summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* man: more backslash-encoding of charactersJan Engelhardt2023-11-137-83/+83
| | | | | | | | "-" is the dash, "\-" is minus as we know, but groff lists some more characters: "^" is "modifier circumflex" and "~" is "modifier tilde", which, too, need to be escaped for our use. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: limit targets for -P option synopsisJan Engelhardt2023-11-132-2/+2
| | | | | | Do not suggest that -P could be used with arbitrary targets. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: copy synopsis markup from iptables.8 to arptables-nft.8Jan Engelhardt2023-11-131-14/+28
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: stop putting non-terminals in italicJan Engelhardt2023-11-131-3/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: repeal manual hyphenationJan Engelhardt2023-11-131-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: remove lone .nh commandJan Engelhardt2023-11-131-2/+0
| | | | | | | No other manpage files use .nh, and I cannot see a reason iptables-apply would exceptionally need it. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* man: consistent use of \(em in Name sectionsJan Engelhardt2023-11-137-7/+7
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* extensions: libarpt_standard.t: Add a rule with builtin option masksPhil Sutter2023-11-091-0/+1
| | | | | | | | Just some random values in hope this starts failing if masks support changes or breaks. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* arptables: Fix --proto-type mask formattingPhil Sutter2023-11-092-1/+5
| | | | | | | | | | | | | | | | | | Arptables accepts numeric --proto-type values and masks in any numeral system identified by (absence of) prefix. Yet it prints the mask value in hex without '0x'-prefix, breaking save and restore the same way numeric --h-type output did. In theory, this could be fixed either by adding the missing prefix or printing the mask in decimal (like most other builtin matches do), but since the value is printed in hex with prefix already, align mask output with that. Also a day 1 bug and consistent with legacy, so no Fixes: tag here as well. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* arptables: Fix formatting of numeric --h-type outputPhil Sutter2023-11-092-3/+5
| | | | | | | | | | | | | | | | | Arptables expects numeric arguments to --h-type option in hexadecimal form, even if no '0x'-prefix is present. In contrast, it prints such values in decimal. This is not just inconsistent, but makes it impossible to save and later restore a ruleset without fixing up the values in between. Assuming that the parser side can't be changed for compatibility reasons, fix the output side instead. This is a day 1 bug and present in legacy arptables as well, so treat this as a "feature" of arptables-nft and omit a Fixes: tag. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* extensions: MARK: fix arptables supportFlorian Westphal2023-11-072-0/+11
| | | | | | | | | | | | arptables "--set-mark" is really just "--or-mark". This bug is also in arptables-legacy. Fix this and add test cases. Note that the test for "16" vs. "0x16" is intentional, arptables parser is buggy and always uses "%x". Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables-txlate: add test casesFlorian Westphal2023-11-073-1/+15
| | | | | | | | | | | | | | | Add test cases for libarpt_mangle and extend the generic tests to cover basic arptables matches. Note that there are several historic artefacts that could be revised. For example, arptables-legacy and arptables-nft both ignore "-p" instead of returning an error about an unsupported option. The ptype could be hard-wired to 0x800 and set unconditionally. OTOH, this should always match for ethernet arp packets anyway. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-arp: add arptables-translateFlorian Westphal2023-11-075-1/+236
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-arp: add missing mask supportFlorian Westphal2023-11-072-2/+27
| | | | | | | | | | arptables-legacy supports masks for --h-type, --opcode and --proto-type, but arptables-nft did not. Add this. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix corner-case noflush restore bugPhil Sutter2023-11-072-0/+27
| | | | | | | | | | Report came from firwalld, but this is actually rather hard to trigger. Since a regular chain line prevents it, typical dump/restore use-cases are unaffected. Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") Cc: Eric Garver <eric@garver.life> Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables-nft: remove ARPT_INV flags usageFlorian Westphal2023-11-033-4/+6
| | | | | | | | | | | | | | | | | | | | | | ARPT_ and IPT_INV flags are not interchangeable, e.g.: define IPT_INV_SRCDEVADDR 0x0080 define ARPT_INV_SRCDEVADDR 0x0010 as these flags can be tested by libarp_foo.so such checks can yield incorrect results. Because arptables-nft uses existing code, e.g. xt_mark, it makes sense to unify this completely by converting the last users of ARPT_INV_ constants. Note that arptables-legacy does not do run-time module loading via dlopen(). Functionaliy implemented by "extensions" in the arptables-legacy git tree are built-in, so this doesn't break arptables-legacy binaries. Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: reveal rateest's combination categoriesPhil Sutter2023-10-271-4/+8
