summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* netfilter: add nf_log.hMarkus Mayer2022-06-281-0/+15
| | | | | | | | | | Since libxt_NFLOG is now using the UAPI version of nf_log.h, it should be bundled alongside the other netfilter kernel headers. This copy of nf_log.h was taken from Linux 5.18. Signed-off-by: Markus Mayer <mmayer@broadcom.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: Define XT_OPTION_OFFSET_SCALE in xtables.hPhil Sutter2022-06-234-6/+3
| | | | | | | | This is the last symbol in xshared.h used by libxtables, move it over. Again, treat this as "implementation detail" and hence put it behind XTABLES_INTERNAL-curtains. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Move struct xtables_afinfo into xtables.hPhil Sutter2022-06-234-23/+28
| | | | | | | | | | | | | The library "owns" this structure and maintains 'afinfo' pointer to instances of it. With libxt_set, there's even an extension making use of the data. To avoid impact on library users, guard it by XTABLES_INTERNAL. To eliminate the xshared.h include by libxt_set, DEBUGP has to be redefined. Other extensions have similar defines, fix this later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-monitor: add missing spaces in printed strAnton Luka Šijanec2022-06-231-2/+2
| | | | | | | | | | when printing the ID and OPTs in iptables/xtables-monitor.c, a space is missing after the string, thereby concatenating the number with the next item in the printed PACKET line. Fixes: d26c538b9a549 ("xtables: add xtables-monitor") Signed-off-by: Anton Luka Šijanec <anton@sijanec.eu> Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Exit if nftnl_alloc_expr failsPhil Sutter2022-06-211-15/+16
| | | | | | | | | | In some code-paths, 'reg' pointer remaining uninitialized is used later so at least minimal error checking is necessary. Given that a call to nftnl_alloc_expr() with sane argument should never fail, complain and exit if it happens. Fixes: 7e38890c6b4fb ("nft: prepare for dynamic register allocation") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables.8: mention that iptables exits when setuidFlorian Westphal2022-06-171-0/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: string: Fix and enable testsPhil Sutter2022-06-111-14/+7
| | | | | | | | | | Some minor fixes were necessary: * --algo is printed after the pattern * Second long string test must fail, that string is 129 chars long * --from 0 and --to 65535 are not printed (default values) Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: string: Review parse_string() functionPhil Sutter2022-06-111-7/+6
| | | | | | | | | | | * Compare against sizeof(info->pattern) which is more clear than having to know that this buffer is of size XT_STRING_MAX_PATTERN_SIZE * Invert the check and error early to reduce indenting * Pass info->patlen to memcpy() to avoid reading past end of 's' Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: string: Do not print default --to valuePhil Sutter2022-06-111-2/+2
| | | | | | | Default value is UINT16_MAX, not 0. Fix the conditional printing. Fixes: c6fbf41cdd157 ("update string match to reflect new kernel implementation (Pablo Neira)") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables-restore: Deny --init-tablePhil Sutter2022-06-111-0/+3
| | | | | | | Allowing this segfaults the program. The deny is in line with legacy ebtables, so no point in implementing support for that. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libebt_standard.t: Test logical-{in,out} as wellPhil Sutter2022-06-111-0/+5
| | | | | | | These weren't used anywhere before. At least ensure they are only allowed where claimed. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend zero counters test a bit furtherPhil Sutter2022-06-111-0/+15
| | | | | | Test zeroing a single rule's counters as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend iptables-xml test a bitPhil Sutter2022-06-111-9/+1
| | | | | | | | Call with --combine as well, even though output doesn't differ. Also there's no need to skip for xtables-nft-multi, it provides the same functionality. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Add some more rules to 0002-verbose-output_0Phil Sutter2022-06-111-0/+15
| | | | | | This increases coverage of function print_match() from 0 to 86.6%. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Add --enable-profiling configure optionPhil Sutter2022-06-118-1/+20
