_watcher *watcher; - } u; - /* size of data */ - unsigned int watcher_size; -#ifdef KERNEL_64_USERSPACE_32 - unsigned int pad; -#endif - unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace)))); -}; - -struct ebt_entry_target -{ - union { - char name[EBT_FUNCTION_MAXNAMELEN]; - struct ebt_target *target; - } u; - /* size of data */ - unsigned int target_size; -#ifdef KERNEL_64_USERSPACE_32 - unsigned int pad; -#endif - unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace)))); -}; - -#define EBT_STANDARD_TARGET "standard" -struct ebt_standard_target -{ - struct ebt_entry_target target; - int verdict; -#ifdef KERNEL_64_USERSPACE_32 - unsigned int pad; -#endif -}; - -/* one entry */ -struct ebt_entry { - /* this needs to be the first field */ - unsigned int bitmask; - unsigned int invflags; - uint16_t ethproto; - /* the physical in-dev */ - char in[IFNAMSIZ]; - /* the logical in-dev */ - char logical_in[IFNAMSIZ]; - /* the physical out-dev */ - char out[IFNAMSIZ]; - /* the logical out-dev */ - char logical_out[IFNAMSIZ]; - unsigned char sourcemac[ETH_ALEN]; - unsigned char sourcemsk[ETH_ALEN]; - unsigned char destmac[ETH_ALEN]; - unsigned char destmsk[ETH_ALEN]; - /* sizeof ebt_entry + matches */ - unsigned int watchers_offset; - /* sizeof ebt_entry + matches + watchers */ - unsigned int target_offset; - /* sizeof ebt_entry + matches + watchers + target */ - unsigned int next_offset; - unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace)))); -}; - -/* {g,s}etsockopt numbers */ -#define EBT_BASE_CTL 128 - -#define EBT_SO_SET_ENTRIES (EBT_BASE_CTL) -#define EBT_SO_SET_COUNTERS (EBT_SO_SET_ENTRIES+1) -#define EBT_SO_SET_MAX (EBT_SO_SET_COUNTERS+1) - -#define EBT_SO_GET_INFO (EBT_BASE_CTL) -#define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO+1) -#define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES+1) -#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1) -#define EBT_SO_GET_MAX (EBT_SO_GET_INIT_ENTRIES+1) - -/* blatently stolen from ip_tables.h - * fn returns 0 to continue iteration */ -#define EBT_MATCH_ITERATE(e, fn, args...) \ -({ \ - unsigned int __i; \ - int __ret = 0; \ - struct ebt_entry_match *__match; \ - \ - for (__i = sizeof(struct ebt_entry); \ - __i < (e)->watchers_offset; \ - __i += __match->match_size + \ - sizeof(struct ebt_entry_match)) { \ - __match = (void *)(e) + __i; \ - \ - __ret = fn(__match , ## args); \ - if (__ret != 0) \ - break; \ - } \ - if (__ret == 0) { \ - if (__i != (e)->watchers_offset) \ - __ret = -EINVAL; \ - } \ - __ret; \ -}) - -#define EBT_WATCHER_ITERATE(e, fn, args...) \ -({ \ - unsigned int __i; \ - int __ret = 0; \ - struct ebt_entry_watcher *__watcher; \ - \ - for (__i = e->watchers_offset; \ - __i < (e)->target_offset; \ - __i += __watcher->watcher_size + \ - sizeof(struct ebt_entry_watcher)) { \ - __watcher = (void *)(e) + __i; \ - \ - __ret = fn(__watcher , ## args); \ - if (__ret != 0) \ - break; \ - } \ - if (__ret == 0) { \ - if (__i != (e)->target_offset) \ - __ret = -EINVAL; \ - } \ - __ret; \ -}) - -#define EBT_ENTRY_ITERATE(entries, size, fn, args...) \ -({ \ - unsigned int __i; \ - int __ret = 0; \ - struct ebt_entry *__entry; \ - \ - for (__i = 0; __i < (size);) { \ - __entry = (void *)(entries) + __i; \ - __ret = fn(__entry , ## args); \ - if (__ret != 0) \ - break; \ - if (__entry->bitmask != 0) \ - __i += __entry->next_offset; \ - else \ - __i += sizeof(struct ebt_entries); \ - } \ - if (__ret == 0) { \ - if (__i != (size)) \ - __ret = -EINVAL; \ - } \ - __ret; \ -}) - -#endif diff -Nru ebtables-2.0.10.4/include/ebtables_u.h ebtables-2.0.10.4+snapshot20181205/include/ebtables_u.h --- ebtables-2.0.10.4/include/ebtables_u.h 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/include/ebtables_u.h 2018-12-05 11:27:50.000000000 +0000 @@ -24,6 +24,7 @@ #ifndef EBTABLES_U_H #define EBTABLES_U_H #include +#include #include #include @@ -43,6 +44,8 @@ #define EBT_ALIGN(s) (((s) + (EBT_MIN_ALIGN-1)) & ~(EBT_MIN_ALIGN-1)) #define ERRORMSG_MAXLEN 128 +#define _INIT __attribute__((constructor)) _init + struct ebt_u_entries { int policy; @@ -144,6 +147,7 @@ struct ebt_u_match { char name[EBT_FUNCTION_MAXNAMELEN]; + uint8_t revision; /* size of the real match data */ unsigned int size; void (*help)(void); @@ -222,6 +226,15 @@ struct ebt_u_target *next; }; + +struct ebt_icmp_names { + const char *name; + uint8_t type; + uint8_t code_min, code_max; +}; + + + /* libebtc.c */ extern struct ebt_u_table *ebt_tables; @@ -300,10 +313,17 @@ int ebt_get_mac_and_mask(const char *from, unsigned char *to, unsigned char *mask); void ebt_parse_ip_address(char *address, uint32_t *addr, uint32_t *msk); char *ebt_mask_to_dotted(uint32_t mask); -void ebt_parse_ip6_address(char *address, struct in6_addr *addr, +void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct in6_addr *msk); char *ebt_ip6_to_numeric(const struct in6_addr *addrp); +char *ebt_ip6_mask_to_string(const struct in6_addr *msk); +int ebt_parse_icmp(const struct ebt_icmp_names *icmp_codes, size_t n_codes, + const char *icmptype, uint8_t type[], uint8_t code[]); +void ebt_print_icmp_type(const struct ebt_icmp_names *icmp_codes, + size_t n_codes, uint8_t *type, uint8_t *code); +void ebt_print_icmp_types(const struct ebt_icmp_names *icmp_codes, + size_t n_codes); int do_command(int argc, char *argv[], int exec_style, struct ebt_u_replace *replace_); @@ -320,6 +340,8 @@ #define ebt_print_error(format,args...) __ebt_print_error(format, ##args); #define ebt_print_error2(format, args...) do {__ebt_print_error(format, ##args); \ return -1;} while (0) +#define ebt_print_error3(format, args...) do {__ebt_print_error(format, ##args); \ + return;} while (0) #define ebt_check_option2(flags,mask) \ ({ebt_check_option(flags,mask); \ if (ebt_errormsg[0] != '\0') \ @@ -373,7 +395,7 @@ #define BASE_CHAIN (hookmask & (1 << NF_BR_NUMHOOKS)) /* Clear the bit in the hook_mask that tells if the rule is on a base chain */ #define CLEAR_BASE_CHAIN_BIT (hookmask &= ~(1 << NF_BR_NUMHOOKS)) -#define PRINT_VERSION printf(PROGNAME" v"PROGVERSION" ("PROGDATE")\n") +#define PRINT_VERSION printf(PROGNAME" v"PROGVERSION" (legacy) ("PROGDATE")\n") #ifndef PROC_SYS_MODPROBE #define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" #endif diff -Nru ebtables-2.0.10.4/include/ethernetdb.h ebtables-2.0.10.4+snapshot20181205/include/ethernetdb.h --- ebtables-2.0.10.4/include/ethernetdb.h 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/include/ethernetdb.h 2018-12-05 11:27:50.000000000 +0000 @@ -38,21 +38,20 @@ /* Open ethertype data base files and mark them as staying open even after a later search if STAY_OPEN is non-zero. */ -extern void setethertypeent(int __stay_open) __THROW; +extern void setethertypeent(int __stay_open); /* Close ethertype data base files and clear `stay open' flag. */ -extern void endethertypeent(void) __THROW; +extern void endethertypeent(void); /* Get next entry from ethertype data base file. Open data base if necessary. */ -extern struct ethertypeent *getethertypeent(void) __THROW; +extern struct ethertypeent *getethertypeent(void); /* Return entry from ethertype data base for network with NAME. */ -extern struct ethertypeent *getethertypebyname(__const char *__name) - __THROW; +extern struct ethertypeent *getethertypebyname(__const char *__name); /* Return entry from ethertype data base which number is PROTO. */ -extern struct ethertypeent *getethertypebynumber(int __ethertype) __THROW; +extern struct ethertypeent *getethertypebynumber(int __ethertype); #endif /* ethernetdb.h */ diff -Nru ebtables-2.0.10.4/include/linux/if_ether.h ebtables-2.0.10.4+snapshot20181205/include/linux/if_ether.h --- ebtables-2.0.10.4/include/linux/if_ether.h 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/include/linux/if_ether.h 1970-01-01 00:00:00.000000000 +0000 @@ -1,126 +0,0 @@ -/* - * INET An implementation of the TCP/IP protocol suite for the LINUX - * operating system. INET is implemented using the BSD Socket - * interface as the means of communication with the user level. - * - * Global definitions for the Ethernet IEEE 802.3 interface. - * - * Version: @(#)if_ether.h 1.0.1a 02/08/94 - * - * Author: Fred N. van Kempen, - * Donald Becker, - * Alan Cox, - * Steve Whitehouse, - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License - * as published by the Free Software Foundation; either version - * 2 of the License, or (at your option) any later version. - */ - -#ifndef _LINUX_IF_ETHER_H -#define _LINUX_IF_ETHER_H - -#include - -/* - * IEEE 802.3 Ethernet magic constants. The frame sizes omit the preamble - * and FCS/CRC (frame check sequence). - */ - -#define ETH_ALEN 6 /* Octets in one ethernet addr */ -#define ETH_HLEN 14 /* Total octets in header. */ -#define ETH_ZLEN 60 /* Min. octets in frame sans FCS */ -#define ETH_DATA_LEN 1500 /* Max. octets in payload */ -#define ETH_FRAME_LEN 1514 /* Max. octets in frame sans FCS */ -#define ETH_FCS_LEN 4 /* Octets in the FCS */ - -/* - * These are the defined Ethernet Protocol ID's. - */ - -#define ETH_P_LOOP 0x0060 /* Ethernet Loopback packet */ -#define ETH_P_PUP 0x0200 /* Xerox PUP packet */ -#define ETH_P_PUPAT 0x0201 /* Xerox PUP Addr Trans packet */ -#define ETH_P_IP 0x0800 /* Internet Protocol packet */ -#define ETH_P_X25 0x0805 /* CCITT X.25 */ -#define ETH_P_ARP 0x0806 /* Address Resolution packet */ -#define ETH_P_BPQ 0x08FF /* G8BPQ AX.25 Ethernet Packet [ NOT AN OFFICIALLY REGISTERED ID ] */ -#define ETH_P_IEEEPUP 0x0a00 /* Xerox IEEE802.3 PUP packet */ -#define ETH_P_IEEEPUPAT 0x0a01 /* Xerox IEEE802.3 PUP Addr Trans packet */ -#define ETH_P_DEC 0x6000 /* DEC Assigned proto */ -#define ETH_P_DNA_DL 0x6001 /* DEC DNA Dump/Load */ -#define ETH_P_DNA_RC 0x6002 /* DEC DNA Remote Console */ -#define ETH_P_DNA_RT 0x6003 /* DEC DNA Routing */ -#define ETH_P_LAT 0x6004 /* DEC LAT */ -#define ETH_P_DIAG 0x6005 /* DEC Diagnostics */ -#define ETH_P_CUST 0x6006 /* DEC Customer use */ -#define ETH_P_SCA 0x6007 /* DEC Systems Comms Arch */ -#define ETH_P_TEB 0x6558 /* Trans Ether Bridging */ -#define ETH_P_RARP 0x8035 /* Reverse Addr Res packet */ -#define ETH_P_ATALK 0x809B /* Appletalk DDP */ -#define ETH_P_AARP 0x80F3 /* Appletalk AARP */ -#define ETH_P_8021Q 0x8100 /* 802.1Q VLAN Extended Header */ -#define ETH_P_IPX 0x8137 /* IPX over DIX */ -#define ETH_P_IPV6 0x86DD /* IPv6 over bluebook */ -#define ETH_P_PAUSE 0x8808 /* IEEE Pause frames. See 802.3 31B */ -#define ETH_P_SLOW 0x8809 /* Slow Protocol. See 802.3ad 43B */ -#define ETH_P_WCCP 0x883E /* Web-cache coordination protocol - * defined in draft-wilson-wrec-wccp-v2-00.txt */ -#define ETH_P_PPP_DISC 0x8863 /* PPPoE discovery messages */ -#define ETH_P_PPP_SES 0x8864 /* PPPoE session messages */ -#define ETH_P_MPLS_UC 0x8847 /* MPLS Unicast traffic */ -#define ETH_P_MPLS_MC 0x8848 /* MPLS Multicast traffic */ -#define ETH_P_ATMMPOA 0x884c /* MultiProtocol Over ATM */ -#define ETH_P_LINK_CTL 0x886c /* HPNA, wlan link local tunnel */ -#define ETH_P_ATMFATE 0x8884 /* Frame-based ATM Transport - * over Ethernet - */ -#define ETH_P_PAE 0x888E /* Port Access Entity (IEEE 802.1X) */ -#define ETH_P_AOE 0x88A2 /* ATA over Ethernet */ -#define ETH_P_TIPC 0x88CA /* TIPC */ -#define ETH_P_1588 0x88F7 /* IEEE 1588 Timesync */ -#define ETH_P_FCOE 0x8906 /* Fibre Channel over Ethernet */ -#define ETH_P_FIP 0x8914 /* FCoE Initialization Protocol */ -#define ETH_P_EDSA 0xDADA /* Ethertype DSA [ NOT AN OFFICIALLY