| | | | | | | | The .\" prefix made these paragraphs invisible in at least regular man page output. Turn them into tags instead. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: use .TP for lists in xt_osf man pagePhil Sutter2023-10-271-12/+22
| | | | | | | | Value and description are more clearly set apart. Using .RS/.RE pairs also adds proper indenting. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: use native bullet point markupJan Engelhardt2023-10-271-12/+17
| | | | | | | | Replace some "fake" bullet point by the official syntax/markup for bulleted lists. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: grammar fixes to some manpagesJan Engelhardt2023-10-272-6/+6
| | | | | | | | | English generally uses open compounds rather than closed ones; fix the excess hyphens in words. Fix a missing dash for the portnr option as well. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: consistent casing of "IPv[46]"Jan Engelhardt2023-10-272-2/+2
| | | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: encode hyphens the way groff/man requires itJan Engelhardt2023-10-272-2/+2
| | | | | | | | | | Edit a few spots where indeed a hyphens (U+2010) rather than U+002D is desired. ("set-name" is not something you input, it is a placeholder in the context of documentation. "out-of-flow" is part of the regular flowed text, so should not use anything but hyphens.) Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: encode emdash the way groff/man requires itJan Engelhardt2023-10-274-4/+4
| | | | | | | | | Unlike LaTeX, two/three U+002D in the source do not translate to an en and em-dash in man. Using \(en and \(em, respectively, addresses this. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: encode minushyphen the way groff/man requires itJan Engelhardt2023-10-2727-52/+55
| | | | | | | | | | | | | | Sparked by a recent LWN article[1], sweeps over the iptables manpages for incorrectly encoded dashes was made by Phil Sutter and myself. An ASCII minushyphen in the source manpage translates to a hyphen in output, so one has to use the sequence "\-" to get a minushyphen in the output, as groff_char(7) explains. [1] https://lwn.net/Articles/947941/ (paywalled until about 2023-11-06) Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: display number ranges with an en dashJan Engelhardt2023-10-275-22/+22
| | | | | | | | For ranges, en dashes should be used; cf. e.g. https://en.wikipedia.org/wiki/Dash#En_dash . Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: string: Adjust description of --to to recent kernel changesPhil Sutter2023-10-251-6/+3
| | | | | | | | | | | | | | This reverts commit 920ece2b392fb83bd26416e0e6f8f6a847aacbaa. Since kernel commit c4eee56e14fe ("net: skb_find_text: Ignore patterns extending past 'to'"), pattern scanning no longer happens past --to offset even if skb_seq_read() returned a larger block. Point this out in the description and also drop the '-1' offset which is not true as kernel's selftest in tools/testing/selftests/netfilter/xt_string.sh shows. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1707 Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: string: Clarify description of --toPhil Sutter2023-10-121-2/+6
| | | | | | | | String match indeed returns a match as long as the given pattern starts in the range of --from and --to, update the text accordingly. Also add a note regarding fragment boundaries. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1707
* libiptc: Fix for another segfault due to chain index NULL pointerPhil Sutter2023-10-122-0/+36
| | | | | | | | | | | | Chain rename code missed to adjust the num_chains value which is used to calculate the number of chain index buckets to allocate during an index rebuild. So with the right number of chains present, the last chain in a middle bucket being renamed (and ending up in another bucket) triggers an index rebuild based on false data. The resulting NULL pointer index bucket then causes a segfault upon reinsertion. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1713 Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc")
* configure: Bump version for 1.8.10 releasev1.8.10Pablo Neira Ayuso2023-10-101-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Bump dependency on libnftnlPhil Sutter2023-09-301-1/+1
| | | | | | | | Recently added support for broute table emulation requires libnftnl version 1.2.6. Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") Signed-off-by: Phil Sutter <phil@nwl.cc>
* include: linux: Update kernel.hPhil Sutter2023-09-143-25/+65
