summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: libipt_icmp.t: Enable tests with numeric outputPhil Sutter2023-08-041-6/+3
| | | | | | | | | | Unrelated to the question whether numeric (save) output is desired or not, enable the tests and expect the known format. Using --list without --numeric prints the names, BTW. Fixes: 49d5b7277c7f2 ("extensions: libipt_icmp: add unit test") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libipt_icmp: Fix confusion between 255/255 and anyPhil Sutter2023-08-042-1/+4
| | | | | | | | | | | | | | | | Per definition, ICMP type "any" is type 255 and the full range of codes (0-255). Save callback though ignored the actual code values, printing "any" for every type 255 match. This at least confuses users as they can't find their rule added as '--icmp-type 255/255' anymore. It is not entirely clear what the fixed commit was trying to establish, but the save output is certainly not correct (especially since print callback gets things right). Reported-by: Amelia Downs <adowns@vmware.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1600 Fixes: fc9237da4e845 ("Fix '-p icmp -m icmp' issue (Closes: #37)") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-apply: Eliminate shellcheck warningsPhil Sutter2023-08-011-8/+8
| | | | | | | | | | | | | Actual warnings were only about use of '-a' in bracket expressions (replace by '&&' pipeline) and the immediate evaluation of the variable in trap command. The remaining changes silence info-level messages: missing quoting around variables, pointless '$' in arithmetic expressions, backticks instead of $(...), missing '-r' parameter when calling read and an awkward negated '-z' check. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-restore: Drop dead codePhil Sutter2023-08-011-2/+0
| | | | | | | | Handle initialization is guarded by 'in_table' boolean, so there can't be a handle already (because the branch which unsets 'in_table' also frees the handle). Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix and extend chain rename testPhil Sutter2023-07-282-12/+40
| | | | | | | | | | The old version exited unintentionally before testing ip6tables. Replace it by a more complete variant testing for all tools, creating and renaming of,chains with various illegal names instead of just renaming to a clashing name. Fixes: ed9cfe1b48526 ("tests: add initial save/restore test cases") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Improve invalid chain name detectionPhil Sutter2023-07-281-5/+28
| | | | | | | | | | | | | | | | Fix several issues: - Most importantly, --new-chain command accepted any name. Introduce ebt_assert_valid_chain_name() for use with both --new-chain and --rename-chain. - Restrict maximum name length to what legacy ebtables allows - this is a bit more than iptables-nft, subject to be unified. - Like iptables, legacy ebtables rejects names prefixed by '-' or '!'. - Use xs_has_arg() for consistency, keep the check for extra args for now. Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") Signed-off-by: Phil Sutter <phil@nwl.cc>
* *tables: Reject invalid chain names when renamingPhil Sutter2023-07-281-0/+1
| | | | | | | | | While given chain name was sanity checked with --new-chain command, --rename-chain command allowed to choose an invalid name. Keep things consistent by adding the missing check. Fixes: e6869a8f59d77 ("reorganized tree after kernel merge") Signed-off-by: Phil Sutter <phil@nwl.cc>
* *tables-restore: Enforce correct counters syntax if presentPhil Sutter2023-07-283-21/+24
| | | | | | | | | If '--counters' option was not given, restore parsers would ignore anything following the policy word. Make them more strict, rejecting anything in that spot which does not look like counter values even if not restoring counters. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Include sets in debug outputPhil Sutter2023-07-282-1/+15
| | | | | | | Rules referencing them are incomplete without, so add debug output on the same level as for rules. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Do not pass nft_rule_ctx to add_nft_among()Phil Sutter2023-07-281-6/+5
| | | | | | | | It is not used, must be a left-over from an earlier version of the fixed commit. Fixes: 4e95200ded923 ("nft-bridge: pass context structure to ops->add() to improve anonymous set support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: More verbose extension comparison debuggingPhil Sutter2023-07-282-0/+9
| | | | | | Dump extension data if it differs. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Special casing for among match in compare_matches()Phil Sutter2023-07-281-2/+5
| | | | | | | | | | | When other extensions may have "garbage" appended to their data which should not be considered for match comparison, among match is the opposite in that it extends its data beyond the value in 'size' field. Add special casing to cover for this, avoiding false-positive rule comparison. Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Sanitize nft-only/0009-needless-bitwise_0Phil Sutter2023-07-191-1/+1