REGISTERED ID ] */ - -/* - * Non DIX types. Won't clash for 1500 types. - */ - -#define ETH_P_802_3 0x0001 /* Dummy type for 802.3 frames */ -#define ETH_P_AX25 0x0002 /* Dummy protocol id for AX.25 */ -#define ETH_P_ALL 0x0003 /* Every packet (be careful!!!) */ -#define ETH_P_802_2 0x0004 /* 802.2 frames */ -#define ETH_P_SNAP 0x0005 /* Internal only */ -#define ETH_P_DDCMP 0x0006 /* DEC DDCMP: Internal only */ -#define ETH_P_WAN_PPP 0x0007 /* Dummy type for WAN PPP frames*/ -#define ETH_P_PPP_MP 0x0008 /* Dummy type for PPP MP frames */ -#define ETH_P_LOCALTALK 0x0009 /* Localtalk pseudo type */ -#define ETH_P_CAN 0x000C /* Controller Area Network */ -#define ETH_P_PPPTALK 0x0010 /* Dummy type for Atalk over PPP*/ -#define ETH_P_TR_802_2 0x0011 /* 802.2 frames */ -#define ETH_P_MOBITEX 0x0015 /* Mobitex (kaz@cafe.net) */ -#define ETH_P_CONTROL 0x0016 /* Card specific control frames */ -#define ETH_P_IRDA 0x0017 /* Linux-IrDA */ -#define ETH_P_ECONET 0x0018 /* Acorn Econet */ -#define ETH_P_HDLC 0x0019 /* HDLC frames */ -#define ETH_P_ARCNET 0x001A /* 1A for ArcNet :-) */ -#define ETH_P_DSA 0x001B /* Distributed Switch Arch. */ -#define ETH_P_TRAILER 0x001C /* Trailer switch tagging */ -#define ETH_P_PHONET 0x00F5 /* Nokia Phonet frames */ -#define ETH_P_IEEE802154 0x00F6 /* IEEE802.15.4 frame */ -#define ETH_P_CAIF 0x00F7 /* ST-Ericsson CAIF protocol */ - -/* - * This is an Ethernet frame header. - */ - -struct ethhdr { - unsigned char h_dest[ETH_ALEN]; /* destination eth addr */ - unsigned char h_source[ETH_ALEN]; /* source ether addr */ - __be16 h_proto; /* packet type ID field */ -} __attribute__((packed)); - - -#endif /* _LINUX_IF_ETHER_H */ diff -Nru ebtables-2.0.10.4/include/linux/netfilter_bridge/ebt_802_3.h ebtables-2.0.10.4+snapshot20181205/include/linux/netfilter_bridge/ebt_802_3.h --- ebtables-2.0.10.4/include/linux/netfilter_bridge/ebt_802_3.h 2011-12-15 20:02:48.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/include/linux/netfilter_bridge/ebt_802_3.h 2018-12-05 11:27:50.000000000 +0000 @@ -2,6 +2,7 @@ #define __LINUX_BRIDGE_EBT_802_3_H #include +#include #define EBT_802_3_SAP 0x01 #define EBT_802_3_TYPE 0x02 @@ -42,8 +43,8 @@ }; struct ebt_802_3_hdr { - __u8 daddr[6]; - __u8 saddr[6]; + __u8 daddr[ETH_ALEN]; + __u8 saddr[ETH_ALEN]; __be16 len; union { struct hdr_ui ui; @@ -59,4 +60,4 @@ __u8 invflags; }; -#endif +#endif /* __LINUX_BRIDGE_EBT_802_3_H */ diff -Nru ebtables-2.0.10.4/include/linux/netfilter_bridge/ebtables.h ebtables-2.0.10.4+snapshot20181205/include/linux/netfilter_bridge/ebtables.h --- ebtables-2.0.10.4/include/linux/netfilter_bridge/ebtables.h 2011-12-15 20:02:48.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/include/linux/netfilter_bridge/ebtables.h 2018-12-05 11:27:50.000000000 +0000 @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ /* * ebtables * @@ -6,20 +7,20 @@ * * ebtables.c,v 2.0, April, 2002 * - * This code is stongly inspired on the iptables code which is + * This code is strongly inspired by the iptables code which is * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling */ -/* Local copy of the kernel file, needed for Sparc64 support */ #ifndef __LINUX_BRIDGE_EFF_H #define __LINUX_BRIDGE_EFF_H +#include #include #include -#include #define EBT_TABLE_MAXNAMELEN 32 #define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN #define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN +#define EBT_EXTENSION_MAXNAMELEN 31 /* verdicts >0 are "branches" */ #define EBT_ACCEPT -1 @@ -32,14 +33,31 @@ * The 4 lsb are more than enough to store the verdict. */ #define EBT_VERDICT_BITS 0x0000000F -struct ebt_counter -{ - uint64_t pcnt; - uint64_t bcnt; +struct xt_match; +struct xt_target; + +struct ebt_counter { + __u64 pcnt; + __u64 bcnt; }; -struct ebt_replace -{ +struct ebt_replace { + char name[EBT_TABLE_MAXNAMELEN]; + unsigned int valid_hooks; + /* nr of rules in the table */ + unsigned int nentries; + /* total size of the entries */ + unsigned int entries_size; + /* start of the chains */ + struct ebt_entries *hook_entry[NF_BR_NUMHOOKS]; + /* nr of counters userspace expects back */ + unsigned int num_counters; + /* where the kernel will put the old counters */ + struct ebt_counter *counters; + char *entries; +}; + +struct ebt_replace_kernel { char name[EBT_TABLE_MAXNAMELEN]; unsigned int valid_hooks; /* nr of rules in the table */ @@ -47,21 +65,12 @@ /* total size of the entries */ unsigned int entries_size; /* start of the chains */ -#ifdef KERNEL_64_USERSPACE_32 - uint64_t hook_entry[NF_BR_NUMHOOKS]; -#else struct ebt_entries *hook_entry[NF_BR_NUMHOOKS]; -#endif /* nr of counters userspace expects back */ unsigned int num_counters; /* where the kernel will put the old counters */ -#ifdef KERNEL_64_USERSPACE_32 - uint64_t counters; - uint64_t entries; -#else struct ebt_counter *counters; char *entries; -#endif }; struct ebt_entries { @@ -85,7 +94,7 @@ /* This is a hack to make a difference between an ebt_entry struct and an * ebt_entries struct when traversing the entries from start to end. - * Using this simplifies the code alot, while still being able to use + * Using this simplifies the code a lot, while still being able to use * ebt_entries. * Contrary, iptables doesn't use something like ebt_entries and therefore uses * different techniques for naming the policy and such. So, iptables doesn't @@ -110,56 +119,49 @@ #define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \ | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST) -struct ebt_entry_match -{ +struct ebt_entry_match { union { - char name[EBT_FUNCTION_MAXNAMELEN]; - struct ebt_match *match; + struct { + char name[EBT_EXTENSION_MAXNAMELEN]; + uint8_t revision; + }; + struct xt_match *match; } u; /* size of data */ unsigned int match_size; -#ifdef KERNEL_64_USERSPACE_32 - unsigned int pad; -#endif unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace)))); }; -struct ebt_entry_watcher -{ +struct ebt_entry_watcher { union { - char name[EBT_FUNCTION_MAXNAMELEN]; - struct ebt_watcher *watcher; + struct { + char name[EBT_EXTENSION_MAXNAMELEN]; + uint8_t revision; + }; + struct xt_target *watcher; } u; /* size of data */ unsigned int watcher_size; -#ifdef KERNEL_64_USERSPACE_32 - unsigned int pad; -#endif unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace)))); }; -struct ebt_entry_target -{ +struct ebt_entry_target { union { - char name[EBT_FUNCTION_MAXNAMELEN]; - struct ebt_target *target; + struct { + char name[EBT_EXTENSION_MAXNAMELEN]; + uint8_t revision; + }; + struct xt_target *target; } u; /* size of data */ unsigned int target_size; -#ifdef KERNEL_64_USERSPACE_32 - unsigned int pad; -#endif unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace)))); }; #define EBT_STANDARD_TARGET "standard" -struct ebt_standard_target -{ +struct ebt_standard_target { struct ebt_entry_target target; int verdict; -#ifdef KERNEL_64_USERSPACE_32 - unsigned int pad; -#endif }; /* one entry */ @@ -167,7 +169,7 @@ /* this needs to be the first field */ unsigned int bitmask; unsigned int invflags; - uint16_t ethproto; + __be16 ethproto; /* the physical in-dev */ char in[IFNAMSIZ]; /* the logical in-dev */ @@ -202,6 +204,7 @@ #define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1) #define EBT_SO_GET_MAX (EBT_SO_GET_INIT_ENTRIES+1) + /* blatently stolen from ip_tables.h * fn returns 0 to continue iteration */ #define EBT_MATCH_ITERATE(e, fn, args...) \ @@ -273,4 +276,4 @@ __ret; \ }) -#endif +#endif /* __LINUX_BRIDGE_EFF_H */ diff -Nru ebtables-2.0.10.4/include/linux/netfilter_bridge/ebt_ip.h ebtables-2.0.10.4+snapshot20181205/include/linux/netfilter_bridge/ebt_ip.h --- ebtables-2.0.10.4/include/linux/netfilter_bridge/ebt_ip.h 2011-12-15 20:02:48.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/include/linux/netfilter_bridge/ebt_ip.h 2018-12-05 11:27:50.000000000 +0000 @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ /* * ebt_ip * @@ -23,8 +24,10 @@ #define EBT_IP_PROTO 0x08 #define EBT_IP_SPORT 0x10 #define EBT_IP_DPORT 0x20 +#define EBT_IP_ICMP 0x40 +#define EBT_IP_IGMP 0x80 #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\ - EBT_IP_SPORT | EBT_IP_DPORT ) + EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP | EBT_IP_IGMP) #define EBT_IP_MATCH "ip" /* the same values are used for the invflags */ @@ -37,8 +40,15 @@ __u8 protocol; __u8 bitmask; __u8 invflags; - __u16 sport[2]; - __u16 dport[2]; + union { + __u16 sport[2]; + __u8 icmp_type[2]; + __u8 igmp_type[2]; + }; + union { + __u16 dport[2]; + __u8 icmp_code[2]; + }; }; #endif diff -Nru ebtables-2.0.10.4/include/linux/netfilter_bridge.h ebtables-2.0.10.4+snapshot20181205/include/linux/netfilter_bridge.h --- ebtables-2.0.10.4/include/linux/netfilter_bridge.h 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/include/linux/netfilter_bridge.h 2018-12-05 11:27:50.000000000 +0000 @@ -24,4 +24,4 @@ #define NF_BR_BROUTING 5 #define NF_BR_NUMHOOKS 6 -#endif +#endif /* __LINUX_BRIDGE_NETFILTER_H */ diff -Nru ebtables-2.0.10.4/include/linux/types.h ebtables-2.0.10.4+snapshot20181205/include/linux/types.h --- ebtables-2.0.10.4/include/linux/types.h 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/include/linux/types.h 2018-12-05 11:27:50.000000000 +0000 @@ -38,7 +38,7 @@ * aligned_u64 should be used in defining kernel<->userspace ABIs to avoid * common 32/64-bit compat problems. * 64-bit values align to 4-byte boundaries on x86_32 (and possibly other - * architectures) and to 8-byte boundaries on 64-bit architetures. The new + * architectures) and to 8-byte boundaries on 64-bit architectures. The new * aligned_64 type enforces 8-byte alignment so that structs containing * aligned_64 values have the same alignment on 32-bit and 64-bit architectures. * No conversions are necessary between 32-bit user-space and a 64-bit kernel. diff -Nru ebtables-2.0.10.4/INSTALL ebtables-2.0.10.4+snapshot20181205/INSTALL --- ebtables-2.0.10.4/INSTALL 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/INSTALL 2018-12-05 11:27:50.000000000 +0000 @@ -1,61 +1,36 @@ -FOLLOW THESE SIMPLE GUIDELINES: -------------------------------- +Installation instructions for iptables +====================================== -Compiling the source code: -%make -Put the files in the right directories: -%make install - -If you are using the CVS code or need your own kernel includes, do this -instead (change the include directory to the appropriate one): -%make install KERNEL_INCLUDES=/usr/src/linux/include - -If you want to make a static binary for ebtables, containing all the -extensions, without shared libraries, do this (this will make a -binary called 'static', which you can rename): -%make static - -WHAT GETS INSTALLED AND WHAT OPTIONS ARE AVAILABLE? ---------------------------------------------------- - -- The ebtables manual gets installed in /usr/local/man/man8 - To put the manual somewhere else, include MANDIR=<> as - option on the command line. - The Makefile will append /man8/ebtables.8. -- ethertypes is by default placed in /etc/, if you - want to change this, include ETHERTYPESPATH=<>. -- The userspace programs ebtables ebtables-save and ebtables-restore are - are copied by default to /usr/local/sbin/ebtables. If you want to put - the executables somewhere else, include BINPATH=<>. -- The ebtables initialisation file (enabling use of 'service ebtables') is - copied to /etc/rc.d/init.d (change with option INITDIR) -- The ebtables configuration file (ebtables-config) is copied to /etc/sysconfig -- ebtables can use a lock file to enable concurrent execution of the ebtables - tool. The standard location of the lock file is /var/lib/ebtables/lock. - Include LOCKFILE=<> if you want to use another file. - -That's all - -You can also use a base directory different from the root directory (/), -using the DESTDIR option. See the Makefile for more details. - - -ADDITIONAL PROGRAMS: ----------------------- --- examples/ulog/test_ulog.c -- - -Contains an example to receive and parse netlink messages containing -packets seen by the ebtables ulog watcher. - -Compile with: -%make test_ulog KERNEL_INCLUDES=/usr/src/linux/include - -Usage: -%examples/ulog/test_ulog NETLINK_GROUP -%ebtables -A chain --ulog-nlgroup NETLINK_GROUP - --- examples/perf_test/perf_test -- - -A test script to compare the performance for the different ways to -construct an ebtables table. This is deprecated and should probably -be ignored. +ebtables uses the well-known configure(autotools) infrastructure. + + $ ./configure + $ make + # make install + + +Prerequisites +============= + + * no kernel-source required + + * but obviously a compiler, glibc-devel and linux-kernel-headers + (/usr/include/linux) + + +Configuring and compiling +========================= + +./configure [options] + +--prefix= + + The prefix to put all installed files under. It defaults to + /usr/local, so the binaries will go into /usr/local/bin, sbin, + manpages into /usr/local/share/man, etc. + +If you want to enable debugging, use + + ./configure CFLAGS="-ggdb3 -O0" CPPFLAGS="-DEBT_DEBUG" + +(-O0 is used to turn off instruction reordering, which makes debugging +much easier.) diff -Nru ebtables-2.0.10.4/libebtc.c ebtables-2.0.10.4+snapshot20181205/libebtc.c --- ebtables-2.0.10.4/libebtc.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/libebtc.c 2018-12-05 11:27:50.000000000 +0000 @@ -31,6 +31,7 @@ #include "include/ethernetdb.h" #include #include +#include #include #include #include @@ -137,58 +138,24 @@ #define LOCKDIR "/var/lib/ebtables" #define LOCKFILE LOCKDIR"/lock" #endif -static int lockfd = -1, locked; int use_lockfd; /* Returns 0 on success, -1 when the file is locked by another process * or -2 on any other error. */ static int lock_file() { - int try = 0; - int ret = 0; - sigset_t sigset; - -tryagain: - /* the SIGINT handler will call unlock_file. To make sure the state - * of the variable locked is correct, we need to temporarily mask the - * SIGINT interrupt. */ - sigemptyset(&sigset); - sigaddset(&sigset, SIGINT); - sigprocmask(SIG_BLOCK, &sigset, NULL); - lockfd = open(LOCKFILE, O_CREAT | O_EXCL | O_WRONLY, 00600); - if (lockfd < 0) { - if (errno == EEXIST) - ret = -1; - else if (try == 1) - ret = -2; - else { - if (mkdir(LOCKDIR, 00700)) - ret = -2; - else { - try = 1; - goto tryagain; - } - } - } else { - close(lockfd); - locked = 1; - } - sigprocmask(SIG_UNBLOCK, &sigset, NULL); - return ret; -} + int fd, try = 0; -void unlock_file() -{ - if (locked) { - remove(LOCKFILE); - locked = 0; +retry: + fd = open(LOCKFILE, O_CREAT, 00600); + if (fd < 0) { + if (try == 1 || mkdir(LOCKDIR, 00700)) + return -2; + try = 1; + goto retry; } + return flock(fd, LOCK_EX); } -void __attribute__ ((destructor)) onexit() -{ - if (use_lockfd) - unlock_file(); -} /* Get the table from the kernel or from a binary file * init: 1 = ask the kernel for the initial contents of a table, i.e. the * way it looks when the table is insmod'ed @@ -305,6 +272,7 @@ if (!m->m) ebt_print_memory(); strcpy(m->m->u.name, m->name); + m->m->u.revision = m->revision; m->m->match_size = EBT_ALIGN(m->size); m->used = 0; } @@ -583,8 +551,10 @@ while (m_l) { m = (struct ebt_u_match *)(m_l->m); m_l2 = u_e->m_list; - while (m_l2 && strcmp(m_l2->m->u.name, m->m->u.name)) + while (m_l2 && (strcmp(m_l2->m->u.name, m->m->u.name) || + m_l2->m->u.revision != m->m->u.revision)) { m_l2 = m_l2->next; + } if (!m_l2 || !m->compare(m->m, m_l2->m)) goto letscontinue; j++; @@ -1102,7 +1072,7 @@ /* check if we've dealt with this chain already */ if (entries2->hook_mask & (1<hook_mask |= entries->hook_mask; + entries2->hook_mask |= entries->hook_mask & ~(1 << NF_BR_NUMHOOKS); /* Jump to the chain, make sure we know how to get back */ stack[sp].chain_nr = chain_nr; stack[sp].n = j; @@ -1242,6 +1212,7 @@ if (!m->m) ebt_print_memory(); strcpy(m->m->u.name, m->name); + m->m->u.revision = m->revision; m->m->match_size = EBT_ALIGN(m->size); m->init(m->m); diff -Nru ebtables-2.0.10.4/m4/.gitignore ebtables-2.0.10.4+snapshot20181205/m4/.gitignore --- ebtables-2.0.10.4/m4/.gitignore 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/m4/.gitignore 2018-12-05 11:27:50.000000000 +0000 @@ -0,0 +1,2 @@ +/libtool.m4 +/lt*.m4 diff -Nru ebtables-2.0.10.4/Makefile ebtables-2.0.10.4+snapshot20181205/Makefile --- ebtables-2.0.10.4/Makefile 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/Makefile 1970-01-01 00:00:00.000000000 +0000 @@ -1,246 +0,0 @@ -# ebtables Makefile - -PROGNAME:=ebtables -PROGRELEASE:=4 -PROGVERSION_:=2.0.10 -PROGVERSION:=$(PROGVERSION_)-$(PROGRELEASE) -PROGDATE:=December\ 2011 -LOCKFILE?=/var/lib/ebtables/lock -LOCKDIR:=$(shell echo $(LOCKFILE) | sed 's/\(.*\)\/.*/\1/')/ - -# default paths -LIBDIR:=/usr/lib -MANDIR:=/usr/local/man -BINDIR:=/usr/local/sbin -ETCDIR:=/etc -INITDIR:=/etc/rc.d/init.d -SYSCONFIGDIR:=/etc/sysconfig -DESTDIR:= - -CFLAGS:=-Wall -Wunused -Werror -CFLAGS_SH_LIB:=-fPIC -O3 -CC:=gcc - -ifeq ($(shell uname -m),sparc64) -CFLAGS+=-DEBT_MIN_ALIGN=8 -DKERNEL_64_USERSPACE_32 -endif - -include extensions/Makefile - -OBJECTS2:=getethertype.o communication.o libebtc.o \ -useful_functions.o ebtables.o - -OBJECTS:=$(OBJECTS2) $(EXT_OBJS) $(EXT_LIBS) - -KERNEL_INCLUDES?