summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* extensions: libebt_arp, libebt_ip: Use xtables_ipparse_any()Phil Sutter2022-11-153-157/+21
| | | | | | | The libxtables function covers all formerly supported inputs (and more). The extended libebt_arp.t passes before and after this patch. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_ip: Include kernel headerPhil Sutter2022-11-152-34/+13
| | | | | | | Update the local copy of linux/netfilter_bridge/ebt_ip.h and include it instead of keeping the local copy of struct ebt_ip_info et al. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libip*t_LOG: Merge extensionsPhil Sutter2022-11-152-350/+58
| | | | | | | | | | | Data structures were identical already, make use of the names in xt_LOG.h and merge all code into a single extension of family NFPROTO_UNSPEC. While being at it, define SYSLOG_NAMES and use the array in syslog.h instead of dragging along an own level->name mapping two times. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Introduce port_match_single_to_range()Phil Sutter2022-11-151-93/+37
| | | | | | | The same algorithm was present four times, outsource it. Also use max()/min() macros for a more readable boundary notation. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Share make_delete_mask() between ip{,6}tablesPhil Sutter2022-11-154-72/+42
| | | | | | | | Function bodies were mostly identical, the only difference being the use of struct ipt_entry or ip6t_entry for size calculation. Pass this value via parameter to make them fully identical. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate-test: Replay results for reverse direction testingPhil Sutter2022-11-111-1/+144
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Call nft with translation output as input, then check xtables-save output to make sure iptables-nft can handle anything it suggests nft to turn its ruleset into. This extends the test case syntax to cover for expected asymmetries. When the existing syntax was something like this: | <xlate command> | <nft output1> | [<nft output2> The new syntax then is: | <xlate command>[;<replay rule part>] | <nft output1> | [<nft output2>] To keep things terse, <replay rule part> may omit the obligatory '-A <chain>' argument. If missing, <xlate command> is sanitized for how it would appear in xtables-save output: '-I' is converted into '-A' and an optional table spec is removed. Since replay mode has to manipulate the ruleset in-kernel, abort if called by unprivileged user. Also try to run in own net namespace to reduce collateral damage. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate-test.py: Introduce run_proc()Phil Sutter2022-11-111-5/+11
| | | | | | It's just a convenience wrapper around Popen(), simplifying the call. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate-test: Cleanup file reading loopPhil Sutter2022-11-111-30/+37
| | | | | | | | Put the actual translation test into a function to call from the loop and clean it up a bit. Preparation work for running a second test on the same data. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADEPhil Sutter2022-11-1110-954/+163
| | | | | | | | | REDIRECT was already merged into DNAT. Given the callback generator and generalized inner parsing routines, merging the other "flavors" is relatively simple. Rename the extension into "libxt_NAT.so" while doing so and turn the old DSOs into symlinks. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Rename some symbolsPhil Sutter2022-11-111-14/+14
| | | | | | | No functional change intended, just a more generic name for some symbols which won't be DNAT-specific soon. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Generate print, save and xlate callbacksPhil Sutter2022-11-111-180/+86
| | | | | | | | | | | Each extension's callbacks follow the same scheme so introduce a generator which accepts the specifics as parameter - including the method to transform from per-extension data into struct nf_nat_range2. Also move the different parser frontends and fcheck callbacks in one spot for clarity. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Use __DNAT_xlate for REDIRECT, tooPhil Sutter2022-11-111-22/+11
| | | | | | | Make the common function a bit more versatile and give it a more generic name, then use it for REDIRECT target, too. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: *NAT: Drop NF_NAT_RANGE_PROTO_RANDOM* flag checksPhil Sutter2022-11-115-49/+19
| | | | | | | | | | | | | | | SNAT, DNAT and REDIRECT extensions tried to prevent NF_NAT_RANGE_PROTO_RANDOM flag from being set if no port or address was also given. With SNAT and DNAT, this is not possible as the respective --to-destination or --to-source parameters are mandatory anyway. Looking at the kernel code, doing so with REDIRECT seems harmless. Moreover, nftables supports 'redirect random' without specifying a port-range. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Fix bad IP address error reportingPhil Sutter2022-11-111-1/+1
| | | | | | | | When introducing 'start' variable to cover for IPv6 addresses enclosed in brackets, this single spot was missed. Fixes: 14d77c8aa29a7 ("extensions: Merge IPv4 and IPv6 DNAT targets") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: *.t: Add missing all-one's netmasks to expected outputPhil Sutter2022-10-264-8/+8
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libxt_connlimit.t: Add missing default valuesPhil Sutter2022-10-261-6/+6
