summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* xtables-compat: remove nft_is_ruleset_compatibleFlorian Westphal2018-05-254-49/+27
| | | | | | | | | | | Use nft_is_table_compatible instead as only helper to a 'skip' decision. Custom tables, tables that have extra base chains that iptables syntax doesn't allow or rules that have special constructs line nftables set lookups or verdict maps are not listed, but a message is provided to show that such table exists. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: allow dumping of chains in specific tableFlorian Westphal2018-05-254-14/+24
| | | | | | | | | | This is used by a followup patch to avoid continuing the 'dump everything and then ignore what we don't need' model. Places that know they only need a particular table 'iptables-save -t filter' can ask the kernel to limit this for us. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: inconsistent error reporting for -X and no empty chainPablo Neira Ayuso2018-05-231-0/+2
| | | | | | | | | | | | | # iptables-compat -N coffee # iptables-compat -I coffee # iptables-compat -X coffee iptables: Device or resource busy. While it should say: iptables: Directory not empty. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-compat: add arp match extensionFlorian Westphal2018-05-212-0/+491
| | | | | | no translation yet, might be doable with raw payload expressions though. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add redirect match extensionFlorian Westphal2018-05-212-0/+110
| | | | | | | | | | No translation. The kernel match will alter packet type (meta set pkttype), but also replace dst mac with the bridges' mac address, however nft currently doesn't allow to retrieve this at runtime. So just add this without the xlate part for now. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-compat: add nat match extensionsFlorian Westphal2018-05-215-0/+300
| | | | | | | | adds snat and dnat. Translation for snat isn't complete, the --snat-arp switch isn't supported so far. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: prefer snprintf to strncpyFlorian Westphal2018-05-202-4/+6
| | | | | | | | | gcc emits these warnings: xtables-eb-translate.c:185:2: warning: ‘strncpy’ specified bound 29 equals destination size [-Wstringop-truncation] strncpy(target->t->u.user.name, jumpto, sizeof(target->t->u.user.name)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: extend generic tests for masks and wildcardsFlorian Westphal2018-05-152-31/+57
| | | | | | This uncovered broken translation of ethernet + mask. Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: store all requested match typesFlorian Westphal2018-05-141-3/+0
| | | | | | | | | | | | | iptables and ip6tables don't need this because iptables is AF_INET, ip6tables AF_INET6, etc. But tools that can change af in-between such as nftables will then may then find to find such module. One example is conntrack, it offsers NFPROTO_IPV4 and NFPROTO_IPV6. When first loading with NFPROTO_IPV6, the IPV4 would be discarded. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ip6table-save: fix save of ip6 address masksFlorian Westphal2018-05-112-7/+17
| | | | | | | | ip6tables-save didn't include the masks. Furhermore, mask decoding used the ipv4 struct which caused it to write into parts of ipv6 saddr. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-translate: suppress redundant protocolsFlorian Westphal2018-05-106-29/+46
| | | | | | | | | | | kernel would reject ip, ip6 etc. without -p ip, -p ip6. So add it. On reverse, search the match list to decide if -p has to be translated or not. Also, icmp and icmpv6 also imply l3 protocol, so no need to translate that either. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: allow checking for zero-macFlorian Westphal2018-05-104-38/+43
| | | | | | | | | | | | | | Allow checking for an all-zero mac address by replacing checks on the address with a check on the option flag. Its set when '-d' or '-s' appears on the command line and when seeing a linklayer payload request for ether s/daddr. Same for -p: s this flag gets removed during getopt when 'p' is encountered. So, if its set, no need to check protocol type. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: add helpers to print interface and mac addressesFlorian Westphal2018-05-101-53/+24
| | | | | | | Reduces repetition, follow patch adds back suppression of src/dst mac when it was not given. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: remove interface masks from ebt_entry structFlorian Westphal2018-05-102-12/+1
| | | | | | They don't exist in the legacy ABI, so don't pretend otherwise. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: fix logical interface negationFlorian Westphal2018-05-102-53/+24
| | | | | | | | | | | | | | | | | | before: Bridge chain: OUTPUT, entries: 4, policy: ACCEPT -o ! noout -j CONTINUE -o out -j CONTINUE --logical-out notlogout -j CONTINUE --logical-out logout -j CONTINUE after: Bridge chain: OUTPUT, entries: 5, policy: ACCEPT -o ! noout -j CONTINUE -o out -j CONTINUE --logical-out ! notlogout -j CONTINUE --logical-out logout -j CONTINUE Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: add and use helper to parse all interface namesFlorian Westphal2018-05-102-56/+23
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: split match/target print from ↵Florian Westphal2018-05-101-18/+26
| | | | | | nft_bridge_print_firewall Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: kill ebtables_command_stateFlorian Westphal2018-05-107-231/+172
