summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* xtables: fix crash if nft_rule_list_get() failsPhil Sutter2018-07-191-1/+2
| | | | | | | | Without this, trying to add a rule using ebtables without proper permissions crashes the program. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Support nft suffix for arptables and ebtablesPhil Sutter2018-07-112-1/+5
| | | | | | | | | Since the names without suffix clash with legacy tools, support the suffixed versions as well to help distributions packaging for parallel installation of both nft and legacy variants. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: check iptables retval, not echoFlorian Westphal2018-07-101-2/+2
| | | | | | | | | Pablo reports that tests that should return nozero now fail. Reason is that $? is checking return value of "echo" and not the script. Fixes: 17c66a50608 ("iptables: tests: shell: Add README") Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: tests: add test for iptables-save and iptables-restoreArushi Singhal2018-07-101-0/+47
| | | | | | | Add test for testing if iptables configuration is restored and saved. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: don't bother to build libebt/libarp extensions if nft backend ↵Florian Westphal2018-07-101-2/+2
| | | | | | | | was disabled Reported-by: Thomas Deutschmann <whissi@gentoo.org> Tested-by: Thomas Deutschmann <whissi@gentoo.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: tests: shell: Add READMEArushi Singhal2018-07-074-1/+18
| | | | | | | | | | | 1) README is added to run test suite. 2) Rename two test-case scripts to follow proper numerical order. 3) "echo -en "\033[1A\033[K" # clean the [EXECUTING] foobar line" command should only used when verbose("-v") option is not there else instead of clearing "[EXECUTING]" prompt it is clearing last prompt of the test file. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* configure: bump version and libnftnl dependencyv1.8.0Florian Westphal2018-07-051-2/+2
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* man: clarify translate tools do not modify any stateFlorian Westphal2018-07-052-1/+9
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-monitor: add --version optionFlorian Westphal2018-07-041-2/+6
| | | | | | ... for consistency with other commands. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-legacy: fix argv0 name for ip6tables-legacyFlorian Westphal2018-07-041-1/+1
| | | | | | xtables-legacy currently cannot be invoked as ip6tables-legacy. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: display legacy/nf_tables flavor in error messages, tooFlorian Westphal2018-07-024-12/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Also, in nf_tables backend case, only show more than one error if we're iptables-restore, else we get very long concatenated errorline. old: iptables v1.6.2: can't initialize iptables table `security': Table does not exist (do you need to insmod?) iptables v1.6.2: iptables: CHAIN_ADD failed (Device or resource busy): chain PREROUTINGCHAIN_ADD failed (Device or resource busy): chain INPUTCHAIN_ADD failed (Device or resource busy): chain POSTROUTINGCHAIN_ADD failed (Device or resource busy): chain OUTPUT iptables-restore v1.6.2: iptables-restore: line 1: CHAIN_ADD failed (Device or resource busy): chain PREROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain INPUT line 1: CHAIN_ADD failed (Device or resource busy): chain POSTROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain OUTPUT line 6: RULE_INSERT failed (No such file or directory): rule in chain PREROUTING now: iptables v1.6.2 (legacy): can't initialize iptables table `security': Table does not exist (do you need to insmod?) iptables v1.6.2 (nf_tables): CHAIN_ADD failed (Device or resource busy): chain PREROUTING iptables-restore v1.6.2 (nf_tables): line 1: CHAIN_ADD failed (Device or resource busy): chain PREROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain INPUT line 1: CHAIN_ADD failed (Device or resource busy): chain POSTROUTING line 1: CHAIN_ADD failed (Device or resource busy): chain OUTPUT line 6: RULE_INSERT failed (No such file or directory): rule in chain PREROUTING Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: add stp matchFlorian Westphal2018-07-022-0/+392
| | | | | | Unfortunately no nft translation available so far. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add script that mimics firewalld startupFlorian Westphal2018-07-023-0/+419
| | | | | | | | | Mimic firewalld startup, i.e. "iptables-restore -n" use. First script is normal startup, second script restores ruleset, then re-runs first one (i.e., with existing rules rather than non-existent tables). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: fix variable name to multi-binaryFlorian Westphal2018-06-292-10/+10