| | | | | | | | | | | Some versions of awk (gawk-4.2.1-4.el8 in particular) also print the non-debug ruleset listing's empty lines, causing the diff to fail. Catch this by exiting upon seeing the first table heading. For the sake of comparing bytecode, the actual ruleset listing is not interesting, anyway. Fixes: 0f7ea0390b336 ("tests/shell: Fix nft-only/0009-needless-bitwise_0") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: pass context structure to ops->add() to improve anonymous set ↵Pablo Neira Ayuso2023-07-128-37/+62
| | | | | | | | | | | | | | | | | support Add context structure to improve bridge among support which creates an anonymous set. This context structure specifies the command and it allows to optionally store a anonymous set. Use this context to generate native bytecode only if this is an add/insert/replace command. This fixes a dangling anonymous set that is created on rule removal. Fixes: 26753888720d ("nft: bridge: Rudimental among extension support") Reported-and-tested-by: Igor Raits <igor@gooddata.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: Fix handling of non-existent chainsJacek Tomasiak2023-06-212-1/+2
| | | | | | | | | | | | | | | | | Since 694612adf87 the "compatibility" check considers non-existent chains as "incompatible". This broke some scripts which used calls like `iptables -L CHAIN404` to test for chain existence and expect "No chain/target/match by that name." in the output. This patch changes the logic of `nft_is_table_compatible()` to report non-existent chains as "compatible" which restores the old behavior. Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648 Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com> Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables: Fix setting of ipv6 countersJacek Tomasiak2023-06-213-6/+9
| | | | | | | | | | | | | | When setting counters using ip6tables-nft -c X Y the X and Y values were not stored. This is a fix based on 9baf3bf0e77dab6ca4b167554ec0e57b65d0af01 but applied to the nft variant of ipv6 not the legacy. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1647 Fixes: 0391677c1a0b2 ("xtables: add IPv6 support") Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com> Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: dissolve should_load_protoJan Engelhardt2023-06-161-14/+4
| | | | | | | | | cs->proto_used already tells whether -p foo was turned into an implicit -m foo once, so I do not think should_load_proto() has a reason to exist. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: use payload matching for layer 4 protocolPablo Neira Ayuso2023-06-161-1/+2
| | | | | | | | | This is an IPv4 header, which does not require the special handling as in IPv6, use the payload matching instead of meta l4proto which is slightly faster in this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: string: document BM false negativesJeremy Sowden2023-06-161-0/+15
| | | | | | | | | | For non-linear skb's there's a possibility that the kernel's Boyer-Moore text-search implementation may miss matches. There's a warning about this in the kernel source. Include that warning in the man-page. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1390 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: check for source and destination address in first placePablo Neira Ayuso2023-06-023-43/+47
| | | | | | | | | | | | | | | | | | | | | | When generating bytecode, check for source and destination address in first place, then, check for the input and output device. In general, the first expression in the rule is the most evaluated during the evaluation process. These selectors are likely to show more variability in rulesets. # iptables-nft -vv -I INPUT -s 1.2.3.4 -p tcp tcp opt -- in * out * 1.2.3.4 -> 0.0.0.0/0 table filter ip flags 0 use 0 handle 0 ip filter INPUT use 0 type filter hook input prio 0 policy accept packets 0 bytes 0 ip filter INPUT [ payload load 4b @ network header + 12 => reg 1 ] [ cmp eq reg 1 0x04030201 ] [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ counter pkts 0 bytes 0 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: ruleparse: Create family-specific source filesPhil Sutter2023-05-0311-725/+846
| | | | | | | Extract the remaining nftnl rule parsing code from nft-<family>.c sources into dedicated ones to complete the separation. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Extract rule parsing callbacks from nft_family_opsPhil Sutter2023-05-037-41/+60
| | | | | | | Introduce struct nft_ruleparse_ops holding the family-specific expression parsers and integrate it into nft_family_ops for now. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Introduce nft-ruleparse.{c,h}Phil Sutter2023-05-035-1290/+1327