| | | | | | | This extension always prints --connlimit-mask and (the default) --connlimit-saddr options. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libebt_vlan.t: Drop trailing whitespace from rulesPhil Sutter2022-10-261-2/+2
| | | | | | | | Fast iptables-test.py mode is picky and it has to: Plain redirect target prints a trailing whitespace, generally stripping the rules in test cases won't work therefore. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libxt_tos.t, libxt_TOS.t: Add missing masks in outputPhil Sutter2022-10-262-10/+10
| | | | | | | Mask differs between numeric --set-tos values and symbolic ones, make sure it is covered by the tests. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libxt_recent.t: Add missing default valuesPhil Sutter2022-10-261-2/+2
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libxt_length.t: Fix odd use-case outputPhil Sutter2022-10-261-1/+1
| | | | | | | Specifying the lower boundary suffixed by colon is an undocumented feature. Explicitly printing the upper boundary in that case seems sane. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libebt_redirect.t: Plain redirect prints with trailing whitespacePhil Sutter2022-10-261-1/+1
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: *.t: Fix for hexadecimal outputPhil Sutter2022-10-265-6/+6
| | | | | | | Use hex input to avoid having to specify an expected output in trivial cases. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: *.t: Fix expected output for simple callsPhil Sutter2022-10-265-5/+5
| | | | | | | These minimal extension uses print in more detailed form. Track this, the output is desired. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Cover for obligatory -j CONTINUE in ebtablesPhil Sutter2022-10-261-0/+3
| | | | | | | | | Unlike iptables, ebtables includes the default rule target in output. Instead of adding it to every rule in ebtables tests, add special casing to the testscript checking if the expected rule output contains a target already and adding the default one if not. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Implement fast test modePhil Sutter2022-10-261-1/+159
| | | | | | | | | | | | | | | | | | | | | | | | | Implement a faster mode of operation for suitable test files: 1) Collect all rules to add and all expected output in lists 2) Any supposedly failing rules are checked immediately like in slow mode. 3) Create and load iptables-restore input from the list in (1) 5) Construct the expected iptables-save output from (1) and check it in a single search 5) If any of the steps above fail, fall back to slow mode for verification and detailed error analysis. Fast mode failures are not fatal, merely warn about them. To keep things simple (and feasible), avoid complicated test files involving external commands, multiple tables or variant-specific results. Aside from speeding up testsuite run-time, rule searching has become more strict since EOL char is practically part of the search string. This revealed many false positives where the expected string was actually a substring of the printed rule. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: NFQUEUE: Document queue-balance limitationPhil Sutter2022-10-263-4/+5
| | | | | | | | | | | The range is not communicated as "min and max queue number", but "first queue number and count" instead. With 16bits for each value, it is not possible to balance between all 65536 possible queues. Although probably never used in practice, point this detail out in man page and make the parser complain instead of the cryptic "xt_NFQUEUE: number of total queues is 0" emitted by the kernel module. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix compile with -DDEBUGPhil Sutter2022-10-072-5/+5
| | | | | | | Conversion from 'ctx' to 'reg' missed some of the DEBUGP() calls. Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libiptc: Fix for segfault when renaming a chainPhil Sutter2022-10-072-0/+28
| | | | | | | | | | This is an odd bug: If the number of chains is right and one renames the last one in the list, libiptc dereferences a NULL pointer. Add fix and test case for it. Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") Reported-by: Julien Castets <castets.j@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix expected ebtables log target outputPhil Sutter2022-10-062-3/+3
| | | | | | | | Forgot to update shell testsuite when removing empty --log-prefix options. Fixes: 9cdb52d655608 ("extensions: libebt_log: Avoid empty log-prefix in output") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix expected output for ip6tables dst matchPhil Sutter2022-10-061-2/+2
| | | | | | | | Forgot to update the shell testsuites when fixing for duplicate whitespace in output. Fixes: 11e06cbb3a877 ("extensions: libip6t_dst: Fix output for empty options") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: libebt_stp.t: Drop duplicate whitespacePhil Sutter2022-10-061-1/+1
| | | | | | Code was fixed but the testcase adjustment slipped through. Fixes: 262dff31a998e ("extensions: libebt_stp: Eliminate duplicate space in output")
* tests: IDLETIMER.t: Fix syntax, support for restore inputPhil Sutter2022-10-051-1/+1
| | | | | | | | | Expected output was wrong in the last OK test, probably defeating rule search check. Also use a different label, otherwise the kernel will reject the second idletimer with same label but different type if both rules are added at once. Fixes: 85b9ec8615428 ("extensions: IDLETIMER: Add alarm timer option")
* extensions: libebt_log: Avoid empty log-prefix in outputPhil Sutter2022-10-052-5/+6
| | | | | Just like iptables LOG target, omit --log-prefix from output if the string is empty.