=include/ - -ETHERTYPESPATH?=$(ETCDIR) -ETHERTYPESFILE:=$(ETHERTYPESPATH)/ethertypes - -PIPE_DIR?=/tmp/$(PROGNAME)-v$(PROGVERSION) -PIPE=$(PIPE_DIR)/ebtablesd_pipe -EBTD_CMDLINE_MAXLN?=2048 -EBTD_ARGC_MAX?=50 - -PROGSPECS:=-DPROGVERSION=\"$(PROGVERSION)\" \ - -DPROGNAME=\"$(PROGNAME)\" \ - -DPROGDATE=\"$(PROGDATE)\" \ - -D_PATH_ETHERTYPES=\"$(ETHERTYPESFILE)\" \ - -DEBTD_ARGC_MAX=$(EBTD_ARGC_MAX) \ - -DEBTD_CMDLINE_MAXLN=$(EBTD_CMDLINE_MAXLN) \ - -DLOCKFILE=\"$(LOCKFILE)\" \ - -DLOCKDIR=\"$(LOCKDIR)\" - -# You can probably ignore this, ebtables{u,d} are normally not used -PROGSPECSD:=-DPROGVERSION=\"$(PROGVERSION)\" \ - -DPROGNAME=\"$(PROGNAME)\" \ - -DPROGDATE=\"$(PROGDATE)\" \ - -D_PATH_ETHERTYPES=\"$(ETHERTYPESFILE)\" \ - -DEBTD_CMDLINE_MAXLN=$(EBTD_CMDLINE_MAXLN) \ - -DEBTD_ARGC_MAX=$(EBTD_ARGC_MAX) \ - -DEBTD_PIPE=\"$(PIPE)\" \ - -DEBTD_PIPE_DIR=\"$(PIPE_DIR)\" - -# Uncomment for debugging (slower) -#PROGSPECS+=-DEBT_DEBUG -#PROGSPECSD+=-DEBT_DEBUG -#CFLAGS+=-ggdb - -all: ebtables ebtables-restore - -communication.o: communication.c include/ebtables_u.h - $(CC) $(CFLAGS) $(CFLAGS_SH_LIB) $(PROGSPECS) -c -o $@ $< -I$(KERNEL_INCLUDES) - -libebtc.o: libebtc.c include/ebtables_u.h - $(CC) $(CFLAGS) $(CFLAGS_SH_LIB) $(PROGSPECS) -c -o $@ $< -I$(KERNEL_INCLUDES) - -useful_functions.o: useful_functions.c include/ebtables_u.h - $(CC) $(CFLAGS) $(CFLAGS_SH_LIB) $(PROGSPECS) -c -o $@ $< -I$(KERNEL_INCLUDES) - -getethertype.o: getethertype.c include/ethernetdb.h - $(CC) $(CFLAGS) $(CFLAGS_SH_LIB) $(PROGSPECS) -c -o $@ $< -Iinclude/ - -ebtables.o: ebtables.c include/ebtables_u.h - $(CC) $(CFLAGS) $(CFLAGS_SH_LIB) $(PROGSPECS) -c -o $@ $< -I$(KERNEL_INCLUDES) - -ebtables-standalone.o: ebtables-standalone.c include/ebtables_u.h - $(CC) $(CFLAGS) $(CFLAGS_SH_LIB) $(PROGSPECS) -c $< -o $@ -I$(KERNEL_INCLUDES) - -libebtc.so: $(OBJECTS2) - $(CC) -shared $(LDFLAGS) -Wl,-soname,libebtc.so -o libebtc.so -lc $(OBJECTS2) - -ebtables: $(OBJECTS) ebtables-standalone.o libebtc.so - $(CC) $(CFLAGS) $(CFLAGS_SH_LIB) $(LDFLAGS) -o $@ ebtables-standalone.o -I$(KERNEL_INCLUDES) -L. -Lextensions -lebtc $(EXT_LIBSI) \ - -Wl,-rpath,$(LIBDIR) - -ebtablesu: ebtablesu.c - $(CC) $(CFLAGS) $(PROGSPECSD) $< -o $@ - -ebtablesd.o: ebtablesd.c include/ebtables_u.h - $(CC) $(CFLAGS) $(PROGSPECSD) -c $< -o $@ -I$(KERNEL_INCLUDES) - -ebtablesd: $(OBJECTS) ebtablesd.o libebtc.so - $(CC) $(CFLAGS) -o $@ ebtablesd.o -I$(KERNEL_INCLUDES) -L. -Lextensions -lebtc $(EXT_LIBSI) \ - -Wl,-rpath,$(LIBDIR) - -ebtables-restore.o: ebtables-restore.c include/ebtables_u.h - $(CC) $(CFLAGS) $(PROGSPECS) -c $< -o $@ -I$(KERNEL_INCLUDES) - -ebtables-restore: $(OBJECTS) ebtables-restore.o libebtc.so - $(CC) $(CFLAGS) $(LDFLAGS) -o $@ ebtables-restore.o -I$(KERNEL_INCLUDES) -L. -Lextensions -lebtc $(EXT_LIBSI) \ - -Wl,-rpath,$(LIBDIR) - -.PHONY: daemon -daemon: ebtablesd ebtablesu - -# a little scripting for a static binary, making one for ebtables-restore -# should be completely analogous -static: extensions/ebt_*.c extensions/ebtable_*.c ebtables.c communication.c ebtables-standalone.c getethertype.c libebtc.c useful_functions.c - cp ebtables-standalone.c ebtables-standalone.c_ ; \ - cp include/ebtables_u.h include/ebtables_u.h_ ; \ - sed "s/ main(/ pseudomain(/" ebtables-standalone.c > ebtables-standalone.c__ ; \ - mv ebtables-standalone.c__ ebtables-standalone.c ; \ - printf "\nint main(int argc, char *argv[])\n{\n " >> ebtables-standalone.c ; \ - for arg in $(EXT_FUNC) \ - ; do \ - sed s/_init/_$${arg}_init/ extensions/ebt_$${arg}.c > extensions/ebt_$${arg}.c_ ; \ - mv extensions/ebt_$${arg}.c_ extensions/ebt_$${arg}.c ; \ - printf "\t%s();\n" _$${arg}_init >> ebtables-standalone.c ; \ - printf "extern void %s();\n" _$${arg}_init >> include/ebtables_u.h ; \ - done ; \ - for arg in $(EXT_TABLES) \ - ; do \ - sed s/_init/_t_$${arg}_init/ extensions/ebtable_$${arg}.c > extensions/ebtable_$${arg}.c_ ; \ - mv extensions/ebtable_$${arg}.c_ extensions/ebtable_$${arg}.c ; \ - printf "\t%s();\n" _t_$${arg}_init >> ebtables-standalone.c ; \ - printf "extern void %s();\n" _t_$${arg}_init >> include/ebtables_u.h ; \ - done ; \ - printf "\n\tpseudomain(argc, argv);\n\treturn 0;\n}\n" >> ebtables-standalone.c ;\ - $(CC) $(CFLAGS) $(LDFLAGS) $(PROGSPECS) -o $@ $^ -I$(KERNEL_INCLUDES) -Iinclude ; \ - for arg in $(EXT_FUNC) \ - ; do \ - sed "s/ .*_init/ _init/" extensions/ebt_$${arg}.c > extensions/ebt_$${arg}.c_ ; \ - mv extensions/ebt_$${arg}.c_ extensions/ebt_$${arg}.c ; \ - done ; \ - for arg in $(EXT_TABLES) \ - ; do \ - sed "s/ .*_init/ _init/" extensions/ebtable_$${arg}.c > extensions/ebtable_$${arg}.c_ ; \ - mv extensions/ebtable_$${arg}.c_ extensions/ebtable_$${arg}.c ; \ - done ; \ - mv ebtables-standalone.c_ ebtables-standalone.c ; \ - mv include/ebtables_u.h_ include/ebtables_u.h - -tmp1:=$(shell printf $(BINDIR) | sed 's/\//\\\//g') -tmp2:=$(shell printf $(SYSCONFIGDIR) | sed 's/\//\\\//g') -tmp3:=$(shell printf $(PIPE) | sed 's/\//\\\//g') -.PHONY: scripts -scripts: ebtables-save ebtables.sysv ebtables-config - cat ebtables-save | sed 's/__EXEC_PATH__/$(tmp1)/g' > ebtables-save_ - mkdir -p $(DESTDIR)$(BINDIR) - install -m 0755 -o root -g root ebtables-save_ $(DESTDIR)$(BINDIR)/ebtables-save - cat ebtables.sysv | sed 's/__EXEC_PATH__/$(tmp1)/g' | sed 's/__SYSCONFIG__/$(tmp2)/g' > ebtables.sysv_ - if [ "$(DESTDIR)" != "" ]; then mkdir -p $(DESTDIR)$(INITDIR); fi - if test -d $(DESTDIR)$(INITDIR); then install -m 0755 -o root -g root ebtables.sysv_ $(DESTDIR)$(INITDIR)/ebtables; fi - cat ebtables-config | sed 's/__SYSCONFIG__/$(tmp2)/g' > ebtables-config_ - if [ "$(DESTDIR)" != "" ]; then mkdir -p $(DESTDIR)$(SYSCONFIGDIR); fi - if test -d $(DESTDIR)$(SYSCONFIGDIR); then