summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* ebtables: Default to extrapositioned negationsPhil Sutter2024-01-1027-236/+241
| | | | | | | | | | | | | | | ebtables-nft has always supported both intra- and extrapositioned negations but defaulted to intrapositioned when printing/saving rules. With commit 58d364c7120b5 ("ebtables: Use do_parse() from xshared") though, it started to warn about intrapositioned negations. So change the default to avoid mandatory warnings when e.g. loading previously dumped rulesets. Also adjust test cases, help texts and ebtables-nft.8 accordingly. Cc: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: libxt_HMARK: Review HMARK_parse()Phil Sutter2024-01-101-51/+9
| | | | | | | | * With XTOPT_NBO support in UINT types, the manual byteorder conversion calls are no longer needed * Setting bits in cb->xflags is done by xtables_option_parse() already * Since O_HMARK_* values match XT_HMARK_* ones, all but the O_HMARK_TYPE case fold together into a single default one
* extensions: libebt_mark_m: Use guided option parserPhil Sutter2024-01-101-36/+22
| | | | | | | Can't use XTTYPE_MARKMASK32 here because in 'val/mask', 'val' is optional. Would have to extend xtopt_parse_markmask() to accept this, maybe guarded by a new XTOPT_ flag to avoid unexpected changes in behaviour?
* extensions: libebt_pkttype: Use guided option parserPhil Sutter2024-01-101-22/+23
| | | | | Not much to gain here. Maybe implement number parsing with fallback to get rid of that part from extension parsers?
* extensions: libxt_limit: Use guided option parser for NFPROTO_BRIDGE, tooPhil Sutter2024-01-101-48/+2
|
* extensions: libebt_arp: Use guided option parserPhil Sutter2024-01-102-130/+78
|
* extensions: libebt_vlan: Use guided option parserPhil Sutter2024-01-101-68/+34
|
* extensions: libebt_802_3: Use guided option parserPhil Sutter2024-01-102-55/+21
|
* extensions: libebt_redirect: Use guided option parserPhil Sutter2024-01-101-23/+17
|
* extensions: libebt_snat: Use guided option parserPhil Sutter2024-01-102-42/+34
|
* extensions: libebt_nflog: Use guided option parserPhil Sutter2024-01-101-64/+18
|
* extensions: libebt_mark: Use guided option parserPhil Sutter2024-01-101-86/+54
|
* extensions: libebt_log: Use guided option parserPhil Sutter2024-01-101-91/+30
|
* extensions: libebt_ip: Use guided option parserPhil Sutter2024-01-102-123/+84
|
* extensions: libebt_ip6: Use guided option parserPhil Sutter2024-01-102-124/+83
|
* extensions: libebt_dnat: Use guided option parserPhil Sutter2024-01-101-37/+27
|
* extensions: libebt_arpreply: Use guided option parserPhil Sutter2024-01-102-34/+22
|
* extensions: libebt_stp: Use guided option parserPhil Sutter2024-01-102-160/+100
|
* extensions: libebt_*: Drop some needless init callbacksPhil Sutter2024-01-104-42/+0
| | | | Extension data is zero by default.
* ebtables: Support for guided option parserPhil Sutter2024-01-101-57/+51
| | | | | | | | | Adjust ebt_load_match() and ebt_command_default() to expect x6_options/x6_parse fiels to be set instead of the traditional ones. Much of this is c'n'p from command_default() in xshared.c, but due to ebtables' custom match data structure (combining matches and watchers), sharing the code is probably not feasible.
* libxtables: xtoptions: Treat NFPROTO_BRIDGE as IPv4Phil Sutter2024-01-101-0/+1
| | | | | | | | | When parsing for XTTYPE_HOST(MASK), the return value of afinfo_family() is used to indicate the expected address family. Make guided option parser expect IPv4 by default for ebtables as this is the more common case. The exception is libebt_ip6, which will temporarily adjust afinfo->family while parsing.