| | | | | | Need to prepend XT_MULTI, not XTABLES_MULTI. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add a few simple tests for list/new/deleteFlorian Westphal2018-06-291-0/+52
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: make -L, -X CHAINNAME workFlorian Westphal2018-06-291-11/+6
| | | | | | | In both cases the argument is optional, in both cases the argument wasn't evaluated. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: remove exec_styleFlorian Westphal2018-06-291-80/+7
| | | | | | no plans to support daemon mode, so remove this. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: don't crash on ebtables -XFlorian Westphal2018-06-291-4/+6
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: fix some spellos and the dash escapeJan Engelhardt2018-06-282-41/+41
| | | | | | | | | Commands, options, filenames, and possibly references to other manpages, should always use the minus. (Important for copy-n-paste and e.g. following manpage links.) Everything else can do with the dash. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add firewalld default ruleset from fedora 27Florian Westphal2018-06-273-0/+320
| | | | | | | The ipv4 version has bogus counters so this can also check save/restore -c option. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add another ipv4 only rulesetFlorian Westphal2018-06-272-0/+82
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add initial save/restore test casesFlorian Westphal2018-06-278-34/+170
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Add script to restore ipt-save files and compare it with save output. This should be extended to cover as many rulesets as possible, so this is only a start. The test script is changed to pass XT_MULTI instead of iptables/ip6tables. This allows ip(6)tables/ebt/arp only test scripts and avoids running all scripts multiple times for ip/ip6tables. Current expected output: I: [OK] ./iptables/tests/shell/testcases/chain/0001duplicate_1 I: [OK] ./iptables/tests/shell/testcases/chain/000newchain_0 I: [OK] ./iptables/tests/shell/testcases/chain/0005rename_1 I: [OK] ./iptables/tests/shell/testcases/ipt-save/0001load-dumps_0 I: legacy results: [OK] 10 [FAILED] 0 [TOTAL] 10 I: [OK] ./iptables/tests/shell/testcases/chain/0001duplicate_1 I: [OK] ./iptables/tests/shell/testcases/chain/0004newchain_0 I: [OK] ./iptables/tests/shell/testcases/chain/0005rename_1 I: [OK] ./iptables/tests/shell/testcases/ipt-save/0001load-dumps_0 I: nft results: [OK] 10 [FAILED] 0 [TOTAL] 10 I: combined results: [OK] 20 [FAILED] 0 [TOTAL] 20 Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: adapt test suite to run with legacy+nftables based binariesFlorian Westphal2018-06-275-93/+45
| | | | | | | | | | | | | | | | | | | | | | | | | While at it, make following changes/fixes: 1. run each test in a fresh net namespace 2. remove rmmod use, its very distuptive and not needed after 1. 3. avoid -e use if possible 4. make sure we exit 0 when test is expected to fail 5. set XT_LIBDIR so we point at the correct extensions to be used Also delete 0003duplicate_1, its same test as 0001duplicate_1. NB: I don't think its good to have this 'encode retval in name' scheme. These are scripts, so they should always return 0, i.e. do iptables --this-command-should-fail || exit 0 echo "succeess, should fail" exit 1 Much simpler, imo. This was inherited from nft shell tests though and changing it there is rather intrusive so use same scheme for now. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: rename xt-multi binaries to -nft, -legacyFlorian Westphal2018-06-276-84/+188
| | | | | | | | | | | | | | This adds a clear distinction between old iptables (formerly xtables-multi, now xtables-legacy-multi) and new iptables (formerly xtables-compat-multi, now xtables-nft-multi). Users will get the ip/ip6tables names via symbolic links, having a distinct name postfix for the legacy/nft variants helps to make a clear distinction, as iptables-nft will always use nf_tables and iptables-legacy always uses get/setsockopt wheres "iptables" could be symlinked to either -nft or -legacy. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-restore: init table before processing policiesFlorian Westphal2018-06-273-0/+8
| | | | | | | | | | | | | | | | | | | | *filter :INPUT DROP [32:4052] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] -A OUTPUT COMMIT will be restored with ACCEPT policies. When -A OUTPUT is processed, the OUTPUT chain isn't found in the chain cache, so the table is re-created with ACCEPT policies, which overrides the earlier DROP policies. A better fix would be to add the policy setting to the chain cache but it seems we'll need a chain abstraction with refcounting first. Fixes: 01e25e264a4c4 ("xtables: add chain cache") Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Fix spelling error in hashlimit sectionMajor Hayden2018-06-261-1/+1