| | | | | | A little convenience to prepare a build for analysis with gcov/gprof. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Make some functions staticPhil Sutter2022-06-102-34/+17
| | | | | | | | With all ip(6)tables variants using the same do_parse() function, quite a bunch of functions are not used outside of xshared.c anymore. Make them static. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-legacy: Drop redundant include of xtables-multi.hPhil Sutter2022-06-101-4/+0
| | | | | | | | The header is included unconditionally first, so no point in doing it a second time of ENABLE_NFTABLES is defined. Fixes: be70918eab26e ("xtables: rename xt-multi binaries to -nft, -legacy") Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables: Support -x/--exact flagPhil Sutter2022-06-081-1/+1
| | | | | | | | | | Legacy arptables accepts but ignores the flag. Yet there are remains of the functionality in sources, like OPT_EXPANDED define and a print_num() function which acts on FMT_KILOMEGAGIGA flag being set or not. So instead of mimicking legacy behaviour by explicitly ignoring -x flag for arptables, just enable the feature for it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Unexport init_extensions*() declarationsPhil Sutter2022-06-071-22/+22
| | | | | | | | | | | | | | The functions are used for static builds to initialize extensions after libxtables init. Regular library users should not need them, but the empty declarations introduced in #else case (and therefore present in user's env) may clash with existing symbol names. Avoid problems and guard the whole block declaring the function prototypes and mangling extensions' _init functions by XTABLES_INTERNAL. Reported-by: Nick Hainke <vincent@systemli.org> Fixes: 6c689b639cf8e ("Simplify static build extension loading") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Check overhead in iptables-save and -restorePhil Sutter2022-06-021-0/+37
| | | | | | | Some repeated calls have been reduced recently, assert this in a test evaluating strace output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: Fix error during out of tree buildBen Brown2022-05-251-1/+1
| | | | | | | | | | | Fixes the following error: ../../libxtables/xtables.c:52:10: fatal error: libiptc/linux_list.h: No such file or directory 52 | #include <libiptc/linux_list.h> Fixes: f58b0d7406451 ("libxtables: Implement notargets hash table") Signed-off-by: Ben Brown <ben@demerara.io> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert "fix build for missing ETH_ALEN definition"Phil Sutter2022-05-251-3/+5
| | | | | | | | | | | | | This reverts commit c5d9a723b5159a28f547b577711787295a14fd84 as it broke compiling against musl libc. Might be a bug in the latter, but for the time being try to please both by avoiding the include and instead defining ETH_ALEN if unset. While being at it, move netinet/ether.h include up. Fixes: 1bdb5535f561a ("libxtables: Extend MAC address printing/parsing support") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Maciej Żenczykowski <maze@google.com>
* treewide: use uint* instead of u_int*Nick Hainke2022-05-188-11/+11
| | | | | | | | | | | | | | | | | | | | Gcc complains about missing types. Some commits introduced u_int* instead of uint*. Use uint treewide. Fixes errors in the form of: In file included from xtables-legacy-multi.c:5: xshared.h:83:56: error: unknown type name 'u_int16_t'; did you mean 'uint16_t'? 83 | set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, | ^~~~~~~~~ | uint16_t make[6]: *** [Makefile:712: xtables_legacy_multi-xtables-legacy-multi.o] Error 1 Avoid libipq API breakage by adjusting libipq.h include accordingly. For arpt_mangle.h kernel uAPI header, apply same change as in kernel commit e91ded8db5747 ("uapi: netfilter_arp: use __u8 instead of u_int8_t"). Signed-off-by: Nick Hainke <vincent@systemli.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix build for -Werror=format-securityPhil Sutter2022-05-131-1/+1
| | | | | | Gcc complains about the omitted format string. Signed-off-by: Phil Sutter <phil@nwl.cc>
* configure: bump version for 1.8.8 releasev1.8.8Pablo Neira Ayuso2022-05-131-3/+3
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Fix EPERM handling for extensions without rev 0Phil Sutter2022-05-112-4/+13