* libxtables: xtoptions: Implement XTTYPE_ETHERMACMASKPhil Sutter2024-01-102-1/+16
| | | | | | Accept an Ethernet MAC address with optional mask in the format xtables_parse_mac_and_mask() expects it. Does not support XTOPT_PUT (for now) due to the lack of defined data structure.
* libxtables: xtoptions: Support XTOPT_NBO with XTTYPE_UINT*Phil Sutter2024-01-101-9/+31
| | | | | Value conversion into Big Endian byteorder is pretty straightforward, merely needed a small helper for uint64.
* libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASKPhil Sutter2024-01-102-2/+0
| | | | | | | | Do as the comment in xtopt_parse_hostmask() claims and omit XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() will catch the incompatibility. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support")
* tests: iptables-test: Use difflib if dumps differPhil Sutter2023-12-211-5/+7
| | | | | | | Improve log readability by printing a unified diff of the expected vs. actual iptables-save output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-legacy: Fix for mandatory lock waitingPhil Sutter2023-12-212-2/+57
| | | | | | | | | | | | | | | | | | | | | | Parameter 'wait' passed to xtables_lock() signals three modes of operation, depending on its value: 0: --wait not specified, do not wait if lock is busy -1: --wait specified without value, wait indefinitely until lock becomes free >0: Wait for 'wait' seconds for lock to become free, abort otherwise Since fixed commit, the first two cases were treated the same apart from calling alarm(0), but that is a nop if no alarm is pending. Fix the code by requesting a non-blocking flock() in the second case. While at it, restrict the alarm setup to the third case only. Cc: Jethro Beekman <jethro@fortanix.com> Cc: howardjohn@google.com Cc: Antonio Ojea <antonio.ojea.garcia@gmail.com> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: replace `echo -e` with `printf`Jeremy Sowden2023-12-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | `echo -e` is not portable and we can end up with: GEN matches.man -e + ./libxt_addrtype.man -e + ./libip6t_ah.man -e + ./libipt_ah.man -e + ./libxt_bpf.man -e + ./libxt_cgroup.man -e + ./libxt_cluster.man -e + ./libxt_comment.man -e + ./libxt_connbytes.man -e + ./libxt_connlabel.man -e + ./libxt_connlimit.man -e + ./libxt_connmark.man -e + ./libxt_conntrack.man [...] Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: add an automake verbosity variable for `ln`Jeremy Sowden2023-12-151-6/+9
| | | | | Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: use standard automake verbosity variablesJeremy Sowden2023-12-152-20/+27
| | | | | | | | | | The previous implementation ignored the default verbosity defined by configure, and controlled by --{enable,disable}-silent-rules, and treated V="" as V=0. Instead, follow the guide-lines given in the automake manual. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: remove unused `AM_VERBOSE_CXX*` variablesJeremy Sowden2023-12-151-2/+0
| | | | | | | There is no C++, so these variables are not required. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: remove obsolete `AM_LIBTOOL_SILENT` variableJeremy Sowden2023-12-151-1/+0
| | | | | | | It doesn't do anything, so get rid of it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: format `AM_CPPFLAGS` variablesJeremy Sowden2023-12-152-2/+17
| | | | | Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Fix spelling mistakesJeremy Sowden2023-12-129-11/+11
| | | | | | | | Corrections for several spelling mistakes, typo's and non-native usages in man-pages and error-messages. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Use do_parse() from xsharedPhil Sutter2023-12-057-1079/+341
| | | | | | | | | | | | | | | | | | | Drop the custom commandline parsers from ebtables and ebtables-translate, extend and use the shared one instead. ebtables gains a few new features from doing this: - Rule counters may be specified in the '-c N,M' syntax - Support for --replace command - Support for --list-rules command - Zero individual rules There is one known regression in this patch, namely maximum chain name length shrinks to 28 characters (from 32). Since this limit changed for iptables in the past as well (e.g. with commit 5429b41c2bb4a), assume nobody really relies upon it anyway. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce option_test_and_reject()Phil Sutter2023-12-051-10/+11
| | | | | | Just a small helper eliminating the repetitive code there. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Use struct xt_cmd_parsePhil Sutter2023-12-051-23/+36
| | | | | | | This is merely to reduce size of the parser merge patch, no functional change intended. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Make 'h' case just a call to print_help()Phil Sutter2023-12-052-31/+31