* extensions: TCPOPTSTRIP: Do not print empty optionsPhil Sutter2022-10-021-0/+13
| | | | | | | No point in printing anything if none of the bits are set. Fixes: aef4c1e727563 ("libxt_TCPOPTSTRIP") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libip6t_dst: Fix output for empty optionsPhil Sutter2022-10-021-3/+3
| | | | | | | | If no --dst-opts were given, print_options() would print just a whitespace. Fixes: 73866357e4a7a ("iptables: do not print trailing whitespaces") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_stp: Eliminate duplicate space in outputPhil Sutter2022-10-021-2/+2
| | | | | | | | No need for print_range() to print a trailing whitespace, caller does this already. Fixes: fd8d7d7e5d911 ("ebtables-nft: add stp match") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: among: Fix for use with ebtables-restorePhil Sutter2022-10-011-8/+6
| | | | | | | | | | When restoring multiple rules which use among match, new size may be smaller than the old one which caused invalid writes by the memcpy() call. Expect this and realloc the match only if it needs to grow. Also use realloc instead of freeing and allocating from scratch. Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: among: Remove pointless fall throughPhil Sutter2022-10-011-3/+2
| | | | | | | | | This seems to be a leftover from an earlier version of the switch(). This fall through is never effective as the next case's code will never apply. So just break instead. Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Test both variants by defaultPhil Sutter2022-10-011-33/+51
| | | | | | | | | Via '--legacy' and '--nftables' flags one may choose the variant to test. Change the default (none of them given) from legacy to both, by effectively running twice. Prefix the summary line with the tested variant for clarity and print a total count line as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Pass netns to execute_cmd()Phil Sutter2022-10-011-24/+16
| | | | | | | | | | | | | | | The command to run might have to be prefixed. Once if the command is 'iptables' (or related) to define the variant, once if '-N' was given to run the command inside the netns. Doing both prefixing inside execute_cmd() avoids a potential conflict and thus simplifies things: The "external command" and "external iptables call" lines become identical in handling, there is no need for a separate prefix char anymore. As a side-effect, this commit also fixes for delete_rule() calls in error case ignoring the netns value. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Simplify execute_cmd() callingPhil Sutter2022-10-011-3/+3
| | | | | | Default 'lineno' parameter to zero, Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Simplify '-N' option a bitPhil Sutter2022-10-011-7/+10
| | | | | | | | Instead of hard-coding, store the netns name in args.netns if the flag was given. The value defaults to None, so existing 'if netns' checks are still valid. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: Drop 'sreg_count' variablePhil Sutter2022-09-281-4/+2
| | | | | | | | It is not needed, one can just use 'reg' function parameter in its place. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* nft: Fix meta statement parsingPhil Sutter2022-09-282-11/+9
| | | | | | | | | | | | The function nft_meta_set_to_target() would always bail since nothing sets 'sreg->meta_sreg.set' to true. This is obvious, as the immediate expression "filling" the source register does not indicate its purpose. The whole source register purpose storing in meta_sreg seems to be pointless, so drop it altogether. Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix among matchPhil Sutter2022-09-284-6/+25
| | | | | | | | | | | | | | | | | | Fixed commit broke among match in two ways: 1) The two lookup sizes are 12 and 6, not 12 and 4 - among supports either ether+IP or ether only, not IP only. 2) Adding two to sreg_count to get the second register is too simple: It works only for four byte regs, not the 16 byte ones. The first register is always a 16 byte one, though. Fixing (1) is trivial, fix (2) by introduction of nft_get_next_reg() doing the right thing. For consistency, use it for among match creation, too. Fixes: f315af1cf8871 ("nft: track each register individually") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Support '-p Length'Phil Sutter2022-09-284-18/+52
| | | | | | | | | | | | | | | | | | To match on Ethernet frames using the etherproto field as length value, ebtables accepts the special protocol name "LENGTH". Implement this in ebtables-nft using a native match for 'ether type < 0x0600'. Since extension 802_3 matches are valid only with such Ethernet frames, add a local add_match() wrapper which complains if the extension is used without '-p Length' parameter. Legacy ebtables does this within the extension's final_check callback, but it's not possible here due for lack of fw->bitmask field access. While being at it, add xlate support, adjust tests and make ebtables-nft print the case-insensitive argument with capital 'L' like legacy ebtables does. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-shared: Introduce __get_cmp_data()Phil Sutter2022-09-282-7/+11
| | | | | | | This is an inner function to get_cmp_data() returning the op value as-is for caller examination. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Merge OPT_* flags with xshared onesPhil Sutter2022-09-282-16/+9
| | | | | | | | | | | | | | Despite also including xshared.h, xtables-eb.c defined its own OPT_* flags with clashing values. Albeit ugly, this wasn't a problem in practice until commit 51d9d9e081344 ("ebtables: Support verbose mode") which introduced use of OPT_VERBOSE from xshared - with same value as the local OPT_PROTOCOL define. Eliminate the clash by appending ebtables-specific flags to the xshared enum and adjust for the different names of some others. Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Eliminate OPT_TABLEPhil Sutter2022-09-281-2/+3
| | | | | | | | | The flag is used for duplicate option checking only and there is a boolean indicating the same already. So copy the error message from EBT_CHECK_OPTION() in situ and just take care not to disturb restore mode handling. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Drop unused OPT_* definesPhil Sutter2022-09-281-3/+0
| | | | | | | Obviously copied from legacy ebtables, not needed by ebtables-nft. OPT_CNT_* ones seem not even used in legacy anymore. Signed-off-by: Phil Sutter <phil@nwl.cc>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 16:06:23 +0000