| | | | | | | | Use iptables_command_state instead. This allows to re-use code from the ip(6)tables layer and reduces cop&pasted code. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: pass correct table skeletonFlorian Westphal2018-05-103-24/+76
| | | | | | | | This always uses xtables_ipv4 (which is same as _ipv6). Pass the correct skeleton instead, this is needed to handle ebtables correctly from xt-translate, as it doesn't use ip/ip6 tables. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: fix wildcard detectionFlorian Westphal2018-05-101-18/+26
| | | | | | | | | | | | if (outiface[len] == '\0') is always true. 'eth+' is stored as 'eth' with length 3, so "eth"[3] == 0. 'eth' is stored as 'eth\0' with length 4, so "eth\0"[4] is also true. Add a helper for this, then use it. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libip6t_srh.t: Add test cases for psid, nsid, and lsidAhmed Abdelsalam2018-05-091-0/+2
| | | | | | | | This patch add some testcases for psid, nsid, and lsid matches into libip6t_srh.t Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_CONNMARK: incorrect translation after v2Pablo Neira Ayuso2018-05-081-3/+3
| | | | | | | | | src: iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-mark 0 exp: nft add rule ip mangle PREROUTING counter ct mark set 0x0 res: nft add rule ip mangle PREROUTING counter ct mark set ct mark and 0x0 Fixes: db7b4e0de960 ("extensions: libxt_CONNMARK: Support bit-shifting for --restore,set and save-mark") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libxt_CONNMARK: Support bit-shifting for --restore,set and save-markJack Ma2018-05-082-13/+284
| | | | | | | | | | | | | | | This patch adds a new feature to iptables that allow bitshifting for --restore,set and save-mark operations. This allows existing logic operators (and, or and xor) and mask to co-operate with new bitshift operations. The intention is to provide uses with more fexible uses of skb->mark and ct->mark. For example, users can save extra bits in skb->mark: skb->mark = ct->mark << 8; Reviewed-by: Florian Westphal <fw@strlen.de> Signed-off-by: Jack Ma <jack.ma@alliedtelesis.co.nz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libip6t_srh: support matching previous, next and last SIDAhmed Abdelsalam2018-05-082-16/+314
| | | | | | | | This patch extends the libip6t_srh shared library to support matching previous SID, next SID, and last SID. Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_DNAT: tests added for shifted portmap rangeThierry Du Tre2018-05-082-0/+10
| | | | | | | | I added and verified these tests after applying Florian's fixed wrt. nf_nat_range2 size for rev2. Signed-off-by: Thierry Du Tre <thierry@dtsystems.be> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: flush table and its content with no -nPablo Neira Ayuso2018-05-081-56/+66
| | | | | | | | | | With no -n, semantics for *filter are to delete filter table and all its content. This restores the similar behaviour introduced in ca165845f7ec ("xtables-compat-restore: flush rules and delete user-defined chains"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: fix bogus error with -X and no user-defined chainsPablo Neira Ayuso2018-05-071-1/+1
| | | | | | | | | # iptables-compat -X iptables: No chain/target/match by that name. While it should display no error message at all. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: flush user-defined chains with -nPablo Neira Ayuso2018-05-074-2/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -n still flushes user-defined chains and its content, the following snippet: iptables-compat -N FOO iptables-compat -I INPUT iptables-compat -I FOO iptables-compat -I FOO iptables-compat-save > A iptables-compat-restore < A iptables-compat -N BAR iptables-compat -A BAR iptables-compat-restore -n < A results in: iptables-compat-save # Generated by xtables-save v1.6.2 on Mon May 7 17:18:44 2018 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :BAR - [0:0] :FOO - [0:0] -A INPUT -A INPUT -A BAR -A FOO -A FOO COMMIT # Completed on Mon May 7 17:18:44 2018 Still, user-defined chains that are not re-defined, such as BAR, are left in place. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat-restore: flush rules and delete user-defined chainsPablo Neira Ayuso2018-05-071-27/+56
| | | | | | Instead of deleting the table and base chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libipt_DNAT: use size of nf_nat_range2 for rev2Florian Westphal2018-05-072-4/+4
| | | | | | | | DNAT tests fail on nf-next.git, kernel complains about target size mismatch (40 vs 48), this fixes this for me. Fixes: 36976c4b5406 ("extensions: libipt_DNAT: support shifted portmap ranges") Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: pass larger socket bufferFlorian Westphal2018-05-071-6/+6
| | | | | | | | needed to display rules that exceed 4k (MNL buffer size). This can happen with many matches in a rule or when using -m cgroup (4k per match). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: xtables-save: don't return 1Florian Westphal2018-05-072-16/+9
| | | | | | | | | | noticed that iptables-compat-save exits with 1 on success, whereas iptables-compat-save -t filter returns 0 (as expected). Caused by double-invert of return value, so ge rid of those. do_output now returns a value suitable to pass to exit() or return from main. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: support concurrent optionFlorian Westphal2018-05-071-5/+2
| | | | | | | | We don't need extra locking as we don't go though rmw cycle when adding a rule, but accept the option for compatibility with legacy ebtables. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-test: fix bug with rateestFlorian Westphal2018-05-071-2/+5