install -m 0600 -o root -g root ebtables-config_ $(DESTDIR)$(SYSCONFIGDIR)/ebtables-config; fi - rm -f ebtables-save_ ebtables.sysv_ ebtables-config_ - -tmp4:=$(shell printf $(LOCKFILE) | sed 's/\//\\\//g') -$(MANDIR)/man8/ebtables.8: ebtables.8 - mkdir -p $(DESTDIR)$(@D) - sed -e 's/$$(VERSION)/$(PROGVERSION)/' -e 's/$$(DATE)/$(PROGDATE)/' -e 's/$$(LOCKFILE)/$(tmp4)/' ebtables.8 > ebtables.8_ - install -m 0644 -o root -g root ebtables.8_ $(DESTDIR)$@ - rm -f ebtables.8_ - -$(DESTDIR)$(ETHERTYPESFILE): ethertypes - mkdir -p $(@D) - install -m 0644 -o root -g root $< $@ - -.PHONY: exec -exec: ebtables ebtables-restore - mkdir -p $(DESTDIR)$(BINDIR) - install -m 0755 -o root -g root $(PROGNAME) $(DESTDIR)$(BINDIR)/$(PROGNAME) - install -m 0755 -o root -g root ebtables-restore $(DESTDIR)$(BINDIR)/ebtables-restore - -.PHONY: install -install: $(MANDIR)/man8/ebtables.8 $(DESTDIR)$(ETHERTYPESFILE) exec scripts - mkdir -p $(DESTDIR)$(LIBDIR) - install -m 0755 extensions/*.so $(DESTDIR)$(LIBDIR) - install -m 0755 *.so $(DESTDIR)$(LIBDIR) - -.PHONY: clean -clean: - rm -f ebtables ebtables-restore ebtablesd ebtablesu static - rm -f *.o *~ *.so - rm -f extensions/*.o extensions/*.c~ extensions/*.so include/*~ - -DIR:=$(PROGNAME)-v$(PROGVERSION) -CVSDIRS:=CVS extensions/CVS examples/CVS examples/perf_test/CVS \ -examples/ulog/CVS include/CVS -# This is used to make a new userspace release, some files are altered so -# do this on a temporary version -.PHONY: release -release: - rm -f extensions/ebt_inat.c - rm -rf $(CVSDIRS) - mkdir -p include/linux/netfilter_bridge - install -m 0644 -o root -g root \ - $(KERNEL_INCLUDES)/linux/netfilter_bridge.h include/linux/ -# To keep possible compile error complaints about undefined ETH_P_8021Q -# off my back - install -m 0644 -o root -g root \ - $(KERNEL_INCLUDES)/linux/if_ether.h include/linux/ - install -m 0644 -o root -g root \ - $(KERNEL_INCLUDES)/linux/types.h include/linux/ - install -m 0644 -o root -g root \ - $(KERNEL_INCLUDES)/linux/netfilter_bridge/*.h \ - include/linux/netfilter_bridge/ - install -m 0644 -o root -g root \ - include/ebtables.h include/linux/netfilter_bridge/ - make clean - touch * - touch extensions/* - touch include/* - touch include/linux/* - touch include/linux/netfilter_bridge/* - sed -i -e 's/$$(VERSION)/$(PROGVERSION)/' -e 's/$$(DATE)/$(PROGDATE)/' -e 's/$$(LOCKFILE)/$(tmp4)/' ebtables.8 - sed -i -e 's/$$(VERSION)/$(PROGVERSION_)/' -e 's/$$(RELEASE)/$(PROGRELEASE)/' ebtables.spec - cd ..;tar -c $(DIR) | gzip >$(DIR).tar.gz; cd - - rm -rf include/linux - -# This will make the rpm and put it in /usr/src/redhat/RPMS -# (do this as root after make release) -.PHONY: rpmbuild -rpmbuild: - cp ../$(DIR).tar.gz /usr/src/redhat/SOURCES/ - rpmbuild --buildroot $(shell mktemp -td $(DIR)-XXXXX) -bb ebtables.spec - -.PHONY: test_ulog -test_ulog: examples/ulog/test_ulog.c getethertype.o - $(CC) $(CFLAGS) $< -o test_ulog -I$(KERNEL_INCLUDES) -lc \ - getethertype.o - mv test_ulog examples/ulog/ - -.PHONY: examples -examples: test_ulog diff -Nru ebtables-2.0.10.4/Makefile.am ebtables-2.0.10.4+snapshot20181205/Makefile.am --- ebtables-2.0.10.4/Makefile.am 1970-01-01 00:00:00.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/Makefile.am 2018-12-05 11:27:50.000000000 +0000 @@ -0,0 +1,77 @@ +# -*- Makefile -*- + +# For debugging, use ./configure CPPFLAGS=-DEBT_DEBUG CFLAGS="-O0 -ggdb3" + +PROGNAME = ${PACKAGE_NAME} +PROGVERSION = ${PACKAGE_VERSION} +PROGDATE = December\ 2011 +LOCKDIR = /var/lib/ebtables +LOCKFILE = ${LOCKDIR}/lock +INITDIR = /etc/rc.d/init.d +initddir = ${INITDIR} +sysconfigdir = ${sysconfdir}/sysconfig +EBTD_CMDLINE_MAXLN = 2048 +EBTD_ARGC_MAX = 50 +PIPE_DIR = /tmp/${PACKAGE_NAME}-v${PROGVERSION} +PIPE = ${PIPE_DIR}/ebtablesd_pipe + + +ACLOCAL_AMFLAGS = -I m4 +AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_srcdir}/include \ + -DPROGVERSION=\"${PACKAGE_VERSION}\" -DPROGNAME=\"${PACKAGE_NAME}\" \ + -DPROGDATE=\"${PROGDATE}\" \ + -D_PATH_ETHERTYPES=\"${sysconfdir}/ethertypes\" \ + -DLOCKFILE=\"${LOCKFILE}\" -DLOCKDIR=\"${LOCKDIR}\" \ + -DEBTD_ARGC_MAX=${EBTD_ARGC_MAX} -DEBTD_CMDLINE_MAXLN=${EBTD_CMDLINE_MAXLN} \ + -DEBTD_PIPE=\"${PIPE}\" -DEBTD_PIPE_DIR=\"${PIPE_DIR}\" +AM_CFLAGS = ${regular_CFLAGS} + +sbin_PROGRAMS = ebtables-legacy ebtablesd ebtablesu ebtables-legacy-restore +EXTRA_PROGRAMS = static examples/ulog/test_ulog +sysconf_DATA = ethertypes +sbin_SCRIPTS = ebtables-legacy-save +man8_MANS = ebtables-legacy.8 +lib_LTLIBRARIES = libebtc.la + +libebtc_la_SOURCES = \ + communication.c ebtables.c getethertype.c \ + libebtc.c useful_functions.c \ + extensions/ebt_802_3.c extensions/ebt_among.c extensions/ebt_arp.c \ + extensions/ebt_arpreply.c extensions/ebt_ip.c extensions/ebt_ip6.c \ + extensions/ebt_limit.c extensions/ebt_log.c extensions/ebt_mark.c \ + extensions/ebt_mark_m.c extensions/ebt_nat.c extensions/ebt_nflog.c \ + extensions/ebt_pkttype.c extensions/ebt_redirect.c \ + extensions/ebt_standard.c extensions/ebt_stp.c extensions/ebt_string.c \ + extensions/ebt_ulog.c extensions/ebt_vlan.c \ + extensions/ebtable_broute.c extensions/ebtable_filter.c \ + extensions/ebtable_nat.c +# Make sure ebtables.c can be built twice +libebtc_la_CPPFLAGS = ${AM_CPPFLAGS} +ebtables_legacy_SOURCES = ebtables-standalone.c +ebtables_legacy_LDADD = libebtc.la +ebtablesd_LDADD = libebtc.la +ebtables_legacy_restore_SOURCES = ebtables-restore.c +ebtables_legacy_restore_LDADD = libebtc.la +static_SOURCES = ebtables.c +static_LDFLAGS = -static +static_LDADD = libebtc.la +examples_ulog_test_ulog_SOURCES = examples/ulog/test_ulog.c getethertype.c + +daemon: ebtablesd ebtablesu +exec: ebtables-legacy ebtables-legacy-restore + +CLEANFILES = ebtables-legacy-save ebtables.sysv ebtables-config ebtables-legacy.8 + +ebtables-legacy-save: ebtables-save.in ${top_builddir}/config.status + ${AM_V_GEN}sed -e 's![@]sbindir@!