| | | | | | | | | | | | | | | | | | | | | Its contents were moved into const.h and sysinfo.h, apply these changes to the cached copies. Fixes for the following warning when compiling xtables-monitor.c with new kernel headers in /usr/include: | In file included from ../include/linux/netfilter/x_tables.h:3, | from ../include/xtables.h:19, | from xtables-monitor.c:36: | ../include/linux/kernel.h:7: warning: "__ALIGN_KERNEL" redefined | 7 | #define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1) | | | In file included from /usr/include/linux/netlink.h:5, | from /home/n0-1/git/libmnl/install/include/libmnl/libmnl.h:9, | from xtables-monitor.c:30: | /usr/include/linux/const.h:31: note: this is the location of the previous definition | 31 | #define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1) | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for useless meta expressions in rulePhil Sutter2023-09-149-72/+36
| | | | | | | | | | | | | | | | | | | A relict of legacy iptables' mandatory matching on interfaces and IP addresses is support for the '-i +' notation, basically a "match any input interface". Trying to make things better than its predecessor, iptables-nft boldly optimizes that nop away - not entirely though, the meta expression loading the interface name was left in place. While not a problem (apart from pointless overhead) in current HEAD, v1.8.7 would trip over this as a following cmp expression (for another match) was incorrectly linked to that stale meta expression, loading strange values into the respective interface name field. While being at it, merge and generalize the functions into a common one for use with ebtables' NFT_META_BRI_(I|O)IFNAME matches, too. Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1702 Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix for ineffective 0007-mid-restore-flush_0Phil Sutter2023-09-141-5/+5
| | | | | | | | | | | | | The test did not catch non-zero exit status of the spawned coprocess. To make it happen, Drop the line killing it (it will exit anyway) and pass its PID to 'wait'. While being at it, put the sleep into the correct spot (otherwise the check for chain 'foo' existence fails as it runs too early) and make said chain existence check effective. Fixes: 4e3c11a6f5a94 ("nft: Fix for ruleset flush while restoring") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Fix checking of conntrack --ctproto 0Quentin Armitage2023-09-142-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are three issues in the code: 1) the check (sinfo->invflags & XT_INV_PROTO) is using the wrong mask 2) in conntrack_mt_parse it is testing (info->invert_flags & XT_INV_PROTO) before the invert bit has been set. 3) the sense of the error message is the wrong way round 1) To get the error, ! -ctstatus XXX has to be specified, since XT_INV_PROTO == XT_CONNTRACK_STATUS e.g. | iptables -I CHAIN -m conntrack ! --ctstatus ASSURED --ctproto 0 ... 3) Unlike --proto 0 (where 0 means all protocols), in the conntrack match --ctproto 0 appears to mean protocol 0, which can never be. Therefore --ctproto 0 could never match and ! --ctproto 0 will always match. Both of these should be rejected, since the user clearly cannot be intending what was specified. The attached patch resolves the issue, and also produces an error message if --ctproto 0 is specified (as well as ! --ctproto 0 ), since --ctproto 0 will never match, and ! --ctproto 0 will always match. [Phil: - Added Fixes: tag - it's a day 1 bug - Copied patch description from Bugzilla - Reorganized changes to reduce diff - Added test cases] Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=874 Fixes: 5054e85be3068 ("general conntrack match module userspace support files") Signed-off-by: Quentin Armitage <quentin@armitage.org.uk> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert --compat option related commitsPhil Sutter2023-09-0120-198/+35
| | | | | | | | | | | | | | | | | | | This reverts the following commits: b14c971db6db0 ("tests: Test compat mode") 11c464ed015b5 ("Add --compat option to *tables-nft and *-nft-restore commands") ca709b5784c98 ("nft: Introduce and use bool nft_handle::compat") 402b9b3c07c81 ("nft: Pass nft_handle to add_{target,action}()") This implementation of a compatibility mode implements rules using xtables extensions if possible and thus relies upon existence of those in kernel space. Assuming no viable replacement for the internal mechanics of this mode will be found in foreseeable future, it will effectively block attempts at deprecating and removing of these xtables extensions in favor of nftables expressions and thus hinder upstream's future plans for iptables. Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: fix example of xt_cpuVictor Julien2023-08-291-2/+2
| | | | | | | | | REDIRECT uses --to-ports instead of --to-port. Fixes: 2d59208943a3 ("extension: add xt_cpu match") Signed-off-by: Victor Julien <victor@inliniac.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Test compat modePhil Sutter2023-08-112-4/+78
| | | | | | | | | | Extend iptables-test.py by a third mode, which is using xtables-nft-multi and passing --compat to all calls creating rules. Also add a shell testcase asserting the effectiveness of --compat by comparing debug (-vv) output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Add --compat option to *tables-nft and *-nft-restore commandsPhil Sutter2023-08-1111-13/+95
