summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* build: remove unused `AM_VERBOSE_CXX*` variablesJeremy Sowden2023-12-151-2/+0
| | | | | | | There is no C++, so these variables are not required. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: remove obsolete `AM_LIBTOOL_SILENT` variableJeremy Sowden2023-12-151-1/+0
| | | | | | | It doesn't do anything, so get rid of it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: format `AM_CPPFLAGS` variablesJeremy Sowden2023-12-152-2/+17
| | | | | Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Fix spelling mistakesJeremy Sowden2023-12-129-11/+11
| | | | | | | | Corrections for several spelling mistakes, typo's and non-native usages in man-pages and error-messages. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Use do_parse() from xsharedPhil Sutter2023-12-057-1079/+341
| | | | | | | | | | | | | | | | | | | Drop the custom commandline parsers from ebtables and ebtables-translate, extend and use the shared one instead. ebtables gains a few new features from doing this: - Rule counters may be specified in the '-c N,M' syntax - Support for --replace command - Support for --list-rules command - Zero individual rules There is one known regression in this patch, namely maximum chain name length shrinks to 28 characters (from 32). Since this limit changed for iptables in the past as well (e.g. with commit 5429b41c2bb4a), assume nobody really relies upon it anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce option_test_and_reject()Phil Sutter2023-12-051-10/+11
| | | | | | Just a small helper eliminating the repetitive code there. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Use struct xt_cmd_parsePhil Sutter2023-12-051-23/+36
| | | | | | | This is merely to reduce size of the parser merge patch, no functional change intended. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Make 'h' case just a call to print_help()Phil Sutter2023-12-052-31/+31
| | | | | | | | | Move the special ebtables help parameter handling into its print_help() function to prepare for it turning into a callback. Add new field 'argc' to struct iptables_command_state to make this possible. It is actually kind of consistent as it holds 'argv' already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Pass struct iptables_command_state to print_help()Phil Sutter2023-12-051-6/+5
| | | | | | | | Parameters passed by the sole caller came from there already, apart from 'table' which is not used (ebtables-nft does not have per-table help texts). Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Change option values to avoid clashesPhil Sutter2023-12-052-19/+19
| | | | | | | | In order to parse input using do_parse(), distinct ebtables option's values have to be distinct from others. Since arptables uses values 2-8 already, resort to values >10. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables{,-translate}: Convert if-clause to switch()Phil Sutter2023-12-052-29/+41
| | | | | | | Parser merge prep work, align final do_commandeb*() parts with do_commandx(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Support for ebtables' --change-counters commandPhil Sutter2023-12-053-9/+66
| | | | | | | | | This is tricky because the short-option clashes with the --check command. OTOH, ebtables supports --check as well (though without short-option), so making do_parse() detect ebtables based on struct xtables_args::family is probably still the least messy option. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Support rule range deletion in do_parse()Phil Sutter2023-12-052-1/+35
| | | | | | | | This is a distinct ebtables feature. Introduce struct xt_cmd_parse::rule_ranges boolean indicating support for it and bail otherwise if a range was specified by the user. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce print_help callback (again)Phil Sutter2023-12-057-3/+10
| | | | | | | | Prep work for ebtables parser to use do_parse(). Adding more special casing to xtables_printhelp() causes a mess, so work with a callback again. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Turn command_default() into a callbackPhil Sutter2023-12-057-3/+12
| | | | | | | | Ebtables' variant is pretty different since all extensions are loaded up front and some targets serve as "watcher" extensions, so let variants specify the function to call for extension parameters. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Perform protocol value parsing in callbackPhil Sutter2023-12-052-9/+14
| | | | | | | | The code is same in iptables and ip6tables, but different in ebtables. Therefore move it into the callback to keep that part of do_parse() generic. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: do_parse: Skip option checking for CMD_DELETE_NUMPhil Sutter2023-12-051-1/+0
| | | | | | | This command will delete a rule by its number, not rule spec. No -i/-o options are expected on commandline. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Fix for non-CIDR-compatible hostmasksPhil Sutter2023-11-291-0/+5
