summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* consistently use <errno.h>Felix Janda2015-05-027-7/+7
| | | | | | | | | On glibc, <sys/errno.h> is a synomym for <errno.h>. <errno.h> is specified by POSIX, so use that. Fixes compilation error with musl libc Signed-off-by: Florian Westphal <fw@strlen.de>
* Merge branch 'ipset-next'Pablo Neira Ayuso2015-04-283-10/+207
|\ | | | | | | | | | | | | | | Get this patch into master: "Alignment problem between 64bit kernel 32bit userspace" As Jozsef requests.
| * Alignment problem between 64bit kernel 32bit userspaceJozsef Kadlecsik2014-11-063-10/+207
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sven-Haegar Koch reported the issue: sims:~# iptables -A OUTPUT -m set --match-set testset src -j ACCEPT iptables: Invalid argument. Run `dmesg' for more information. In syslog: x_tables: ip_tables: set.3 match: invalid size 48 (kernel) != (user) 32 which was introduced by the counter extension in ipset. The patch fixes the alignment issue with introducing a new set match revision with the fixed underlying 'struct ip_set_counter_match' structure. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* | libxtables: find extensions based on family tooArturo Borrero2015-04-091-5/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When using libxtables with an external program (nft) which switches family contexts (using xtables_set_nfproto()), the xtables_find_{match,target} functions need to compare the family too. We want to avoid this situation: 1) user first sets afinfo to IPv6 2) xtables_find_target() finds & load ip6t_REJECT and uses it 3) afinfo change to IPv4 4) user then tries to use ipt_REJECT 5) xtables_find_target() finds ip6t_REJECT instead (same target name) 6) using ip6t_REJECT as ipt_REJECT can cause a lot of troubles Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | list: fix prefetch dummyArturo Borrero2015-04-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | linux_list.h:381:59: warning: right-hand operand of comma expression has no effect [-Wunused-value] for (pos = list_entry((head)->next, typeof(*pos), member), \ ^ libiptc.c:552:2: note: in expansion of macro 'list_for_each_entry' list_for_each_entry(c, &h->chains, list) { ^ [ Patch copied from one similar of Patrick McHardy on libnftnl ] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* | ebtables-compat: fix misplaced function attribute on ebt_print_error()Arturo Borrero Gonzalez2015-04-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | xtables-eb.c:305:1: warning: empty declaration } __attribute__((noreturn, format(printf,2,3))); ^ xtables-eb.c:311:2: warning: initialization makes '__attribute__((noreturn))' qualified function pointer from unqualified .exit_err = ebt_print_error, ^ Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | cgroup, man: improve man-page bitsDaniel Borkmann2015-04-081-5/+13
| | | | | | | | | | | | | | | | Document limitations when in use with INPUT until we found a better solution. Also fix up indent in the example section. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libxt_tcp: manpage correctionJiri Popelka2015-03-161-1/+0
| | | | | | | | | | | | | | | | | | | | $ iptables -A INPUT -m tcp --sport 6500:6400 -j ACCEPT iptables v1.4.21: invalid portrange (min > max) Error message added with d15fb34c Signed-off-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* | ebtables-compat: fix rule deleting with -D in rules with no targetArturo Borrero2015-03-131-1/+1
| | | | | | | | | | | | | | | | Before this patch, rule deleting with -D produces segfault in rules with no target. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ebtables-compat: add a bridge-specific exit_error functionArturo Borrero2015-03-131-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previous to this patch, error reporting in ebtables-compat was like: % ebtables-compat xxx (null) v1.4.21: Bad argument : 'xxx' Try `(null) -h' or '(null) --help' for more information. While the original ebtables was: % ebtables xxx Bad argument : 'xxx'. With this patch, we switch to: % ebtables-compat xxx Bad argument : 'xxx'. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ebtables-compat: add support for limit extensionArturo Borrero2015-03-132-0/+180
| | | | | | | | | | | | Add support for the ebtables limit extension (match), Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* | man: using physdev match in OUTPUT is not supported anymoreFlorian Westphal2015-03-061-11/+3
| | | | | | | | | | | | | | | | kernels 2.6.20 and later reject -m physdev in OUTPUT with "using --physdev-out in the OUTPUT, FORWARD and POSTROUTING chains for non-bridged traffic is not supported anymore" error in dmesg. Signed-off-by: Florian Westphal <fw@strlen.de>
* | arptables-compat: delete extra space in target printingArturo Borrero2015-03-051-1/+1