| | | | | | | | | | | Extract all code dealing with parsing from struct nftnl_rule into struct iptables_command_state from nft-shared.c into a separate source file. Basically this is nft_rule_to_iptables_command_state() and the functions it calls, plus family-independent parsers called from family-specific callbacks. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix parsing of option arguments in same wordPhil Sutter2023-04-283-31/+35
| | | | | | | | | | | | | | | | When merging commandline parsers, a decision between 'argv[optind - 1]' and 'optarg' had to be made in some spots. While the implementation of check_inverse() required the former, use of the latter allows for the common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at the suffix while 'argv[optind - 1]' will just point at the following option. Fix the mess by making check_inverse() update optarg pointer if needed so calling code may refer to and always correct 'optarg'. Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Don't omit standard matches if invertedPhil Sutter2023-04-281-2/+4
| | | | | | | | Inverted --h-len and --h-type matches were omitted from output by accident if they matched on their standard value. Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values") Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Fix parsing of inverted 'arp operation' matchPhil Sutter2023-04-281-1/+1
| | | | | | | | The wrong bit was set in 'invflags', probably due to copy'n'paste from the previous case. Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Drop unused includePhil Sutter2023-04-211-1/+0
| | | | | | | Code does not refer to struct xt_comment_info anymore. Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment") Signed-off-by: Phil Sutter <phil@nwl.cc>
* utils: nfbpf_compile: Replace pcap_compile_nopcap()Phil Sutter2023-04-211-1/+9
| | | | | | | | The function is deprecated. Eliminate the warning by use of pcap_open_dead(), pcap_compile() and pcap_close() just how pcap_compile_nopcap() is implemented internally in libpcap. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Test for false-positive rule checkPhil Sutter2023-04-051-0/+17
| | | | | | | | Rule comparison in legacy ip6tables was broken by commit eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables"): A part of the rules' data was masked out for comparison by accident. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-nft: add broute table emulationFlorian Westphal2023-04-047-28/+112
| | | | | | | | | | | | | | Use new 'meta broute set 1' to emulate -t broute. If '-t broute' is given, automatically translate -j DROP to 'meta broute set 1 accept' internally. Reverse translation zaps the broute and pretends verdict was DROP. Note that BROUTING is internally handled via PREROUTING, i.e. 'redirect' and 'nat' targets are not available, they will need to be emulated via nft expressions. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* include: update nf_tables uapi headerFlorian Westphal2023-04-041-5/+54
| | | | | | | Taken from nf-next. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: use pkg-config for libpcapAlyssa Ross2023-04-042-7/+8
| | | | | | | | | | | | | | | | If building statically, with libpcap built with libnl support, linking will fail, as the compiler won't be able to find the libnl symbols since static libraries don't contain dependency information. To fix this, use pkg-config to find the flags for linking libpcap, since the pkg-config files contain the neccesary dependency information. autoconf will add code to the configure script for initializing pkg-config the first time it seems PKG_CHECK_MODULES, so make the libnfnetlink check the first one in the script, so the initialization code is run unconditionally. Signed-off-by: Alyssa Ross <hi@alyssa.is> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ip6tables: Fix checking existence of ruleMarkus Boehme2023-04-041-1/+1
| | | | | | | | | | Pass the proper entry size when creating a match mask for checking the existence of a rule. Failing to do so causes wrong results. Reported-by: Jonathan Caicedo <jonathan@jcaicedo.com> Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables") Signed-off-by: Markus Boehme <markubo@amazon.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-test.py: make explicit use of python3Arturo Borrero Gonzalez2023-03-151-1/+1
| | | | | | | | | | | In most distros 'python' means python2, which is not available anywhere. This is a problem when, for example, building the Debian package. This script is called as part of the build but 'python' is not available. Mention python3 explictly. The script runs just fine in python3. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-nft: remove unused function argumentFlorian Westphal2023-03-156-6/+6
| | | | | | Not used, all callers pass NULL. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-nft: make builtin tables staticFlorian Westphal2023-03-142-7/+3