| | | | | | | | | | | | | | rateest test needs to insert rateest targets with @progname syntax. However, this used the system-installed binary rather than the one from git. Morever, it did not respect --nftables switch, i.e. add occurs with iptables so iptables-compat won't find it. Fixes: d7ac61b58e78 ("add nft switch and test binaries from git") Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: fix ipv4 frag (-f)Florian Westphal2018-05-051-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | iptables-translate -A I -f nft add rule ip filter I ip frag-off != 0 counter iptables however checks: frag_off = ntohs(iph->frag_off) & IP_OFFSET; if (NF_INVF(ipinfo, IPT_INV_FRAG, (ipinfo->flags & IPT_F_FRAG) && !frag_off)) return false; So we need to mask off non-offset bits. Second issue is that we negated the meaning in ipt-restore. -f should match if (frag_off & IP_OFFSET) NE 0 ! -f matches non-fragmented packets, i.e. frag_off & IP_OFFSET == 0. So we cannot use nft_invflags2cmp(), as that will use NEQ for negation, but we need EQ instead here. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: also check tg2->userspacesizeFlorian Westphal2018-05-051-1/+3
| | | | | | memcmp uses tg1->userspacesize, make sure its same as tg2 first. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: avoid unneeded bitwise opsFlorian Westphal2018-05-052-5/+23
| | | | | | no need to and with all-ones mask. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: restore: sync options with iptables-restoreFlorian Westphal2018-05-051-2/+13
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: add xlate test for ipables -fFlorian Westphal2018-05-051-0/+6
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: output -s,d first during save, just like iptablesFlorian Westphal2018-05-052-10/+10
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-compat: chains are purge out already from table flushPablo Neira Ayuso2018-05-053-52/+0
| | | | | | | Remove dead code that uses the ancient non-batch netlink API. Chains are already purged out from table flush. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: do not fail on restore if user chain existsPablo Neira Ayuso2018-05-054-4/+32
| | | | | | | | | | | | The following snippet fails if user chain FOO exists, but it should not fail: iptables-compat -F iptables-compat -N FOO iptables-compat-save > foo iptables-compat-restore < foo Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables-compat: remove non-batching routinesPablo Neira Ayuso2018-05-052-153/+7
| | | | | | | This is only needed by 3.16, which was released 8 months after nftables was merged upstream. That kernel version supports a reduced featureset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables.conf: fix hook skeletonsFlorian Westphal2018-05-041-6/+5
| | | | | | | nat prio for in/out were inverted. arp no longer has a forward chain. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: fall back to comment match in case name is too longFlorian Westphal2018-05-043-5/+13
| | | | | | | ... or when using multiple --comment lines. This is more of a 'cosmetic' fix to handle the test suite case. Signed-off-by: Florian Westphal <fw@strlen.de>
* xlate-test: use locally installed xlate toolsFlorian Westphal2018-05-041-1/+3
| | | | | | | same as iptables-test: use the translate tools in the current working directory, not the system-wide ones. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: ebtables: handle mac masks properlyFlorian Westphal2018-05-043-1/+17
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: nft-arp: fix warning wrt. sprintf-out-of-boundsFlorian Westphal2018-05-031-2/+2
| | | | | | | nft-arp.c:112:3: note: 'sprintf' output between 2 and 21 bytes into a destination of size 20 sprintf(buf, "/%s", addr_to_dotted(mask)); Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: truncate comments to 254 bytesFlorian Westphal2018-04-291-1/+3
| | | | | | | Kernel clamps udata size at 256 bytes, udata size however also includes internal bookkeeping which brings us over this limit. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libipt_DNAT: support shifted portmap rangesThierry Du Tre2018-04-293-51/+423
| | | | | | | | | | | | | | | | | | | | | | | | | | This is a proposal patch for iptables DNAT extension to support shifted portmap ranges. It is related to the kernel patch proposed in earlier message '[PATCH v5] netfilter : add NAT support for shifted portmap ranges'. A new struct nf_nat_range2 was added as extension for existing struct nf_nat_range and is used by new revisions (2) for the DNAT target. Current DNAT revisions for Ipv4 (rev 0) and IPv6 (rev 1) are kept so functionality with older kernels is not impacted. The syntax for shifted portmaps uses an extra value in '--to-destination' for setting the base port which determines the offset in the redirect port range for incoming connections. i.e. : iptables -t nat -A zone_wan_prerouting -p tcp -m tcp --dport 5000:5100 -j DNAT --to-destination '192.168.1.2:2000-2100/5000' The base port value is totally optional, so current behavior is not impacted in any way. The use of slash '/' as separator is an arbitrary choice, all other suggestions are valid of course (original proposal used semicolon but this was not practical for commandline use) Another approach using an additional option seems also possible (i.e. '--base-port 5000'). However, that would mean more parsing logic with extra lines of code and thus increased risk for regression. Signed-off-by: Thierry Du Tre <thierry@dtsystems.be> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>