| | | | | | | | | | Treating revision 0 as compatible in EPERM case works fine as long as there is a revision 0 of that extension defined in DSO. Fix the code for others: Extend the EPERM handling to all revisions and keep the existing warning for revision 0. Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: LOG: Document --log-macdecode in man pagePhil Sutter2022-05-111-0/+3
| | | | | | | Help text already contains it, so no update needed there. Fixes: 127647892c7ca ("extensions: libipt_LOG/libip6t_LOG: support macdecode option") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: *NAT: Review --random* option descriptionsPhil Sutter2022-05-114-20/+6
| | | | | | | | Stating the option again in the first (single?) sentence is pointless. Get rid of that initial half-sentence in MASQUERADE options and unify the texts a bit. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Merge core printing functionsPhil Sutter2022-05-111-31/+27
| | | | | | | | | | | Have a versatile __NAT_print() function providing enough flexibility for DNAT and REDIRECT, IPv4 and IPv6 and 'print' and 'save' output. Then define macros to simplify calling it. As a side effect, this fixes ip6tables DNAT revision 1 print output. Fixes: 14d77c8aa29a7 ("extensions: Merge IPv4 and IPv6 DNAT targets") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Revert change to struct xtables_pprotPhil Sutter2022-05-111-1/+1
| | | | | | | | | | | | While protocol values may exceed eight bits, the data structure is indeed used only to store the static list of name/value pairs for faster lookups. None of those has such a value and if one is added in future, the compiler will complain about it. So restore the old field type to retain binary compatibility. Fixes: 556f704458cdb ("Use proto_to_name() from xshared in more places") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Drop xtables_globals 'optstring' fieldPhil Sutter2022-05-118-8/+20
| | | | | | | | | | | Define the different optstrings in xshared.h instead, they are not relevant for other libxtables users. This is a partial revert of commit 65b150ae382a8 ("xshared: Store optstring in xtables_globals") to avoid breaking libxtables' ABI compatibility. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Extend xtables_printhelp() for arptablesPhil Sutter2022-05-117-119/+43
| | | | | | | | | | | | | | | | | | | | | | | | The function checks afinfo->family already to cover ip6tables specifics, doing the same for arptables does not make things much worse. This changes arptables-nft help output slightly: * List possible negations extrapositioned, which is preferred anyway (arptables-nft supports both) * List --out-interface option at lexically sorted position * Print --wait option, it's ignored just like with iptables * Restore default target option printing as with legacy arptables (not sure if arptables-nft ever did this) by explicitly loading them. While being at it, add --set-counters short option '-c' to help output for ip(6)tables. This effectively removes the need for (and all users of) xtables_global's 'print_help' callback, thus effectively reverts commit fe83b12fc910e ("libxtables: Introduce xtables_globals print_help callback") which broke libxtables' ABI compatibility. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Move arp_opcodes into shared spacePhil Sutter2022-05-118-29/+21
| | | | | | | It will be referenced by xtables_printhelp() if printing for arptables and therefore must be present in legacy as well even if unused. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: MARK: Drop extra newline at end of helpPhil Sutter2022-05-111-2/+1
| | | | | Fixes: f4b737fb0c52a ("libxt_MARK r2") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: split gen_payload() to allocate register and initialize expressionPablo Neira Ayuso2022-05-021-4/+14
| | | | | | Add __gen_payload(), in preparation for the dynamic register allocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: prepare for dynamic register allocationPablo Neira Ayuso2022-05-026-94/+137
| | | | | | | | | Store the register that has been allocated and pass it on to the next expression. NFT_REG_1 is still used. No functional changes are expected. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass handle to helper functions to build netlink payloadPablo Neira Ayuso2022-05-027-66/+73