| | | | | | | | | | | | | | This is an extra space, let's get rid of it. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | arptables-compat: add support for the CLASSIFY targetArturo Borrero2015-03-051-12/+32
| | | | | | | | | | | | | | This patch adds support to arptables-compat for the CLASSIFY target. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ebtables-compat: support nflog extensionArturo Borrero2015-03-043-1/+147
| | | | | | | | | | | | | | Let's give support for the nflog extension (a watcher). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libxt_quota: fix _save() invert syntaxArturo Borrero2015-02-232-6/+3
| | | | | | | | | | | | | | Space is misplaced. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | iptables-compat: unset context flags in netlink delinearize stepPablo Neira Ayuso2015-02-224-18/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Once the data that the compare expression provides have been digested. For example: -A INPUT -i noexist -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT doesn't show anymore the following broken output via iptables-compat-save: -A INPUT -i +t -p udplite -s 10.10.10.10/32 -d 10.0.0.10/32 -j ACCEPT Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* | tests: remove old test casesFlorian Westphal2015-02-197-307/+0
| | | | | | | | | | | | | | Obsoleted by iptables-test.py in project root directory, see extensions/*.t for the new test cases. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: libip6t_dst: make inversion workFlorian Westphal2015-02-192-0/+3
| | | | | | | | | | | | The inversion flag wasn't set in the match struct. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions/libxt_recent.t: add test case for 3.19 regressionFlorian Westphal2015-02-191-2/+6
| | | | | | | | | | | | fail with vanilla 3.19. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: SNPT,DNPT: fix save/print outputFlorian Westphal2015-02-194-8/+10
| | | | | | | | | | | | | | wrong placement of ' ', i.e. we get -j SNPT--src-pfx dead::/64 --dst-pfx 1c3::/64 Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: add more test cases for iptables-test.pyFlorian Westphal2015-02-1942-0/+231
| | | | | | | | | | | | | | | | | | | | Instead of using iptables-save-formatted files in the tests/ dir, lets use the iptables-test.py framework for all matches/targets. This obsoletes tests/ completely, will be removed in followup patch. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: remove 'unclean' matchFlorian Westphal2015-02-192-17/+0
| | | | | | | | | | | | removed from kernel in 2003. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: remove SAME targetFlorian Westphal2015-02-193-223/+0
| | | | | | | | | | | | removed from the kernel December 2007. Signed-off-by: Florian Westphal <fw@strlen.de>
* | extensions: remove MIRRORFlorian Westphal2015-02-192-27/+0
| | | | | | | | | | | | removed from the kernel back in 2003. Signed-off-by: Florian Westphal <fw@strlen.de>
* | xtables-compat: remove unused fields from bridge and arp familiesPablo Neira Ayuso2015-02-181-10/+3
| | | | | | | | | | | | | | | | | | These two families only work under nft compat, so leave unset the fields that we don't use. Basically, we need neither the module autoload code nor the native get/setsockopt() revision infrastructure since we use the one that nft_compat provides through nfnetlink. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | arptables-compat: add mangle target extensionArturo Borrero2015-02-186-45/+282
| | | | | | | | | | | | | | | | This patch adds support to use the mangle target extensions, along with the required changes in the surrounding code. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | xshared: calm down compilation warningPablo Neira Ayuso2015-02-181-0/+1
| | | | | | | | | | | | | | xshared.c: In function ‘xtables_lock’: xshared.c:255:3: warning: implicit declaration of function ‘flock’ [-Wimplicit-function-declaration] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | tests: add test case for xt_recent regressionFlorian Westphal2015-02-131-0/+3
| | | | | | | | | | | | | | fails on 3.19 kernel: xt_recent: hitcount (8) is larger than packets to be remembered (8) for table foo Signed-off-by: Florian Westphal <fw@strlen.de>
* | tests: split into family and table specific filesFlorian Westphal2015-02-138-69/+107
| | | | | | | | | | | | | | also add simple script to restore/save them. run_qa.sh passes on standard-distro kernels. Signed-off-by: Florian Westphal <fw@strlen.de>
* | Merge branch 'ebtables-compat'Pablo Neira Ayuso2015-02-1130-33/+3825
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ebtables-compat branch provides the compatibility layer to run ebtables extensions. Currently, only the following matches / targets / watchers are supported: * 802_3 * ip * mark_m and mark * log The remaining ones should be easy to port them to on top of libxtables, they will follow up later.