| | | | | Signed-off-by: Major Hayden <major@mhtx.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: make duplicate test workFlorian Westphal2018-06-251-3/+1
| | | | | | | | | | set -e causes 2nd command (which is expected to fail) to terminate the script as well. So, don't set -e and let the error check invert the return value to 0. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: add xtables-monitorFlorian Westphal2018-06-258-5/+786
| | | | | | | | | | | | | | | | | | | This is a partial revert of commit 7462e4aa757dc28e74b4a731b3ee13079b04ef23 ("iptables-compat: Keep xtables-config and xtables-events out from tree") and re-adds xtables-events under a new name, with a few enhancements, this is --trace mode, which replaces printk-based tracing, and an imroved event mode which will now also display pid/name and new generation id at the end of a batch. Example output of xtables-monitor --event --trace PACKET: 10 fa6b77e1 IN=wlan0 MACSRC=51:14:31:51:XX:XX MACDST=1c:b6:b0:ac:XX:XX MACPROTO=86dd SRC=2a00:3a0:2::1 DST=2b00:bf0:c001::1 LEN=1440 TC=18 HOPLIMIT=61 FLOWLBL=1921 SPORT=22 DPORT=13024 ACK PSH TRACE: 10 fa6b77e1 raw:PREROUTING:return: TRACE: 10 fa6b77e1 raw:PREROUTING:policy:DROP EVENT: -6 -t mangle -A PREROUTING -j DNPT --src-pfx dead::/64 --dst-pfx 1c3::/64 NEWGEN: GENID=6581 PID=15601 NAME=xtables-multi Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: translate nft meta trace set 1 to -j TRACEFlorian Westphal2018-06-253-2/+93
| | | | | | | nft meta expr enables the nfnetlink based trace infrastruvture, so prefer to use that rather than xt_TRACE. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: warn in case old-style (set/getsockopt) tables existFlorian Westphal2018-06-254-3/+49
| | | | | | | Provide a hint that iptables isn't showing all rules because its using nfnetlink rather than old set/getsockopt. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: add nf_tables vs. legacy postfix to version stringsFlorian Westphal2018-06-1812-12/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | -V now yields: arptables vlibxtables.so.12 (nf_tables) ebtables 1.6.2 (nf_tables) ip6tables v1.6.2 (legacy) ip6tables v1.6.2 (nf_tables) ip6tables-restore v1.6.2 (nf_tables) ip6tables-save v1.6.2 (nf_tables) ip6tables-restore v1.6.2 (legacy) ip6tables-restore-translate v1.6.2 ip6tables-save v1.6.2 (legacy) ip6tables-translate v1.6.2 (nf_tables) iptables v1.6.2 (legacy) iptables v1.6.2 (nf_tables) iptables-restore v1.6.2 (nf_tables) iptables-save v1.6.2 (nf_tables) iptables-restore v1.6.2 (legacy) iptables-restore-translate v1.6.2 iptables-save v1.6.2 (legacy) iptables-translate v1.6.2 (nf_tables) This allows to see wheter "iptables" is using old set/getsockopt or new nf_tables infrastructure. Suggested-by: Harald Welte <laforge@gnumonks.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables8.in: Update coreteam namesFlorian Westphal2018-06-181-2/+3
| | | | | | Refresh this to match reality again. Signed-off-by: Florian Westphal <fw@strlen.de>
* include: update kernel netfilter header filesFlorian Westphal2018-06-173-8/+703
| | | | | | needed to get the TRACE definition. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: silence two compiler warningsFlorian Westphal2018-06-172-2/+1
| | | | | | | | | | | inlined from ‘do_commandarp’ at xtables-arp.c:1198:16: xtables-arp.c:844:2: warning: ‘strncpy’ specified bound 29 equals destination size [-Wstringop-truncation] strncpy(target->t->u.user.name, jumpto, sizeof(target->t->u.user.name)); xtables-eb-translate.c: In function ‘do_commandeb_xlate’: xtables-eb-translate.c:285:6: warning: unused variable ‘chcounter’ [-Wunused-variable] int chcounter = 0; /* Needed for -C */ ^~~~~~~~~ Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: remove dead code inherited from ebtablesFlorian Westphal2018-06-151-2/+1
| | | | | | | | | | | | | | previous patch shows this problem: xtables-eb.c: In function ‘parse_change_counters_rule’: xtables-eb.c:534:65: warning: logical ‘and’ of mutually exclusive tests is always false [-Wlogical-op] (argv[optind + 1][0] == '-' && (argv[optind + 1][1] < '0' && argv[optind + 1][1] > '9'))) ... so this never worked. Just remove it, the arg will be fed to strtol() -- No need to do this check. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1149 Signed-off-by: Florian Westphal <fw@strlen.de>
* configure: add -Wlogical-op warning to cflagsFlorian Westphal2018-06-151-0/+1