| | | | | | | | | | | | | | | | | | | In order to parse the mask, xtopt_parse_hostmask() calls xtopt_parse_plenmask() thereby limiting netmask support to prefix lengths (alternatively specified in IP address notation). In order to lift this impractical restriction, make xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may fall back to xtopt_parse_mask() which correctly initializes val.hmask itself and indicates non-CIDR-compatible masks by setting val.hlen to -1. So in order to support these odd masks, it is sufficient for xtopt_parse_plenmask() to skip its mask building from val.hlen value and take whatever val.hmask contains. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Fix for garbage access in xtables_options_xfrm()Phil Sutter2023-11-291-1/+2
| | | | | | | | | | Allocation of the temporary array did not account for a terminating NULL entry, causing array boundary overstepping in the called xtables_merge_options(), causing spurious errors in extension parameter parsing. Fixes: ed8c3ea4015f0 ("libxtables: Combine the two extension option mergers") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: Do not escape exclamation marksPhil Sutter2023-11-292-2/+2
| | | | | | | | | | This appears to be not necessary, also mandoc complains about it: | mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Leave interface masks alone when parsing from kernelPhil Sutter2023-11-296-36/+16
| | | | | | | | The mask is entirely unused by nft-variants in general and legacy ones when printing. It is relevant only when inserting a legacy rule into kernel as it doesn't detect the '+'-suffix. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Do not populate interface masks per defaultPhil Sutter2023-11-294-11/+48
| | | | | | | | | These are needed by legacy variants only, so introduce a simplified xtables_parse_interface() replacement which does not deal with them and a small function which sets the mask based on given interface name for use by legacy tools. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Entirely ignore interface masks when saving rulesPhil Sutter2023-11-296-38/+12
| | | | | | | Rule printing code does this for more than 20 years now, assume it's safe to rely upon the wildcard interface name to contain a '+' suffix. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Simplify generic_opt_check()Phil Sutter2023-11-291-49/+28
| | | | | | | | | | The option/command matrix does not contain any '+' entries anymore, so each option/command combination is either allowed (and optional) or not. Reduce the matrix to an array of unsigned ints which specify the commands a given option is allowed with. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xt_cmd_parse_ops::option_invertPhil Sutter2023-11-297-24/+34
| | | | | | | | | Replace the awkward inverse_for_options array with basically a few switch() statements clearly identifying the relation between option and inverse values and relieve callers from having to find the option flag bit's position. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce xt_cmd_parse_ops::option_namePhil Sutter2023-11-297-66/+100
| | | | | | | | | | | | The old opt2char() function was flawed: Since not every field in optflags contains a printable character, typical use of its return value in print statements could lead to garbage on screen. Replace this by a mechanism to retrieve an option's long name which supports family-specific overrides. and get rid of optflags field altogether and define NUMBER_OF_OPT similar to NUMBER_OF_CMD. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: proper roff encoding for ~ and ^Jan Engelhardt2023-11-275-20/+20
| | | | | | Fixes: v1.8.10-28-g4b0c168a Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: MARK: arptables: Use guided option parserPhil Sutter2023-11-231-67/+15
| | | | | | | | | | | It expects mark values in hex which is possible by setting the base field. The only adjustment needed to use the revision 2 parser is to fill the mask for --set-mark: With XTTYPE_MARKMASK32, an omitted mask sets all mask bits, XTTYPE_UINT32 leaves it uninitialized, though. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libarpt_mangle: Use guided option parserPhil Sutter2023-11-232-84/+48
| | | | | | | | | | | | | Sadly not the best conversion, struct arpt_mangle is not ideal for use as storage backend: With MAC addresses, xtopt_parse_ethermac() refuses to write into *_devaddr fields as they are larger than expected. With XTTYPE_HOSTMASK OTOH, XTOPT_PUT is not supported in the first place. As a side-effect, network names (from /etc/networks) are no longer accepted. But earlier migrations to guided option parser had this side-effect as well, so probably not a frequently used feature. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce struct xt_option_entry::basePhil Sutter2023-11-232-2/+4
| | | | | | | Enable guided option parser users to parse integer values with a fixed base. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce xtables_strtoul_base()Phil Sutter2023-11-232-5/+13