| | | | | | | | | | | | | | | The flag sets nft_handle::compat boolean, indicating a compatible rule implementation is wanted. Users expecting their created rules to be fetched from kernel by an older version of *tables-nft may use this to avoid potential compatibility issues. Changes since v1: - Expect short option '-C' in {ip,ip6,eb}tables-nft-restore command line parser - Support -C/--compat in arptables-nft-restore, too - Update man pages with the new flag Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Introduce and use bool nft_handle::compatPhil Sutter2023-08-113-5/+8
| | | | | | | | If set, create rules using compat expressions where possible and disable the bitwise expression avoidance introduced in 323259001d617 ("nft: Optimize class-based IP prefix matches"). Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Pass nft_handle to add_{target,action}()Phil Sutter2023-08-116-13/+17
| | | | | | Prepare for varying rule content based on a global flag. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Use SOCK_CLOEXEC/O_CLOEXEC where availablePhil Sutter2023-08-103-27/+4
| | | | | | | | | | | | No need for the explicit fcntl() call, request the behaviour when opening the descriptor. One fcntl() call setting FD_CLOEXEC remains in extensions/libxt_bpf.c, the indirect syscall seems not to support passing the flag directly. Reported-by: Gaurav Gupta <g.gupta@samsung.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1104 Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Test chain policy counter behaviourPhil Sutter2023-08-101-0/+78
| | | | | | Test the last two fixes in that area. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert "libiptc: fix wrong maptype of base chain counters on restore"Phil Sutter2023-08-101-1/+1
| | | | | | | | | | | | | This reverts commit 7c4d668c9c2ee007c82063b7fc784cbbf46b2ec4. The change can't be right: A simple rule append call will reset all built-in chains' counters. The old code works fine even given the mentioned "empty restore" use-case, at least if counters don't change on the fly in-kernel. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=912 Fixes: 7c4d668c9c2ee ("libiptc: fix wrong maptype of base chain counters on restore") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Create builtin chains with counters enabledPhil Sutter2023-08-101-6/+8
| | | | | | | | | | | | | | The kernel enables policy counters for nftables chains only if NFTA_CHAIN_COUNTERS attribute is present. For this to be generated, one has to set NFTNL_CHAIN_PACKETS and NFTNL_CHAIN_BYTES attributes in the allocated nftnl_chain object. The above happened for base chains only with iptables-nft-restore if called with --counters flag. Since this is very unintuitive to users, fix the situation by adding counters to base chains in any case. Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: iptables-test: Fix command segfault reportsPhil Sutter2023-08-101-3/+6
| | | | | | | Logging produced a stack trace due to undefined variable 'cmd'. Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-ruleparse: parse meta mark set as MARK targetFlorian Westphal2023-08-101-12/+28
| | | | | | | | | | | | | | | | | | Mixing nftables and iptables-nft in the same table doesn't work, but some people do this. v1.8.8 ignored rules it could not represent in iptables syntax, v1.8.9 bails in this case. Add parsing of meta mark expressions so iptables-nft can render them as -j MARK rules. This is flawed, nft has features that have no corresponding syntax in iptables, but we can't undo this. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1659 Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft-ruleparse: Introduce nft_create_target()Phil Sutter2023-08-106-87/+52
| | | | | | | | | | | | | | | | Like nft_create_match(), this is a small wrapper around the typical target extension lookup and (standard) init code. To use it from nft_parse_target() and nft_parse_log(), introduce an inner variant which accepts the target payload size as parameter. The call to rule_parse_ops::target callback was problematic with standard target, because the callbacks initialized iptables_command_state::jumpto with the target name, "standard" in that case. Perform its tasks in nft_create_target(), keep it only for bridge family's special handling of watcher "targets". Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libip6t_icmp: Add names for mld-listener typesPhil Sutter2023-08-052-0/+11
| | | | | | | Add the three names (plus one alias) just as in nftables. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1250 Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: move processing logic out of assertsJan Palus2023-08-052-6/+17
| | | | | | | | | | [Phil: Introduce assert_nft_restart() to keep things clean, also add fallback returns to nft_action() and nft_prepare(), sanitizing things at least a bit.] Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1487 Signed-off-by: Jan Palus <atler@pld-linux.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: iptables-save.8: Start paragraphs in upper-casePhil Sutter2023-08-051-2/+2
| | | | | | | Also add a missing full stop. Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages") Signed-off-by: Phil Sutter <phil@nwl.cc>