| | | | | | | | | Move the special ebtables help parameter handling into its print_help() function to prepare for it turning into a callback. Add new field 'argc' to struct iptables_command_state to make this possible. It is actually kind of consistent as it holds 'argv' already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Pass struct iptables_command_state to print_help()Phil Sutter2023-12-051-6/+5
| | | | | | | | Parameters passed by the sole caller came from there already, apart from 'table' which is not used (ebtables-nft does not have per-table help texts). Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Change option values to avoid clashesPhil Sutter2023-12-052-19/+19
| | | | | | | | In order to parse input using do_parse(), distinct ebtables option's values have to be distinct from others. Since arptables uses values 2-8 already, resort to values >10. Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables{,-translate}: Convert if-clause to switch()Phil Sutter2023-12-052-29/+41
| | | | | | | Parser merge prep work, align final do_commandeb*() parts with do_commandx(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Support for ebtables' --change-counters commandPhil Sutter2023-12-053-9/+66
| | | | | | | | | This is tricky because the short-option clashes with the --check command. OTOH, ebtables supports --check as well (though without short-option), so making do_parse() detect ebtables based on struct xtables_args::family is probably still the least messy option. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Support rule range deletion in do_parse()Phil Sutter2023-12-052-1/+35
| | | | | | | | This is a distinct ebtables feature. Introduce struct xt_cmd_parse::rule_ranges boolean indicating support for it and bail otherwise if a range was specified by the user. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Introduce print_help callback (again)Phil Sutter2023-12-057-3/+10
| | | | | | | | Prep work for ebtables parser to use do_parse(). Adding more special casing to xtables_printhelp() causes a mess, so work with a callback again. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Turn command_default() into a callbackPhil Sutter2023-12-057-3/+12
| | | | | | | | Ebtables' variant is pretty different since all extensions are loaded up front and some targets serve as "watcher" extensions, so let variants specify the function to call for extension parameters. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Perform protocol value parsing in callbackPhil Sutter2023-12-052-9/+14
| | | | | | | | The code is same in iptables and ip6tables, but different in ebtables. Therefore move it into the callback to keep that part of do_parse() generic. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: do_parse: Skip option checking for CMD_DELETE_NUMPhil Sutter2023-12-051-1/+0
| | | | | | | This command will delete a rule by its number, not rule spec. No -i/-o options are expected on commandline. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Fix for non-CIDR-compatible hostmasksPhil Sutter2023-11-291-0/+5
| | | | | | | | | | | | | | | | | | | In order to parse the mask, xtopt_parse_hostmask() calls xtopt_parse_plenmask() thereby limiting netmask support to prefix lengths (alternatively specified in IP address notation). In order to lift this impractical restriction, make xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may fall back to xtopt_parse_mask() which correctly initializes val.hmask itself and indicates non-CIDR-compatible masks by setting val.hlen to -1. So in order to support these odd masks, it is sufficient for xtopt_parse_plenmask() to skip its mask building from val.hlen value and take whatever val.hmask contains. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Fix for garbage access in xtables_options_xfrm()Phil Sutter2023-11-291-1/+2
| | | | | | | | | | Allocation of the temporary array did not account for a terminating NULL entry, causing array boundary overstepping in the called xtables_merge_options(), causing spurious errors in extension parameter parsing. Fixes: ed8c3ea4015f0 ("libxtables: Combine the two extension option mergers") Signed-off-by: Phil Sutter <phil@nwl.cc>
* man: Do not escape exclamation marksPhil Sutter2023-11-292-2/+2
| | | | | | | | | | This appears to be not necessary, also mandoc complains about it: | mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Leave interface masks alone when parsing from kernelPhil Sutter2023-11-296-36/+16
| | | | | | | | The mask is entirely unused by nft-variants in general and legacy ones when printing. It is relevant only when inserting a legacy rule into kernel as it doesn't detect the '+'-suffix. Signed-off-by: Phil Sutter <phil@nwl.cc>