| | | | | | Only used in nft.c. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-eb: fix crash when opts isn't reallocatedFlorian Westphal2023-03-141-1/+2
| | | | | | | opts may point to statically allocated memory. This fixes abort() from libc. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-restore: Fix for deletion of new, referenced rulePhil Sutter2023-03-012-1/+18
| | | | | | | | | | | | | | | | | | Combining multiple corner-cases here: * Insert a rule before another new one which is not the first. Triggers NFTNL_RULE_ID assignment of the latter. * Delete the referenced new rule in the same batch again. Causes overwriting of the previously assigned RULE_ID. Consequently, iptables-nft-restore fails during *insert*, because the reference is dangling. Reported-by: Eric Garver <eric@garver.life> Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch") Signed-off-by: Phil Sutter <phil@nwl.cc> Tested-by: Eric Garver <eric@garver.life>
* include: Add missing linux/netfilter/xt_LOG.hPhil Sutter2023-02-223-38/+20
| | | | | | | | | | When merging IP-version-specific LOG extensions, a dependency to that header was introduced without caching it. Fix this and drop the now unused ip{,6}t_LOG.h files. Reported-by: Thomas Devoogdt <thomas@devoogdt.com> Fixes: 87e4f1bf0b87b ("extensions: libip*t_LOG: Merge extensions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xt_sctp: add the missing chunk types in sctp_helpXin Long2023-02-211-1/+1
| | | | | | | | | | | | | Add the missing chunk types in sctp_help(), so that the help cmd can display these chunk types as below: # iptables -p sctp --help chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Support insert with indexPhil Sutter2023-02-172-1/+3
| | | | | | | | | Translation is pretty simple due to nft's 'insert rule ... index' support. Testing the translation is sadly not: index 1 vanishes (as it should), higher indexes are rejected in replay mode since no rules previously exist. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: ip and ip6 matches depend on protocol matchPhil Sutter2023-02-171-2/+9
| | | | | | | This is consistent with legacy ebtables, also avoids invalid combinations like '-p IPv6 --ip-source 1.2.3.4'. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip: Translation has to match on ether typePhil Sutter2023-02-172-3/+24
| | | | | | | | | | | | | | On one hand, nft refuses th expression in bridge family if layer3 protocol has not been assured by a previous match. On the other, ebt_ip kernel module will only match on IPv4 packets, so there might be a functional change in the translation versus the original. Instead of just always emitting an 'ether type' match, decide whether it's actually needed - explicit "ip <something>" payload matches (or icmp ones) cause implicit creation of a match on IPv4 by nft. Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip: Do not use 'ip dscp' for translationPhil Sutter2023-02-172-3/+3
| | | | | | | | | Converting from TOS field match to DSCP one is irreversible, so replay testing is not possible. Use a raw payload expression to produce something that translates 1:1 back into an 'ip' match. Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_redirect: Fix for wrong syntax in translationPhil Sutter2023-02-172-4/+4
| | | | | | | Meta key comes before 'set' in meta statement. Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_redirect: Fix target translationPhil Sutter2023-02-172-1/+9
| | | | | | | | | While EBT_ACCEPT is the default verdict for ebtables targets, omitting it from translation implicitly converts it into 'continue'. Omit the non-default EBT_CONTINUE instead. Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate: Print file names even if specifiedPhil Sutter2023-02-171-1/+1
| | | | | | | Since the script now supports running for multiple files given on command line, do not skip printing a status line for each. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate: Properly split input in replay modePhil Sutter2023-02-171-1/+1
| | | | | | | | Source command may contain quotes, using shlex.split() does the right thing there. Fixes: 7705b2daa3bdc ("tests: xlate: Use --check to verify replay") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Simplify using nft_create_match()Phil Sutter2023-02-171-66/+40
| | | | | | | | | Perform the nft_family_ops::parse_match call from inside nft_create_match(). It frees callers from having to access the match itself. Then return a pointer to match data instead of the match itself. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Use nft_create_match() in one more spotPhil Sutter2023-02-171-11/+1
| | | | | | | By dropping the per-family 'cs->matches' selection (which is the default anyway), code becomes identical to the function's body. Signed-off-by: Phil Sutter <phil@nwl.cc>