${sbindir}!g' <$< >$@ + +ebtables.sysv: ebtables.sysv.in ${top_builddir}/config.status + ${AM_V_GEN}sed -e 's![@]sbindir@!${sbindir}!g' -e 's![@]sysconfigdir@!${sysconfigdir}!g' <$< >$@ + +ebtables-config: ebtables-config.in ${top_builddir}/config.status + ${AM_V_GEN}sed -e 's![@]sysconfigdir@!${sysconfigdir}!g' <$< >$@ + +ebtables-legacy.8: ebtables-legacy.8.in ${top_builddir}/config.status + ${AM_V_GEN}sed -e 's![@]PACKAGE_VERSION!${PACKAGE_VERSION}!g' \ + -e 's![@]PACKAGE_DATE@!${PROGDATE}!g' \ + -e 's![@]LOCKFILE@!${LOCKFILE}!g' <$< >$@ diff -Nru ebtables-2.0.10.4/useful_functions.c ebtables-2.0.10.4+snapshot20181205/useful_functions.c --- ebtables-2.0.10.4/useful_functions.c 2011-12-15 20:02:47.000000000 +0000 +++ ebtables-2.0.10.4+snapshot20181205/useful_functions.c 2018-12-05 11:27:50.000000000 +0000 @@ -24,6 +24,9 @@ */ #include "include/ebtables_u.h" #include "include/ethernetdb.h" +#include +#include +#include #include #include #include @@ -34,6 +37,7 @@ #include #include + const unsigned char mac_type_unicast[ETH_ALEN] = {0,0,0,0,0,0}; const unsigned char msk_type_unicast[ETH_ALEN] = {1,0,0,0,0,0}; const unsigned char mac_type_multicast[ETH_ALEN] = {1,0,0,0,0,0}; @@ -188,7 +192,7 @@ return -1; *q = '\0'; onebyte = strtol(p, &end, 10); - if (*end != '\0' || onebyte > 255 || onebyte < 0) + if (*end != '\0' || onebyte > 255 || onebyte < 0) return -1; ip2[i] = (unsigned char)onebyte; p = q + 1; @@ -275,7 +279,7 @@ *buf = '\0'; else /* Mask was not a decent combination of 1's and 0's */ - sprintf(buf, "/%d.%d.%d.%d", ((unsigned char *)&mask)[0], + sprintf(buf, "/%d.%d.%d.%d", ((unsigned char *)&mask)[0], ((unsigned char *)&mask)[1], ((unsigned char *)&mask)[2], ((unsigned char *)&mask)[3]); @@ -411,3 +415,168 @@ static char buf[50+1]; return (char *)inet_ntop(AF_INET6, addrp, buf, sizeof(buf)); } + +char *ebt_ip6_mask_to_string(const struct in6_addr *msk) +{ + /* /0000:0000:0000:0000:0000:000.000.000.000 + * /0000:0000:0000:0000:0000:0000:0000:0000 */ + static char buf[51+1]; + if (msk->s6_addr32[0] == 0xFFFFFFFFL && msk->s6_addr32[1] == 0xFFFFFFFFL && + msk->s6_addr32[2] == 0xFFFFFFFFL && msk->s6_addr32[3] == 0xFFFFFFFFL) + *buf = '\0'; + else + sprintf(buf, "/%s", ebt_ip6_to_numeric(msk)); + return buf; +} + +static char* +parse_num(const char *str, long min, long max, long *num) +{ + char *end; + + errno = 0; + *num = strtol(str, &end, 10); + if (errno && (*num == LONG_MIN || *num == LONG_MAX)) { + ebt_print_error("Invalid number %s: %s", str, strerror(errno)); + return NULL; + } + if (min <= max) { + if (*num > max || *num < min) { + ebt_print_error("Value %ld out of range (%ld, %ld)", *num, min, max); + return NULL; + } + } + if (*num == 0 && str == end) + return NULL; + return end; +} + +static char * +parse_range(const char *str, long min, long max, long num[]) +{ + char *next; + + next = parse_num(str, min, max, num); + if (next == NULL) + return NULL; + if (next && *next == ':') + next = parse_num(next+1, min, max, &num[1]); + else + num[1] = num[0]; + return next; +} + +int ebt_parse_icmp(const struct ebt_icmp_names *icmp_codes, size_t n_codes, + const char *icmptype, uint8_t type[], uint8_t code[]) +{ + unsigned int match = n_codes; + unsigned int i; + long number[2]; + + for (i = 0; i < n_codes; i++) { + if (strncasecmp(icmp_codes[i].name, icmptype, strlen(icmptype))) + continue; + if (match != n_codes) + ebt_print_error("Ambiguous ICMP type `%s':" + " `%s' or `%s'?", + icmptype, icmp_codes[match].name, + icmp_codes[i].name); + match = i; + } + + if (match < n_codes) { + type[0] = type[1] = icmp_codes[match].type; + if (code) { + code[0] = icmp_codes[match].code_min; + code[1] = icmp_codes[match].code_max; + } + } else { + char *next = parse_range(icmptype, 0, 255, number); + if (!next) { + ebt_print_error("Unknown ICMP type `%s'", + icmptype); + return -1; + } + type[0] = (uint8_t) number[0]; + type[1] = (uint8_t) number[1]; + switch (*next) { + case 0: + if (code) { + code[0] = 0; + code[1] = 255; + } + return 0; + case '/': + if (code) { + next = parse_range(next+1, 0, 255, number); + code[0] = (uint8_t) number[0]; + code[1] = (uint8_t) number[1]; + if (next == NULL) + return -1; + if (next && *next == 0) + return 0; + } + /* fallthrough */ + default: + ebt_print_error("unknown character %c", *next); + return -1; + } + } + return 0; +} + +static void print_icmp_code(uint8_t *code) +{ + if (!code) + return; + + if (code[0] == code[1]) + printf("/%"PRIu8 " ", code[0]); + else + printf("/%"PRIu8":%"PRIu8 " ", code[0], code[1]); +} + +void ebt_print_icmp_type(const struct ebt_icmp_names *icmp_codes, + size_t n_codes, uint8_t *type, uint8_t *code) +{ + unsigned int i; + + if (type[0] != type[1]) { + printf("%"PRIu8 ":%" PRIu8, type[0], type[1]); + print_icmp_code(code); + return; + } + + for (i = 0; i < n_codes; i++) { + if (icmp_codes[i].type != type[0]) + continue; + + if (!code || (icmp_codes[i].code_min == code[0] && + icmp_codes[i].code_max == code[1])) { + printf("%s ", icmp_codes[i].name); + return; + } + } + printf("%"PRIu8, type[0]); + print_icmp_code(code); +} + +void ebt_print_icmp_types(const struct ebt_icmp_names *icmp_codes, + size_t n_codes) +{ + unsigned int i; + + for (i = 0; i < n_codes; i++) { + if (i && icmp_codes[i].type == icmp_codes[i-1].type) { + if (icmp_codes[i].code_min == icmp_codes[i-1].code_min + && (icmp_codes[i].code_max + == icmp_codes[i-1].code_max)) + printf(" (%s)", icmp_codes[i].name); + else + printf("\n %s", icmp_codes[i].name); + } + else + printf("\n%s", icmp_codes[i].name); + } + printf("\n"); +}