| | | | | | | | Semantically identical to xtables_strtoul() but accepts the base as parameter so callers may force it irrespective of number prefix. The old xtables_strtoul() becomes a shallow wrapper. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Fix guided option parser for use with arptablesPhil Sutter2023-11-231-5/+18
| | | | | | | | With an unexpected value in afinfo->family, guided option parser was rather useless when called from arptables extensions. Introduce afinfo_family() wrapper to sanitize at least NFPROTO_ARP value. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Combine the two extension option mergersPhil Sutter2023-11-231-43/+8
| | | | | | | | | | For extending the command parser's struct option array, there is xtables_merge_options() and xtables_options_xfrm(). Since their bodies were almost identical, make the latter a wrapper of the former by transforming the passed struct xt_option_entry array into a temporary struct option one before handing over. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Implement --change-counters commandPhil Sutter2023-11-236-20/+197
| | | | | | | | Treat it like --replace against the same rule with changed counters. The operation is obviously not atomic, so rule counters may change in kernel while the rule is fetched, modified and replaced. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: do_parse: Ignore '-j CONTINUE'Phil Sutter2023-11-231-1/+2
| | | | | | | | | | | While iptables does not support his NOP, arptables man page claims it does (although legacy arptables rejects it) and ebtables prefers to print it instead of omitting the '-j' option. Accept and ignore the target when parsing to at least fix for arptables-nft and prepare for ebtables-nft using do_parse() as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Align line number formatting with legacyPhil Sutter2023-11-231-1/+1
| | | | | | | | Legacy ebtables appends a dot to the number printed in first column if --Ln flag was given. Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Make ebt_load_match_extensions() staticPhil Sutter2023-11-232-2/+1
| | | | | | The function is not used outside of xtables-eb.c. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Drop append_entry() wrapperPhil Sutter2023-11-231-22/+4
| | | | | | There is no point in having it when there is no code to share. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate: Print failing command linePhil Sutter2023-11-231-2/+3
| | | | | | | | If the command segfaults, 'error' variable is empty and the resulting error message is even misleading as the called program may not have been iptables-translate. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Drop pointless CMD_REPLACE checkPhil Sutter2023-11-231-5/+0
| | | | | | | | All current users set default source and destination addresses in their post_parse callbacks, so legacy variants are safe and nft variants don't have this restriction anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Drop needless assignment in --help casePhil Sutter2023-11-231-3/+0
| | | | | | | Help text printing code does not refer to optarg, so there is no need to assign to it if unset. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: All variants support -v, update OPTSTRING_COMMONPhil Sutter2023-11-231-4/+4
| | | | | Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: struct xt_cmd_parse::xlate is unusedPhil Sutter2023-11-232-2/+0
| | | | | | | | | | Drop the boolean, it was meant to disable some existence checks in do_parse() prior to the caching rework. Now that do_parse() runs before any caching is done, the checks in question don't exist anymore so drop this relict. Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-bridge: nft_bridge_add() uses wrong flagsPhil Sutter2023-11-231-2/+2
| | | | | | | | | When checking whether -s or -d was given, invflags were used by accident. This change has no functional effect since the values remain the same, but this way it's clear where the previously assigned flags are used. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Install arptables-translate link and man pagePhil Sutter2023-11-232-8/+15
| | | | | | | | While at it, introduce a variable to hold the various semantic links to xtables-translate.8 man page. Fixes: 5b7324e0675e3 ("nft-arp: add arptables-translate") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: more backslash-encoding of charactersJan Engelhardt2023-11-137-83/+83
| | | | | | | | "-" is the dash, "\-" is minus as we know, but groff lists some more characters: "^" is "modifier circumflex" and "~" is "modifier tilde", which, too, need to be escaped for our use. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: limit targets for -P option synopsisJan Engelhardt2023-11-132-2/+2
| | | | | | Do not suggest that -P could be used with arbitrary targets. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: copy synopsis markup from iptables.8 to arptables-nft.8Jan Engelhardt2023-11-131-14/+28
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: stop putting non-terminals in italicJan Engelhardt2023-11-131-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: repeal manual hyphenationJan Engelhardt2023-11-131-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>