| * | ebtables-compat: add log watcher extensionArturo Borrero2015-02-111-0/+197
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the log 'watcher' extension. The work was started by Giuseppe Longo <giuseppelng@gmail.com> and finised by me. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: add watchers supportArturo Borrero2015-02-115-19/+190
| | | | | | | | | | | | | | | | | | | | | ebtables watchers are targets which always return EBT_CONTINUE. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: add mark target extensionArturo Borrero2015-02-032-0/+214
| | | | | | | | | | | | | | | | | | | | | Translate the mark target extension to the xtables-compat environment. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: finish target infrastructureArturo Borrero2015-02-032-40/+70
| | | | | | | | | | | | | | | Signed-off-by: Arturo Borrero <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: call extensions final checksArturo Borrero2015-02-034-33/+23
| | | | | | | | | | | | | | | | | | | | | Let's call extensions final checks. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | libxtables: search first for AF-specific extensionArturo Borrero2015-01-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are some extension which may name-clash, for example: * libxt_mark.so * liebt_mark.so Let's search first for AF-specific extension and then for the generic libxt_**. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | extensions: cleanup commented code in ebtables-compat extensionsArturo Borrero2015-01-302-45/+0
| | | | | | | | | | | | | | | | | | | | | | | | This code can be cleaned up. No need for validation from userspace, the kernel will reject incorrect options. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: add mark_m match extensionArturo Borrero2015-01-303-0/+133
| | | | | | | | | | | | | | | | | | | | | Translate mark_m match extension to the xtables-compat environment. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: add 'ip' match extensionArturo Borrero2015-01-283-0/+371
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the 'ip' match extension to ebtables-compat. It involves adapting old ebtables extension code to the xtables-compat environment. For testing: % sudo ebtables-compat -p 0x0800 --ip-src 1.1.1.1 -j ACCEPT The patch includes a cached copy of the extension kernel header. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: fix nft payload basesArturo Borrero2015-01-285-15/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ebtables should use NFT_PAYLOAD_LL_HEADER to fetch basic payload information from packets in the bridge family. Let's allow the add_payload() function to know in which base it should work. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: include rule counters in ebtables rulesArturo Borrero2015-01-281-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Counters are missing in ebtables rules. This patch includes them just before the target, so counters are incremented when the rule is about to take his action. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: prevent same matches to be included multiple timesArturo Borrero2015-01-281-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using two matches options results in two copies of the match being included in the nft rule. Example before this patch: % ebtables-compat -A FORWARD -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT % ebtables-compat -L [...] -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT Example with this patch: % ebtables-compat -A FORWARD -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT % ebtables-compat -L [...] % -p 0x0800 --ip-src 10.0.0.1 --ip-dst 10.0.0.2 -j ACCEPT [Note: the br_ip extension comes in a follow-up patch] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: prevent options overwriteArturo Borrero2015-01-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Parsing options will be overwritten if every time we load a match the extension options are merged to the original options. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: add nft rule compat information to bridge rulesArturo Borrero2015-01-281-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | The compat information is required by some ebtables extensions to properly work. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | include: cache copy of Linux header uapi/linux/netfilter_bridge/ebt_802_3.hArturo Borrero2015-01-281-0/+63
| | | | | | | | | | | | | | | | | | | | | | | | Cache a copy of Linux header uapi/linux/netfilter_bridge/ebt_802_3.h which contains the struct ebt_802_3_info definition. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: fix ACCEPT printing by simplifying logicArturo Borrero2015-01-281-16/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The commit bc543af ("ebtables-compat: fix segfault in rules w/o target") doesn't handle all possible cases of target printing, and ACCEPT is left behind. BTW, the logic of target (-j XXX) printing is a bit weird. This patch simplifies it. I assume: * cs->jumpto is only filled by nft_immediate. * cs->target is only filled by nft_target. So we end with these cases: * nft_immediate contains a 'standard' target (ACCEPT, DROP, CONTINUE, RETURN, chain) Then cs->jumpto contains the target already. We have the rule. * No standard target. If nft_target contains a target, try to load it. * Neither nft_target nor nft_immediate exist. Then, assume CONTINUE. The printing path is then straight forward: either cs.jumpto or cs.target contains the target. As there isn't support for target extensions yet, there is no way to test the nft_target (cs.target) path. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: include /etc/ethertypes in tarballArturo Borrero2015-01-072-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | The /etc/ethertypes file was originally distributed by the ebtables tarball. So, let's include the file also in ebtables-compat, so users can keep using protocol names instead of the hex code. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: fix segfault in rules w/o targetArturo Borrero2015-01-061-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a segfault in rules without target. Now, these two rules are allowed: % ebtables-compat -A FORWARD -p 0x0600 -j CONTINUE % ebtables-compat -A FORWARD -p 0x0600 And both are printed: Bridge chain: FORWARD, entries: 1, policy: ACCEPT -p 0x600 -j CONTINUE Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | ebtables-compat: fix printing of extensionArturo Borrero2015-01-053-17/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fix printing of ebt extensions: % sudo ebtables-compat -L [...] Bridge chain: FORWARD, entries: 1, policy: ACCEPT --802_3-type 0x0012 -j ACCEPT [...] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>