| | | | | | | Pass struct nft_handle to helper functions in preparation for the dynamic register allocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: native mark matching supportPablo Neira Ayuso2022-05-022-0/+59
| | | | | | Use meta mark + bitwise + cmp instead of nft_compat mark match. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: pass struct nft_xt_ctx to parse_meta()Pablo Neira Ayuso2022-05-026-10/+10
| | | | | | In preparation for native mark match support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-shared: update context register for bitwise expressionPablo Neira Ayuso2022-05-021-0/+2
| | | | | | | | Update the destination register, otherwise nft_parse_cmp() gives up on interpreting the cmp expression when bitwise sreg != dreg. Fixes: 2c4a34c30cb4 ("iptables-compat: fix address prefix") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: man: Document service name support in DNAT and REDIRECTPhil Sutter2022-04-082-0/+3
| | | | | | | Unless as part of a range, service names may be used. Point this out to avoid confusion. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Merge REDIRECT into DNATPhil Sutter2022-04-0812-380/+204
| | | | | | | | | Code is very similar, join them to reuse parsing code at least. As a side-effect, this enables parsing of service names for ports in DNAT as well as using port number 0 as that's what REDIRECT allows. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: Merge IPv4 and IPv6 DNAT targetsPhil Sutter2022-04-085-468/+218
| | | | | | | | | Make parse_to() family-aware so it serves for both IPv4 and IPv6. Have a core _DNAT_parse() function which parses into the most modern (nf_nat_range2) data structure and a bunch of wrappers to copy into legacy data structures if needed. Treat other callbacks analogous. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: DNAT: Rename from libipt to libxtPhil Sutter2022-04-081-0/+0
| | | | | | | Prepare for merge of libipt and libip6t DNAT extensions, allow for better code review. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ipt_DNAT: Combine xlate functions alsoPhil Sutter2022-04-081-67/+21
| | | | | | | | | | Make use of the new sprint_range() to introduce a common inner function for both v1 and v2 xlate functions. Also abort translation with shifted port ranges to not hide the missing feature in nftables. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ipt_DNAT: Merge v1/v2 print/save codePhil Sutter2022-04-081-65/+46
| | | | | | | | | | | Turn print_range() function into sprint_range() so it becomes more versatile. Make it accept the new nf_nat_range2 data structure and make v1 callers convert their nf_nat_ipv4_multi_range_compat structs to that. This allows to introduce an inner __DNAT_print() which acts for v1 and v2 and prints either 'print' or 'save' syntax. Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: ipt_DNAT: Merge v1 and v2 parsersPhil Sutter2022-04-081-179/+111
| | | | | | | | | | | | | | | | Use v2 parser for both and copy field values into v1 data structure if needed. While being at it: * Introduce parse_ports() function similar to the one in libipt_REDIRECT.c. * Use xtables_strtoui() in the above instead of atoi() for integrated range checking. * Parse IP addresses using inet_pton(), writing directly into struct nf_nat_range2 fields. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert "libipt_[SD]NAT: avoid false error about multiple destinations specified"Phil Sutter2022-04-084-25/+4
| | | | | | | | | | | | | This reverts commit f25b2355e889290879c8cecad3dd24ec0c384fb8. The workaround is not needed anymore since commit 30b178b9bf11e ("extensions: *NAT: Kill multiple IPv4 range support"). While being at it, drop the same hidden flag logic from libip6t_[SD]NAT extensions as well and just don't set XTOPT_MULTI so guided option parser will reject multiple parameters automatically. Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: DNAT: Describe shifted port range featurePhil Sutter2022-04-081-1/+4
| | | | | | This wasn't mentioned anywhere. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate-test: Fix for empty source line on failurePhil Sutter2022-03-311-1/+2
| | | | | | | | The code overwrites 'line' before checking expected output. Save it in a temporary variable. Fixes: 62828a6aff231 ("tests: xlate-test: support multiline expectation") Signed-off-by: Phil Sutter <phil@nwl.cc>