| | | | | | It finds dead code in ebtables. Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-translate: remove --change-counters codeFlorian Westphal2018-06-151-73/+5
| | | | | | Not used in the translator, so zap it. Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables: tests: shell: add shell test-suiteArushi Singhal2018-06-126-0/+180
| | | | | | | | | | | | | | | | | | | | | | | To run the test suite (as root): % cd iptables/tests/shell % ./run-tests.sh Test files are executables files with the pattern <<name_N>> , where N is the expected return code of the executable. Since they are located with `find', test-files can be spreaded in any sub-directories. You can turn on a verbose execution by calling: % ./run-tests.sh -v Before each call to the test-files, `kernel_cleanup' will be called. Also, test-files will receive the environment variable $IPTABLES which contains the path to the iptables binary being tested. You can pass an arbitrary $IPTABLES value as well: % IPTABLES=/../../xtables-multi iptables ./run-tests.sh Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: skip invalid tablesFlorian Westphal2018-05-301-1/+3
| | | | | | | in bridge and arp families, some tables such as security do not exist, so name is NULL. skip them, else we segfault in strcmp. Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: more error printing fixesPablo Neira Ayuso2018-05-291-3/+2
| | | | | | | | Check for nft_insert_rule, since nft_add_rule is never set via nft_fn. Moreover, generalize ELOOP error since there is only one single location in the kernel code where we can hit this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: homogenize error messageArushi Singhal2018-05-291-1/+1
| | | | | | | | | | | | | | | | There is a difference between error messages in iptables and iptables-compat: # iptables-compat -D INPUT 4 iptables: No chain/target/match by that name. # iptables -D INPUT 4 iptables: Index of deletion too big. Now, will show same error message. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: initialize basechains for rule flush command tooPablo Neira Ayuso2018-05-281-0/+3
| | | | | | Otherwise, flush commands on not-yet-initialized basechains hit ENOENT. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: rework rule cache logicPablo Neira Ayuso2018-05-281-28/+59
| | | | | | | | | | | Perform incremental tracking on rule cache updates, instead of flushing and resynchronizing with the kernel over and over again. Note that there is no need to call flush_rule_cache() from nft_rule_delete() and nft_rule_delete_num(), since __nft_rule_del() already deletes the rule from the list. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add chain cachePablo Neira Ayuso2018-05-284-37/+55
| | | | | | | | So we don't have to dump the chain cache content over and over again. Moreover, perform incremental updates on the chain cache to add and to delete non-base chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: initialize basechains only once on ruleset restorePablo Neira Ayuso2018-05-282-20/+29
| | | | | | | | | | | | | | We cannot assume iptables-restore files always come with explicit basechain definition, eg. :PREROUTING ACCEPT incremental ruleset updates may deliberately skip this. But loading basechains over and over again can take time, so do it just once per batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-compat: ignore '+' interface nameFlorian Westphal2018-05-281-6/+8
| | | | | | | | its same as omitting it, so instead of generating invalid compare-with-0-sized-register, just ignore it. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-compat: append all errors into single lineFlorian Westphal2018-05-281-19/+37
| | | | | | | | | | | iptables-restore < /tmp/bogus iptables-restore v1.6.2: iptables-restore: line 49: RULE_APPEND failed (No such file or directory): rule in chain FOOBAR line 2023: RULE_APPEND failed (Invalid argument): rule in chain TESTSNAT This is a followup commit to 437746c7b528f ("xtables: extended error reporting"). Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: extended error reportingFlorian Westphal2018-05-263-22/+132
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: allocate struct xt_comment_info for commentsPablo Neira Ayuso2018-05-261-1/+3
| | | | | | | When mapping it to the comment match, otherwise, crash happens when trying to save the ruleset listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: use libnftnl batch APIPablo Neira Ayuso2018-05-262-104/+91
| | | | | | | Use existing batching API from library, the existing code relies on an earlier implementation of it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>